@weave-kit/engine 1.6.0 → 1.8.0

package/CHANGELOG.md

@@ -5,6 +5,43 @@ the project uses [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.8.0] - 2026-10-12
+
+Additive (no `CONTRACT_VERSION` bump).
+
+### Added
+
+- **`weave doctor --report [path]`** — write a **redacted, local-only** deployment profile (JSON,
+  default `weavekit-report.json`): engine/runtime versions, enabled subsystems/adapters, capability
+  switches (`rls.enforce`, tenants, scope, `systemSchema`, …) and object/field-count buckets, plus the
+  doctor check statuses. It contains no hosts, URLs, ids, object names or other customer data and is
+  never uploaded (the engine has no telemetry). New export `buildDeploymentReport`.
+
+## [1.7.0] - 2026-10-12
+
+Additive (no `CONTRACT_VERSION` bump): built-in OIDC/JWT auth + MCP OAuth discovery.
+
+### Added
+
+- **Built-in OIDC/JWT verifier (`auth.oidc`).** The engine validates bearer JWTs locally — JWKS
+  (explicit `jwksUri` or OIDC discovery from `issuer`), `iss`/`aud`/`exp`/`nbf` with clock skew, and
+  **asymmetric algorithms only** (never `none`/HMAC) — and resolves them to the identity directory
+  (`ref` from `subjectClaim`, default `sub`; `rolesClaim`/`tenantClaim` surfaced as `claims.roles` /
+  `claims.tenantId`). `auth.source` is now optional and `auth` may carry `oidc`. Powered by `jose`.
+  New exports `createOidcVerifier`, `OidcConfig`.
+- **MCP OAuth Protected Resource Metadata (RFC 9728).** With `auth.oidc`, `GET
+  /.well-known/oauth-protected-resource` advertises `authorization_servers` (default `[issuer]`,
+  override `auth.oidc.authorizationServers`) and 401 responses carry a
+  `WWW-Authenticate: Bearer resource_metadata="…"` challenge — so standards-based MCP hosts (Claude,
+  ChatGPT connectors, VS Code) can discover and run the OAuth flow. New exports
+  `oauthProtectedResourceMetadata`, `wwwAuthenticateChallenge`, `OAUTH_PROTECTED_RESOURCE_PATH`.
+
+### Changed
+
+- **E1 boundary:** OIDC/JWT is now **MIT** (built-in `auth.oidc`). `@weave-kit/enterprise` E1 now
+  covers SAML, SCIM/LDAP/HRIS directory sync, group→role mapping, multi-IdP and identity-event audit.
+  The `AuthVerifier` seam stays open for custom/SAML verifiers.
+
 ## [1.6.0] - 2026-10-12
 
 Additive (no `CONTRACT_VERSION` bump): a dedicated system schema for brownfield installs.

package/dist/adapters/auth/index.d.ts

@@ -5,6 +5,10 @@ export type { Authenticator, AuthConfig, AuthResolver, AuthSource } from './sour
 export { createAuth } from './source.js';
 export type { AuthVerifier } from './verify.js';
 export { createDirectoryAuthenticator, enforceSyncedIdentity, withDefaultTenant, withDefaultScope } from './subject.js';
+export { createOidcVerifier } from './oidc.js';
+export type { OidcConfig, OidcVerifierOptions } from './oidc.js';
+export { OAUTH_PROTECTED_RESOURCE_PATH, oauthProtectedResourceMetadata, wwwAuthenticateChallenge } from './oauth-metadata.js';
+export type { OAuthProtectedResourceMetadata } from './oauth-metadata.js';
 /**
  * Resolve the Authorization header into a subject, or throw a 401-family
  * {@link SchemaError}. Missing header → `auth.missingKey`; present but

package/dist/adapters/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAExH;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAEpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC9H,YAAY,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAEpE"}

package/dist/adapters/auth/index.js

@@ -2,6 +2,8 @@ import { SchemaError } from '../../core/index.js';
 import { createAuth } from './source.js';
 export { createAuth } from './source.js';
 export { createDirectoryAuthenticator, enforceSyncedIdentity, withDefaultTenant, withDefaultScope } from './subject.js';
+export { createOidcVerifier } from './oidc.js';
+export { OAUTH_PROTECTED_RESOURCE_PATH, oauthProtectedResourceMetadata, wwwAuthenticateChallenge } from './oauth-metadata.js';
 /**
  * Resolve the Authorization header into a subject, or throw a 401-family
  * {@link SchemaError}. Missing header → `auth.missingKey`; present but

package/dist/adapters/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAuC,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAExH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAA4B,EAC5B,MAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAuC,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG9H;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAA4B,EAC5B,MAA0B,EAC1B,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/adapters/auth/oauth-metadata.d.ts

