@softure-ai/mcp-access 0.1.6 → 0.1.8

package/dist/next/pages.js.map

@@ -1 +1 @@
-{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":";AAAA,gDAAgD;AAChD,4EAA4E;AAC5E,kGAAkG;AAClG,+FAA+F;AAC/F,wFAAwF;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAItC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA+C,MAAM,wBAAwB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,YAAY,GAAG,0EAA0E,CAAC;AAEhG,SAAS,cAAc,CAAC,MAAyB,EAAE,QAA2B;IAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/B,KAAK,UAAU;YACb,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;YAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC;YAChE,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAsB,EAAE,GAAS,EAAE,MAAqB,EAAE,OAAyB,EAAE,QAA2B;IAC7H,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjI,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChK,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QACnG,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5C,SAAS;QACT,OAAO,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAuC,EAAE,MAAqB,EAAE,OAAyB,EAAE,QAA2B;IACpI,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC/I,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,YAC5D,KAAC,YAAY,IACX,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAC3E,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAC3E,WAAW,EAAE,OAAO,CAAC,WAAW,EAChC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EACnC,WAAW,EAAE,gBAAgB,EAC7B,YAAY,EAAE,iBAAiB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,GACrB,GACG,GACF,CACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":";AAAA,gDAAgD;AAChD,4EAA4E;AAC5E,kGAAkG;AAClG,+FAA+F;AAC/F,wFAAwF;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAItC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAuE,MAAM,wBAAwB,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,YAAY,GAAG,0EAA0E,CAAC;AAEhG,SAAS,cAAc,CAAC,MAAyB,EAAE,QAA2B;IAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/B,KAAK,UAAU;YACb,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;YAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC;YAChE,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAsB,EAAE,GAAS,EAAE,MAAqB,EAAE,OAAyB,EAAE,QAA2B;IAC7H,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjI,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChK,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QACnG,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5C,SAAS;QACT,OAAO,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB,EAAE,MAAqB,EAAE,OAAyB,EAAE,QAA2B;IACnH,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChK,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QACnG,OAAO,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAuC,EAAE,MAAqB,EAAE,OAAyB,EAAE,QAA2B;IACpI,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC/I,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,YAC5D,KAAC,YAAY,IACX,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAC3E,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAC3E,WAAW,EAAE,OAAO,CAAC,WAAW,EAChC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EACnC,WAAW,EAAE,gBAAgB,EAC7B,YAAY,EAAE,iBAAiB,KAC3B,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAC5H,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,GACrB,GACG,GACF,CACR,CAAC;AACJ,CAAC"}

