@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/mcpserver/oauth/managed-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-env.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/managed-env.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAElG,OAAO,EACL,iCAAiC,EACjC,uCAAuC,EACxC,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,cAAc,CACZ,KAAK,EAAE,gBAAgB,CAAC,OAAO,iCAAiC,CAAC,GAChE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,eAAe,CACb,OAAO,EAAE,gBAAgB,CAAC,OAAO,uCAAuC,CAAC,GACxE,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;;;OAOG;IACH,MAAM,CACJ,WAAW,EAAE,gBAAgB,CAAC,OAAO,iBAAiB,CAAC,EACvD,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,MAAM,CACJ,KAAK,EAAE,gBAAgB,CAAC,OAAO,4BAA4B,CAAC,GAC3D,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB;AAED,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,wBAAwB,EAChC,MAAM,EAAE,MAAM;IAGjC;;;;;;;;;;;OAWG;IACG,wBAAwB,CAC5B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,CAAC;IA8BlB;;;;;OAKG;IACG,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAepE;;;OAGG;IACG,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1E;;;;;OAKG;IACG,aAAa,CACjB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAAA;KAAE,GAC7C,OAAO,CAAC,IAAI,CAAC;CAcjB"}

package/dist/domain/mcpserver/oauth/managed-env.js

@@ -0,0 +1,111 @@
+/**
+ * Managed-environment access — ports pkg/domain/mcpserver/oauth/
+ * managed_env.go whole: reading and rewriting OAuth token secrets (#17's
+ * EC-builder slice) plus creating and deleting the managed environments
+ * themselves (#19's connect/OAuth slice). Every operation rides the
+ * environment domain's in-process client, so encryption, validation, and
+ * audit come from the environment pipeline automatically (DD-002: full
+ * interceptor traversal on every internal call).
+ */
+import { create } from "@bufbuild/protobuf";
+import { EnvironmentSecretValueInputSchema, UpdateEnvironmentVariablesRequestSchema, } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/io_pb";
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { ApiResourceDeleteInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+/** The label marking system-managed OAuth-token environments. */
+export const MANAGED_ENV_LABEL = "stigmer.ai/managed";
+export class ManagedEnvironmentService {
+    client;
+    logger;
+    constructor(client, logger) {
+        this.client = client;
+        this.logger = logger;
+    }
+    /**
+     * Creates a new system-managed environment with the
+     * stigmer.ai/managed=true label and returns its resource id (Go
+     * CreateManagedEnvironment). The environment goes through the standard
+     * create pipeline, which handles id generation, slug resolution,
+     * timestamps, and search indexing. `caller` propagates the connecting
+     * user through the hop (ruling R5, parity entry 20260830.05) so a
+     * composed tuple-lifecycle driver attributes ownership to them — the
+     * Java createAsCaller posture ("org link + owner = caller"); the
+     * reserved-label guard keys its trust arm on the in-process ORIGIN,
+     * so the managed label still passes with a propagated caller.
+     */
+    async createManagedEnvironment(name, org, caller) {
+        let created;
+        try {
+            created = await this.client.create(create(EnvironmentSchema, {
+                apiVersion: "agentic.stigmer.ai/v1",
+                kind: "Environment",
+                metadata: {
+                    name,
+                    org,
+                    labels: { [MANAGED_ENV_LABEL]: "true" },
+                },
+            }), caller);
+        }
+        catch (error) {
+            throw new Error(`failed to create managed environment: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const envId = created.metadata?.id ?? "";
+        this.logger.info("Created managed environment for OAuth token storage", {
+            environment_id: envId,
+            name,
+            org,
+        });
+        return envId;
+    }
+    /**
+     * Deletes a managed environment and all its secrets (Go
+     * DeleteManagedEnvironment). Non-fatal callers should catch errors —
+     * the environment may already be deleted (concurrent disconnects or
+     * partial-failure retries).
+     */
+    async deleteManagedEnvironment(environmentId) {
+        try {
+            await this.client.delete(create(ApiResourceDeleteInputSchema, { resourceId: environmentId }));
+        }
+        catch (error) {
+            throw new Error(`failed to delete managed environment ${environmentId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        this.logger.info("Deleted managed environment", {
+            environment_id: environmentId,
+        });
+    }
+    /**
+     * Retrieves a single decrypted secret value from a managed environment
+     * (Go ReadSecretValue).
+     */
+    async readSecretValue(environmentId, key) {
+        let value;
+        try {
+            value = await this.client.getSecretValue(create(EnvironmentSecretValueInputSchema, {
+                environmentId,
+                key,
+            }));
+        }
+        catch (error) {
+            throw new Error(`failed to read secret ${JSON.stringify(key)} from managed environment ${environmentId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return value.value;
+    }
+    /**
+     * Writes secret variables into a managed environment (Go
+     * UpdateSecrets). Values must be plaintext (never enc:vN:-prefixed —
+     * the environment pipeline rejects ciphertext-shaped input, oss#395);
+     * the pipeline encrypts is_secret values at rest (oss#405).
+     */
+    async updateSecrets(environmentId, variables) {
+        try {
+            await this.client.updateVariables(create(UpdateEnvironmentVariablesRequestSchema, {
+                environmentId,
+                variables,
+            }));
+        }
+        catch (error) {
+            throw new Error(`failed to update secrets in managed environment ${environmentId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+//# sourceMappingURL=managed-env.js.map