@@ -0,0 +1,23 @@
+import type { OidcConfig } from './oidc.js';
+/**
+ * OAuth 2.0 Protected Resource Metadata (RFC 9728) + the `WWW-Authenticate`
+ * challenge that points an MCP host at it. When `auth.oidc` is configured the
+ * engine advertises its authorization server(s) at
+ * `/.well-known/oauth-protected-resource`, and 401 responses carry a
+ * `Bearer resource_metadata="…"` challenge so a standards-based MCP host (Claude,
+ * ChatGPT connectors, VS Code) can discover and run the OAuth flow.
+ */
+export declare const OAUTH_PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+export interface OAuthProtectedResourceMetadata {
+    /** this protected resource's identifier (the MCP server URL) */
+    resource: string;
+    /** OAuth authorization server issuer(s) an agent obtains a token from */
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    scopes_supported?: string[];
+}
+/** build the RFC 9728 metadata; `undefined` when OIDC is not configured */
+export declare function oauthProtectedResourceMetadata(oidc: OidcConfig | undefined, origin: string): OAuthProtectedResourceMetadata | undefined;
+/** the RFC 9728 `WWW-Authenticate` challenge for a 401 (points at the metadata document) */
+export declare function wwwAuthenticateChallenge(origin: string): string;
+//# sourceMappingURL=oauth-metadata.d.ts.map

package/dist/adapters/auth/oauth-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/oauth-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,0CAA0C,CAAC;AAErF,MAAM,WAAW,8BAA8B;IAC7C,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,2EAA2E;AAC3E,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GACb,8BAA8B,GAAG,SAAS,CAS5C;AAED,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/D"}

package/dist/adapters/auth/oauth-metadata.js

@@ -0,0 +1,26 @@
+/**
+ * OAuth 2.0 Protected Resource Metadata (RFC 9728) + the `WWW-Authenticate`
+ * challenge that points an MCP host at it. When `auth.oidc` is configured the
+ * engine advertises its authorization server(s) at
+ * `/.well-known/oauth-protected-resource`, and 401 responses carry a
+ * `Bearer resource_metadata="…"` challenge so a standards-based MCP host (Claude,
+ * ChatGPT connectors, VS Code) can discover and run the OAuth flow.
+ */
+export const OAUTH_PROTECTED_RESOURCE_PATH = '/.well-known/oauth-protected-resource';
+/** build the RFC 9728 metadata; `undefined` when OIDC is not configured */
+export function oauthProtectedResourceMetadata(oidc, origin) {
+    if (oidc === undefined)
+        return undefined;
+    const authorizationServers = oidc.authorizationServers ?? (oidc.issuer === undefined ? [] : [oidc.issuer]);
+    return {
+        resource: oidc.resource ?? origin,
+        authorization_servers: authorizationServers,
+        bearer_methods_supported: ['header'],
+        ...(oidc.scopes === undefined ? {} : { scopes_supported: oidc.scopes }),
+    };
+}
+/** the RFC 9728 `WWW-Authenticate` challenge for a 401 (points at the metadata document) */
+export function wwwAuthenticateChallenge(origin) {
+    return `Bearer resource_metadata="${origin}${OAUTH_PROTECTED_RESOURCE_PATH}"`;
+}
+//# sourceMappingURL=oauth-metadata.js.map

package/dist/adapters/auth/oauth-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.js","sourceRoot":"","sources":["../../../src/adapters/auth/oauth-metadata.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAAC;AAWrF,2EAA2E;AAC3E,MAAM,UAAU,8BAA8B,CAC5C,IAA4B,EAC5B,MAAc;IAEd,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3G,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM;QACjC,qBAAqB,EAAE,oBAAoB;QAC3C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,6BAA6B,MAAM,GAAG,6BAA6B,GAAG,CAAC;AAChF,CAAC"}

