mcp-authz 0.1.0

package/dist/index.js

@@ -0,0 +1,731 @@
+import { createPrincipal, definePermissions, definePolicy, reconcile } from "./policy.js";
+import { McpServer, OAuthError, OAuthErrorCode, UriTemplate, bearerAuthChallengeResponse, classifyInboundRequest, createMcpHandler, getOAuthProtectedResourceMetadataUrl, isJsonContentType, oauthMetadataResponse, requireBearerAuth } from "@modelcontextprotocol/server";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+//#region src/discovery.ts
+/**
+* Fetch the authorization server's own metadata instead of hand-copying it.
+*
+* The five endpoints in `oauthMetadata` are published by every AS worth using,
+* and copying them by hand is where a deployment breaks in a way no error
+* explains: a stale token endpoint looks like a client bug for an afternoon.
+*
+* This is opt-in and never called for you, because it trades a fetch at boot
+* for the config. An AS that is down now stops your deploy rather than only
+* your logins.
+*/
+/** Where an AS publishes metadata, most specific first (RFC 8414, then OIDC). */
+function candidates(issuer) {
+	const url = new URL(issuer);
+	const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+	return [`${url.origin}/.well-known/oauth-authorization-server${path}`, `${url.origin}${path}/.well-known/openid-configuration`];
+}
+async function discoverOAuth(issuer, options = {}) {
+	const get = options.fetch ?? globalThis.fetch;
+	const tried = [];
+	for (const url of candidates(issuer)) {
+		tried.push(url);
+		const response = await get(url).catch(() => void 0);
+		if (!response?.ok) continue;
+		const metadata = await response.json().catch(() => void 0);
+		if (!metadata?.authorization_endpoint || !metadata.token_endpoint) continue;
+		if (metadata.issuer !== issuer) throw new Error(`${url} declares issuer '${metadata.issuer}', not '${issuer}'. Use the issuer exactly as the authorization server writes it.`);
+		return metadata;
+	}
+	throw new Error(`No OAuth metadata for '${issuer}'. Tried:\n  ${tried.join("\n  ")}\nPass \`oauthMetadata\` directly if your AS publishes it somewhere else.`);
+}
+//#endregion
+//#region src/gate.ts
+function gate(server, principal, permissions, options = {}) {
+	const required = isMapLike(permissions) ? new Map(permissions) : new Map(Object.entries(permissions));
+	const wrap = (kind, register) => function gated(...args) {
+		const name = String(args[0]);
+		const label = kind === "tool" ? name : `${kind}:${name}`;
+		const permission = required.get(label);
+		if (permission === void 0) throw new Error(`gate(): no permission declared for ${kind} '${name}'. Add '${label}' to the permission map, or stop registering it.`);
+		const last = args.length - 1;
+		const handler = args[last];
+		if (options.onAudit && typeof handler === "function") {
+			const resource = options.audit?.[label];
+			const inner = handler;
+			args[last] = async function audited(...called) {
+				const started = performance.now();
+				const base = {
+					issuer: principal.issuer,
+					sub: principal.sub,
+					email: principal.email,
+					kind,
+					name,
+					permission,
+					resource: resource?.(called[0]),
+					decision: "allow"
+				};
+				await options.onAudit?.({
+					...base,
+					phase: "attempt",
+					at: (/* @__PURE__ */ new Date()).toISOString()
+				});
+				try {
+					const result = await inner.apply(this, called);
+					await options.onAudit?.({
+						...base,
+						phase: "success",
+						at: (/* @__PURE__ */ new Date()).toISOString(),
+						durationMs: performance.now() - started
+					});
+					return result;
+				} catch (error) {
+					await options.onAudit?.({
+						...base,
+						phase: "failure",
+						at: (/* @__PURE__ */ new Date()).toISOString(),
+						durationMs: performance.now() - started,