package/dist/domain/mcpserver/oauth/managed-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-env.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/managed-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EACL,iCAAiC,EACjC,uCAAuC,GACxC,MAAM,yDAAyD,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AAMpG,iEAAiE;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AA+BtD,MAAM,OAAO,yBAAyB;IAEjB;IACA;IAFnB,YACmB,MAAgC,EAChC,MAAc;QADd,WAAM,GAAN,MAAM,CAA0B;QAChC,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,wBAAwB,CAC5B,IAAY,EACZ,GAAW,EACX,MAAuB;QAEvB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAChC,MAAM,CAAC,iBAAiB,EAAE;gBACxB,UAAU,EAAE,uBAAuB;gBACnC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE;oBACR,IAAI;oBACJ,GAAG;oBACH,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE;iBACxC;aACF,CAAC,EACF,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;YACtE,cAAc,EAAE,KAAK;YACrB,IAAI;YACJ,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAAC,aAAqB;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CACtB,MAAM,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,wCAAwC,aAAa,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC9C,cAAc,EAAE,aAAa;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB,EAAE,GAAW;QACtD,IAAI,KAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CACtC,MAAM,CAAC,iCAAiC,EAAE;gBACxC,aAAa;gBACb,GAAG;aACJ,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,6BAA6B,aAAa,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpJ,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,aAAqB,EACrB,SAA8C;QAE9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC/B,MAAM,CAAC,uCAAuC,EAAE;gBAC9C,aAAa;gBACb,SAAS;aACV,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,mDAAmD,aAAa,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9H,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/domain/mcpserver/oauth/pkce.d.ts

@@ -0,0 +1,14 @@
+/** A PKCE code verifier and its corresponding S256 challenge. */
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/**
+ * Creates a cryptographically random PKCE pair using the S256 method.
+ *
+ * The code verifier is a 32-byte random value encoded as base64url (no
+ * padding). The code challenge is the SHA-256 hash of the verifier, also
+ * base64url-encoded.
+ */
+export declare function generatePkce(): PkcePair;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/domain/mcpserver/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/pkce.ts"],"names":[],"mappings":"AAOA,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,QAAQ,CAOvC"}

package/dist/domain/mcpserver/oauth/pkce.js

@@ -0,0 +1,22 @@
+/**
+ * PKCE pair generation — ports pkg/domain/mcpserver/oauth/pkce.go.
+ * Always S256: RFC 7636 and OAuth 2.1 require it, and initiate refuses
+ * authorization servers that do not support it (discovery.ts).
+ */
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * Creates a cryptographically random PKCE pair using the S256 method.
+ *
+ * The code verifier is a 32-byte random value encoded as base64url (no
+ * padding). The code challenge is the SHA-256 hash of the verifier, also
+ * base64url-encoded.
+ */
+export function generatePkce() {
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256")
+        .update(verifier)
+        .digest()
+        .toString("base64url");
+    return { codeVerifier: verifier, codeChallenge: challenge };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/domain/mcpserver/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQtD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;SACnC,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,EAAE;SACR,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC"}

