@softure-ai/mcp-access 0.1.6 → 0.1.8

package/dist/server/oauth-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAA0C,MAAM,eAAe,CAAC;AAEjG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAErK,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;CACpF,CAAC;AACF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrE,2FAA2F;AAC3F,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;AAEpG,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IACnH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,YAAY;AAEZ;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnG,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACpH,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gCAAgC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxI,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,SAA2C,EAAE,OAAmB;IACrF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACzF,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE;QACzD,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE;QAC/C,qBAAqB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE;QACzD,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QAC5F,sEAAsE;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAqB,EACrB,OAA4B,EAC5B,UAAsB,iBAAiB,CAAC,MAAM,CAAC,EAC/C,eAA8B,IAAI;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO;QACL,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;QACrD,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QACvF,QAAQ,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC;QAChG,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAA2B,EAAE,UAAmC,IAAI;IAChI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AAC5I,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC9F,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9H;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAuB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAClI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC1J,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,gGAAgG;AAChG,aAAa;AAEb,qGAAqG;AACrG,SAAS,0BAA0B,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,uDAAuD,2BAA2B,oEAAoE,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,OAAgB,EAAE,WAA0B,IAAI;IACzG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,aAAa,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,eAAe;AAEf;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAqB,EAAE,OAAgB;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;SAC/F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,aAAa,CAAC,cAAc,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,mHAAmH;AACnH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,IAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,YAAY,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,cAAc;KACjF,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,aAAa,GAAG,kFAAkF,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgB;IAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,OAAO,aAAa,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4DAA4D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,aAAa,CAAC,cAAc,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CAAC,GAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAgB;IACvF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3H,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;AACjH,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,WAAmB,EACnB,MAA+C,EAC/C,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAqB,EACrB,MAAuB,EACvB,UAAsB,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,gBAAgB;QACtB,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC;KAClH,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAC/J,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;AACjJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAuB;IAC3E,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAmB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAqB,EAAE,OAAgB,EAAE,MAAqB;IAC9G,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAExG,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5J,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAC9C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM;YACN,WAAW;YACX,aAAa;YACb,iFAAiF;YACjF,QAAQ,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;SAC3G,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/server/oauth-validation.d.ts

@@ -0,0 +1,28 @@
+import type { OAuthClientRegistration } from "./oauth.js";
+/** The longest client name: it is also the name of the client's access tokens (1-60). */
+export declare const MAX_CLIENT_NAME_LENGTH = 60;
+/**
+ * Whether a URI may be a `redirect_uri`: `https` anywhere, `http` only on loopback (RFC 8252
+ * §7.3), a native app scheme outside the deny list; never with a fragment (RFC 6749 §3.1.2).
+ */
+export declare function isAllowedRedirectUri(candidate: string): boolean;
+export interface RegistrationError {
+    readonly error: "invalid_redirect_uri" | "invalid_client_metadata";
+    readonly description: string;
+}
+/**
+ * Registration metadata (RFC 7591 §2). The default method is `client_secret_basic`, as the RFC
+ * says; MCP clients name `none` themselves. Without a name the client is called after the host of
+ * its first redirect URI, so the consent page has something to say.
+ */
+export type ClientRegistrationResult = {
+    readonly ok: true;
+    readonly value: OAuthClientRegistration;
+} | {
+    readonly ok: false;
+    readonly error: RegistrationError;
+};
+export declare function parseClientRegistration(body: unknown): ClientRegistrationResult;
+/** The URL a native client returns to, as it may be shown: the host for http(s), else the whole URI. */
+export declare function describeRedirectUri(redirectUri: string): string;
+//# sourceMappingURL=oauth-validation.d.ts.map

package/dist/server/oauth-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-validation.d.ts","sourceRoot":"","sources":["../../src/server/oauth-validation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAWzC;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAW/D;AAmBD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,yBAAyB,CAAC;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAE9D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,wBAAwB,CAiC/E;AAED,wGAAwG;AACxG,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAG/D"}

