@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/mcpserver/initiate-oauth-connect.js

@@ -0,0 +1,331 @@
+/**
+ * initiateOAuthConnect — ports
+ * pkg/domain/mcpserver/controller/initiate_oauth_connect.go: start the
+ * OAuth authorization flow for an MCP server. For DCR servers (no
+ * oauth_app_ref): discover the authorization server, register a client
+ * via RFC 7591, generate PKCE, pre-flight the authorize endpoint, return
+ * the auth URL. For vendor OAuth servers: load the OAuthApp for client
+ * credentials and build the auth URL from its endpoints.
+ *
+ * Proven by mcpserver-oauth.conformance.test.ts
+ * (CONFORMANCE_TARGET=local) and
+ * __tests__/initiate-oauth-connect.test.ts.
+ */
+import { create } from "@bufbuild/protobuf";
+import { randomBytes } from "node:crypto";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
+import { InitiateOAuthConnectOutputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { TokenEndpointAuthMethod, VendorApprovalStatus, } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
+import { EncryptionScope } from "../../encryption/encryption.js";
+import { failedPreconditionError, internalError, invalidArgumentError, notFoundError, } from "../../pipeline/errors.js";
+import { authorizeDirect } from "../../pipeline/steps/authorize.js";
+import { resolveOAuthAppRef } from "../oauthapp/refresolution.js";
+import { tokenAuthMethodFromSpec } from "./connect.js";
+import { generatePkce } from "./oauth/pkce.js";
+import { discoverAuthorizationServer } from "./oauth/discovery.js";
+import { registerClient } from "./oauth/dcr.js";
+import { preflightAuthorize } from "./oauth/preflight.js";
+export async function initiateOAuthConnect(deps, input, identity) {
+    if (deps.oauthRedirectUri === "") {
+        throw failedPreconditionError("OAuth Connect is not configured: STIGMER_OAUTH_REDIRECT_URI is not set");
+    }
+    const mcpServerId = input.mcpServerId;
+    if (mcpServerId === "") {
+        throw invalidArgumentError("mcp_server_id is required");
+    }
+    let mcpServer;
+    try {
+        mcpServer = await deps.store.getResource(ApiResourceKind.mcp_server, mcpServerId, McpServerSchema);
+    }
+    catch {
+        throw notFoundError("mcp_server", mcpServerId);
+    }
+    // The annotation's can_connect check AFTER the load — the Java
+    // McpServerInitiateOAuthConnectHandler order (load-before-authorize,
+    // stigmer#224). C2 Stage 4.
+    await authorizeDirect(McpServerCommandController.method.initiateOAuthConnect, deps.authorizer, identity, input);
+    const auth = mcpServer.spec?.auth;
+    if (auth === undefined) {
+        throw failedPreconditionError(`MCP server '${mcpServerId}' does not have an auth block configured`);
+    }
+    const pkcePair = generatePkce();
+    const stateParam = generateState();
+    const oauthAppRef = auth.oauthAppRef;
+    const isDcr = oauthAppRef === undefined || oauthAppRef.slug === "";
+    const result = isDcr
+        ? await initiateDcr(deps, mcpServer, pkcePair, stateParam)
+        : await initiateVendorOAuth(deps, mcpServer, pkcePair, stateParam);
+    const authMethod = isDcr ? "mcp_oauth" : "vendor_oauth";
+    const pendingState = {
+        state: stateParam,
+        codeVerifier: pkcePair.codeVerifier,
+        clientId: result.clientId,
+        clientSecret: result.clientSecret,
+        tokenEndpoint: result.tokenEndpoint,
+        mcpServerId,
+        // OSS mode: single user, no identity account.
+        identityAccountId: "",
+        targetEnvVar: auth.targetEnvVar,
+        authMethod,
+        tokenAuthMethod: result.tokenAuthMethod,
+        redirectUri: deps.oauthRedirectUri,
+        org: input.org,
+        createdAt: 0,
+    };
+    // Fail-closed: an encryption error fails the request; plaintext never
+    // reaches the store.
+    let sealed;
+    try {
+        sealed = await sealPendingOAuthState(deps.secretService, deps.logger, pendingState);
+    }
+    catch (error) {
+        throw internalError(error, "failed to encrypt OAuth handshake secrets");
+    }
+    try {
+        await deps.pendingOAuthStates.save(sealed);
+    }
+    catch (error) {
+        throw internalError(error, "failed to save pending OAuth state");
+    }
+    deps.logger.info("Initiated OAuth Connect flow", {
+        mcp_server_id: mcpServerId,
+        auth_method: authMethod,
+        provider: result.providerName,
+    });
+    return create(InitiateOAuthConnectOutputSchema, {
+        authorizationUrl: result.authorizationUrl,
+        state: stateParam,
+        scopes: result.scopes,
+        providerName: result.providerName,
+    });
+}
+async function initiateDcr(deps, mcpServer, pkcePair, stateParam) {
+    // Resolve the URL for OAuth authorization server discovery. Priority:
+    // auth.discovery_url > http.url — discovery_url enables DCR for stdio
+    // servers that have no HTTP URL.