package/dist/domain/mcpserver/oauth/preflight.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A definite refusal from an authorization endpoint, observed before any
+ * browser was involved (Go AuthorizeRejection).
+ */
+export interface AuthorizeRejection {
+    /** The HTTP status the authorization endpoint returned. */
+    statusCode: number;
+    /**
+     * The provider's own explanation, extracted from an RFC 6749-shaped
+     * JSON error body (error_description, falling back to error). Empty
+     * when the body is HTML or otherwise unparseable.
+     */
+    vendorDetail: string;
+    /** A truncated copy of the raw response body, for logs. */
+    bodySnippet: string;
+}
+/**
+ * Go's preflightHTTPClient 4s timeout: this probe sits on the user-facing
+ * initiate path, after discovery and DCR round trips.
+ */
+export declare const PREFLIGHT_REQUEST_TIMEOUT_MS = 4000;
+/**
+ * Probes an authorization URL server-side and reports whether the
+ * provider will refuse it before ever showing a login page (Go
+ * PreflightAuthorize). Redirects are deliberately not followed: a healthy
+ * authorization endpoint answers a fresh GET with either a login/consent
+ * page (2xx) or a redirect into the vendor's login flow (3xx), and the
+ * first response alone is enough to classify.
+ */
+export declare function preflightAuthorize(authorizationUrl: string, fetchImpl?: typeof fetch): Promise<AuthorizeRejection | undefined>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/domain/mcpserver/oauth/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/preflight.ts"],"names":[],"mappings":"AA2BA;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,OAAQ,CAAC;AAOlD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,gBAAgB,EAAE,MAAM,EACxB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAsBzC"}

package/dist/domain/mcpserver/oauth/preflight.js

@@ -0,0 +1,82 @@
+/**
+ * Authorization-endpoint pre-flight probe — ports
+ * pkg/domain/mcpserver/oauth/preflight.go.
+ *
+ * Some providers (e.g. Canva) accept Dynamic Client Registration for any
+ * redirect URI but enforce a redirect-host allowlist at the authorization
+ * endpoint. The rejection then surfaces only inside the OAuth popup, on a
+ * vendor error page that never redirects back — so the connect flow never
+ * learns it failed (stigmer/stigmer#235). This probe moves that discovery
+ * to initiate time, where it can fail fast with an honest error.
+ *
+ * Classification is deliberately narrow — blocked means HTTP 400, nothing
+ * else. RFC 6749 §4.1.2.1 requires an invalid-redirect rejection to be
+ * shown at the authorization server without redirecting, which providers
+ * implement as a 400. Everything else fails open (undefined, possibly
+ * after a diagnostic error): bot-protection layers answer server-side
+ * GETs with 403/503 while real browsers pass, and treating those as
+ * blocked would turn healthy providers into false dead ends. A fail-open
+ * miss merely preserves today's behavior; a false positive would break a
+ * working connect flow.
+ *
+ * The probe is side-effect-free: state and PKCE parameters are opaque to
+ * the authorization server at this point, and nothing is consumed until
+ * the callback leg, which the probe never reaches.
+ */
+import { truncateBody } from "./truncate-body.js";
+/**
+ * Go's preflightHTTPClient 4s timeout: this probe sits on the user-facing
+ * initiate path, after discovery and DCR round trips.
+ */
+export const PREFLIGHT_REQUEST_TIMEOUT_MS = 4_000;
+/**
+ * Error pages are small; anything longer is noise (Go's LimitReader cap).
+ */
+const PREFLIGHT_BODY_READ_CAP = 4096;
+/**
+ * Probes an authorization URL server-side and reports whether the
+ * provider will refuse it before ever showing a login page (Go
+ * PreflightAuthorize). Redirects are deliberately not followed: a healthy
+ * authorization endpoint answers a fresh GET with either a login/consent
+ * page (2xx) or a redirect into the vendor's login flow (3xx), and the
+ * first response alone is enough to classify.
+ */
+export async function preflightAuthorize(authorizationUrl, fetchImpl = fetch) {
+    // Network errors propagate to the caller, who treats them as
+    // fail-open diagnostics — exactly Go's (nil, err) contract.
+    const response = await fetchImpl(authorizationUrl, {
+        method: "GET",
+        redirect: "manual",
+        signal: AbortSignal.timeout(PREFLIGHT_REQUEST_TIMEOUT_MS),
+    });
+    if (response.status !== 400) {
+        // Drain so the socket is reusable; the status alone classifies.
+        await response.text().catch(() => "");
+        return undefined;
+    }
+    const body = (await response.text()).slice(0, PREFLIGHT_BODY_READ_CAP);
+    return {
+        statusCode: response.status,
+        vendorDetail: extractVendorDetail(body),
+        bodySnippet: truncateBody(body),
+    };
+}
+/**
+ * Pulls the provider's own words from an RFC 6749-shaped JSON error body
+ * (Go extractVendorDetail). HTML error pages (Canva's case) yield "" —
+ * scraping prose out of markup is not worth the fragility.
+ */
+function extractVendorDetail(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return "";
+    }
+    if ((parsed.error_description ?? "") !== "") {
+        return parsed.error_description;
+    }
+    return parsed.error ?? "";
+}
+//# sourceMappingURL=preflight.js.map

