@softure-ai/mcp-access 0.1.6 → 0.1.8

package/dist/ui/token-manager.js

@@ -43,8 +43,12 @@ function TokenItem({ row, action, messages, slot, unstyled, }) {
     const [state, formAction, isPending] = useActionState(action, { status: "idle" });
     return (_jsxs("li", { className: slot("item"), "data-token-id": row.id, children: [_jsxs("div", { className: slot("itemHeader"), children: [_jsx("p", { className: slot("heading"), children: row.name }), _jsxs("form", { action: formAction, children: [_jsx("input", { type: "hidden", name: "id", value: row.id }), _jsx(Button, { type: "submit", variant: "danger", size: "sm", pending: isPending, "aria-label": `${messages.list.revoke}: ${row.name}`, unstyled: unstyled, children: isPending ? messages.list.revoking : messages.list.revoke })] })] }), _jsxs("p", { className: row.isExpired ? slot("details") : slot("badge"), children: [row.statusText, " \u00B7 ", row.scopeText] }), _jsx("p", { className: slot("details"), children: row.details.join(" · ") }), _jsx(FormError, { message: state.status === "error" ? getTokenErrorMessage(messages, state.error) : undefined, unstyled: unstyled })] }));
 }
-export function TokenManager({ tools, tokens, allowWrites, maxTokens, issueAction, revokeAction, messages, locale, classNames, unstyled }) {
+function GrantItem({ grant, action, messages, slot, unstyled, }) {
+    const [state, formAction, isPending] = useActionState(action, { status: "idle" });
+    return (_jsxs("li", { className: slot("item"), "data-grant-id": grant.id, children: [_jsxs("div", { className: slot("itemHeader"), children: [_jsx("p", { className: slot("heading"), children: grant.clientName }), _jsxs("form", { action: formAction, children: [_jsx("input", { type: "hidden", name: "id", value: grant.id }), _jsx(Button, { type: "submit", variant: "danger", size: "sm", pending: isPending, "aria-label": `${messages.grants.disconnect}: ${grant.clientName}`, unstyled: unstyled, children: isPending ? messages.grants.disconnecting : messages.grants.disconnect })] })] }), _jsx("p", { className: slot("badge"), children: grant.scopeText }), _jsx("p", { className: slot("details"), children: grant.details.join(" · ") }), _jsx(FormError, { message: state.status === "error" ? getTokenErrorMessage(messages, state.error) : undefined, unstyled: unstyled })] }));
+}
+export function TokenManager({ tools, tokens, allowWrites, maxTokens, issueAction, revokeAction, grants, revokeGrantAction, messages, locale, classNames, unstyled, }) {
     const slot = createSlotClassGetter({ defaults: DEFAULT_CLASSES, classNames, unstyled });
-    return (_jsxs("div", { className: slot("root"), children: [_jsxs("section", { className: slot("section"), children: [_jsx("h2", { className: slot("heading"), children: messages.tools.title }), tools.length === 0 ? (_jsx("p", { className: slot("text"), children: messages.tools.empty })) : (_jsx("ul", { className: slot("list"), children: tools.map((tool) => (_jsxs("li", { className: slot("item"), children: [_jsxs("div", { className: slot("itemHeader"), children: [_jsx("code", { className: slot("heading"), children: tool.name }), _jsx("span", { className: slot("badge"), children: tool.accessText })] }), _jsx("p", { className: slot("text"), children: tool.description })] }, tool.name))) }))] }), _jsx(IssueForm, { action: issueAction, allowWrites: allowWrites, maxTokens: maxTokens, messages: messages, locale: locale, slot: slot, unstyled: unstyled }), _jsxs("section", { className: slot("section"), children: [_jsx("h2", { className: slot("heading"), children: messages.list.title }), tokens.length === 0 ? (_jsx("p", { className: slot("text"), children: messages.list.empty })) : (_jsx("ul", { className: slot("list"), children: tokens.map((row) => (_jsx(TokenItem, { row: row, action: revokeAction, messages: messages, slot: slot, unstyled: unstyled }, row.id))) }))] })] }));
+    return (_jsxs("div", { className: slot("root"), children: [_jsxs("section", { className: slot("section"), children: [_jsx("h2", { className: slot("heading"), children: messages.tools.title }), tools.length === 0 ? (_jsx("p", { className: slot("text"), children: messages.tools.empty })) : (_jsx("ul", { className: slot("list"), children: tools.map((tool) => (_jsxs("li", { className: slot("item"), children: [_jsxs("div", { className: slot("itemHeader"), children: [_jsx("code", { className: slot("heading"), children: tool.name }), _jsx("span", { className: slot("badge"), children: tool.accessText })] }), _jsx("p", { className: slot("text"), children: tool.description })] }, tool.name))) }))] }), _jsx(IssueForm, { action: issueAction, allowWrites: allowWrites, maxTokens: maxTokens, messages: messages, locale: locale, slot: slot, unstyled: unstyled }), _jsxs("section", { className: slot("section"), children: [_jsx("h2", { className: slot("heading"), children: messages.list.title }), tokens.length === 0 ? (_jsx("p", { className: slot("text"), children: messages.list.empty })) : (_jsx("ul", { className: slot("list"), children: tokens.map((row) => (_jsx(TokenItem, { row: row, action: revokeAction, messages: messages, slot: slot, unstyled: unstyled }, row.id))) }))] }), grants === undefined || revokeGrantAction === undefined ? null : (_jsxs("section", { className: slot("section"), children: [_jsx("h2", { className: slot("heading"), children: messages.grants.title }), _jsx("p", { className: slot("text"), children: messages.grants.lead }), grants.length === 0 ? (_jsx("p", { className: slot("text"), children: messages.grants.empty })) : (_jsx("ul", { className: slot("list"), children: grants.map((grant) => (_jsx(GrantItem, { grant: grant, action: revokeGrantAction, messages: messages, slot: slot, unstyled: unstyled }, grant.id))) }))] }))] }));
 }
 //# sourceMappingURL=token-manager.js.map