package/dist/adapters/auth/oidc.d.ts

@@ -0,0 +1,49 @@
+import type { AuthVerifier } from './verify.js';
+/**
+ * Built-in OIDC/JWT bearer verification (MIT). The engine ships this verifier so
+ * a project can authenticate with a standards-based IdP (JWKS + local JWT
+ * validation) without an integration. It resolves a `Bearer <jwt>` into a
+ * {@link VerifiedIdentity} (`ref` from {@link OidcConfig.subjectClaim}, default
+ * `sub`); the identity directory then maps it to an `IdentitySubject`.
+ *
+ * Signature/JWKS handling is delegated to `jose` (`createRemoteJWKSet` caches and
+ * rotates keys by `kid`). Configure it under `EngineConfig.auth.oidc`.
+ */
+export interface OidcConfig {
+    /**
+     * OIDC issuer. Used as the `iss` check and, unless `jwksUri` is set, to
+     * discover the JWKS at `<issuer>/.well-known/openid-configuration`.
+     */
+    issuer?: string;
+    /** explicit JWKS endpoint; overrides discovery (required when `issuer` is unset) */
+    jwksUri?: string;
+    /** expected `aud` (string or list); the token's `aud` must include it */
+    audience?: string | string[];
+    /** claim carrying the external user ref (default `sub`) */
+    subjectClaim?: string;
+    /** when set, the named claim's value is also exposed as `claims.roles` */
+    rolesClaim?: string;
+    /** when set, the named claim's value is also exposed as `claims.tenantId` */
+    tenantClaim?: string;
+    /** allowed signing algorithms (default: asymmetric RS/ES/PS/EdDSA — never `none`/HMAC) */
+    algorithms?: string[];
+    /** clock-skew tolerance in seconds (default 5) */
+    clockToleranceSec?: number;
+    /** OAuth authorization server(s) advertised at `/.well-known/oauth-protected-resource` (default: `[issuer]`) */
+    authorizationServers?: string[];
+    /** scopes advertised in the protected-resource metadata */
+    scopes?: string[];
+    /** this server's public URL (the metadata `resource`); defaults to the request origin */
+    resource?: string;
+}
+export interface OidcVerifierOptions {
+    /** fetch implementation (defaults to the global `fetch`); injectable for tests */
+    fetch?: typeof fetch;
+}
+/**
+ * Build an {@link AuthVerifier} that locally validates OIDC JWTs. Returns `null`
+ * (→ 401 `auth.invalidKey`) for a missing/invalid token, never throws on a bad
+ * credential. The JWKS is fetched lazily on the first verification.
+ */
+export declare function createOidcVerifier(config: OidcConfig, options?: OidcVerifierOptions): AuthVerifier;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/adapters/auth/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/oidc.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gHAAgH;IAChH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA6BD,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAqDtG"}