+    let serverUrl = mcpServer.spec?.auth?.discoveryUrl ?? "";
+    if (serverUrl === "") {
+        const serverType = mcpServer.spec?.serverType;
+        if (serverType?.case === "http") {
+            serverUrl = serverType.value.url;
+        }
+    }
+    if (serverUrl === "") {
+        throw failedPreconditionError(`DCR requires a discoverable URL. MCP server '${mcpServer.metadata?.id ?? ""}' has no http.url and no auth.discovery_url. ` +
+            "Set auth.discovery_url for stdio servers, oauth_app_ref for vendor OAuth, or switch to HTTP transport");
+    }
+    let metadata;
+    try {
+        metadata = await discoverAuthorizationServer(serverUrl);
+    }
+    catch (error) {
+        throw failedPreconditionError(`OAuth authorization server discovery failed for ${serverUrl}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (metadata.registrationEndpoint === "") {
+        throw failedPreconditionError(`MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR`);
+    }
+    const clientName = `Stigmer (${mcpServer.metadata?.name ?? ""})`;
+    let dcrResponse;
+    try {
+        dcrResponse = await registerClient(metadata.registrationEndpoint, deps.oauthRedirectUri, clientName);
+    }
+    catch (error) {
+        throw failedPreconditionError(`DCR registration failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let scopes = mcpServer.spec?.auth?.scopeHints ?? [];
+    if (scopes.length === 0 && metadata.scopesSupported.length > 0) {
+        scopes = metadata.scopesSupported;
+    }
+    const authUrl = buildAuthorizationUrl(metadata.authorizationEndpoint, dcrResponse.clientId, deps.oauthRedirectUri, pkcePair.codeChallenge, stateParam, scopes, "scope");
+    // Some providers accept DCR for any redirect URI but enforce a
+    // redirect-host allowlist at the authorization endpoint; without this
+    // pre-flight the rejection would surface only as a vendor error page
+    // inside the popup, which never redirects back (stigmer/stigmer#235).
+    // Fail-open by contract: only a definite rejection blocks initiate.
+    let rejection;
+    try {
+        rejection = await preflightAuthorize(authUrl);
+    }
+    catch (probeError) {
+        deps.logger.debug("authorize pre-flight probe inconclusive; proceeding", {
+            mcp_server_id: mcpServer.metadata?.id ?? "",
+            error: probeError instanceof Error ? probeError.message : String(probeError),
+        });
+    }
+    if (rejection !== undefined) {
+        deps.logger.warn("authorization endpoint rejected the sign-in request pre-flight", {
+            status_code: rejection.statusCode,
+            mcp_server_id: mcpServer.metadata?.id ?? "",
+            body_snippet: rejection.bodySnippet,
+        });
+        throw failedPreconditionError(dcrRejectionMessage(mcpServer.metadata?.name ?? "", deps.oauthRedirectUri, rejection));
+    }
+    return {
+        authorizationUrl: authUrl,
+        providerName: mcpServer.metadata?.name ?? "",
+        scopes,
+        clientId: dcrResponse.clientId,
+        clientSecret: "",
+        tokenEndpoint: metadata.tokenEndpoint,
+        tokenAuthMethod: "",
+    };
+}
+async function initiateVendorOAuth(deps, mcpServer, pkcePair, stateParam) {
+    const ref = mcpServer.spec?.auth?.oauthAppRef;
+    let oauthApp;
+    try {
+        oauthApp = await resolveOAuthAppRef(deps.store, ref, deps.logger);
+    }
+    catch (error) {
+        throw internalError(error, "failed to list oauth apps");
+    }
+    if (oauthApp === undefined) {
+        throw notFoundError("oauth_app", ref?.slug ?? "");
+    }
+    const approvalStatus = oauthApp.spec?.vendorApprovalStatus;
+    if (approvalStatus === VendorApprovalStatus.PENDING ||
+        approvalStatus === VendorApprovalStatus.REJECTED) {
+        const statusLabel = approvalStatus === VendorApprovalStatus.REJECTED
+            ? "rejected"
+            : "pending approval";
+        // The suggested alternative must be one that can actually work:
+        // oauth_only endpoints reject static tokens, so recommending manual
+        // entry there sends the user down a dead end (stigmer/stigmer#412).