package/dist/ui/token-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/ui/token-manager.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,aAAa,EAAe,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAmB,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5H,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAA0B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAkDtD,MAAM,eAAe,GAA+C;IAClE,IAAI,EAAE,+CAA+C;IACrD,OAAO,EAAE,6HAA6H;IACtI,OAAO,EAAE,6DAA6D;IACtE,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,+DAA+D;IACrE,IAAI,EAAE,iCAAiC;IACvC,UAAU,EAAE,yDAAyD;IACrE,KAAK,EAAE,4CAA4C;IACnD,OAAO,EAAE,oCAAoC;IAC7C,OAAO,EAAE,mCAAmC;IAC5C,IAAI,EAAE,0MAA0M;CACjN,CAAC;AAIF,6CAA6C;AAC7C,SAAS,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAA4G;IACnK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,SAAS,IAAI;QACX,KAAK,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAC5C,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;QACvB,+EAA+E;QAC/E,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CACzB,CAAC;IACJ,CAAC;IACD,OAAO,CACL,eAAK,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAC7B,eAAK,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,aAChC,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,KAAK,GAAK,EAC1C,KAAC,MAAM,IAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,YACpE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAClD,IACL,EACN,cAAK,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,KAAK,GAAO,IACvC,CACP,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,EACxB,MAAM,EACN,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,QAAQ,GAOT;IACC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,KAAC,OAAO,IAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAC;IAC9I,OAAO,CACL,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,GAAM,EAClG,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAK,EACtD,aAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACvB,MAAM,CAAC,WAAW,OAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAC1F,EACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EACnE,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAK,EAC5D,KAAC,UAAU,IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,EAAC,QAAQ,EAAE,QAAQ,YAC5F,QAAQ,CAAC,MAAM,CAAC,cAAc,GACpB,EACZ,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACrE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,oBAAoB,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,EACxH,KAAC,MAAM,IAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,YAC1D,QAAQ,CAAC,MAAM,CAAC,IAAI,GACd,IACD,CACX,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EACjB,MAAM,EACN,WAAW,EACX,SAAS,EACT,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,QAAQ,GAST;IACC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,yEAAyE;IACzE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,OAAO,CACL,8BACE,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAM,EAC3D,gBAAM,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC/C,KAAC,SAAS,IACR,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAC1B,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAC7B,SAAS,EAAE,qBAAqB,EAChC,QAAQ,QACR,YAAY,EAAC,KAAK,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,GAClB,EACD,WAAW,CAAC,CAAC,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,EAChJ,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,GAAK,EACzF,KAAC,SAAS,IAAC,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAI,EAC9H,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,YAC3E,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GACpD,IACJ,IACC,EACT,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAC,gBAAgB,IAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAI,IAC1J,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EACjB,GAAG,EACH,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,QAAQ,GAOT;IACC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,OAAO,CACL,cAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAiB,GAAG,CAAC,EAAE,aAChD,eAAK,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,aAChC,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,GAAG,CAAC,IAAI,GAAK,EAC7C,gBAAM,MAAM,EAAE,UAAU,aACtB,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAI,EAChD,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,SAAS,gBAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,YACxI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GACnD,IACJ,IACH,EACN,aAAG,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAC1D,GAAG,CAAC,UAAU,cAAK,GAAG,CAAC,SAAS,IAC/B,EACJ,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAK,EAC5D,KAAC,SAAS,IAAC,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAI,IAC3H,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAqB;IAC1J,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,OAAO,CACL,eAAK,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC1B,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAM,EAC1D,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACpB,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAK,CACvD,CAAC,CAAC,CAAC,CACF,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,cAAoB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACzC,eAAK,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,aAChC,eAAM,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,IAAI,CAAC,IAAI,GAAQ,EACpD,eAAM,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,IAAI,CAAC,UAAU,GAAQ,IACpD,EACN,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,WAAW,GAAK,KAL3C,IAAI,CAAC,IAAI,CAMb,CACN,CAAC,GACC,CACN,IACO,EACV,KAAC,SAAS,IAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAI,EACtJ,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAM,EACzD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACrB,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAK,CACtD,CAAC,CAAC,CAAC,CACF,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CACnB,KAAC,SAAS,IAAc,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAA1F,GAAG,CAAC,EAAE,CAAwF,CAC/G,CAAC,GACC,CACN,IACO,IACN,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/ui/token-manager.