package/dist/adapters/auth/oidc.js

@@ -0,0 +1,92 @@
+import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+/** asymmetric algorithms only — symmetric/HMAC/`none` are never accepted */
+const DEFAULT_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'EdDSA',
+];
+/** extract the token from a `Bearer <jwt>` Authorization header */
+function bearerToken(header) {
+    if (header === undefined)
+        return undefined;
+    const match = /^Bearer\s+(\S+)$/i.exec(header.trim());
+    return match?.[1];
+}
+/** a string claim value (arrays/objects are ignored) */
+function stringClaim(payload, name) {
+    const value = payload[name];
+    return typeof value === 'string' ? value : undefined;
+}
+/**
+ * Build an {@link AuthVerifier} that locally validates OIDC JWTs. Returns `null`
+ * (→ 401 `auth.invalidKey`) for a missing/invalid token, never throws on a bad
+ * credential. The JWKS is fetched lazily on the first verification.
+ */
+export function createOidcVerifier(config, options = {}) {
+    if (config.issuer === undefined && config.jwksUri === undefined) {
+        throw new Error('auth.oidc: set "issuer" (discovery) or "jwksUri"');
+    }
+    const algorithms = config.algorithms ?? DEFAULT_ALGORITHMS;
+    const fetchImpl = options.fetch ?? fetch;
+    let keySet;
+    async function keys() {
+        if (keySet !== undefined)
+            return keySet;
+        let uri = config.jwksUri;
+        if (uri === undefined) {
+            const discoveryUrl = `${config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+            const res = await fetchImpl(discoveryUrl);
+            if (!res.ok)
+                throw new Error(`auth.oidc: discovery failed (${res.status}) for ${discoveryUrl}`);
+            const doc = (await res.json());
+            if (typeof doc.jwks_uri !== 'string')
+                throw new Error('auth.oidc: discovery document has no jwks_uri');
+            uri = doc.jwks_uri;
+        }
+        keySet = createRemoteJWKSet(new URL(uri), { [customFetch]: fetchImpl });
+        return keySet;
+    }
+    return {
+        async verify(header) {
+            const token = bearerToken(header);
+            if (token === undefined)
+                return null;
+            let payload;
+            try {
+                const result = await jwtVerify(token, await keys(), {
+                    ...(config.issuer === undefined ? {} : { issuer: config.issuer }),
+                    ...(config.audience === undefined ? {} : { audience: config.audience }),
+                    algorithms,
+                    clockTolerance: config.clockToleranceSec ?? 5,
+                });
+                payload = result.payload;
+            }
+            catch {
+                return null; // invalid signature/claims → unauthenticated
+            }
+            const ref = stringClaim(payload, config.subjectClaim ?? 'sub');
+            if (ref === undefined || ref === '')
+                return null;
+            const claims = { ...payload };
+            if (config.rolesClaim !== undefined && claims.roles === undefined) {
+                const roles = payload[config.rolesClaim];
+                if (roles !== undefined)
+                    claims.roles = roles;
+            }
+            if (config.tenantClaim !== undefined && claims.tenantId === undefined) {
+                const tenant = stringClaim(payload, config.tenantClaim);
+                if (tenant !== undefined)
+                    claims.tenantId = tenant;
+            }
+            return { ref, claims };
+        },
+    };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/adapters/auth/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/adapters/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAC;AA0CzG,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG;IACzB,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC;AAEF,mEAAmE;AACnE,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,OAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,UAA+B,EAAE;IACtF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,IAAI,MAAmC,CAAC;IAExC,KAAK,UAAU,IAAI;QACjB,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,MAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;YAC7F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,SAAS,YAAY,EAAE,CAAC,CAAC;YAChG,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;YACzD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACvG,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAA0B;YACrC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACrC,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE;oBAClD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;oBACjE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACvE,UAAU;oBACV,cAAc,EAAE,MAAM,CAAC,iBAAiB,IAAI,CAAC;iBAC9C,CAAC,CAAC;gBACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;YAC5D,CAAC;YACD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;YAC/D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjD,MAAM,MAAM,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;YACvD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACzC,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChD,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/auth/source.d.ts

@@ -14,8 +14,9 @@ export type AuthResolver = (header: string | undefined) => IdentitySubject | nul
  * The authentication source: either a static key map or a resolver function.
  * `source` is required whenever `auth` is configured (fail fast otherwise).
  *
- * Stable seam (`@enterprise-reserved`): SSO/OIDC/SAML is enterprise E1; the
- * engine ships static-key and custom-resolver sources.
+ * Stable seam (`@enterprise-reserved`): SAML / multi-IdP federation is enterprise
+ * E1. The engine ships static-key and custom-resolver sources plus a built-in
+ * OIDC/JWT verifier (`auth.oidc`).
  */
 export type AuthSource = Record<string, IdentitySubject> | AuthResolver;
 /** authentication config — the single source of truth is `source` */

package/dist/adapters/auth/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAC/F;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAEpH;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC;AAExE,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAiB5D"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAC/F;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAEpH;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,YAAY,CAAC;AAExE,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAiB5D"}

package/dist/adapters/auth/source.js.map

@@ -1 +1 @@
-{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../src/adapters/auth/source.ts"],"names":[],"mappings":"AA6BA,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC;IACpB,OAAO;QACL,OAAO,CAAC,MAA0B;YAChC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACxB,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../src/adapters/auth/source.ts"],"names":[],"mappings":"AA8BA,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC;IACpB,OAAO;QACL,OAAO,CAAC,MAA0B;YAChC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACxB,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/auth/verify.d.ts