package/dist/server/oauth-validation.js

@@ -0,0 +1,88 @@
+// The OAuth boundary: registration metadata, redirect URIs, scopes and `resource`. Everything
+// enters as `unknown` or a raw string and leaves as a result; an expected refusal is a value.
+import { z } from "zod";
+/** The longest client name: it is also the name of the client's access tokens (1-60). */
+export const MAX_CLIENT_NAME_LENGTH = 60;
+/**
+ * Schemes never accepted as a redirect URI: they run code or read local resources in the person's
+ * browser, or travel unencrypted. Other non-HTTP schemes are native app schemes (RFC 8252 §7.1,
+ * e.g. `cursor://`, `vscode://`), which desktop MCP clients return through.
+ */
+const FORBIDDEN_SCHEMES = new Set(["javascript:", "data:", "vbscript:", "file:", "blob:", "about:", "ws:", "wss:", "ftp:"]);
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+const AUTH_METHODS = ["none", "client_secret_post", "client_secret_basic"];
+/**
+ * Whether a URI may be a `redirect_uri`: `https` anywhere, `http` only on loopback (RFC 8252
+ * §7.3), a native app scheme outside the deny list; never with a fragment (RFC 6749 §3.1.2).
+ */
+export function isAllowedRedirectUri(candidate) {
+    if (candidate.includes("#"))
+        return false;
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === "https:")
+        return url.hostname !== "";
+    if (url.protocol === "http:")
+        return LOOPBACK_HOSTS.has(url.hostname);
+    return !FORBIDDEN_SCHEMES.has(url.protocol);
+}
+/** A name without control or format characters, trimmed and cut: it is shown on the consent page. */
+function cleanClientName(name) {
+    return name
+        .replace(/[\p{Cc}\p{Cf}]/gu, "")
+        .trim()
+        .slice(0, MAX_CLIENT_NAME_LENGTH)
+        .trim();
+}
+const registrationSchema = z.object({
+    redirect_uris: z.array(z.string().max(2000)).min(1).max(10),
+    client_name: z.string().max(200).optional(),
+    token_endpoint_auth_method: z.enum(AUTH_METHODS).optional(),
+    grant_types: z.array(z.enum(["authorization_code", "refresh_token"])).optional(),
+    response_types: z.array(z.literal("code")).optional(),
+});
+export function parseClientRegistration(body) {
+    const parsed = registrationSchema.safeParse(body);
+    if (!parsed.success) {
+        const isRedirectIssue = parsed.error.issues.some((issue) => issue.path[0] === "redirect_uris");
+        return {
+            ok: false,
+            error: isRedirectIssue
+                ? { error: "invalid_redirect_uri", description: "redirect_uris must list 1 to 10 URIs." }
+                : { error: "invalid_client_metadata", description: `Invalid client metadata: ${parsed.error.issues.map((issue) => issue.path.join(".")).join(", ")}.` },
+        };
+    }
+    const redirectUris = parsed.data.redirect_uris;
+    if (!redirectUris.every(isAllowedRedirectUri)) {
+        return {
+            ok: false,
+            error: {
+                error: "invalid_redirect_uri",
+                description: "A redirect URI must be https, http on a loopback host or a native app scheme, without a fragment.",
+            },
+        };
+    }
+    const name = cleanClientName(parsed.data.client_name ?? "");
+    // The first URI parsed above; a native scheme without a host falls back to its scheme.
+    const firstUri = new URL(redirectUris[0] ?? "");
+    const fallbackName = cleanClientName(firstUri.host === "" ? firstUri.protocol.replace(/:$/, "") : firstUri.host);
+    return {
+        ok: true,
+        value: {
+            clientName: name !== "" ? name : fallbackName,
+            redirectUris,
+            tokenEndpointAuthMethod: parsed.data.token_endpoint_auth_method ?? "client_secret_basic",
+        },
+    };
+}
+/** The URL a native client returns to, as it may be shown: the host for http(s), else the whole URI. */
+export function describeRedirectUri(redirectUri) {
+    const url = new URL(redirectUri);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.host : redirectUri;
+}
+//# sourceMappingURL=oauth-validation.js.map

package/dist/server/oauth-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-validation.js","sourceRoot":"","sources":["../../src/server/oauth-validation.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8FAA8F;AAC9F,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5H,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAA4D,CAAC;AAEtI;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;IAC1D,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI;SACR,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,0BAA0B,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChF,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAgBH,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;QAC/F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe;gBACpB,CAAC,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,uCAAuC,EAAE;gBACzF,CAAC,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,WAAW,EAAE,4BAA4B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;SAC1J,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,mGAAmG;aACjH;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC5D,uFAAuF;IACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;YAC7C,YAAY;YACZ,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,qBAAqB;SACzF;KACF,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACxF,CAAC"}