package/dist/domain/mcpserver/oauth/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAmBlD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAElD;;GAEG;AACH,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,gBAAwB,EACxB,YAA0B,KAAK;IAE/B,6DAA6D;IAC7D,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;QACjD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC;KAC1D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,gEAAgE;QAChE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAEvE,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;QACvC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,MAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,iBAA2B,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/domain/mcpserver/oauth/refresh.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Pre-flight token refresh — ports pkg/domain/mcpserver/oauth/refresh.go.
+ * Consumed by the agentexecution EC builder's OAuth injection (#17); the
+ * connect-lane refresh callers arrive with #19.
+ */
+import type { OAuthGrant } from "../../../store/interface.js";
+import type { Logger } from "../../../boot/logger.js";
+/** The outcome of a refresh attempt (Go RefreshResult). */
+export interface RefreshResult {
+    refreshed: boolean;
+    newAccessToken: string;
+    newRefreshToken: string;
+    /** Unix seconds; 0 = does not expire. */
+    newExpiresAt: number;
+}
+/**
+ * Refresh slightly before expiry — Go's 60-second buffer, named per the
+ * guidelines' semantic-constant rule.
+ */
+export declare const REFRESH_EXPIRY_BUFFER_SECONDS = 60;
+/**
+ * Checks whether the grant's access token is expired and, if so, uses the
+ * refresh token to obtain a new one. The caller updates the managed
+ * environment and the grant record with the returned values.
+ *
+ * clientSecret is empty for DCR/public clients; tokenAuthMethod selects
+ * how a non-empty secret is presented (empty falls back to Basic).
+ * Returns refreshed=false when the token has no expiry (long-lived
+ * Notion/Slack-style tokens) or is not yet within the buffer; throws when
+ * the refresh is needed but impossible or fails (the caller surfaces a
+ * re-auth error).
+ */
+export declare function refreshTokenIfExpired(grant: OAuthGrant, currentRefreshToken: string, clientSecret: string, tokenAuthMethod: string, logger: Logger, fetchImpl?: typeof fetch): Promise<RefreshResult>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/domain/mcpserver/oauth/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/refresh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,EAC3B,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,CAAC,CAiExB"}