+        const alternative = mcpServer.spec?.auth?.oauthOnly
+            ? "This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead."
+            : "Please enter a token manually instead.";
+        throw failedPreconditionError(`OAuth sign-in is unavailable: the platform's OAuth app for '${oauthApp.spec?.provider ?? ""}' is ${statusLabel} by the vendor. ${alternative}`);
+    }
+    let clientSecret = oauthApp.spec?.clientSecret ?? "";
+    if (deps.secretService.isEncrypted(clientSecret)) {
+        try {
+            clientSecret = await deps.secretService.decrypt(clientSecret);
+        }
+        catch (error) {
+            throw internalError(error, "failed to decrypt OAuthApp client secret");
+        }
+    }
+    const scopes = oauthApp.spec?.scopes ?? [];
+    const authUrl = buildAuthorizationUrl(oauthApp.spec?.authorizationUrl ?? "", oauthApp.spec?.clientId ?? "", deps.oauthRedirectUri, pkcePair.codeChallenge, stateParam, scopes, oauthApp.spec?.scopeParameterName ?? "");
+    return {
+        authorizationUrl: authUrl,
+        providerName: oauthApp.spec?.provider ?? "",
+        scopes,
+        clientId: oauthApp.spec?.clientId ?? "",
+        clientSecret,
+        tokenEndpoint: oauthApp.spec?.tokenUrl ?? "",
+        tokenAuthMethod: tokenAuthMethodFromSpec(oauthApp.spec?.tokenEndpointAuthMethod ??
+            TokenEndpointAuthMethod.UNSPECIFIED),
+    };
+}
+/**
+ * Builds the authorization URL (Go buildAuthorizationURL). Parameters are
+ * rendered SORTED by key — Go's url.Values.Encode() sorts, and the
+ * conformance suite asserts the exact parameter set — with
+ * form-urlencoding (spaces as +, both editions).
+ */
+export function buildAuthorizationUrl(authEndpoint, clientId, redirectUri, codeChallenge, state, scopes, scopeParamName) {
+    const scopeParam = scopeParamName === "" ? "scope" : scopeParamName;
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+        state,
+    });
+    if (scopes.length > 0) {
+        params.set(scopeParam, scopes.join(" "));
+    }
+    params.sort();
+    const separator = authEndpoint.includes("?") ? "&" : "?";
+    return authEndpoint + separator + params.toString();
+}
+/**
+ * Renders the user-facing copy for a pre-flight authorize rejection (Go
+ * dcrRejectionMessage). The wording is hedged — a 400 can in principle
+ * have other causes — but leads with the redirect-host allowlist because
+ * it is the only cause observed in the wild (Canva, stigmer/stigmer#235),
+ * and it names this deployment's callback host so self-hosted operators
+ * can act on it. Surfaces which render initiate errors pass this text
+ * through verbatim (getUserMessage in @stigmer/sdk), so it must stand on
+ * its own for an end user.
+ */
+export function dcrRejectionMessage(providerName, redirectUri, rejection) {
+    let callbackHost = redirectUri;
+    try {
+        const parsed = new URL(redirectUri);
+        if (parsed.host !== "") {
+            callbackHost = parsed.host;
+        }
+    }
+    catch {
+        // Keep the raw URI when it does not parse — Go's err-tolerant arm.
+    }
+    let message = `${providerName} rejected the sign-in request before showing a login page (HTTP ${rejection.statusCode}). ` +
+        `The most common cause is a redirect-host allowlist: this deployment's OAuth callback host (${callbackHost}) ` +
+        "is not on the provider's approved list. Self-hosted deployments with a localhost callback are typically unaffected.";
+    if (rejection.vendorDetail !== "") {
+        message += " Provider detail: " + rejection.vendorDetail;
+    }
+    return message;
+}
+/** 32 random bytes, base64url — CSRF state (Go generateState). */
+function generateState() {
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * Encrypts the two real secrets in the pending row — code_verifier (every
+ * flow) and client_secret (vendor flow) — before they rest in SQLite, so
+ * handshake secrets never leak through filesystem backups of the database
+ * (oss#394; ports stigmer-cloud#294). The store itself stays a
+ * byte-faithful adapter; this call site is the single write seam.
+ *
+ * The row is a self-contained SNAPSHOT, never an alias of the OAuthApp's
+ * stored ciphertext: initiateVendorOAuth decrypts the app's secret
+ * (failing loudly if the key is unavailable), and the seal re-encrypts
+ * that plaintext with a fresh nonce. The token exchange must use the
+ * credentials the authorization code was minted for, not whatever a later
+ * resolution of the OAuthApp would return.