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,aAAa,EAAe,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAmB,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5H,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAA0B,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAkEtD,MAAM,eAAe,GAA+C;IAClE,IAAI,EAAE,+CAA+C;IACrD,OAAO,EAAE,6HAA6H;IACtI,OAAO,EAAE,6DAA6D;IACtE,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,+DAA+D;IACrE,IAAI,EAAE,iCAAiC;IACvC,UAAU,EAAE,yDAAyD;IACrE,KAAK,EAAE,4CAA4C;IACnD,OAAO,EAAE,oCAAoC;IAC7C,OAAO,EAAE,mCAAmC;IAC5C,IAAI,EAAE,0MAA0M;CACjN,CAAC;AAIF,6CAA6C;AAC7C,SAAS,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAA4G;IACnK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,SAAS,IAAI;QACX,KAAK,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAC5C,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;QACvB,+EAA+E;QAC/E,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CACzB,CAAC;IACJ,CAAC;IACD,OAAO,CACL,eAAK,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAC7B,eAAK,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,aAChC,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,KAAK,GAAK,EAC1C,KAAC,MAAM,IAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,YACpE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAClD,IACL,EACN,cAAK,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,KAAK,GAAO,IACvC,CACP,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,EACxB,MAAM,EACN,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,QAAQ,GAOT;IACC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,KAAC,OAAO,IAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAC;IAC9I,OAAO,CACL,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,GAAM,EAClG,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAK,EACtD,aAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACvB,MAAM,CAAC,WAAW,OAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAC1F,EACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EACnE,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAK,EAC5D,KAAC,UAAU,IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,EAAC,QAAQ,EAAE,QAAQ,YAC5F,QAAQ,CAAC,MAAM,CAAC,cAAc,GACpB,EACZ,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACrE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,oBAAoB,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,EACxH,KAAC,MAAM,IAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,YAC1D,QAAQ,CAAC,MAAM,CAAC,IAAI,GACd,IACD,CACX,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EACjB,MAAM,EACN,WAAW,EACX,SAAS,EACT,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,QAAQ,GAST;IACC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,yEAAyE;IACzE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,OAAO,CACL,8BACE,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAM,EAC3D,gBAAM,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC/C,KAAC,SAAS,IACR,IAAI,EAAC,MAAM,EACX,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAC1B,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAC7B,SAAS,EAAE,qBAAqB,EAChC,QAAQ,QACR,YAAY,EAAC,KAAK,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,GAClB,EACD,WAAW,CAAC,CAAC,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,EAChJ,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,GAAK,EACzF,KAAC,SAAS,IAAC,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAI,EAC9H,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,YAC3E,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GACpD,IACJ,IACC,EACT,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAC,gBAAgB,IAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAI,IAC1J,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EACjB,GAAG,EACH,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,QAAQ,GAOT;IACC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,OAAO,CACL,cAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAiB,GAAG,CAAC,EAAE,aAChD,eAAK,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,aAChC,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,GAAG,CAAC,IAAI,GAAK,EAC7C,gBAAM,MAAM,EAAE,UAAU,aACtB,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAI,EAChD,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,SAAS,gBAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,YACxI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GACnD,IACJ,IACH,EACN,aAAG,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAC1D,GAAG,CAAC,UAAU,cAAK,GAAG,CAAC,SAAS,IAC/B,EACJ,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAK,EAC5D,KAAC,SAAS,IAAC,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAI,IAC3H,CACN,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EACjB,KAAK,EACL,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,QAAQ,GAOT;IACC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,OAAO,CACL,cAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAiB,KAAK,CAAC,EAAE,aAClD,eAAK,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,aAChC,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,KAAK,CAAC,UAAU,GAAK,EACrD,gBAAM,MAAM,EAAE,UAAU,aACtB,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAI,EAClD,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,SAAS,gBAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,YACtJ,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,GAChE,IACJ,IACH,EACN,YAAG,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,KAAK,CAAC,SAAS,GAAK,EAClD,YAAG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAK,EAC9D,KAAC,SAAS,IAAC,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAI,IAC3H,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAC3B,KAAK,EACL,MAAM,EACN,WAAW,EACX,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACN,UAAU,EACV,QAAQ,GACU;IAClB,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,OAAO,CACL,eAAK,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC1B,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAM,EAC1D,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACpB,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAK,CACvD,CAAC,CAAC,CAAC,CACF,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,cAAoB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACzC,eAAK,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,aAChC,eAAM,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,IAAI,CAAC,IAAI,GAAQ,EACpD,eAAM,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,IAAI,CAAC,UAAU,GAAQ,IACpD,EACN,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,WAAW,GAAK,KAL3C,IAAI,CAAC,IAAI,CAMb,CACN,CAAC,GACC,CACN,IACO,EACV,KAAC,SAAS,IAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAI,EACtJ,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAM,EACzD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACrB,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAK,CACtD,CAAC,CAAC,CAAC,CACF,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CACnB,KAAC,SAAS,IAAc,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAA1F,GAAG,CAAC,EAAE,CAAwF,CAC/G,CAAC,GACC,CACN,IACO,EACT,MAAM,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAChE,mBAAS,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aACjC,aAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAM,EAC5D,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAK,EACrD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACrB,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAK,CACxD,CAAC,CAAC,CAAC,CACF,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrB,KAAC,SAAS,IAAgB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAArG,KAAK,CAAC,EAAE,CAAiG,CAC1H,CAAC,GACC,CACN,IACO,CACX,IACG,CACP,CAAC;AACJ,CAAC"}