package/dist/server/oauth.d.ts

@@ -0,0 +1,106 @@
+import { type Err, type Ok } from "@softure-ai/core";
+import type { OAuthGrantView } from "../contract.js";
+import { type OAuthClientRow, type OAuthTokenEndpointAuthMethod } from "../schema.js";
+import { type McpAccessContext } from "./tokens.js";
+/** Refresh tokens: for people and secret scanners, like the access token prefix. */
+export declare const REFRESH_TOKEN_PREFIX = "sftmcr_";
+/** Authorization codes. */
+export declare const CONSENT_CODE_PREFIX = "sftmca_";
+/** Client secrets of confidential clients. */
+export declare const CLIENT_SECRET_PREFIX = "sftmcs_";
+/** A registration without any grant after a day is abandoned (registration is public and free). */
+export declare const STALE_CLIENT_MS: number;
+export interface OAuthClientRegistration {
+    /** 1 to 60 characters, trimmed, no control characters (`parseClientRegistration` makes it so). */
+    readonly clientName: string;
+    readonly redirectUris: readonly string[];
+    readonly tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
+}
+export interface RegisteredOAuthClient {
+    readonly client: OAuthClientRow;
+    /** The plaintext secret of a confidential client, shown once; null for a public client. */
+    readonly clientSecret: string | null;
+}
+export interface IssuedOAuthTokens {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    /** Seconds, as `expires_in` counts them (RFC 6749 §5.1). */
+    readonly expiresIn: number;
+    readonly canWrite: boolean;
+}
+/**
+ * Registers a client (RFC 7591). A secret only for the methods that use one. Abandoned clients
+ * (no grant, older than a day) are deleted first, so a flood of registrations does not pile up.
+ */
+export declare function registerMcpClient(ctx: McpAccessContext, input: OAuthClientRegistration): Promise<RegisteredOAuthClient>;
+export declare function findOAuthClient(ctx: McpAccessContext, clientId: string): Promise<OAuthClientRow | null>;
+/**
+ * Whether the client authenticated: a confidential client with its secret (constant-time
+ * compare), a public client by presenting none.
+ */
+export declare function isClientSecretValid(client: OAuthClientRow, secret: string | null): boolean;
+export interface CreateAuthorizationCodeInput {
+    /** The client's row id (`OAuthClientRow.id`), not its public client id. */
+    readonly clientRowId: string;
+    /** The person who consented, from the session. */
+    readonly userId: string;
+    readonly redirectUri: string;
+    readonly codeChallenge: string;
+    /** Asked for by the client, allowed by the app and ticked by the person. */
+    readonly canWrite: boolean;
+}
+/** Issues a code after the person's consent. Expired codes are deleted on the way. */
+export declare function createAuthorizationCode(ctx: McpAccessContext, input: CreateAuthorizationCodeInput): Promise<string>;
+export interface ExchangeAuthorizationCodeInput {
+    readonly code: string;
+    /** The authenticated client. */
+    readonly client: OAuthClientRow;
+    /** Null when the client left it out; allowed only when it registered exactly one. */
+    readonly redirectUri: string | null;
+    readonly codeVerifier: string;
+}
+/**
+ * Exchanges a code for tokens (RFC 6749 §4.1.3, PKCE per RFC 7636 §4.6), or null for any refusal.
+ *
+ * The code is burned first, by a conditional `UPDATE … WHERE used_at IS NULL`: a wrong verifier,
+ * another client or another redirect URI leave a dead code, not an invitation to keep guessing,
+ * and two parallel exchanges cannot both win. A second use of a used code revokes the grant
+ * issued from it (RFC 6749 §4.1.2): two parties saw the code. A new consent of the same client
+ * replaces its grant, whose tokens go by cascade.
+ */
+export declare function exchangeAuthorizationCode(ctx: McpAccessContext, input: ExchangeAuthorizationCodeInput): Promise<IssuedOAuthTokens | null>;
+export interface RefreshOAuthGrantInput {
+    readonly refreshToken: string;
+    /** The authenticated client: a grant answers only the client it was issued to. */
+    readonly client: OAuthClientRow;
+}
+/**
+ * Refreshes a grant: a new access token and a new refresh token (rotation, OAuth 2.1 §4.3.1). The
+ * presented hash moves to `previous_refresh_token_hash` in the same conditional `UPDATE` that
+ * checks it is current; presenting it again later deletes the whole grant, for both parties.
+ */
+export declare function refreshMcpGrant(ctx: McpAccessContext, input: RefreshOAuthGrantInput): Promise<IssuedOAuthTokens | null>;
+/** The owner's unexpired grants, newest first: the connected apps list. */
+export declare function listOAuthGrants(ctx: McpAccessContext, userId: string): Promise<OAuthGrantView[]>;
+export interface RevokeOAuthGrantInput {
+    /** The owner, from the session. */
+    readonly userId: string;
+    /** From the form: any value, including another account's grant id. */
+    readonly grantId: string;
+}
+/**
+ * Revokes a grant at once: its refresh token goes with the row and its access tokens by cascade,
+ * so the assistant's next request gets 401. The owner is part of the `WHERE`.
+ */
+export declare function revokeOAuthGrant(ctx: McpAccessContext, input: RevokeOAuthGrantInput): Promise<Ok<undefined> | Err<"mcp-access.grant_not_found">>;
+export interface PrunedOAuthRecords {
+    readonly codes: number;
+    readonly grants: number;
+    readonly clients: number;
+}
+/**
+ * Deletes expired codes, grants whose refresh token expired (their access tokens by cascade) and
+ * abandoned clients, of every account: for a scheduled job, next to `pruneAccessTokens`.
+ */
+export declare function pruneOAuthRecords(ctx: McpAccessContext): Promise<PrunedOAuthRecords>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/server/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/server/oauth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAW,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAoE,KAAK,cAAc,EAAE,KAAK,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAGxJ,OAAO,EAAsD,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAExG,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAC9C,2BAA2B;AAC3B,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAQ9C,mGAAmG;AACnG,eAAO,MAAM,eAAe,QAAS,CAAC;AAItC,MAAM,WAAW,uBAAuB;IACtC,kGAAkG;IAClG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,uBAAuB,EAAE,4BAA4B,CAAC;CAChE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiB7H;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAI7G;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAM1F;AAED,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,sFAAsF;AACtF,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBzH;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAoC/I;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAoB7H;AAoCD,2EAA2E;AAC3E,wBAAsB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAatG;AAED,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAID;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAOtJ;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAM1F"}