@@ -1,12 +1,14 @@
 import type { VerifiedIdentity } from '../../core/provider/identity/index.js';
 /**
  * Authentication seam: turn a raw credential (the `Authorization` header) into
- * a verified-but-unresolved identity. Protocol verifiers (OIDC/JWT/SAML) are
- * supplied by integrations (e.g. `@weave-kit/enterprise`); the engine defines
- * the contract and composes it with the identity directory. Returning `null`
- * means the credential is missing/invalid (401).
+ * a verified-but-unresolved identity. The engine ships a built-in OIDC/JWT
+ * verifier (`createOidcVerifier`, configured via `auth.oidc`); other protocol
+ * verifiers (SAML, …) are supplied by integrations (e.g. `@weave-kit/enterprise`)
+ * against this same contract. Returning `null` means the credential is
+ * missing/invalid (401).
  *
- * Stable seam (`@enterprise-reserved`): protocol verifiers are enterprise E1.
+ * Stable seam (`@enterprise-reserved`): SAML and other protocol verifiers are
+ * enterprise E1; OIDC/JWT is MIT.
  */
 export interface AuthVerifier {
     verify(header: string | undefined): VerifiedIdentity | null | Promise<VerifiedIdentity | null>;

package/dist/adapters/auth/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChG"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/adapters/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChG"}

package/dist/adapters/mcp/http.d.ts

@@ -2,6 +2,7 @@ import type { FastifyInstance } from 'fastify';
 import type { Locale, ToolDefinition } from '../../core/index.js';
 import type { ToolExecutor } from '../../runtime/tools/index.js';
 import type { Authenticator } from '../auth/index.js';
+import { type OidcConfig } from '../auth/index.js';
 import type { IdentityResolver } from '../../core/provider/identity/index.js';
 import type { McpSessionStore } from './session.js';
 import type { McpGuardrails } from './guardrails.js';
@@ -34,6 +35,8 @@ export interface McpHttpDeps {
     prompts?: McpPromptsConfig;
     /** schema signature folded into the compiled-surface cache key (schema change → cache miss) */
     schemaRevision?: string;
+    /** when set (from `auth.oidc`), serve RFC 9728 protected-resource metadata at `/.well-known/oauth-protected-resource` */
+    oauth?: OidcConfig;
 }
 export declare function registerMcpRoutes(app: FastifyInstance, deps: McpHttpDeps): void;
 //# sourceMappingURL=http.d.ts.map

package/dist/adapters/mcp/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkB7E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAElF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,cAAc,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAiB,MAAM,YAAY,CAAC;AA+D3D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,EAAE,aAAa,CAAC;IAC1B,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3D,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAuCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAyN/E"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkB7E,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAElF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAA+E,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAChI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,cAAc,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAiB,MAAM,YAAY,CAAC;AA+D3D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,EAAE,aAAa,CAAC;IAC1B,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3D,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yHAAyH;IACzH,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAuCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmO/E"}

package/dist/adapters/mcp/http.js

@@ -4,7 +4,7 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema, ErrorCode, McpError, isInitializeRequest, } from '@modelcontextprotocol/sdk/types.js';
 import { SchemaError, traceIdOf, validateToolArgs } from '../../core/index.js';
-import { authenticate } from '../auth/index.js';
+import { authenticate, OAUTH_PROTECTED_RESOURCE_PATH, oauthProtectedResourceMetadata } from '../auth/index.js';
 import { credentialIdOf } from './session.js';
 import { compileToolsFor } from './generate.js';
 import { listResources, readResource } from './resources.js';
@@ -283,6 +283,15 @@ export function registerMcpRoutes(app, deps) {
     app.post(path, handle);
     app.get(path, handle);
     app.delete(path, handle);
+    // OAuth 2.0 Protected Resource Metadata (RFC 9728): a public document letting a
+    // standards-based MCP host discover the authorization server and run the OAuth
+    // flow. Served only when OIDC is configured (`auth.oidc`).
+    if (deps.oauth !== undefined) {
+        app.get(OAUTH_PROTECTED_RESOURCE_PATH, async (request, reply) => {
+            const origin = `${request.protocol}://${request.host}`;
+            reply.type('application/json').send(oauthProtectedResourceMetadata(deps.oauth, origin));
+        });
+    }
     app.addHook('onClose', async () => {
         for (const entry of sessions.values()) {
             await entry.transport.close();