package/dist/domain/mcpserver/oauth/refresh.js

@@ -0,0 +1,74 @@
+import { refreshToken } from "./token.js";
+/**
+ * Refresh slightly before expiry — Go's 60-second buffer, named per the
+ * guidelines' semantic-constant rule.
+ */
+export const REFRESH_EXPIRY_BUFFER_SECONDS = 60;
+/**
+ * Checks whether the grant's access token is expired and, if so, uses the
+ * refresh token to obtain a new one. The caller updates the managed
+ * environment and the grant record with the returned values.
+ *
+ * clientSecret is empty for DCR/public clients; tokenAuthMethod selects
+ * how a non-empty secret is presented (empty falls back to Basic).
+ * Returns refreshed=false when the token has no expiry (long-lived
+ * Notion/Slack-style tokens) or is not yet within the buffer; throws when
+ * the refresh is needed but impossible or fails (the caller surfaces a
+ * re-auth error).
+ */
+export async function refreshTokenIfExpired(grant, currentRefreshToken, clientSecret, tokenAuthMethod, logger, fetchImpl = fetch) {
+    if (grant.accessTokenExpiresAt === 0) {
+        // Token does not expire.
+        return notRefreshed();
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (now < grant.accessTokenExpiresAt - REFRESH_EXPIRY_BUFFER_SECONDS) {
+        return notRefreshed();
+    }
+    if (currentRefreshToken === "") {
+        throw new Error(`access token for resource '${grant.resourceId}' has expired and no refresh token is available. ` +
+            "Please re-authenticate via OAuth Connect");
+    }
+    logger.info("Access token expired, refreshing via refresh_token grant", {
+        resourceId: grant.resourceId,
+        resourceKind: grant.resourceKind,
+        expiredAt: grant.accessTokenExpiresAt,
+        tokenEndpoint: grant.tokenEndpoint,
+    });
+    let tokenResponse;
+    try {
+        tokenResponse = await refreshToken(grant.tokenEndpoint, currentRefreshToken, grant.clientId, clientSecret, tokenAuthMethod, fetchImpl);
+    }
+    catch (error) {
+        throw new Error(`token refresh failed for resource '${grant.resourceId}': ${error instanceof Error ? error.message : String(error)}. ` +
+            "Please re-authenticate via OAuth Connect");
+    }
+    let newExpiresAt = 0;
+    if (tokenResponse.expiresIn > 0) {
+        newExpiresAt = Math.floor(Date.now() / 1000) + tokenResponse.expiresIn;
+    }
+    const newRefreshToken = tokenResponse.refreshToken !== ""
+        ? tokenResponse.refreshToken
+        : currentRefreshToken;
+    logger.info("Token refresh successful", {
+        resourceId: grant.resourceId,
+        resourceKind: grant.resourceKind,
+        newExpiresAt,
+        refreshTokenRotated: tokenResponse.refreshToken !== "",
+    });
+    return {
+        refreshed: true,
+        newAccessToken: tokenResponse.accessToken,
+        newRefreshToken,
+        newExpiresAt,
+    };
+}
+function notRefreshed() {
+    return {
+        refreshed: false,
+        newAccessToken: "",
+        newRefreshToken: "",
+        newExpiresAt: 0,
+    };
+}
+//# sourceMappingURL=refresh.js.map

package/dist/domain/mcpserver/oauth/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/refresh.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAW1C;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiB,EACjB,mBAA2B,EAC3B,YAAoB,EACpB,eAAuB,EACvB,MAAc,EACd,YAA0B,KAAK;IAE/B,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,EAAE,CAAC;QACrC,yBAAyB;QACzB,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,KAAK,CAAC,oBAAoB,GAAG,6BAA6B,EAAE,CAAC;QACrE,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,mBAAmB,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,CAAC,UAAU,mDAAmD;YAC/F,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE;QACtE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,oBAAoB;QACrC,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC;IAClB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,YAAY,CAChC,KAAK,CAAC,aAAa,EACnB,mBAAmB,EACnB,KAAK,CAAC,QAAQ,EACd,YAAY,EACZ,eAAe,EACf,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,CAAC,UAAU,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YACpH,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAChC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC;IACzE,CAAC;IAED,MAAM,eAAe,GACnB,aAAa,CAAC,YAAY,KAAK,EAAE;QAC/B,CAAC,CAAC,aAAa,CAAC,YAAY;QAC5B,CAAC,CAAC,mBAAmB,CAAC;IAE1B,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY;QACZ,mBAAmB,EAAE,aAAa,CAAC,YAAY,KAAK,EAAE;KACvD,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,aAAa,CAAC,WAAW;QACzC,eAAe;QACf,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,CAAC;KAChB,CAAC;AACJ,CAAC"}

package/dist/domain/mcpserver/oauth/token.d.ts

@@ -0,0 +1,32 @@
+/** Token-endpoint response (Go TokenResponse). */
+export interface TokenResponse {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    refreshToken: string;
+    scope: string;
+}
+/**
+ * Token-endpoint client authentication methods, in the RFC 8414
+ * token_endpoint_auth_methods_supported vocabulary. An empty or
+ * unrecognized method falls back to Basic — the RFC 6749 §2.3.1 baseline.
+ */
+export declare const TOKEN_AUTH_METHOD_BASIC = "client_secret_basic";
+export declare const TOKEN_AUTH_METHOD_POST = "client_secret_post";
+/** Go's tokenHTTPClient 15s timeout — a named constant per guidelines. */
+export declare const TOKEN_REQUEST_TIMEOUT_MS = 15000;
+/**
+ * Exchanges an authorization code for tokens using the
+ * authorization_code grant with PKCE (Go ExchangeCode). For public
+ * clients (DCR), clientSecret is empty; for confidential clients (vendor
+ * OAuth) tokenAuthMethod selects how the secret is presented.
+ */
+export declare function exchangeCode(tokenEndpoint: string, code: string, redirectUri: string, codeVerifier: string, clientId: string, clientSecret: string, tokenAuthMethod: string, fetchImpl?: typeof fetch): Promise<TokenResponse>;
+/**
+ * Exchanges a refresh token for a new access token (refresh_token
+ * grant). For public clients (DCR), clientSecret is empty; for
+ * confidential clients (vendor OAuth) tokenAuthMethod selects how the
+ * secret is presented.
+ */
+export declare function refreshToken(tokenEndpoint: string, currentRefreshToken: string, clientId: string, clientSecret: string, tokenAuthMethod: string, fetchImpl?: typeof fetch): Promise<TokenResponse>;
+//# sourceMappingURL=token.d.ts.map