package/dist/options.d.ts

@@ -1,10 +1,13 @@
 import { z } from "zod";
+import type { McpOriginRequest, McpOrigins } from "./origins.js";
 /** The name an MCP client lists the server under: no spaces, so a shell command needs no quotes. */
 export declare const SERVER_NAME_PATTERN: RegExp;
 /** The MCP rule for tool names: 1 to 128 of A-Z, a-z, 0-9, `_`, `-` and `.`. */
 export declare const TOOL_NAME_PATTERN: RegExp;
 /** The longest token name the table takes (`access_tokens.name`). */
 export declare const MAX_TOKEN_NAME_LENGTH = 60;
+/** The longest value the token check looks at: a longer header is refused before any pattern runs. */
+export declare const MAX_PRESENTED_TOKEN_LENGTH = 512;
 declare const toolSchema: z.ZodObject<{
     name: z.ZodString;
     access: z.ZodEnum<{
@@ -16,6 +19,29 @@ declare const toolSchema: z.ZodObject<{
         pl: "pl";
     }> & z.core.$partial, z.ZodString>;
 }, z.core.$strict>;
+/**
+ * Keys of the authorization server metadata the package generates. An extension cannot set them:
+ * they decide where a client sends a person and its secrets.
+ */
+export declare const GENERATED_AUTHORIZATION_SERVER_KEYS: readonly ["issuer", "authorization_endpoint", "token_endpoint", "registration_endpoint", "scopes_supported", "response_types_supported", "response_modes_supported", "grant_types_supported", "token_endpoint_auth_methods_supported", "code_challenge_methods_supported", "authorization_response_iss_parameter_supported"];
+/** Keys of the protected resource metadata the package generates; `resource_name` is the app's to replace. */
+export declare const GENERATED_PROTECTED_RESOURCE_KEYS: readonly ["resource", "authorization_servers", "scopes_supported", "bearer_methods_supported"];
+/** Extra keys of a discovery document: a JSON object, or computed from the request's origins. */
+export type McpMetadataExtension = Readonly<Record<string, unknown>> | ((origins: McpOrigins) => Readonly<Record<string, unknown>>);
+/** The app origin of one request, or null for `appOrigin`. */
+export type McpAppOriginResolver = (request: McpOriginRequest) => string | null;
+/** A bare http(s) origin (no path, query, fragment or credentials), reduced to its origin. */
+export declare function isBareOrigin(value: string): boolean;
+declare const oauthSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    accessTokenLifetimeMinutes: z.ZodDefault<z.ZodInt>;
+    refreshTokenLifetimeDays: z.ZodDefault<z.ZodInt>;
+    authorizationCodeLifetimeMinutes: z.ZodDefault<z.ZodInt>;
+    metadata: z.ZodPrefault<z.ZodObject<{
+        authorizationServer: z.ZodOptional<z.ZodUnion<readonly [z.ZodCustom<(origins: McpOrigins) => Readonly<Record<string, unknown>>, (origins: McpOrigins) => Readonly<Record<string, unknown>>>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+        protectedResource: z.ZodOptional<z.ZodUnion<readonly [z.ZodCustom<(origins: McpOrigins) => Readonly<Record<string, unknown>>, (origins: McpOrigins) => Readonly<Record<string, unknown>>>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export declare const mcpAccessOptionsSchema: z.ZodObject<{
     serverName: z.ZodString;
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -33,11 +59,25 @@ export declare const mcpAccessOptionsSchema: z.ZodObject<{
     tokenLifetimeDays: z.ZodDefault<z.ZodInt>;
     maxTokensPerUser: z.ZodDefault<z.ZodInt>;
     expiryWarningDays: z.ZodDefault<z.ZodInt>;
+    legacyTokenPattern: z.ZodOptional<z.ZodInstanceOf<RegExp>>;
+    resolveAppOrigin: z.ZodOptional<z.ZodCustom<McpAppOriginResolver, McpAppOriginResolver>>;
+    resourceOrigins: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+    oauth: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        accessTokenLifetimeMinutes: z.ZodDefault<z.ZodInt>;
+        refreshTokenLifetimeDays: z.ZodDefault<z.ZodInt>;
+        authorizationCodeLifetimeMinutes: z.ZodDefault<z.ZodInt>;
+        metadata: z.ZodPrefault<z.ZodObject<{
+            authorizationServer: z.ZodOptional<z.ZodUnion<readonly [z.ZodCustom<(origins: McpOrigins) => Readonly<Record<string, unknown>>, (origins: McpOrigins) => Readonly<Record<string, unknown>>>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+            protectedResource: z.ZodOptional<z.ZodUnion<readonly [z.ZodCustom<(origins: McpOrigins) => Readonly<Record<string, unknown>>, (origins: McpOrigins) => Readonly<Record<string, unknown>>>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type McpAccessOptionsInput = z.input<typeof mcpAccessOptionsSchema>;
 export type McpAccessOptions = z.output<typeof mcpAccessOptionsSchema>;
 export type McpToolDefinitionInput = z.input<typeof toolSchema>;
 export type McpToolDefinition = z.output<typeof toolSchema>;
 export type McpToolAccess = McpToolDefinition["access"];
+export type McpOAuthOptions = z.output<typeof oauthSchema>;
 export {};
 //# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,QAA2C,CAAC;AAE5E,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,QAA4B,CAAC;AAE3D,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAKxC,QAAA,MAAM,UAAU;;;;;;;;;;kBAUd,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAuB/B,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAChE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEjE,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,QAA2C,CAAC;AAE5E,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,QAA4B,CAAC;AAE3D,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAK9C,QAAA,MAAM,UAAU;;;;;;;;;;kBAUd,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,mCAAmC,8TAYtC,CAAC;AAEX,8GAA8G;AAC9G,eAAO,MAAM,iCAAiC,gGAAiG,CAAC;AAEhJ,iGAAiG;AACjG,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpI,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,GAAG,IAAI,CAAC;AAahF,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKnD;AAOD,QAAA,MAAM,WAAW;;;;;;sFAtBM,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAhD,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oFAAhD,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAhD,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;kBA6CrE,CAAC;AAQH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;0FArDZ,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAhD,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wFAAhD,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAhD,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;;kBA+FnE,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAChE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACxD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/options.js