package/dist/adapters/mcp/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,SAAS,EACT,QAAQ,EACR,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAyB,MAAM,cAAc,CAAC;AAG7E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AAEH,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAU,CAAC;AAErD,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAA6C,EAAE,aAAiC;IACnG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAIF,CAAC;IACpB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,UAAkB,EAAE,aAAgD,EAAE,OAAiC,EAAE,EAAE;QAC3H,IAAI,OAAO,GAAG,aAAa,CAAC;QAC5B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,GAAG,OAA8C,CAAC;YACtD,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC;QACjE,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAa,CAAC;YAC/C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAa,CAAC,CAAC;IAC7D,CAAC,CAAyB,CAAC;AAC7B,CAAC;AAkCD,2FAA2F;AAC3F,SAAS,eAAe,CACtB,UAAyB,EACzB,OAAmB,EACnB,IAAY,EACZ,IAAa,EACb,YAAuD,mBAAmB;IAE1E,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,iBAAiB,CAAC,KAAK;QAClC,OAAO,EAAE,OAAO,CAAC,iBAAiB;QAClC,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,IAAI,EAAE;QAC7C,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,SAAS;QACT,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnF,IAAI,EAAE;YACJ,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;YACnC,IAAI;SACL;QACD,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAiB;IACvE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC9F,MAAM,YAAY,GAAoB,IAAI,CAAC,YAAY,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,iGAAiG;IACjG,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,kFAAkF;IAClF,MAAM,iBAAiB,GAAG,GAAG,CAAC;IAC9B,SAAS,UAAU,CAAC,OAAmB;QACrC,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzG,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtH,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB;gBAAE,YAAY,CAAC,KAAK,EAAE,CAAC;YACjE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,SAAS,WAAW,CAAC,SAAmC;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAC7B,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAC5D,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;gBAC/B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;aAChC,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC;gBACH,OAAO,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACnF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yEAAyE;gBACzE,gDAAgD;gBAChD,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;gBAC7H,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;gBACxE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjG,OAAO,MAAoC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;gBAC7H,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,4EAA4E;gBAC5E,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAA6B,CAAC,CAAC;YAC9E,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBACtE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAA+B,CAAC;YACpG,CAAC;YACD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;YAC7U,MAAM,MAAM,GAAkB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO,MAAmC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,SAAS,aAAa,CAAC,KAAmB;QACxC,MAAM,KAAK,GAAiB,EAAkB,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,GAAW,EAAE,EAAE;gBACpC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;gBAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAuB,EAAE,KAAmB;QAChE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC9F,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5E,2EAA2E;QAC3E,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;gBAClD,MAAM,IAAI,WAAW,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAe,CAAC;QACrC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9G,sFAAsF;YACtF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,uEAAuE;YACvE,2DAA2D;YAC3D,aAAa,GAAG,aAAa,CAAC;gBAC5B,iBAAiB;gBACjB,YAAY;gBACZ,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAC5D,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC;QACjC,CAAC;QAED,8EAA8E;QAC9E,oEAAoE;QACpE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS;YAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,aAAa,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChH,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEzB,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,SAAS,EACT,QAAQ,EACR,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,6BAA6B,EAAE,8BAA8B,EAAmB,MAAM,kBAAkB,CAAC;AAGhI,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAyB,MAAM,cAAc,CAAC;AAG7E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AAEH,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAU,CAAC;AAErD,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAA6C,EAAE,aAAiC;IACnG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAIF,CAAC;IACpB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,UAAkB,EAAE,aAAgD,EAAE,OAAiC,EAAE,EAAE;QAC3H,IAAI,OAAO,GAAG,aAAa,CAAC;QAC5B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,GAAG,OAA8C,CAAC;YACtD,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC;QACjE,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAa,CAAC;YAC/C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAa,CAAC,CAAC;IAC7D,CAAC,CAAyB,CAAC;AAC7B,CAAC;AAoCD,2FAA2F;AAC3F,SAAS,eAAe,CACtB,UAAyB,EACzB,OAAmB,EACnB,IAAY,EACZ,IAAa,EACb,YAAuD,mBAAmB;IAE1E,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,iBAAiB,CAAC,KAAK;QAClC,OAAO,EAAE,OAAO,CAAC,iBAAiB;QAClC,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,IAAI,EAAE;QAC7C,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,SAAS;QACT,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnF,IAAI,EAAE;YACJ,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;YACnC,IAAI;SACL;QACD,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAiB;IACvE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC9F,MAAM,YAAY,GAAoB,IAAI,CAAC,YAAY,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,iGAAiG;IACjG,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,kFAAkF;IAClF,MAAM,iBAAiB,GAAG,GAAG,CAAC;IAC9B,SAAS,UAAU,CAAC,OAAmB;QACrC,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzG,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtH,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB;gBAAE,YAAY,CAAC,KAAK,EAAE,CAAC;YACjE,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,SAAS,WAAW,CAAC,SAAmC;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAC7B,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAC5D,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;gBAC/B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;aAChC,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC;gBACH,OAAO,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACnF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yEAAyE;gBACzE,gDAAgD;gBAChD,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;gBAC7H,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;gBACxE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjG,OAAO,MAAoC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;gBAC7H,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,4EAA4E;gBAC5E,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAA6B,CAAC,CAAC;YAC9E,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBACtE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAA+B,CAAC;YACpG,CAAC;YACD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;YAC7U,MAAM,MAAM,GAAkB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO,MAAmC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,SAAS,aAAa,CAAC,KAAmB;QACxC,MAAM,KAAK,GAAiB,EAAkB,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,GAAW,EAAE,EAAE;gBACpC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;gBAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAuB,EAAE,KAAmB;QAChE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC9F,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5E,2EAA2E;QAC3E,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;gBAClD,MAAM,IAAI,WAAW,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAe,CAAC;QACrC,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9G,sFAAsF;YACtF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,uEAAuE;YACvE,2DAA2D;YAC3D,aAAa,GAAG,aAAa,CAAC;gBAC5B,iBAAiB;gBACjB,YAAY;gBACZ,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAC5D,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC;QACjC,CAAC;QAED,8EAA8E;QAC9E,oEAAoE;QACpE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS;YAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,aAAa,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChH,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEzB,gFAAgF;IAChF,+EAA+E;IAC/E,2DAA2D;IAC3D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/mcp/index.d.ts