package/dist/domain/mcpserver/oauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/token.ts"],"names":[],"mappings":"AAQA,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,CAAC,CAgBxB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EACvB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,CAAC,CAcxB"}

package/dist/domain/mcpserver/oauth/token.js

@@ -0,0 +1,112 @@
+/**
+ * OAuth token-endpoint client — ports pkg/domain/mcpserver/oauth/token.go
+ * whole: the pre-flight refresh (#17) and the authorization-code exchange
+ * (#19). Proven by mcpserver-oauth.conformance.test.ts and the Class B
+ * mcpserver-connect suite.
+ */
+import { truncateBody } from "./truncate-body.js";
+/**
+ * Token-endpoint client authentication methods, in the RFC 8414
+ * token_endpoint_auth_methods_supported vocabulary. An empty or
+ * unrecognized method falls back to Basic — the RFC 6749 §2.3.1 baseline.
+ */
+export const TOKEN_AUTH_METHOD_BASIC = "client_secret_basic";
+export const TOKEN_AUTH_METHOD_POST = "client_secret_post";
+/** Go's tokenHTTPClient 15s timeout — a named constant per guidelines. */
+export const TOKEN_REQUEST_TIMEOUT_MS = 15_000;
+/**
+ * Exchanges an authorization code for tokens using the
+ * authorization_code grant with PKCE (Go ExchangeCode). For public
+ * clients (DCR), clientSecret is empty; for confidential clients (vendor
+ * OAuth) tokenAuthMethod selects how the secret is presented.
+ */
+export async function exchangeCode(tokenEndpoint, code, redirectUri, codeVerifier, clientId, clientSecret, tokenAuthMethod, fetchImpl = fetch) {
+    const params = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier,
+        client_id: clientId,
+    });
+    return doTokenRequest(tokenEndpoint, params, clientId, clientSecret, tokenAuthMethod, fetchImpl);
+}
+/**
+ * Exchanges a refresh token for a new access token (refresh_token
+ * grant). For public clients (DCR), clientSecret is empty; for
+ * confidential clients (vendor OAuth) tokenAuthMethod selects how the
+ * secret is presented.
+ */
+export async function refreshToken(tokenEndpoint, currentRefreshToken, clientId, clientSecret, tokenAuthMethod, fetchImpl = fetch) {
+    const params = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: currentRefreshToken,
+        client_id: clientId,
+    });
+    return doTokenRequest(tokenEndpoint, params, clientId, clientSecret, tokenAuthMethod, fetchImpl);
+}
+async function doTokenRequest(tokenEndpoint, params, clientId, clientSecret, tokenAuthMethod, fetchImpl) {
+    // Exactly one credential channel per request — RFC 6749 §2.3 forbids
+    // presenting the secret through more than one method. Post mode rides
+    // the form body; anything else (including empty) is the Basic-header
+    // baseline.
+    const usePostSecret = clientSecret !== "" && tokenAuthMethod === TOKEN_AUTH_METHOD_POST;
+    if (usePostSecret) {
+        params.set("client_secret", clientSecret);
+    }
+    const headers = {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+    };
+    if (clientSecret !== "" && !usePostSecret) {
+        headers.Authorization = `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;
+    }
+    let response;
+    try {
+        response = await fetchImpl(tokenEndpoint, {
+            method: "POST",
+            headers,
+            body: params.toString(),
+            signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new Error(`token request to ${tokenEndpoint} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const body = await response.text();
+    if (response.status !== 200) {
+        throw new Error(`token endpoint ${tokenEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(body);
+    }
+    catch (error) {
+        throw new Error(`failed to parse token response: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const tokenResponse = {
+        accessToken: raw.access_token ?? "",
+        tokenType: raw.token_type ?? "",
+        expiresIn: raw.expires_in ?? 0,
+        refreshToken: raw.refresh_token ?? "",
+        scope: raw.scope ?? "",
+    };
+    // Slack V2 nests user tokens under authed_user when only user scopes
+    // are requested; its presence is the reliable signal to prefer the user
+    // token over the top-level bot token. Standard providers omit it.
+    if (raw.authed_user !== undefined) {
+        if ((raw.authed_user.access_token ?? "") !== "") {
+            tokenResponse.accessToken = raw.authed_user.access_token;
+        }
+        if ((raw.authed_user.token_type ?? "") !== "") {
+            tokenResponse.tokenType = raw.authed_user.token_type;
+        }
+        if ((raw.authed_user.scope ?? "") !== "") {
+            tokenResponse.scope = raw.authed_user.scope;
+        }
+    }
+    if (tokenResponse.accessToken === "") {
+        throw new Error(`token response from ${tokenEndpoint} is missing access_token`);
+    }
+    return tokenResponse;
+}
+//# sourceMappingURL=token.js.map