package/migrations/0002_create_oauth_grants.sql

@@ -0,0 +1,68 @@
+-- OAuth 2.1 for MCP clients (opt-in, `oauth.enabled`): clients registered dynamically, short-lived
+-- authorization codes, and one grant per account and client carrying a rotated refresh token. An
+-- access token issued through OAuth is a row of access_tokens with its grant; revoking the grant
+-- deletes its tokens by cascade. Every secret is stored as its sha256 only.
+-- Rollback: ALTER TABLE mcp.access_tokens DROP COLUMN grant_id;
+--   DROP TABLE mcp.oauth_grants, mcp.oauth_authorization_codes, mcp.oauth_clients; then
+--   DELETE FROM softure.migrations WHERE module = 'mcp-access' AND version = 2;
+CREATE TABLE oauth_clients (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  -- Public identifier the client sends (RFC 6749 §2.2); not a secret.
+  client_id text NOT NULL CHECK (char_length(client_id) BETWEEN 1 AND 255),
+  -- Shown on the consent page and in the connected apps list; also the name of its access tokens.
+  client_name text NOT NULL CHECK (char_length(client_name) BETWEEN 1 AND 60 AND client_name = btrim(client_name)),
+  redirect_uris jsonb NOT NULL CHECK (jsonb_typeof(redirect_uris) = 'array' AND jsonb_array_length(redirect_uris) BETWEEN 1 AND 10),
+  token_endpoint_auth_method text NOT NULL CHECK (token_endpoint_auth_method IN ('none', 'client_secret_post', 'client_secret_basic')),
+  -- Only for confidential clients; a public client (`none`) is protected by PKCE alone.
+  client_secret_hash text CHECK (client_secret_hash ~ '^[0-9a-f]{64}$'),
+  created_at timestamptz NOT NULL,
+  CONSTRAINT oauth_clients_client_id_key UNIQUE (client_id),
+  CONSTRAINT oauth_clients_secret_matches_method CHECK ((token_endpoint_auth_method = 'none') = (client_secret_hash IS NULL))
+);
+
+CREATE TABLE oauth_authorization_codes (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  code_hash text NOT NULL CHECK (code_hash ~ '^[0-9a-f]{64}$'),
+  client_id uuid NOT NULL REFERENCES oauth_clients (id) ON DELETE CASCADE,
+  user_id uuid NOT NULL REFERENCES auth.users (id) ON DELETE CASCADE,
+  redirect_uri text NOT NULL,
+  -- PKCE S256 challenge: base64url of a sha256, always 43 characters.
+  code_challenge text NOT NULL CHECK (code_challenge ~ '^[A-Za-z0-9_-]{43}$'),
+  can_write boolean NOT NULL,
+  expires_at timestamptz NOT NULL,
+  -- Set by the one exchange that may use the code; a second use revokes the grant it produced.
+  used_at timestamptz,
+  created_at timestamptz NOT NULL,
+  CHECK (expires_at > created_at),
+  CONSTRAINT oauth_authorization_codes_code_hash_key UNIQUE (code_hash)
+);
+
+CREATE INDEX oauth_authorization_codes_client_id_idx ON oauth_authorization_codes (client_id);
+CREATE INDEX oauth_authorization_codes_user_id_idx ON oauth_authorization_codes (user_id);
+CREATE INDEX oauth_authorization_codes_expires_at_idx ON oauth_authorization_codes (expires_at);
+
+CREATE TABLE oauth_grants (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES auth.users (id) ON DELETE CASCADE,
+  client_id uuid NOT NULL REFERENCES oauth_clients (id) ON DELETE CASCADE,
+  -- Granted write access; writes also need the app's allowWrites option.
+  can_write boolean NOT NULL,
+  refresh_token_hash text NOT NULL CHECK (refresh_token_hash ~ '^[0-9a-f]{64}$'),
+  -- The refresh token before the last rotation: presenting it again revokes the grant.
+  previous_refresh_token_hash text CHECK (previous_refresh_token_hash ~ '^[0-9a-f]{64}$'),
+  refresh_expires_at timestamptz NOT NULL,
+  -- Informational, written at most once a minute; never an access decision.
+  last_used_at timestamptz,
+  created_at timestamptz NOT NULL,
+  CONSTRAINT oauth_grants_refresh_token_hash_key UNIQUE (refresh_token_hash),
+  -- One grant per account and client: a new consent replaces the old grant.
+  CONSTRAINT oauth_grants_user_id_client_id_key UNIQUE (user_id, client_id)
+);
+
+CREATE INDEX oauth_grants_client_id_idx ON oauth_grants (client_id);
+CREATE INDEX oauth_grants_previous_refresh_token_hash_idx ON oauth_grants (previous_refresh_token_hash);
+CREATE INDEX oauth_grants_refresh_expires_at_idx ON oauth_grants (refresh_expires_at);
+
+-- The grant an access token was issued from; null for a token issued on the token page.
+ALTER TABLE access_tokens ADD COLUMN grant_id uuid REFERENCES oauth_grants (id) ON DELETE CASCADE;
+CREATE INDEX access_tokens_grant_id_idx ON access_tokens (grant_id);

package/module.json

@@ -1,15 +1,29 @@
 {
   "id": "mcp-access",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "dependsOn": { "security": "^0.1.0", "auth": "^0.1.0" },
   "dbSchema": "mcp",
-  "tables": ["access_tokens"],
+  "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],
   "env": [],
   "switches": [],
-  "routes": { "page": "/account/mcp", "endpoint": "/api/mcp" },
+  "routes": {
+    "page": "/account/mcp",
+    "endpoint": "/api/mcp",
+    "oauthConsent": "/oauth/authorize",
+    "oauthDecision": "/api/oauth/authorize",
+    "oauthToken": "/api/oauth/token",
+    "oauthRegister": "/api/oauth/register"
+  },
   "mount": [
     { "kind": "page", "path": "app/account/mcp/page.tsx", "export": "McpAccessPage" },
-    { "kind": "route-handler", "path": "app/api/mcp/route.ts", "export": "createMcpRoute" }
+    { "kind": "route-handler", "path": "app/api/mcp/route.ts", "export": "createMcpRoute" },
+    { "kind": "page", "path": "app/oauth/authorize/page.tsx", "export": "OAuthConsentPage" },
+    { "kind": "route-handler", "path": "app/api/oauth/authorize/route.ts", "export": "decideOAuthAuthorizationRoute" },
+    { "kind": "route-handler", "path": "app/api/oauth/token/route.ts", "export": "exchangeOAuthTokenRoute" },
+    { "kind": "route-handler", "path": "app/api/oauth/register/route.ts", "export": "registerOAuthClientRoute" },
+    { "kind": "route-handler", "path": "app/.well-known/oauth-authorization-server/route.ts", "export": "getAuthorizationServerMetadataRoute" },
+    { "kind": "route-handler", "path": "app/.well-known/oauth-protected-resource/route.ts", "export": "getProtectedResourceMetadataRoute" },
+    { "kind": "route-handler", "path": "app/.well-known/oauth-protected-resource/api/mcp/route.ts", "export": "getProtectedResourceMetadataRoute" }
   ],
   "privacy": { "exports": true, "deletes": true }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js.",
   "license": "MIT",
   "type": "module",
@@ -20,6 +20,7 @@
     "!src/**/*.test.ts",
     "!src/**/*.test.tsx",
     "migrations",
+    "adoption",
     "module.json"
   ],
   "publishConfig": {