@@ -4,7 +4,7 @@ import type { AuditSink } from '../../core/audit/index.js';
 import type { AlertSink } from '../../core/provider/alerts/index.js';
 import type { IdentityDirectory, IdentityResolver } from '../../core/provider/identity/index.js';
 import type { ToolExecutor } from '../../runtime/tools/index.js';
-import type { Authenticator } from '../auth/index.js';
+import type { Authenticator, OidcConfig } from '../auth/index.js';
 import { type RateLimitConfig } from './guardrails.js';
 import type { McpEngine } from './types.js';
 /**
@@ -85,6 +85,8 @@ export interface McpRegisterDeps {
     directory?: IdentityDirectory;
     /** schema signature: part of the compiled-surface cache key so a schema change invalidates it */
     schemaRevision?: string;
+    /** `auth.oidc` — enables the RFC 9728 protected-resource metadata endpoint */
+    oauth?: OidcConfig;
 }
 export interface McpServerHandle {
     /** closes all transports/servers and clears the session store */

package/dist/adapters/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACjG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,CAAC,EAAE;YACP,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;YAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB,CAAC;KACH,CAAC;IACF;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,gBAAgB,CAAC;IAChE;;;;;OAKG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,qEAAqE;IACrE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,kGAAkG;IAClG,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,GAAG,eAAe,CAkDxF;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACjG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,CAAC,EAAE;YACP,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;YAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB,CAAC;KACH,CAAC;IACF;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,gBAAgB,CAAC;IAChE;;;;;OAKG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,qEAAqE;IACrE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IACzC,kGAAkG;IAClG,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,GAAG,eAAe,CAmDxF;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/adapters/mcp/index.js

@@ -7,7 +7,7 @@ import { registerMcpRoutes } from './http.js';
  * identity (`mcp.identities`: static directory or a customer-provided resolver).
  */
 export function registerMcp(app, deps) {
-    const { engine, authenticator, mcp, locale, audit, alerts, tools, corsOrigin, directory, schemaRevision } = deps;
+    const { engine, authenticator, mcp, locale, audit, alerts, tools, corsOrigin, directory, schemaRevision, oauth } = deps;
     // on-behalf-of resolver priority: a function `mcp.identities` wins, then a
     // static `mcp.identities` map, then the engine identity directory, else empty
     const explicit = mcp?.identities;
@@ -43,6 +43,7 @@ export function registerMcp(app, deps) {
         allowImpersonation: mcp?.impersonation === 'directory',
         prompts,
         schemaRevision,
+        ...(oauth === undefined ? {} : { oauth }),
     });
     return {
         async close() {