package/dist/server/oauth.js

@@ -0,0 +1,235 @@
+// The OAuth 2.1 authorization server's data layer (an adopting app's OAuth code, generalised onto
+// the module context). Every secret (code, refresh token, client secret) leaves this file once and
+// is stored as its sha256; expiry sits in the queries. An access token issued here is a row of
+// `access_tokens` with its grant, so the endpoint verifies it like any other token.
+import { timingSafeEqual } from "node:crypto";
+import { err, ok } from "@softure-ai/core";
+import { and, desc, eq, gt, isNotNull, isNull, lt, lte, notExists } from "drizzle-orm";
+import { accessTokens, oauthAuthorizationCodes, oauthClients, oauthGrants } from "../schema.js";
+import { getMcpAccessOptions } from "./options.js";
+import { isPkceVerifierValid } from "./pkce.js";
+import { ACCESS_TOKEN_PREFIX, createSecret, hashAccessToken } from "./tokens.js";
+/** Refresh tokens: for people and secret scanners, like the access token prefix. */
+export const REFRESH_TOKEN_PREFIX = "sftmcr_";
+/** Authorization codes. */
+export const CONSENT_CODE_PREFIX = "sftmca_";
+/** Client secrets of confidential clients. */
+export const CLIENT_SECRET_PREFIX = "sftmcs_";
+/** Client ids are public (RFC 6749 §2.2); the prefix only helps a person reading a log. */
+const CLIENT_ID_PREFIX = "sftmc_";
+/** Codes, refresh tokens and client secrets longer than this are not looked up. */
+const MAX_SECRET_LENGTH = 512;
+const MINUTE_MS = 60_000;
+const DAY_MS = 24 * 60 * MINUTE_MS;
+/** A registration without any grant after a day is abandoned (registration is public and free). */
+export const STALE_CLIENT_MS = DAY_MS;
+/**
+ * Registers a client (RFC 7591). A secret only for the methods that use one. Abandoned clients
+ * (no grant, older than a day) are deleted first, so a flood of registrations does not pile up.
+ */
+export async function registerMcpClient(ctx, input) {
+    const now = ctx.clock.now();
+    await deleteStaleClients(ctx, now);
+    const secret = input.tokenEndpointAuthMethod === "none" ? null : createSecret(CLIENT_SECRET_PREFIX);
+    const [client] = await ctx.db
+        .insert(oauthClients)
+        .values({
+        clientId: `${CLIENT_ID_PREFIX}${createSecret("").secret.slice(0, 22)}`,
+        clientName: input.clientName,
+        redirectUris: [...input.redirectUris],
+        tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
+        clientSecretHash: secret?.secretHash ?? null,
+        createdAt: now,
+    })
+        .returning();
+    if (client === undefined)
+        throw new Error("@softure-ai/mcp-access: inserting an OAuth client returned no row");
+    return { client, clientSecret: secret?.secret ?? null };
+}
+export async function findOAuthClient(ctx, clientId) {
+    if (clientId === "" || clientId.length > 255)
+        return null;
+    const [client] = await ctx.db.select().from(oauthClients).where(eq(oauthClients.clientId, clientId));
+    return client ?? null;
+}
+/**
+ * Whether the client authenticated: a confidential client with its secret (constant-time
+ * compare), a public client by presenting none.
+ */
+export function isClientSecretValid(client, secret) {
+    if (client.clientSecretHash === null)
+        return secret === null;
+    if (secret === null || secret.length > MAX_SECRET_LENGTH)
+        return false;
+    const expected = Buffer.from(client.clientSecretHash);
+    const actual = Buffer.from(hashAccessToken(secret));
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+/** Issues a code after the person's consent. Expired codes are deleted on the way. */
+export async function createAuthorizationCode(ctx, input) {
+    const now = ctx.clock.now();
+    const lifetimeMs = getMcpAccessOptions(ctx.config).oauth.authorizationCodeLifetimeMinutes * MINUTE_MS;
+    const { secret: code, secretHash: codeHash } = createSecret(CONSENT_CODE_PREFIX);
+    await ctx.db.delete(oauthAuthorizationCodes).where(lte(oauthAuthorizationCodes.expiresAt, now));
+    await ctx.db.insert(oauthAuthorizationCodes).values({
+        codeHash,
+        clientId: input.clientRowId,
+        userId: input.userId,
+        redirectUri: input.redirectUri,
+        codeChallenge: input.codeChallenge,
+        canWrite: input.canWrite,
+        expiresAt: new Date(now.getTime() + lifetimeMs),
+        createdAt: now,
+    });
+    return code;
+}
+/**