package/src/contract.ts

@@ -6,7 +6,8 @@ export type McpAccessErrorCode =
   | "mcp-access.name_required"
   | "mcp-access.name_too_long"
   | "mcp-access.token_limit_reached"
-  | "mcp-access.token_not_found";
+  | "mcp-access.token_not_found"
+  | "mcp-access.grant_not_found";
 
 /** Every code the token page can show: its own, a missing session and the generic ones. */
 export type TokenFormErrorCode = McpAccessErrorCode | "auth.unauthenticated" | CoreErrorCode;
@@ -73,8 +74,22 @@ export type IssueTokenFormState =
   | { readonly status: "ok"; readonly issued: IssuedToken }
   | { readonly status: "error"; readonly error: TokenFormErrorCode };
 
+/** A connected app (an OAuth grant) as its owner sees it. */
+export interface OAuthGrantView {
+  readonly id: string;
+  /** The name the client registered with, cut to 60 characters. */
+  readonly clientName: string;
+  /** Granted with write access (it still writes only while the app allows writes). */
+  readonly canWrite: boolean;
+  readonly createdAt: Date;
+  readonly lastUsedAt: Date | null;
+}
+
 /** What the revoke action returns to one token's form. */
 export type RevokeTokenFormState =
   | { readonly status: "idle" }
   | { readonly status: "ok" }
   | { readonly status: "error"; readonly error: TokenFormErrorCode };
+
+/** What the disconnect action returns to one connected app's form. */
+export type RevokeGrantFormState = RevokeTokenFormState;

package/src/index.ts

@@ -17,6 +17,12 @@ export const MODULE_ID = "mcp-access";
  */
 export const MCP_RATE_LIMIT_BUCKETS = {
   mcp: { limit: 200, windowMinutes: 15 },
+  /**
+   * OAuth registration (per address) and token requests (per address and client id), when
+   * `oauth.enabled`. Enough for an assistant platform refreshing many users' tokens per client,
+   * too little for a script filling the clients table.
+   */
+  "mcp-oauth": { limit: 60, windowMinutes: 15 },
 } as const;
 
 /**
@@ -26,16 +32,30 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.1.6",
+    version: "0.1.8",
     dependsOn: { security: "^0.1.0", auth: "^0.1.0" },
     dbSchema: "mcp",
-    tables: ["access_tokens"],
+    tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],
     env: [],
     switches: [],
-    routes: { page: "/account/mcp", endpoint: "/api/mcp" },
+    routes: {
+      page: "/account/mcp",
+      endpoint: "/api/mcp",
+      oauthConsent: "/oauth/authorize",
+      oauthDecision: "/api/oauth/authorize",
+      oauthToken: "/api/oauth/token",
+      oauthRegister: "/api/oauth/register",
+    },
     mount: [
       { kind: "page", path: "app/account/mcp/page.tsx", export: "McpAccessPage" },
       { kind: "route-handler", path: "app/api/mcp/route.ts", export: "createMcpRoute" },
+      { kind: "page", path: "app/oauth/authorize/page.tsx", export: "OAuthConsentPage" },
+      { kind: "route-handler", path: "app/api/oauth/authorize/route.ts", export: "decideOAuthAuthorizationRoute" },
+      { kind: "route-handler", path: "app/api/oauth/token/route.ts", export: "exchangeOAuthTokenRoute" },
+      { kind: "route-handler", path: "app/api/oauth/register/route.ts", export: "registerOAuthClientRoute" },
+      { kind: "route-handler", path: "app/.well-known/oauth-authorization-server/route.ts", export: "getAuthorizationServerMetadataRoute" },
+      { kind: "route-handler", path: "app/.well-known/oauth-protected-resource/route.ts", export: "getProtectedResourceMetadataRoute" },
+      { kind: "route-handler", path: "app/.well-known/oauth-protected-resource/api/mcp/route.ts", export: "getProtectedResourceMetadataRoute" },
     ],
     privacy: { exports: true, deletes: true },
   },
@@ -63,19 +83,28 @@ export type {
   McpAccessErrorCode,
   McpClientSetup,
   McpServerIdentity,
+  OAuthGrantView,
+  RevokeGrantFormState,
   RevokeTokenFormState,
   TokenFormErrorCode,
 } from "./contract.js";
 export { getTokenErrorMessage, mcpAccessMessages, type McpAccessMessages } from "./messages/index.js";
 export {
+  MAX_PRESENTED_TOKEN_LENGTH,
   MAX_TOKEN_NAME_LENGTH,
   SERVER_NAME_PATTERN,
   TOOL_NAME_PATTERN,
+  GENERATED_AUTHORIZATION_SERVER_KEYS,
+  GENERATED_PROTECTED_RESOURCE_KEYS,
   type McpAccessOptions,
   type McpAccessOptionsInput,
+  type McpAppOriginResolver,
+  type McpMetadataExtension,
+  type McpOAuthOptions,
   type McpToolAccess,
   type McpToolDefinition,
   type McpToolDefinitionInput,
 } from "./options.js";
-export { accessTokens } from "./schema.js";
+export { readRequestOrigin, type McpOriginRequest, type McpOrigins } from "./origins.js";
+export { accessTokens, oauthAuthorizationCodes, oauthClients, oauthGrants, type OAuthClientRow, type OAuthTokenEndpointAuthMethod } from "./schema.js";
 export { getAccessTokenStatus, type AccessTokenStatusOptions } from "./token-status.js";