package/dist/adapters/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/mcp/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAwB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAwF9C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAoB,EAAE,IAAqB;IACrE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAEjH,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,CAAC;IACjC,MAAM,gBAAgB,GACpB,OAAO,QAAQ,KAAK,UAAU;QAC5B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,KAAK,SAAS;YACtB,CAAC,CAAC,CAAC,GAAW,EAAE,EAAE,CAAE,QAA4C,CAAC,GAAG,CAAC,IAAI,IAAI;YAC7E,CAAC,CAAC,SAAS,KAAK,SAAS;gBACvB,CAAC,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAErB,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS;QACrC,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3C,MAAM,OAAO,GACX,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK;QAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrB,CAAC,CAAC;YACE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnF,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;SACpF,CAAC;IACR,iBAAiB,CAAC,GAAG,EAAE;QACrB,MAAM;QACN,aAAa;QACb,gBAAgB;QAChB,UAAU;QACV,YAAY;QACZ,MAAM;QACN,KAAK;QACL,QAAQ,EAAE,GAAG,EAAE,QAAQ;QACvB,UAAU;QACV,kBAAkB,EAAE,GAAG,EAAE,aAAa,KAAK,WAAW;QACtD,OAAO;QACP,cAAc;KACf,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,KAAK;YACT,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/mcp/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAwB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AA0F9C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAoB,EAAE,IAAqB;IACrE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAExH,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,GAAG,EAAE,UAAU,CAAC;IACjC,MAAM,gBAAgB,GACpB,OAAO,QAAQ,KAAK,UAAU;QAC5B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,KAAK,SAAS;YACtB,CAAC,CAAC,CAAC,GAAW,EAAE,EAAE,CAAE,QAA4C,CAAC,GAAG,CAAC,IAAI,IAAI;YAC7E,CAAC,CAAC,SAAS,KAAK,SAAS;gBACvB,CAAC,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAErB,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS;QACrC,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3C,MAAM,OAAO,GACX,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK;QAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrB,CAAC,CAAC;YACE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnF,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;SACpF,CAAC;IACR,iBAAiB,CAAC,GAAG,EAAE;QACrB,MAAM;QACN,aAAa;QACb,gBAAgB;QAChB,UAAU;QACV,YAAY;QACZ,MAAM;QACN,KAAK;QACL,QAAQ,EAAE,GAAG,EAAE,QAAQ;QACvB,UAAU;QACV,kBAAkB,EAAE,GAAG,EAAE,aAAa,KAAK,WAAW;QACtD,OAAO;QACP,cAAc;QACd,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,KAAK;YACT,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/adapters/rest/errorHandler.d.ts

@@ -1,9 +1,13 @@
-import type { FastifyInstance } from 'fastify';
+import type { FastifyInstance, FastifyRequest } from 'fastify';
 import type { Locale } from '../../core/index.js';
+export interface ErrorHandlerOptions {
+    /** add a `WWW-Authenticate` challenge to 401 responses (RFC 9728 OAuth protected-resource) */
+    wwwAuthenticate?: (request: FastifyRequest) => string;
+}
 /**
  * Install uniform error handling on the app:
  * - setErrorHandler: every thrown error → {@link mapSchemaError} spec
  * - setNotFoundHandler: unknown routes → uniform 404 body
  */
-export declare function setErrorHandlers(app: FastifyInstance, locale: Locale): void;
+export declare function setErrorHandlers(app: FastifyInstance, locale: Locale, options?: ErrorHandlerOptions): void;
 //# sourceMappingURL=errorHandler.d.ts.map

package/dist/adapters/rest/errorHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errorHandler.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/errorHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAS3E"}
+{"version":3,"file":"errorHandler.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/errorHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CACvD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,IAAI,CAY9G"}

package/dist/adapters/rest/errorHandler.js

@@ -5,9 +5,12 @@ import { mapSchemaError } from '../../core/api/index.js';
  * - setErrorHandler: every thrown error → {@link mapSchemaError} spec
  * - setNotFoundHandler: unknown routes → uniform 404 body
  */
-export function setErrorHandlers(app, locale) {
-    app.setErrorHandler((err, _request, reply) => {
+export function setErrorHandlers(app, locale, options = {}) {
+    app.setErrorHandler((err, request, reply) => {
         const spec = mapSchemaError(err, locale);
+        if (spec.status === 401 && options.wwwAuthenticate !== undefined) {
+            reply.header('WWW-Authenticate', options.wwwAuthenticate(request));
+        }
         reply.status(spec.status).send(spec.body);
     });
     app.setNotFoundHandler((_request, reply) => {

package/dist/adapters/rest/errorHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../../src/adapters/rest/errorHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,MAAc;IACnE,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../../src/adapters/rest/errorHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAOzD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,MAAc,EAAE,UAA+B,EAAE;IACtG,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}