+ *
+ * The DCR path's empty client secret stays empty — never
+ * ciphertext-of-"" — so completeOAuthConnect and the token exchange keep
+ * seeing the emptiness that means "public client".
+ *
+ * Disabled encryption (no key configured) passes plaintext through with a
+ * WARN, matching the deployment-wide posture for environment, OAuthApp
+ * and ChannelApp secrets under the same key. A real encryption error
+ * while enabled throws so the caller fails the request instead of
+ * persisting plaintext.
+ */
+export async function sealPendingOAuthState(secretService, logger, state) {
+    if (!secretService.isEnabled()) {
+        logger.warn("Encryption disabled: pending OAuth state secrets will be stored in plaintext");
+        return state;
+    }
+    // Tenancy-only scope from the row's own org (proto-required min_len 1
+    // on the initiate input, so never empty here) — the handshake ephemera
+    // seal under the caller's org exactly like the durable rows they
+    // snapshot from.
+    const scope = EncryptionScope.forOrganization(state.org);
+    let sealedVerifier;
+    try {
+        sealedVerifier = await secretService.encrypt(state.codeVerifier, scope);
+    }
+    catch (error) {
+        throw new Error(`failed to encrypt code_verifier: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let sealedSecret = state.clientSecret;
+    if (state.clientSecret !== "") {
+        try {
+            sealedSecret = await secretService.encrypt(state.clientSecret, scope);
+        }
+        catch (error) {
+            throw new Error(`failed to encrypt client_secret: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return { ...state, codeVerifier: sealedVerifier, clientSecret: sealedSecret };
+}
+//# sourceMappingURL=initiate-oauth-connect.js.map

package/dist/domain/mcpserver/initiate-oauth-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiate-oauth-connect.js","sourceRoot":"","sources":["../../../src/domain/mcpserver/initiate-oauth-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAKxG,OAAO,EAAE,gCAAgC,EAAE,MAAM,uDAAuD,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,oDAAoD,CAAC;AAI5D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA0B,EAC1B,KAAgC,EAChC,QAAwB;IAExB,IAAI,IAAI,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,uBAAuB,CAC3B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CACtC,eAAe,CAAC,UAAU,EAC1B,WAAW,EACX,eAAe,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,+DAA+D;IAC/D,qEAAqE;IACrE,4BAA4B;IAC5B,MAAM,eAAe,CACnB,0BAA0B,CAAC,MAAM,CAAC,oBAAoB,EACtD,IAAI,CAAC,UAAU,EACf,QAAQ,EACR,KAAK,CACN,CAAC;IAEF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,uBAAuB,CAC3B,eAAe,WAAW,0CAA0C,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC1D,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;IAExD,MAAM,YAAY,GAAsB;QACtC,KAAK,EAAE,UAAU;QACjB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW;QACX,8CAA8C;QAC9C,iBAAiB,EAAE,EAAE;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU;QACV,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,WAAW,EAAE,IAAI,CAAC,gBAAgB;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,CAAC;KACb,CAAC;IAEF,sEAAsE;IACtE,qBAAqB;IACrB,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAClC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,EACX,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;QAC/C,aAAa,EAAE,WAAW;QAC1B,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;AACL,CAAC;AAaD,KAAK,UAAU,WAAW,CACxB,IAA0B,EAC1B,SAAoB,EACpB,QAAkB,EAClB,UAAkB;IAElB,sEAAsE;IACtE,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IACzD,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;QAC9C,IAAI,UAAU,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,uBAAuB,CAC3B,gDAAgD,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,+CAA+C;YACzH,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uBAAuB,CAC3B,mDAAmD,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,oBAAoB,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,uBAAuB,CAC3B,iBAAiB,SAAS,qDAAqD,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,GAAG,CAAC;IACjE,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,cAAc,CAChC,QAAQ,CAAC,oBAAoB,EAC7B,IAAI,CAAC,gBAAgB,EACrB,UAAU,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uBAAuB,CAC3B,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CACnC,QAAQ,CAAC,qBAAqB,EAC9B,WAAW,CAAC,QAAQ,EACpB,IAAI,CAAC,gBAAgB,EACrB,QAAQ,CAAC,aAAa,EACtB,UAAU,EACV,MAAM,EACN,OAAO,CACR,CAAC;IAEF,+DAA+D;IAC/D,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,SAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE;YACvE,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC3C,KAAK,EACH,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gEAAgE,EAChE;YACE,WAAW,EAAE,SAAS,CAAC,UAAU;YACjC,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC3C,YAAY,EAAE,SAAS,CAAC,WAAW;SACpC,CACF,CAAC;QACF,MAAM,uBAAuB,CAC3B,mBAAmB,CACjB,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,EAC9B,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,OAAO;QACzB,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC5C,MAAM;QACN,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,eAAe,EAAE,EAAE;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAA0B,EAC1B,SAAoB,EACpB,QAAkB,EAClB,UAAkB;IAElB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;IAE9C,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAC3D,IACE,cAAc,KAAK,oBAAoB,CAAC,OAAO;QAC/C,cAAc,KAAK,oBAAoB,CAAC,QAAQ,EAChD,CAAC;QACD,MAAM,WAAW,GACf,cAAc,KAAK,oBAAoB,CAAC,QAAQ;YAC9C,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,kBAAkB,CAAC;QACzB,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS;YACjD,CAAC,CAAC,gGAAgG;YAClG,CAAC,CAAC,wCAAwC,CAAC;QAC7C,MAAM,uBAAuB,CAC3B,+DAA+D,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,QAAQ,WAAW,mBAAmB,WAAW,EAAE,CAChJ,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,KAAK,EAAE,0CAA0C,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,qBAAqB,CACnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,EACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,EAC7B,IAAI,CAAC,gBAAgB,EACrB,QAAQ,CAAC,aAAa,EACtB,UAAU,EACV,MAAM,EACN,QAAQ,CAAC,IAAI,EAAE,kBAAkB,IAAI,EAAE,CACxC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE,OAAO;QACzB,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE;QAC3C,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE;QACvC,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE;QAC5C,eAAe,EAAE,uBAAuB,CACtC,QAAQ,CAAC,IAAI,EAAE,uBAAuB;YACpC,uBAAuB,CAAC,WAAW,CACtC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAgB,EAChB,WAAmB,EACnB,aAAqB,EACrB,KAAa,EACb,MAAgB,EAChB,cAAsB;IAEtB,MAAM,UAAU,GAAG,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IAEpE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,CAAC;IAEd,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,OAAO,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,WAAmB,EACnB,SAA6B;IAE7B,IAAI,YAAY,GAAG,WAAW,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACvB,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,IAAI,OAAO,GACT,GAAG,YAAY,mEAAmE,SAAS,CAAC,UAAU,KAAK;QAC3G,8FAA8F,YAAY,IAAI;QAC9G,qHAAqH,CAAC;IACxH,IAAI,SAAS,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAClC,OAAO,IAAI,oBAAoB,GAAG,SAAS,CAAC,YAAY,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kEAAkE;AAClE,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA4B,EAC5B,MAAc,EACd,KAAwB;IAExB,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,8EAA8E,CAC/E,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,iBAAiB;IACjB,MAAM,KAAK,GAAG,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzD,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACtC,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAChF,CAAC"}

package/dist/domain/mcpserver/oauth/dcr.d.ts

@@ -0,0 +1,17 @@
+/** Dynamic Client Registration response per RFC 7591 (Go DCRResponse). */
+export interface DcrResponse {
+    clientId: string;
+    clientSecret: string;
+    clientName: string;
+    tokenEndpointAuthMethod: string;
+}
+/** Go's dcrHTTPClient 15s timeout — a named constant per guidelines. */
+export declare const DCR_REQUEST_TIMEOUT_MS = 15000;
+/**
+ * Performs OAuth Dynamic Client Registration at the given registration
+ * endpoint (Go RegisterClient). The returned client_id is stored in the
+ * user's OAuthGrant for subsequent token operations. Accepts 200 or 201
+ * (RFC says 201; real providers answer both).
+ */
+export declare function registerClient(registrationEndpoint: string, redirectUri: string, clientName: string, fetchImpl?: typeof fetch): Promise<DcrResponse>;
+//# sourceMappingURL=dcr.d.ts.map

package/dist/domain/mcpserver/oauth/dcr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dcr.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/dcr.ts"],"names":[],"mappings":"AAUA,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,WAAW,CAAC,CA2DtB"}

package/dist/domain/mcpserver/oauth/dcr.js

@@ -0,0 +1,62 @@
+/**
+ * RFC 7591 Dynamic Client Registration — ports
+ * pkg/domain/mcpserver/oauth/dcr.go. Registers a PUBLIC client
+ * (token_endpoint_auth_method "none"): MCP OAuth uses PKCE instead of a
+ * client secret, and an empty secret is what keeps the pending state's
+ * "never ciphertext-of-empty" rule meaningful (oss#394).