package/src/messages/en.ts

@@ -58,12 +58,40 @@ export const en = {
     revoke: "Revoke",
     revoking: "Revoking…",
   },
+  grants: {
+    title: "Connected apps",
+    lead: "Assistants you connected by signing in, such as claude.ai or ChatGPT. Disconnecting one stops its access at once.",
+    empty: "No app is connected.",
+    connectedOn: "Connected {date}",
+    disconnect: "Disconnect",
+    disconnecting: "Disconnecting…",
+  },
+  consent: {
+    title: "{client} wants access to your account",
+    lead: "The assistant can answer questions with your data in this app. You can disconnect it at any time on the AI assistant access page.",
+    app: "App",
+    returnsTo: "returns to {target}",
+    account: "Account",
+    access: "Access",
+    readAccess: "Read your data",
+    allowWrite: "Also allow changes",
+    allowWriteHint: "Without it, the assistant can only read.",
+    allow: "Allow",
+    deny: "Deny",
+    errorTitle: "The assistant cannot be connected",
+    unknownClient: "The app that sent you here is not registered. Connect it again from the assistant.",
+    redirectMismatch: "The return address does not match the one the app registered. Connect it again from the assistant.",
+    invalidRequest: "The app sent a connection request this app cannot accept.",
+    nothingGranted: "No access was granted.",
+    backToApp: "Back to the app ({target})",
+  },
   errors: {
     "mcp-access": {
       name_required: "Give the token a name, so you can tell it from the others.",
       name_too_long: "The name is too long.",
       token_limit_reached: "You already hold the most active tokens allowed. Revoke one before creating another.",
       token_not_found: "This token no longer exists. It may have been revoked already.",
+      grant_not_found: "This app is no longer connected.",
     },
     auth: {
       unauthenticated: "Your session has ended. Log in again.",

package/src/messages/pl.ts

@@ -60,12 +60,40 @@ export const pl: typeof en = {
     revoke: "Unieważnij",
     revoking: "Unieważnianie…",
   },
+  grants: {
+    title: "Połączone aplikacje",
+    lead: "Asystenci połączeni przez logowanie, na przykład claude.ai albo ChatGPT. Odłączenie od razu odbiera im dostęp.",
+    empty: "Żadna aplikacja nie jest połączona.",
+    connectedOn: "Połączono {date}",
+    disconnect: "Odłącz",
+    disconnecting: "Odłączanie…",
+  },
+  consent: {
+    title: "{client} prosi o dostęp do Twojego konta",
+    lead: "Asystent odpowie na pytania, korzystając z Twoich danych w tej aplikacji. Możesz go odłączyć w każdej chwili na stronie dostępu dla asystenta AI.",
+    app: "Aplikacja",
+    returnsTo: "wróci na {target}",
+    account: "Konto",
+    access: "Dostęp",
+    readAccess: "Odczyt Twoich danych",
+    allowWrite: "Pozwól też na zmiany",
+    allowWriteHint: "Bez tego asystent może tylko czytać.",
+    allow: "Zezwól",
+    deny: "Odmów",
+    errorTitle: "Nie da się połączyć asystenta",
+    unknownClient: "Aplikacja, która Cię tu przysłała, nie jest zarejestrowana. Połącz ją od nowa z poziomu asystenta.",
+    redirectMismatch: "Adres powrotu nie zgadza się z tym, który aplikacja zarejestrowała. Połącz ją od nowa z poziomu asystenta.",
+    invalidRequest: "Aplikacja wysłała żądanie połączenia, którego ta aplikacja nie może przyjąć.",
+    nothingGranted: "Nie nadano żadnego dostępu.",
+    backToApp: "Wróć do aplikacji ({target})",
+  },
   errors: {
     "mcp-access": {
       name_required: "Nadaj tokenowi nazwę, żeby odróżnić go od pozostałych.",
       name_too_long: "Nazwa jest za długa.",
       token_limit_reached: "Masz już najwięcej aktywnych tokenów, ile można. Unieważnij któryś, zanim utworzysz nowy.",
       token_not_found: "Ten token już nie istnieje. Mógł zostać unieważniony.",
+      grant_not_found: "Ta aplikacja nie jest już połączona.",
     },
     auth: {
       unauthenticated: "Twoja sesja wygasła. Zaloguj się ponownie.",

package/src/next/actions.ts

@@ -9,11 +9,12 @@ import { getSoftureConfig } from "@softure-ai/core/next";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
 import { getMcpClientSetup } from "../client-setup.js";
-import type { IssueTokenFormState, RevokeTokenFormState } from "../contract.js";
+import type { IssueTokenFormState, RevokeGrantFormState, RevokeTokenFormState } from "../contract.js";
 import { MAX_TOKEN_NAME_LENGTH } from "../options.js";
 import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "../server/options.js";
+import { revokeOAuthGrant } from "../server/oauth.js";
 import { issueAccessToken, revokeAccessToken } from "../server/tokens.js";
-import { getMcpAccessContext } from "./context.js";
+import { getMcpAccessContext, getRequestOrigins } from "./context.js";
 import { formatDate } from "./format.js";
 