+ * Exchanges a code for tokens (RFC 6749 §4.1.3, PKCE per RFC 7636 §4.6), or null for any refusal.
+ *
+ * The code is burned first, by a conditional `UPDATE … WHERE used_at IS NULL`: a wrong verifier,
+ * another client or another redirect URI leave a dead code, not an invitation to keep guessing,
+ * and two parallel exchanges cannot both win. A second use of a used code revokes the grant
+ * issued from it (RFC 6749 §4.1.2): two parties saw the code. A new consent of the same client
+ * replaces its grant, whose tokens go by cascade.
+ */
+export async function exchangeAuthorizationCode(ctx, input) {
+    if (input.code.length > MAX_SECRET_LENGTH)
+        return null;
+    const now = ctx.clock.now();
+    const codeHash = hashAccessToken(input.code);
+    return ctx.db.transaction(async (tx) => {
+        const [code] = await tx
+            .update(oauthAuthorizationCodes)
+            .set({ usedAt: now })
+            .where(and(eq(oauthAuthorizationCodes.codeHash, codeHash), isNull(oauthAuthorizationCodes.usedAt), gt(oauthAuthorizationCodes.expiresAt, now)))
+            .returning();
+        if (code === undefined) {
+            await revokeGrantOfReusedCode(tx, codeHash);
+            return null;
+        }
+        const redirectUri = input.redirectUri ?? (input.client.redirectUris.length === 1 ? (input.client.redirectUris[0] ?? null) : null);
+        if (code.clientId !== input.client.id || code.redirectUri !== redirectUri || !isPkceVerifierValid(input.codeVerifier, code.codeChallenge)) {
+            return null;
+        }
+        await tx.delete(oauthGrants).where(and(eq(oauthGrants.userId, code.userId), eq(oauthGrants.clientId, code.clientId)));
+        const { secret: refreshToken, secretHash: refreshTokenHash } = createSecret(REFRESH_TOKEN_PREFIX);
+        const [grant] = await tx
+            .insert(oauthGrants)
+            .values({
+            userId: code.userId,
+            clientId: code.clientId,
+            canWrite: code.canWrite,
+            refreshTokenHash,
+            refreshExpiresAt: getRefreshExpiry(ctx, now),
+            createdAt: now,
+        })
+            .returning();
+        if (grant === undefined)
+            throw new Error("@softure-ai/mcp-access: inserting an OAuth grant returned no row");
+        return issueGrantTokens(ctx, tx, { grant, clientName: input.client.clientName, refreshToken, now });
+    });
+}
+/**
+ * Refreshes a grant: a new access token and a new refresh token (rotation, OAuth 2.1 §4.3.1). The
+ * presented hash moves to `previous_refresh_token_hash` in the same conditional `UPDATE` that
+ * checks it is current; presenting it again later deletes the whole grant, for both parties.
+ */
+export async function refreshMcpGrant(ctx, input) {
+    if (input.refreshToken.length > MAX_SECRET_LENGTH)
+        return null;
+    const now = ctx.clock.now();
+    const presentedHash = hashAccessToken(input.refreshToken);
+    return ctx.db.transaction(async (tx) => {
+        const { secret: refreshToken, secretHash: refreshTokenHash } = createSecret(REFRESH_TOKEN_PREFIX);
+        const [grant] = await tx
+            .update(oauthGrants)
+            .set({ refreshTokenHash, previousRefreshTokenHash: presentedHash, refreshExpiresAt: getRefreshExpiry(ctx, now) })
+            .where(and(eq(oauthGrants.refreshTokenHash, presentedHash), eq(oauthGrants.clientId, input.client.id), gt(oauthGrants.refreshExpiresAt, now)))
+            .returning();
+        if (grant === undefined) {
+            // A token from before a rotation: two parties hold it, so the grant goes for both.
+            await tx.delete(oauthGrants).where(eq(oauthGrants.previousRefreshTokenHash, presentedHash));
+            return null;
+        }
+        // The grant's spent access tokens; the current ones stay valid until they expire.
+        await tx.delete(accessTokens).where(and(eq(accessTokens.grantId, grant.id), lte(accessTokens.expiresAt, now)));
+        return issueGrantTokens(ctx, tx, { grant, clientName: input.client.clientName, refreshToken, now });
+    });
+}
+function getRefreshExpiry(ctx, now) {
+    return new Date(now.getTime() + getMcpAccessOptions(ctx.config).oauth.refreshTokenLifetimeDays * DAY_MS);
+}
+/** The grant's access token, a row of `access_tokens` named after the client. */
+async function issueGrantTokens(ctx, tx, input) {
+    const lifetimeMs = getMcpAccessOptions(ctx.config).oauth.accessTokenLifetimeMinutes * MINUTE_MS;