+ * Proven by mcpserver-oauth.conformance.test.ts (CONFORMANCE_TARGET=local).
+ */
+import { truncateBody } from "./truncate-body.js";
+/** Go's dcrHTTPClient 15s timeout — a named constant per guidelines. */
+export const DCR_REQUEST_TIMEOUT_MS = 15_000;
+/**
+ * Performs OAuth Dynamic Client Registration at the given registration
+ * endpoint (Go RegisterClient). The returned client_id is stored in the
+ * user's OAuthGrant for subsequent token operations. Accepts 200 or 201
+ * (RFC says 201; real providers answer both).
+ */
+export async function registerClient(registrationEndpoint, redirectUri, clientName, fetchImpl = fetch) {
+    const requestBody = JSON.stringify({
+        redirect_uris: [redirectUri],
+        client_name: clientName,
+        grant_types: ["authorization_code"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none",
+    });
+    let response;
+    try {
+        response = await fetchImpl(registrationEndpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: requestBody,
+            signal: AbortSignal.timeout(DCR_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new Error(`DCR request to ${registrationEndpoint} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const body = await response.text();
+    if (response.status !== 201 && response.status !== 200) {
+        throw new Error(`DCR at ${registrationEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(body);
+    }
+    catch (error) {
+        throw new Error(`failed to parse DCR response: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if ((raw.client_id ?? "") === "") {
+        throw new Error(`DCR response from ${registrationEndpoint} is missing client_id`);
+    }
+    return {
+        clientId: raw.client_id,
+        clientSecret: raw.client_secret ?? "",
+        clientName: raw.client_name ?? "",
+        tokenEndpointAuthMethod: raw.token_endpoint_auth_method ?? "",
+    };
+}
+//# sourceMappingURL=dcr.js.map

package/dist/domain/mcpserver/oauth/dcr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dcr.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/dcr.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAUlD,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,WAAmB,EACnB,UAAkB,EAClB,YAA0B,KAAK;IAE/B,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,CAAC,oBAAoB,CAAC;QACnC,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;IAEH,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,kBAAkB,oBAAoB,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,UAAU,oBAAoB,kBAAkB,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,GAKH,CAAC;IACF,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,qBAAqB,oBAAoB,uBAAuB,CACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAmB;QACjC,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;QACrC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QACjC,uBAAuB,EAAE,GAAG,CAAC,0BAA0B,IAAI,EAAE;KAC9D,CAAC;AACJ,CAAC"}

package/dist/domain/mcpserver/oauth/discovery.d.ts

@@ -0,0 +1,37 @@
+/**
+ * RFC 8414 authorization-server discovery — ports
+ * pkg/domain/mcpserver/oauth/discovery.go. The well-known URI lives at the
+ * URL ORIGIN (scheme + host), not under the server's path — a Linear-style
+ * MCP URL like https://mcp.linear.app/mcp discovers at
+ * https://mcp.linear.app/.well-known/oauth-authorization-server.
+ * Proven by mcpserver-oauth.conformance.test.ts (CONFORMANCE_TARGET=local).
+ */
+/**
+ * OAuth 2.0 Authorization Server Metadata discovered via RFC 8414
+ * (Go AuthServerMetadata). Field names keep the RFC's snake_case on the
+ * wire; this interface is the parsed camelCase view.
+ */
+export interface AuthServerMetadata {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint: string;
+    scopesSupported: string[];
+    codeChallengeMethodsSupported: string[];
+}
+/** Go's discoveryHTTPClient 10s timeout — a named constant per guidelines. */
+export declare const DISCOVERY_REQUEST_TIMEOUT_MS = 10000;
+/**
+ * Fetches the OAuth Authorization Server Metadata from the MCP server's
+ * .well-known endpoint per RFC 8414 (Go DiscoverAuthorizationServer).
+ * Throws with Go's message text on non-200, unparseable metadata, missing
+ * endpoints, or an S256-less server — initiate embeds these messages in
+ * its FailedPrecondition copy, so the text is contract.
+ */
+export declare function discoverAuthorizationServer(serverUrl: string, fetchImpl?: typeof fetch): Promise<AuthServerMetadata>;
+/**
+ * Constructs the .well-known URL from the MCP server URL (Go
+ * buildWellKnownURL). Per RFC 8414, the well-known URI is at the origin.