 /** Longer values are cut: the server functions refuse them anyway, and nothing huge is echoed back. */
@@ -48,6 +49,8 @@ export async function issueTokenAction(_previous: IssueTokenFormState, formData:
   // Every field has a `catch`, so parsing cannot fail.
   const input = issueInput.parse({ name: formData.get("name"), canWrite: formData.get("canWrite") });
   try {
+    // Resolved before issuing: a failure afterwards would leave a token nobody received.
+    const endpointUrl = getMcpEndpointUrl(config, await getRequestOrigins(config, getMcpAccessRoutes(config).page));
     const result = await issueAccessToken(await getMcpAccessContext(config), { userId: user.id, name: input.name, canWrite: input.canWrite !== null });
     if (!result.ok) return { status: "error", error: result.error };
     refreshPage(config);
@@ -62,7 +65,7 @@ export async function issueTokenAction(_previous: IssueTokenFormState, formData:
         expiresText: formatMessage(messages.issued.expires, { date: formatDate(config, issued.expiresAt) }),
         setup: getMcpClientSetup({
           serverName: getMcpAccessOptions(config).serverName,
-          endpointUrl: getMcpEndpointUrl(config),
+          endpointUrl,
           token: issued.token,
           promptTemplate: messages.setup.assistantPrompt,
         }),
@@ -89,3 +92,20 @@ export async function revokeTokenAction(_previous: RevokeTokenFormState, formDat
     return { status: "error", error: reportFailure("revoking a token", error) };
   }
 }
+
+/** Disconnects one of the signed-in user's OAuth apps: the grant and its access tokens go at once. */
+export async function revokeGrantAction(_previous: RevokeGrantFormState, formData: FormData): Promise<RevokeGrantFormState> {
+  const config = getSoftureConfig();
+  const user = await getCurrentUser();
+  if (user === null) return { status: "error", error: "auth.unauthenticated" };
+
+  const input = revokeInput.parse({ id: formData.get("id") });
+  try {
+    const result = await revokeOAuthGrant(await getMcpAccessContext(config), { userId: user.id, grantId: input.id });
+    if (!result.ok) return { status: "error", error: result.error };
+    refreshPage(config);
+    return { status: "ok" };
+  } catch (error) {
+    return { status: "error", error: reportFailure("disconnecting an app", error) };
+  }
+}

package/src/next/context.ts

@@ -1,14 +1,21 @@
 // What the adapter hands the server functions: the registered config, the process-wide database
 // handle and the wall clock.
-import { systemClock, type SoftureConfig } from "@softure-ai/core";
+import type { SoftureConfig } from "@softure-ai/core";
 import { getSoftureConfig } from "@softure-ai/core/next";
-import { getConfiguredDatabase } from "@softure-ai/db";
+import type { McpOrigins } from "../origins.js";
+import { createMcpAccessContext } from "../server/context.js";
+import { resolveMcpOrigins } from "../server/origins.js";
 import type { McpAccessContext } from "../server/tokens.js";
 
-export async function getMcpAccessContext(config: SoftureConfig = getSoftureConfig()): Promise<McpAccessContext> {
-  if (config.database === null) {
-    throw new Error("@softure-ai/mcp-access: softure.config.ts has no database; mcp-access needs one");
-  }
-  const { db } = await getConfiguredDatabase(config.database);
-  return { db, clock: systemClock, config };
+export function getMcpAccessContext(config: SoftureConfig = getSoftureConfig()): Promise<McpAccessContext> {
+  return createMcpAccessContext(config);
+}
+
+/**
+ * The origins of the request a page or a server action runs in, from Next's `headers()`: the same
+ * ones the route handlers resolve, so the consent page and its decision agree.
+ */
+export async function getRequestOrigins(config: SoftureConfig, path: string): Promise<McpOrigins> {
+  const { headers } = await import("next/headers");
+  return resolveMcpOrigins(config, { url: new URL(path, config.appOrigin).toString(), headers: await headers() });
 }

package/src/next/index.ts

@@ -1,5 +1,15 @@
 // The Next.js adapter of @softure-ai/mcp-access: the MCP route factory, the token page and its
-// server actions (docs/02-module-standard.md §8).
-export { issueTokenAction, revokeTokenAction } from "./actions.js";
+// server actions, and the OAuth routes and consent page (docs/02-module-standard.md §8).
+export { issueTokenAction, revokeGrantAction, revokeTokenAction } from "./actions.js";
+export { OAuthConsentPage, type OAuthConsentPageProps } from "./oauth-page.js";
+export {
+  answerOAuthPreflight,
+  decideOAuthAuthorizationRoute,
+  exchangeOAuthTokenRoute,
+  getAuthorizationServerMetadataRoute,
+  getProtectedResourceMetadataRoute,
+  registerOAuthClientRoute,
+} from "./oauth-routes.js";
+export { getMcpAccessContext } from "./context.js";
 export { McpAccessPage } from "./pages.js";
 export { createMcpRoute } from "./route.js";