@@ -7,6 +7,8 @@ export const SERVER_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
 export const TOOL_NAME_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
 /** The longest token name the table takes (`access_tokens.name`). */
 export const MAX_TOKEN_NAME_LENGTH = 60;
+/** The longest value the token check looks at: a longer header is refused before any pattern runs. */
+export const MAX_PRESENTED_TOKEN_LENGTH = 512;
 /** Copy per locale; a locale without its own text falls back to `en`. */
 const localizedTextSchema = z.partialRecord(z.enum(LOCALES), z.string().trim().min(1).max(500));
 const toolSchema = z.strictObject({
@@ -20,6 +22,78 @@ const toolSchema = z.strictObject({
     /** What the tool does, for the owner deciding which token to issue. */
     description: localizedTextSchema.refine((text) => text.en !== undefined, "needs at least an en text"),
 });
+/**
+ * Keys of the authorization server metadata the package generates. An extension cannot set them:
+ * they decide where a client sends a person and its secrets.
+ */
+export const GENERATED_AUTHORIZATION_SERVER_KEYS = [
+    "issuer",
+    "authorization_endpoint",
+    "token_endpoint",
+    "registration_endpoint",
+    "scopes_supported",
+    "response_types_supported",
+    "response_modes_supported",
+    "grant_types_supported",
+    "token_endpoint_auth_methods_supported",
+    "code_challenge_methods_supported",
+    "authorization_response_iss_parameter_supported",
+];
+/** Keys of the protected resource metadata the package generates; `resource_name` is the app's to replace. */
+export const GENERATED_PROTECTED_RESOURCE_KEYS = ["resource", "authorization_servers", "scopes_supported", "bearer_methods_supported"];
+function metadataExtensionSchema(generated) {
+    return z.union([
+        z.custom((value) => typeof value === "function"),
+        z.record(z.string(), z.unknown()).superRefine((record, context) => {
+            for (const key of generated) {
+                if (Object.hasOwn(record, key))
+                    context.addIssue({ code: "custom", path: [key], message: `"${key}" is generated by the module and cannot be set` });
+            }
+        }),
+    ], { error: "must be an object of extra keys or a function (origins) => object" });
+}
+/** A bare http(s) origin (no path, query, fragment or credentials), reduced to its origin. */
+export function isBareOrigin(value) {
+    if (!URL.canParse(value))
+        return false;
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return false;
+    return url.username === "" && url.password === "" && (url.pathname === "/" || url.pathname === "") && !value.includes("?") && !value.includes("#");
+}
+const originSchema = z
+    .string()
+    .refine((value) => isBareOrigin(value), "must be an http(s) origin such as https://example.com, without a path, query or credentials")
+    .transform((value) => new URL(value).origin);
+const oauthSchema = z.strictObject({
+    /**
+     * Makes the module an OAuth 2.1 authorization server for its endpoint: discovery metadata,
+     * dynamic client registration, a consent page and a token endpoint. The app mounts those routes.
+     */
+    enabled: z.boolean().default(false),
+    /** How long an access token issued through OAuth works. Clients refresh it themselves. */
+    accessTokenLifetimeMinutes: z.int().min(5).max(1440).default(60),
+    /** How long a refresh token works, counted from the last refresh: a grant in use never expires. */
+    refreshTokenLifetimeDays: z.int().min(1).max(365).default(90),
+    /** How long an authorization code works; RFC 6749 §4.1.2 recommends at most ten minutes. */
+    authorizationCodeLifetimeMinutes: z.int().min(1).max(10).default(10),
+    /**
+     * Extra keys of the discovery documents (e.g. `jwks_uri`, `service_documentation`,
+     * `resource_documentation`, `agent_auth`). Generated keys win; the protected resource document
+     * takes the app's `resource_name`.
+     */
+    metadata: z
+        .strictObject({
+        authorizationServer: metadataExtensionSchema(GENERATED_AUTHORIZATION_SERVER_KEYS).optional(),
+        protectedResource: metadataExtensionSchema(GENERATED_PROTECTED_RESOURCE_KEYS).optional(),
+    })
+        .prefault({}),
+});
+/** A pattern for tokens an app issued before adopting the module: anchored, and stateless. */
+const legacyTokenPatternSchema = z
+    .instanceof(RegExp, { message: "must be a RegExp" })
+    .refine((pattern) => pattern.source.startsWith("^") && pattern.source.endsWith("$"), "must be anchored with ^ and $")
+    .refine((pattern) => !pattern.global && !pattern.sticky, "must not use the g or y flag");
 export const mcpAccessOptionsSchema = z
     .strictObject({
     /** The name MCP clients list the server under, e.g. "acme". Used in the setup instructions. */
@@ -28,12 +102,31 @@ export const mcpAccessOptionsSchema = z
     tools: z.array(toolSchema).default([]),
     /** Lets write tokens be issued and used. Off, every token reads only, write tokens included. */
     allowWrites: z.boolean().default(false),
-    /** How long a token works. A choice: longer than a session, never forever. */
+    /** How long a token issued on the token page works. A choice: longer than a session, never forever. */
     tokenLifetimeDays: z.int().min(1).max(365).default(90),
     /** How many unexpired tokens one account may hold. */
     maxTokensPerUser: z.int().min(1).max(100).default(20),
     /** From how many calendar days before its expiry the page warns about a token. */
     expiryWarningDays: z.int().min(0).max(60).default(14),
+    /**
+     * Tokens an app issued before it adopted the module, e.g. `/^[0-9a-f]{64}$/`. Such a value is
+     * looked up by its sha256 like a token of the module's own shape; new tokens keep the prefix.
+     */
+    legacyTokenPattern: legacyTokenPatternSchema.optional(),
+    /**
+     * The app origin of a request, when it is not the fixed `appOrigin`: an image built once and
+     * served under another origin, or a proxy whose `request.url` does not carry the public host.
+     * `readRequestOrigin` (`/server`) reads it from `Host`. Null keeps `appOrigin`.
+     */
+    resolveAppOrigin: z.custom((value) => typeof value === "function", "must be a function (request) => string | null").optional(),
+    /**
+     * Other public hosts of the app, e.g. the apex when the product runs on `app.`: their root
+     * protected resource metadata names that host as `resource` (RFC 9728 §3.3), and the
+     * authorization and token endpoints accept it as `resource`.
+     */
+    resourceOrigins: z.array(originSchema).max(16, "takes at most 16 origins").default([]),
+    /** OAuth 2.1 for MCP clients that connect without a pasted token (claude.ai, ChatGPT). */
+    oauth: oauthSchema.prefault({}),
 })
     .superRefine((options, context) => {
     const names = new Set();