+    const { secret: accessToken, secretHash: tokenHash } = createSecret(ACCESS_TOKEN_PREFIX);
+    await tx.insert(accessTokens).values({
+        userId: input.grant.userId,
+        grantId: input.grant.id,
+        name: input.clientName,
+        tokenHash,
+        canWrite: input.grant.canWrite,
+        createdAt: input.now,
+        expiresAt: new Date(input.now.getTime() + lifetimeMs),
+    });
+    return { accessToken, refreshToken: input.refreshToken, expiresIn: lifetimeMs / 1000, canWrite: input.grant.canWrite };
+}
+/** A used code presented again revokes the grant its first use produced (same account and client). */
+async function revokeGrantOfReusedCode(tx, codeHash) {
+    const [reused] = await tx
+        .select({ userId: oauthAuthorizationCodes.userId, clientId: oauthAuthorizationCodes.clientId })
+        .from(oauthAuthorizationCodes)
+        .where(and(eq(oauthAuthorizationCodes.codeHash, codeHash), isNotNull(oauthAuthorizationCodes.usedAt)));
+    if (reused === undefined)
+        return;
+    await tx.delete(oauthGrants).where(and(eq(oauthGrants.userId, reused.userId), eq(oauthGrants.clientId, reused.clientId)));
+}
+/** The owner's unexpired grants, newest first: the connected apps list. */
+export async function listOAuthGrants(ctx, userId) {
+    return ctx.db
+        .select({
+        id: oauthGrants.id,
+        clientName: oauthClients.clientName,
+        canWrite: oauthGrants.canWrite,
+        createdAt: oauthGrants.createdAt,
+        lastUsedAt: oauthGrants.lastUsedAt,
+    })
+        .from(oauthGrants)
+        .innerJoin(oauthClients, eq(oauthGrants.clientId, oauthClients.id))
+        .where(and(eq(oauthGrants.userId, userId), gt(oauthGrants.refreshExpiresAt, ctx.clock.now())))
+        .orderBy(desc(oauthGrants.createdAt), desc(oauthGrants.id));
+}
+const UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Revokes a grant at once: its refresh token goes with the row and its access tokens by cascade,
+ * so the assistant's next request gets 401. The owner is part of the `WHERE`.
+ */
+export async function revokeOAuthGrant(ctx, input) {
+    if (!UUID_SHAPE.test(input.grantId))
+        return err("mcp-access.grant_not_found");
+    const removed = await ctx.db
+        .delete(oauthGrants)
+        .where(and(eq(oauthGrants.userId, input.userId), eq(oauthGrants.id, input.grantId)))
+        .returning();
+    return removed.length > 0 ? ok() : err("mcp-access.grant_not_found");
+}
+/**
+ * Deletes expired codes, grants whose refresh token expired (their access tokens by cascade) and
+ * abandoned clients, of every account: for a scheduled job, next to `pruneAccessTokens`.
+ */
+export async function pruneOAuthRecords(ctx) {
+    const now = ctx.clock.now();
+    const codes = await ctx.db.delete(oauthAuthorizationCodes).where(lte(oauthAuthorizationCodes.expiresAt, now)).returning();
+    const grants = await ctx.db.delete(oauthGrants).where(lte(oauthGrants.refreshExpiresAt, now)).returning();
+    const clients = await deleteStaleClients(ctx, now);
+    return { codes: codes.length, grants: grants.length, clients };
+}
+/** Clients without a grant, registered more than a day ago; they give nobody any access. */
+async function deleteStaleClients(ctx, now) {
+    const removed = await ctx.db
+        .delete(oauthClients)
+        .where(and(lt(oauthClients.createdAt, new Date(now.getTime() - STALE_CLIENT_MS)), notExists(ctx.db.select({ id: oauthGrants.id }).from(oauthGrants).where(eq(oauthGrants.clientId, oauthClients.id)))))
+        .returning();
+    return removed.length;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/server/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/server/oauth.