+						error: error instanceof Error ? error.message : String(error)
+					});
+					throw error;
+				}
+			};
+		}
+		const registered = register.apply(server, args);
+		if (!principal.can(permission)) {
+			if (typeof registered?.disable !== "function") throw new Error(`gate(): SDK registration for ${kind} '${name}' cannot be disabled safely.`);
+			registered.disable();
+		}
+		return registered;
+	};
+	const gatedMethods = {
+		registerTool: wrap("tool", server.registerTool),
+		registerPrompt: wrap("prompt", server.registerPrompt),
+		registerResource: wrap("resource", server.registerResource)
+	};
+	return new Proxy(server, { get(target, property) {
+		const gatedMethod = gatedMethods[property];
+		if (gatedMethod) return gatedMethod;
+		const value = target[property];
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+function isMapLike(value) {
+	return typeof value === "object" && value !== null && typeof value.get === "function" && Symbol.iterator in value;
+}
+//#endregion
+//#region src/identity.ts
+var AccessDeniedError = class AccessDeniedError extends Error {
+	email;
+	reason;
+	constructor(email, reason, message) {
+		super(message);
+		this.name = "AccessDeniedError";
+		this.email = email;
+		this.reason = reason;
+	}
+	static notPermitted(email, policyHint = "the access policy") {
+		return new AccessDeniedError(email, "not_permitted", `${email} matches no rule in ${policyHint}, so they hold no permissions. Ask an administrator to grant them a role.`);
+	}
+	static noCredential(email, credentialHint = "a backend credential") {
+		return new AccessDeniedError(email, "no_credential", `${email} is permitted but has no ${credentialHint}, and no shared account is configured.`);
+	}
+};
+//#endregion
+//#region src/scopes.ts
+const BASE64_SENTINEL = /^=\?base64\?([A-Za-z0-9+/]*(?:={0,2}))\?=$/;
+const CANONICAL_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+/**
+* Tools use their bare name (or `tool:name`); prompts use `prompt:name`; and
+* resources use `resource:<uri>`. Everything else needs only the baseline.
+*/
+function scopesFromMcpHeaders(request, toolScopes, baseline = "mcp") {
+	const method = request.headers.get("mcp-method");
+	const rawName = request.headers.get("mcp-name");
+	const name = rawName === null ? void 0 : decodeMcpNameHeader(rawName);
+	return scopesForCapability(method ?? void 0, name, toolScopes, baseline);
+}
+/** Select scopes from an already validated MCP method/name pair. */
+function scopesForCapability(method, name, capabilityScopes, baseline = "mcp") {
+	if (!name) return [baseline];
+	const key = method === "tools/call" ? capabilityScopes[name] === void 0 ? `tool:${name}` : name : method === "prompts/get" ? `prompt:${name}` : method === "resources/read" ? `resource:${name}` : void 0;
+	const required = (key ? capabilityScopes[key] : void 0) ?? baseline;
+	return typeof required === "string" ? [required] : [...required];
+}
+/** Decode SEP-2243's optional Base64 sentinel without accepting non-canonical input. */
+function decodeMcpNameHeader(value) {
+	const normalized = value.trim();
+	if (!normalized.startsWith("=?base64?") || !normalized.endsWith("?=")) return normalized;
+	const encoded = BASE64_SENTINEL.exec(normalized)?.[1];
+	if (encoded === void 0 || !CANONICAL_BASE64.test(encoded)) return void 0;
+	try {
+		const binary = atob(encoded);
+		const bytes = Uint8Array.from(binary, (character) => character.codePointAt(0) ?? 0);
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/routing.ts
+const NAME_SOURCE = {
+	"tools/call": "name",
+	"prompts/get": "name",
+	"resources/read": "uri"
+};
+/**
+* Parse and validate every routing input before it can influence OAuth scopes.
+* This mirrors the SDK's standard-header rung, including Base64 sentinel
+* decoding, but runs before bearer authorization rather than during dispatch.