package/dist/domain/mcpserver/oauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAWlD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,IAAY,EACZ,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,YAAoB,EACpB,eAAuB,EACvB,YAA0B,KAAK;IAE/B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IACH,OAAO,cAAc,CACnB,aAAa,EACb,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,mBAA2B,EAC3B,QAAgB,EAChB,YAAoB,EACpB,eAAuB,EACvB,YAA0B,KAAK;IAE/B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,mBAAmB;QAClC,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IACH,OAAO,cAAc,CACnB,aAAa,EACb,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,SAAS,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,aAAqB,EACrB,MAAuB,EACvB,QAAgB,EAChB,YAAoB,EACpB,eAAuB,EACvB,SAAuB;IAEvB,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,YAAY;IACZ,MAAM,aAAa,GACjB,YAAY,KAAK,EAAE,IAAI,eAAe,KAAK,sBAAsB,CAAC;IACpE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,mCAAmC;QACnD,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,YAAY,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;YACvB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,oBAAoB,aAAa,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,kBAAkB,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,GAWH,CAAC;IACF,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAkB;QACnC,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE;QACnC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC9B,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;QACrC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;KACvB,CAAC;IAEF,qEAAqE;IACrE,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YAChD,aAAa,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,YAAsB,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9C,aAAa,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,UAAoB,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,aAAa,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,KAAe,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,uBAAuB,aAAa,0BAA0B,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/domain/mcpserver/oauth/truncate-body.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Bounded HTTP-body snippets for error messages and rejection records —
+ * ports pkg/domain/mcpserver/oauth/dcr.go's package-level truncateBody,
+ * shared by the DCR, preflight, and token modules exactly as in Go.
+ */
+/** Go truncateBody's 256-byte cap, verbatim. */
+export declare function truncateBody(body: string): string;
+//# sourceMappingURL=truncate-body.d.ts.map

package/dist/domain/mcpserver/oauth/truncate-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"truncate-body.d.ts","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/truncate-body.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD"}

package/dist/domain/mcpserver/oauth/truncate-body.js

@@ -0,0 +1,11 @@
+/**
+ * Bounded HTTP-body snippets for error messages and rejection records —
+ * ports pkg/domain/mcpserver/oauth/dcr.go's package-level truncateBody,
+ * shared by the DCR, preflight, and token modules exactly as in Go.
+ */
+/** Go truncateBody's 256-byte cap, verbatim. */
+export function truncateBody(body) {
+    const MAX = 256;
+    return body.length <= MAX ? body : `${body.slice(0, MAX)}...`;
+}
+//# sourceMappingURL=truncate-body.js.map

package/dist/domain/mcpserver/oauth/truncate-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"truncate-body.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/oauth/truncate-body.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AAChE,CAAC"}

package/dist/domain/mcpserver/search-extractor.d.ts

@@ -0,0 +1,3 @@
+import type { SearchableExtractor } from "../../query/search/extractor.js";
+export declare const mcpServerSearchExtractor: SearchableExtractor;
+//# sourceMappingURL=search-extractor.d.ts.map

package/dist/domain/mcpserver/search-extractor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-extractor.d.ts","sourceRoot":"","sources":["../../../src/domain/mcpserver/search-extractor.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,eAAO,MAAM,wBAAwB,EAAE,mBA4CtC,CAAC"}