+ */
+export declare function buildWellKnownUrl(serverUrl: string): string;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/domain/mcpserver/oauth/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,6BAA6B,EAAE,MAAM,EAAE,CAAC;CACzC;AAED,8EAA8E;AAC9E,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAqD7B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAsB3D"}

package/dist/domain/mcpserver/oauth/discovery.js

@@ -0,0 +1,93 @@
+/**
+ * RFC 8414 authorization-server discovery — ports
+ * pkg/domain/mcpserver/oauth/discovery.go. The well-known URI lives at the
+ * URL ORIGIN (scheme + host), not under the server's path — a Linear-style
+ * MCP URL like https://mcp.linear.app/mcp discovers at
+ * https://mcp.linear.app/.well-known/oauth-authorization-server.
+ * Proven by mcpserver-oauth.conformance.test.ts (CONFORMANCE_TARGET=local).
+ */
+/** Go's discoveryHTTPClient 10s timeout — a named constant per guidelines. */
+export const DISCOVERY_REQUEST_TIMEOUT_MS = 10_000;
+/**
+ * Fetches the OAuth Authorization Server Metadata from the MCP server's
+ * .well-known endpoint per RFC 8414 (Go DiscoverAuthorizationServer).
+ * Throws with Go's message text on non-200, unparseable metadata, missing
+ * endpoints, or an S256-less server — initiate embeds these messages in
+ * its FailedPrecondition copy, so the text is contract.
+ */
+export async function discoverAuthorizationServer(serverUrl, fetchImpl = fetch) {
+    const wellKnownUrl = buildWellKnownUrl(serverUrl);
+    let response;
+    try {
+        response = await fetchImpl(wellKnownUrl, {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            signal: AbortSignal.timeout(DISCOVERY_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new Error(`discovery request to ${wellKnownUrl} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (response.status !== 200) {
+        // Drain the body so the connection can be reused; the status alone
+        // classifies the failure.
+        await response.text();
+        throw new Error(`authorization server discovery failed: ${wellKnownUrl} returned HTTP ${response.status} (expected 200). ` +
+            "This MCP server may not support the MCP Authorization specification");
+    }
+    let raw;
+    try {
+        raw = (await response.json());
+    }
+    catch (error) {
+        throw new Error(`failed to parse authorization server metadata: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const metadata = {
+        issuer: raw.issuer ?? "",
+        authorizationEndpoint: raw.authorization_endpoint ?? "",
+        tokenEndpoint: raw.token_endpoint ?? "",
+        registrationEndpoint: raw.registration_endpoint ?? "",
+        scopesSupported: raw.scopes_supported ?? [],
+        codeChallengeMethodsSupported: raw.code_challenge_methods_supported ?? [],
+    };
+    validateMetadata(metadata, wellKnownUrl);
+    return metadata;
+}
+/**
+ * Constructs the .well-known URL from the MCP server URL (Go
+ * buildWellKnownURL). Per RFC 8414, the well-known URI is at the origin.
+ */
+export function buildWellKnownUrl(serverUrl) {
+    let parsed;
+    try {
+        parsed = new URL(serverUrl);
+    }
+    catch (error) {
+        throw new Error(`invalid server URL for discovery: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const scheme = parsed.protocol.replace(/:$/, "");
+    if (scheme !== "http" && scheme !== "https") {
+        throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);
+    }
+    if (parsed.host === "") {
+        throw new Error("invalid server URL for discovery: server URL has no host");
+    }
+    const origin = `${scheme}://${parsed.host}`;
+    return `${origin.replace(/\/+$/, "")}/.well-known/oauth-authorization-server`;
+}
+function validateMetadata(m, sourceUrl) {
+    if (m.authorizationEndpoint === "") {
+        throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);
+    }
+    if (m.tokenEndpoint === "") {
+        throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);
+    }
+    if (m.codeChallengeMethodsSupported.length > 0 &&
+        !m.codeChallengeMethodsSupported.includes("S256")) {
+        // Go renders the supported list with %v — space-separated in
+        // brackets; matched exactly because initiate forwards this text.