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,oFAAoF;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAqB,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAA0D,MAAM,cAAc,CAAC;AACxJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAyB,MAAM,aAAa,CAAC;AAExG,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAC9C,2BAA2B;AAC3B,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAC7C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAC9C,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;AACnC,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAyBtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAqB,EAAE,KAA8B;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACpG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE;SAC1B,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC;QACN,QAAQ,EAAE,GAAG,gBAAgB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACtE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,gBAAgB,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;QAC5C,SAAS,EAAE,GAAG;KACf,CAAC;SACD,SAAS,EAAE,CAAC;IACf,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/G,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAqB,EAAE,QAAgB;IAC3E,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrG,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,MAAqB;IAC/E,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,MAAM,KAAK,IAAI,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAaD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAqB,EAAE,KAAmC;IACtG,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,gCAAgC,GAAG,SAAS,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACjF,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAChG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC;QAClD,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;QAC/C,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAqB,EAAE,KAAqC;IAC1G,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAqC,EAAE;QACxE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,uBAAuB,CAAC;aAC/B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;aAC9I,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,uBAAuB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1I,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAClG,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB;YAChB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;YAC5C,SAAS,EAAE,GAAG;SACf,CAAC;aACD,SAAS,EAAE,CAAC;QACf,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC7G,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAqB,EAAE,KAA6B;IACxF,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAqC,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAClG,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;aAChH,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;aAC7I,SAAS,EAAE,CAAC;QACf,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,mFAAmF;YACnF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,kFAAkF;QAClF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/G,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAqB,EAAE,GAAS;IACxD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;AAC3G,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,gBAAgB,CAC7B,GAAqB,EACrB,EAAe,EACf,KAAuL;IAEvL,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAChG,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACzF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QACnC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QAC1B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;QACvB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;KACtD,CAAC,CAAC;IACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;AACzH,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,uBAAuB,CAAC,EAAe,EAAE,QAAgB;IACtE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC;SAC9F,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzG,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAqB,EAAE,MAAc;IACzE,OAAO,GAAG,CAAC,EAAE;SACV,MAAM,CAAC;QACN,EAAE,EAAE,WAAW,CAAC,EAAE;QAClB,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAC;SACD,IAAI,CAAC,WAAW,CAAC;SACjB,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;SAClE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;SAC7F,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AASD,MAAM,UAAU,GAAG,iEAAiE,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAqB,EAAE,KAA4B;IACxF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;SACzB,MAAM,CAAC,WAAW,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;SACnF,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AACvE,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAqB;IAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC1H,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC1G,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,GAAS;IAChE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;SACzB,MAAM,CAAC,YAAY,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,EACrE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CACpH,CACF;SACA,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC"}