package/dist/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AAE5E,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhG,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,4DAA4D;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;IAC1F;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,2BAA2B,CAAC;CACtG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,YAAY,CAAC;IACZ,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,2EAA2E,CAAC;IAC9H,mGAAmG;IACnG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,gGAAgG;IAChG,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,sDAAsD;IACtD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,kFAAkF;IAClF,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AAE5E,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,sGAAsG;AACtG,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhG,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,4DAA4D;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;IAC1F;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,2BAA2B,CAAC;CACtG,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,QAAQ;IACR,wBAAwB;IACxB,gBAAgB;IAChB,uBAAuB;IACvB,kBAAkB;IAClB,0BAA0B;IAC1B,0BAA0B;IAC1B,uBAAuB;IACvB,uCAAuC;IACvC,kCAAkC;IAClC,gDAAgD;CACxC,CAAC;AAEX,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,UAAU,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,0BAA0B,CAAU,CAAC;AAQhJ,SAAS,uBAAuB,CAAC,SAA4B;IAC3D,OAAO,CAAC,CAAC,KAAK,CAAC;QACb,CAAC,CAAC,MAAM,CAA6D,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC;QAC5G,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;YAChE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;oBAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,gDAAgD,EAAE,CAAC,CAAC;YACtJ,CAAC;QACH,CAAC,CAAC;KACH,EAAE,EAAE,KAAK,EAAE,mEAAmE,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACrJ,CAAC;AAED,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,6FAA6F,CAAC;KACrI,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/C,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,0FAA0F;IAC1F,0BAA0B,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,mGAAmG;IACnG,wBAAwB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,4FAA4F;IAC5F,gCAAgC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE;;;;OAIG;IACH,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,mBAAmB,EAAE,uBAAuB,CAAC,mCAAmC,CAAC,CAAC,QAAQ,EAAE;QAC5F,iBAAiB,EAAE,uBAAuB,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;KACzF,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,wBAAwB,GAAG,CAAC;KAC/B,UAAU,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;KACnD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,+BAA+B,CAAC;KACpH,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;AAE3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,YAAY,CAAC;IACZ,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,2EAA2E,CAAC;IAC9H,mGAAmG;IACnG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,gGAAgG;IAChG,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,uGAAuG;IACvG,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,sDAAsD;IACtD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,kFAAkF;IAClF,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD;;;OAGG;IACH,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,EAAE,+CAA+C,CAAC,CAAC,QAAQ,EAAE;IACpJ;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtF,0FAA0F;IAC1F,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;CAChC,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/origins.d.ts