+        throw new Error(`authorization server at ${sourceUrl} does not support S256 PKCE (supports: [${m.codeChallengeMethodsSupported.join(" ")}]). ` +
+            "S256 is required by the MCP Authorization specification");
+    }
+}
+//# sourceMappingURL=discovery.js.map

package/dist/domain/mcpserver/oauth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAiB,EACjB,YAA0B,KAAK;IAE/B,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAElD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE;YACvC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,wBAAwB,YAAY,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,mEAAmE;QACnE,0BAA0B;QAC1B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,0CAA0C,YAAY,kBAAkB,QAAQ,CAAC,MAAM,mBAAmB;YACxG,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,GAOH,CAAC;IACF,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAe,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,kDAAkD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAuB;QACnC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,qBAAqB,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE;QACvD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,EAAE;QACvC,oBAAoB,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACrD,eAAe,EAAE,GAAG,CAAC,gBAAgB,IAAI,EAAE;QAC3C,6BAA6B,EAAE,GAAG,CAAC,gCAAgC,IAAI,EAAE;KAC1E,CAAC;IAEF,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,yDAAyD,MAAM,sCAAsC,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,MAAM,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,yCAAyC,CAAC;AAChF,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAqB,EAAE,SAAiB;IAChE,IAAI,CAAC,CAAC,qBAAqB,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,2BAA2B,SAAS,oCAAoC,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2BAA2B,SAAS,4BAA4B,CACjE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,6BAA6B,CAAC,MAAM,GAAG,CAAC;QAC1C,CAAC,CAAC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EACjD,CAAC;QACD,6DAA6D;QAC7D,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,2BAA2B,SAAS,2CAA2C,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;YAC5H,yDAAyD,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/domain/mcpserver/oauth/managed-env.d.ts

@@ -0,0 +1,69 @@
+import type { EnvironmentValue } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import { EnvironmentSecretValueInputSchema, UpdateEnvironmentVariablesRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/io_pb";
+import type { Environment } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { ApiResourceDeleteInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { MessageInitShape } from "@bufbuild/protobuf";
+import type { Logger } from "../../../boot/logger.js";
+import type { CallerIdentity } from "../../../extensions/identity.js";
+/** The label marking system-managed OAuth-token environments. */
+export declare const MANAGED_ENV_LABEL = "stigmer.ai/managed";
+/**
+ * The narrow in-process environment surface this service consumes —
+ * satisfied by the composition root's in-process clients (DD-002: full
+ * interceptor traversal on every internal call).
+ */
+export interface ManagedEnvironmentClient {
+    getSecretValue(input: MessageInitShape<typeof EnvironmentSecretValueInputSchema>): Promise<EnvironmentValue>;
+    updateVariables(request: MessageInitShape<typeof UpdateEnvironmentVariablesRequestSchema>): Promise<Environment>;
+    /**
+     * `caller` propagates the ORIGINAL caller through the in-process hop
+     * (ruling R5; Java createAsCaller — parity entry 20260830.05): the
+     * created environment's owner attribution lands on the connecting
+     * user, so it stays visible and manageable under an enforcing
+     * Authorizer. Absent = the minted internal class (the pre-R5 shape,
+     * kept for hops with no request caller).
+     */
+    create(environment: MessageInitShape<typeof EnvironmentSchema>, caller?: CallerIdentity): Promise<Environment>;
+    delete(input: MessageInitShape<typeof ApiResourceDeleteInputSchema>): Promise<Environment>;
+}
+export declare class ManagedEnvironmentService {
+    private readonly client;
+    private readonly logger;
+    constructor(client: ManagedEnvironmentClient, logger: Logger);
+    /**
+     * Creates a new system-managed environment with the
+     * stigmer.ai/managed=true label and returns its resource id (Go
+     * CreateManagedEnvironment). The environment goes through the standard
+     * create pipeline, which handles id generation, slug resolution,
+     * timestamps, and search indexing. `caller` propagates the connecting
+     * user through the hop (ruling R5, parity entry 20260830.05) so a
+     * composed tuple-lifecycle driver attributes ownership to them — the
+     * Java createAsCaller posture ("org link + owner = caller"); the
+     * reserved-label guard keys its trust arm on the in-process ORIGIN,
+     * so the managed label still passes with a propagated caller.
+     */
+    createManagedEnvironment(name: string, org: string, caller?: CallerIdentity): Promise<string>;
+    /**
+     * Deletes a managed environment and all its secrets (Go
+     * DeleteManagedEnvironment). Non-fatal callers should catch errors —
+     * the environment may already be deleted (concurrent disconnects or
+     * partial-failure retries).
+     */
+    deleteManagedEnvironment(environmentId: string): Promise<void>;
+    /**
+     * Retrieves a single decrypted secret value from a managed environment
+     * (Go ReadSecretValue).
+     */
+    readSecretValue(environmentId: string, key: string): Promise<string>;
+    /**
+     * Writes secret variables into a managed environment (Go
+     * UpdateSecrets). Values must be plaintext (never enc:vN:-prefixed —
+     * the environment pipeline rejects ciphertext-shaped input, oss#395);
+     * the pipeline encrypts is_secret values at rest (oss#405).
+     */
+    updateSecrets(environmentId: string, variables: {
+        [key: string]: EnvironmentValue;
+    }): Promise<void>;
+}
+//# sourceMappingURL=managed-env.d.ts.map