package/dist/server/options.d.ts

@@ -1,6 +1,7 @@
 import { type Locale, type SoftureConfig } from "@softure-ai/core";
 import type { McpAccessMessages } from "../messages/index.js";
 import type { McpAccessOptions } from "../options.js";
+import type { McpOrigins } from "../origins.js";
 /** The enabled module. Throws when the app did not enable it: calling its functions then is a bug. */
 export declare function getMcpAccessModule(config: SoftureConfig): import("@softure-ai/core").AnySoftureModule;
 export declare function getMcpAccessOptions(config: SoftureConfig): McpAccessOptions;
@@ -9,10 +10,18 @@ export interface McpAccessRoutes {
     readonly page: string;
     /** `POST` MCP endpoint. */
     readonly endpoint: string;
+    /** OAuth consent page (`GET`): the authorization endpoint clients send the person to. */
+    readonly oauthConsent: string;
+    /** `POST` target of the consent form; answers `303` to the client's redirect URI. */
+    readonly oauthDecision: string;
+    /** `POST` OAuth token endpoint. */
+    readonly oauthToken: string;
+    /** `POST` dynamic client registration (RFC 7591). */
+    readonly oauthRegister: string;
 }
 export declare function getMcpAccessRoutes(config: SoftureConfig): McpAccessRoutes;
-/** The absolute URL MCP clients call: the app's origin and the endpoint route. */
-export declare function getMcpEndpointUrl(config: SoftureConfig): string;
+/** The absolute URL MCP clients call: the app's origin (the request's, when given) and the endpoint route. */
+export declare function getMcpEndpointUrl(config: SoftureConfig, origins?: McpOrigins): string;
 /** The module's copy in the app's locale, with the app's overrides applied. */
 export declare function getMcpAccessMessages(config: SoftureConfig): McpAccessMessages;
 /** The text in `locale`, else in `en`. */

package/dist/server/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,+CAMvD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAG3E;AAED,MAAM,WAAW,eAAe;IAC9B,sBAAsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CASzE;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,iBAAiB,CAG7E;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9F"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,+CAMvD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAG3E;AAED,MAAM,WAAW,eAAe;IAC9B,sBAAsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgBzE;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,CAErF;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,iBAAiB,CAG7E;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9F"}

package/dist/server/options.js

@@ -22,11 +22,18 @@ export function getMcpAccessRoutes(config) {
             throw new Error(`@softure-ai/mcp-access: route "${name}" is missing from the module manifest`);
         return path;
     };
-    return { page: read("page"), endpoint: read("endpoint") };
+    return {
+        page: read("page"),
+        endpoint: read("endpoint"),
+        oauthConsent: read("oauthConsent"),
+        oauthDecision: read("oauthDecision"),
+        oauthToken: read("oauthToken"),
+        oauthRegister: read("oauthRegister"),
+    };
 }
-/** The absolute URL MCP clients call: the app's origin and the endpoint route. */
-export function getMcpEndpointUrl(config) {
-    return new URL(getMcpAccessRoutes(config).endpoint, config.appOrigin).toString();
+/** The absolute URL MCP clients call: the app's origin (the request's, when given) and the endpoint route. */
+export function getMcpEndpointUrl(config, origins) {
+    return new URL(getMcpAccessRoutes(config).endpoint, origins?.appOrigin ?? config.appOrigin).toString();
 }
 /** The module's copy in the app's locale, with the app's overrides applied. */
 export function getMcpAccessMessages(config) {

package/dist/server/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,SAAS,EAAmC,MAAM,kBAAkB,CAAC;AAI9E,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,sGAAsG;AACtG,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,uEAAuE;IACvE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAA2B,CAAC;AAChE,CAAC;AASD,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAU,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,wFAAwF;QACxF,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,uCAAuC,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,OAAO,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,+EAA+E;IAC/E,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAsB,CAAC;AACjF,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB,CAAC,IAAqC,EAAE,MAAc;IACpF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,SAAS,EAAmC,MAAM,kBAAkB,CAAC;AAK9E,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,sGAAsG;AACtG,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,uEAAuE;IACvE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAA2B,CAAC;AAChE,CAAC;AAiBD,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAU,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,wFAAwF;QACxF,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,uCAAuC,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;QAC1B,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAoB;IAC3E,OAAO,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AACzG,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,+EAA+E;IAC/E,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAsB,CAAC;AACjF,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB,CAAC,IAAqC,EAAE,MAAc;IACpF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/server/origins.d.ts

@@ -0,0 +1,8 @@
+import type { SoftureConfig } from "@softure-ai/core";
+import type { McpOriginRequest, McpOrigins } from "../origins.js";
+/**
+ * The origins for `request`, or the configured ones without a request. A resolver that returns
+ * something other than a bare http(s) origin is a setup bug: thrown by name, never served.
+ */
+export declare function resolveMcpOrigins(config: SoftureConfig, request?: McpOriginRequest | null): McpOrigins;
+//# sourceMappingURL=origins.d.ts.map

package/dist/server/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../src/server/origins.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGlE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,UAAU,CAOtG"}