package/src/next/oauth-page.tsx

@@ -0,0 +1,68 @@
+// The OAuth consent page, ready to mount with one line:
+// `export { OAuthConsentPage as default } from "@softure-ai/mcp-access/next"`.
+// The authorization endpoint clients send the person to. Without a session it redirects to the
+// login page and back with every parameter (state, challenge, resource). Errors before the client
+// and its redirect URI are confirmed are shown here, never redirected; later ones offer a link back
+// to the client, never an automatic redirect (anyone can register a redirect URI).
+import { requireUser } from "@softure-ai/auth/next";
+import { formatMessage } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { Card } from "@softure-ai/ui";
+import { notFound } from "next/navigation";
+import { getConsentPath, isOAuthEnabled, readAuthorizationParams, validateAuthorizationRequest } from "../server/oauth-http.js";
+import { describeRedirectUri } from "../server/oauth-validation.js";
+import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes } from "../server/options.js";
+import { ConsentError, ConsentForm } from "../ui/consent-form.js";
+import { getMcpAccessContext, getRequestOrigins } from "./context.js";
+
+type SearchParams = Promise<Record<string, string | string[] | undefined>>;
+
+export interface OAuthConsentPageProps {
+  readonly searchParams?: SearchParams;
+}
+
+const LAYOUT_CLASS = "sft:mx-auto sft:box-border sft:w-full sft:sm:max-w-md sft:px-4 sft:py-4";
+
+export async function OAuthConsentPage({ searchParams }: OAuthConsentPageProps) {
+  const config = getSoftureConfig();
+  if (!isOAuthEnabled(config)) notFound();
+  const query = (await searchParams) ?? {};
+  const params = readAuthorizationParams({ get: (name: string) => query[name] });
+  const user = await requireUser({ next: getConsentPath(config, params), searchParams: query });
+
+  const messages = getMcpAccessMessages(config);
+  const origins = await getRequestOrigins(config, getMcpAccessRoutes(config).oauthConsent);
+  const outcome = await validateAuthorizationRequest(await getMcpAccessContext(config), params, origins);
+  if (outcome.kind !== "valid") {
+    const message =
+      outcome.kind === "redirect-error" ? messages.consent.invalidRequest : outcome.reason === "unknown_client" ? messages.consent.unknownClient : messages.consent.redirectMismatch;
+    return (
+      <main className={LAYOUT_CLASS}>
+        <Card title={messages.consent.errorTitle}>
+          <ConsentError
+            message={message}
+            {...(outcome.kind === "redirect-error" ? { backLocation: outcome.location, backTarget: describeRedirectUri(outcome.redirectUri) } : {})}
+            messages={messages}
+          />
+        </Card>
+      </main>
+    );
+  }
+
+  const { client, redirectUri, isWriteRequested } = outcome.request;
+  return (
+    <main className={LAYOUT_CLASS}>
+      <Card title={formatMessage(messages.consent.title, { client: client.clientName })} subtitle={messages.consent.lead}>
+        <ConsentForm
+          action={getMcpAccessRoutes(config).oauthDecision}
+          params={[...params.entries()]}
+          clientName={client.clientName}
+          redirectTarget={describeRedirectUri(redirectUri)}
+          accountEmail={user.email}
+          isWriteOffered={isWriteRequested && getMcpAccessOptions(config).allowWrites}
+          messages={messages}
+        />
+      </Card>
+    </main>
+  );
+}

package/src/next/oauth-routes.ts

@@ -0,0 +1,73 @@
+// The OAuth routes, each mounted with one line (README §4), e.g.
+// `app/api/oauth/token/route.ts → export { exchangeOAuthTokenRoute as POST, answerOAuthPreflight as OPTIONS } from "@softure-ai/mcp-access/next";`
+// They supply the module context (and, for the decision, the session's user) to the handlers in
+// `/server`. With `oauth.enabled` off every one answers 404.
+import { getCurrentUser } from "@softure-ai/auth/next";
+import { errorLogLabel } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import {
+  answerOAuthPreflight,
+  getAuthorizationServerMetadata,
+  getProtectedResourceMetadata,
+  getRootProtectedResourceMetadata,
+  handleAuthorizationDecision,
+  handleClientRegistration,
+  handleTokenRequest,
+  serveDiscoveryDocument,
+} from "../server/oauth-http.js";
+import type { McpAccessContext } from "../server/tokens.js";
+import { getMcpAccessContext } from "./context.js";
+
+const UNAVAILABLE = { status: 503, headers: { "cache-control": "no-store" } };
+
+async function withContext(request: Request, handle: (ctx: McpAccessContext, request: Request) => Promise<Response>): Promise<Response> {
+  let ctx;
+  try {
+    ctx = await getMcpAccessContext();
+  } catch (error) {
+    console.error(`@softure-ai/mcp-access: opening the database failed: ${errorLogLabel(error)}`);
+    return Response.json({ error: "temporarily_unavailable" }, UNAVAILABLE);
+  }
+  return handle(ctx, request);
+}
+
+/**
+ * `GET /.well-known/oauth-authorization-server`. Reads the request, so Next never renders it at
+ * build time with one origin baked in.
+ */
+export function getAuthorizationServerMetadataRoute(request: Request): Response {
+  return serveDiscoveryDocument(getSoftureConfig(), (config, origins) => getAuthorizationServerMetadata(config, origins), request);
+}
+
+/**
+ * `GET /.well-known/oauth-protected-resource` and `…/oauth-protected-resource/api/mcp`: the same
+ * export at both paths; the request's path picks the variant.
+ */
+export function getProtectedResourceMetadataRoute(request: Request): Response {
+  const isRoot = new URL(request.url).pathname.replace(/\/+$/, "").endsWith("/oauth-protected-resource");
+  return serveDiscoveryDocument(
+    getSoftureConfig(),
+    isRoot ? getRootProtectedResourceMetadata : (config, origins) => getProtectedResourceMetadata(config, "endpoint", origins),
+    request,
+  );
+}
+
+/** `POST /api/oauth/register`. */
+export function registerOAuthClientRoute(request: Request): Promise<Response> {
+  return withContext(request, handleClientRegistration);
+}
+
+/** `POST /api/oauth/token`. */
+export function exchangeOAuthTokenRoute(request: Request): Promise<Response> {
+  return withContext(request, handleTokenRequest);
+}
+
+/** `POST /api/oauth/authorize`: the consent form's decision, answered with `303`. */
+export function decideOAuthAuthorizationRoute(request: Request): Promise<Response> {
+  return withContext(request, async (ctx, req) => {
+    const user = await getCurrentUser();
+    return handleAuthorizationDecision(ctx, req, user?.id ?? null);
+  });
+}
+
+export { answerOAuthPreflight };