@@ -0,0 +1,27 @@
+/** What the origin helpers read from a request: a Web `Request`, or Next's `headers()` with a URL. */
+export interface McpOriginRequest {
+    readonly url: string;
+    readonly headers: {
+        get(name: string): string | null;
+    };
+}
+export interface McpOrigins {
+    /** The issuer, and the origin of every endpoint, of `resource_metadata` and of the consent form. */
+    readonly appOrigin: string;
+    /** Other public hosts (`resourceOrigins`), each a bare origin. */
+    readonly resourceOrigins: readonly string[];
+}
+/** The host the request was sent to: `Host`, else the URL's host. Behind a proxy the URL names the server's own. */
+export declare function readRequestHost(request: McpOriginRequest): string;
+/**
+ * The origin the request was sent to: the first `X-Forwarded-Proto` value when it is http or https
+ * (else the URL's scheme) and `Host` (else the URL's host). For `resolveAppOrigin` in an app whose
+ * proxy passes `Host` through and refuses hosts it does not serve.
+ */
+export declare function readRequestOrigin(request: McpOriginRequest): string;
+/**
+ * The resource origin the request was sent to, when its host is one of `resourceOrigins`; when two
+ * share the host, the one whose scheme `X-Forwarded-Proto` names wins, else the first. Null otherwise.
+ */
+export declare function findServedResourceOrigin(origins: McpOrigins, request: McpOriginRequest): string | null;
+//# sourceMappingURL=origins.d.ts.map

package/dist/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAGA,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACxD;AAED,MAAM,WAAW,UAAU;IACzB,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAOD,oHAAoH;AACpH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAKnE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAKtG"}

package/dist/origins.js

@@ -0,0 +1,32 @@
+// The origins one request is served under: the app origin every OAuth URL is built from, and the
+// other public hosts whose root may be named as a protected resource. Pure: no config, no database.
+function firstValue(header) {
+    const value = header?.split(",")[0]?.trim().toLowerCase();
+    return value === undefined || value === "" ? null : value;
+}
+/** The host the request was sent to: `Host`, else the URL's host. Behind a proxy the URL names the server's own. */
+export function readRequestHost(request) {
+    return firstValue(request.headers.get("host")) ?? new URL(request.url).host;
+}
+/**
+ * The origin the request was sent to: the first `X-Forwarded-Proto` value when it is http or https
+ * (else the URL's scheme) and `Host` (else the URL's host). For `resolveAppOrigin` in an app whose
+ * proxy passes `Host` through and refuses hosts it does not serve.
+ */
+export function readRequestOrigin(request) {
+    const url = new URL(request.url);
+    const proto = firstValue(request.headers.get("x-forwarded-proto"));
+    const scheme = proto === "http" || proto === "https" ? proto : url.protocol.replace(/:$/, "");
+    return new URL(`${scheme}://${readRequestHost(request)}`).origin;
+}
+/**
+ * The resource origin the request was sent to, when its host is one of `resourceOrigins`; when two
+ * share the host, the one whose scheme `X-Forwarded-Proto` names wins, else the first. Null otherwise.
+ */
+export function findServedResourceOrigin(origins, request) {
+    const host = readRequestHost(request);
+    const candidates = origins.resourceOrigins.filter((origin) => new URL(origin).host === host);
+    const proto = firstValue(request.headers.get("x-forwarded-proto"));
+    return candidates.find((origin) => new URL(origin).protocol === `${proto ?? ""}:`) ?? candidates[0] ?? null;
+}
+//# sourceMappingURL=origins.js.map

package/dist/origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.js","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,oGAAoG;AAepG,SAAS,UAAU,CAAC,MAAqB;IACvC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAyB;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9F,OAAO,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAmB,EAAE,OAAyB;IACrF,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,GAAG,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9G,CAAC"}