+*/
+function classifyScopedRequest(request, body) {
+	if (request.method.toUpperCase() !== "POST") return {
+		kind: "legacy",
+		body: void 0,
+		outcome: {
+			kind: "legacy",
+			reason: "http-method"
+		}
+	};
+	const outcome = classifyInboundRequest({
+		httpMethod: request.method,
+		...header(request, "mcp-protocol-version", "protocolVersionHeader"),
+		...header(request, "mcp-method", "mcpMethodHeader"),
+		...header(request, "mcp-name", "mcpNameHeader"),
+		body
+	});
+	if (outcome.kind === "reject") return rejected(outcome.httpStatus, outcome.code, outcome.message, outcome.data, requestId$1(body));
+	if (outcome.kind === "legacy") return {
+		kind: "legacy",
+		body,
+		outcome
+	};
+	const method = outcome.message.method;
+	if (outcome.messageKind !== "request") return {
+		kind: "modern",
+		body,
+		outcome,
+		method
+	};
+	if (request.headers.get("mcp-method") === null) return mismatch("(missing)", `the body names method ${method} but the required Mcp-Method header is absent`, body);
+	const source = Object.hasOwn(NAME_SOURCE, method) ? NAME_SOURCE[method] : void 0;
+	if (source === void 0) return {
+		kind: "modern",
+		body,
+		outcome,
+		method
+	};
+	const params = isRecord$1(outcome.message.params) ? outcome.message.params : void 0;
+	const bodyName = typeof params?.[source] === "string" ? params[source] : void 0;
+	const rawName = request.headers.get("mcp-name");
+	if (rawName === null) {
+		if (bodyName === void 0) return {
+			kind: "modern",
+			body,
+			outcome,
+			method
+		};
+		return mismatch("(missing)", `the body carries params.${source}="${bodyName}" but the required Mcp-Name header is absent`, body);
+	}
+	const decodedName = decodeMcpNameHeader(rawName);
+	if (decodedName === void 0) return mismatch(rawName.trim(), "the Mcp-Name header carries an invalid Base64 sentinel value", body);
+	if (bodyName !== void 0 && decodedName !== bodyName) return mismatch(rawName.trim(), `the body carries params.${source}="${bodyName}" but the Mcp-Name header names "${decodedName}"`, body);
+	return {
+		kind: "modern",
+		body,
+		outcome,
+		method,
+		...bodyName === void 0 ? {} : { name: bodyName }
+	};
+}
+function header(request, name, property) {
+	const value = request.headers.get(name);
+	return value === null ? {} : { [property]: value };
+}
+function mismatch(headerValue, bodyDescription, body) {
+	return rejected(400, -32020, `Bad Request: the request headers and body disagree: ${bodyDescription}`, { mismatch: {
+		header: headerValue,
+		body: bodyDescription
+	} }, requestId$1(body));
+}
+function rejected(httpStatus, code, message, data, id) {
+	return {
+		kind: "reject",
+		httpStatus,
+		code,
+		message,
+		...data === void 0 ? {} : { data },
+		id
+	};
+}
+function requestId$1(body) {
+	if (!isRecord$1(body)) return null;
+	const id = body.id;
+	return typeof id === "string" || typeof id === "number" ? id : null;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/verifier.ts
+const invalidToken = (message) => new OAuthError(OAuthErrorCode.InvalidToken, message);
+/**
+* A JWKS-backed verifier. Keys are fetched once and cached by `jose`, which
+* also handles rotation, so a key roll at the AS does not need a redeploy.
+*/
+function jwksVerifier(options) {
+	const jwks = createRemoteJWKSet(new URL(options.jwksUri));
+	const emailClaim = options.emailClaim ?? "email";
+	const emailVerifiedClaim = options.emailVerifiedClaim ?? "email_verified";
+	const expectedResource = new URL(options.resource.href).href.split("#")[0];
+	return {
+		async verifyAccessToken(token) {
+			let payload;
+			try {
+				payload = (await jwtVerify(token, jwks, {
+					issuer: options.issuer,
+					audience: expectedResource
+				})).payload;
+			} catch (error) {
+				throw invalidToken(`Token rejected: ${error instanceof Error ? error.message : String(error)}`);
+			}
+			if (typeof payload.exp !== "number") throw invalidToken("Token has no `exp` claim.");
+			const email = payload[emailClaim];
+			if (typeof email !== "string" || !email) throw invalidToken(`Token carries no '${emailClaim}' claim, so there is no identity to map.`);
+			if ((options.requireEmailVerified ?? true) && payload[emailVerifiedClaim] !== true) throw invalidToken(`Token does not prove '${emailClaim}' with '${emailVerifiedClaim}: true'.`);
+			const sub = payload.sub;
+			if (typeof sub !== "string" || !sub) throw invalidToken("Token has no `sub` claim, so there is no stable subject to bind to.");
+			const domain = typeof payload.hd === "string" ? payload.hd : void 0;
+			if (options.allowedDomain && domain?.toLowerCase() !== options.allowedDomain.toLowerCase()) throw invalidToken(`Token is for ${domain ?? "an unknown domain"}, not ${options.allowedDomain}.`);
+			return {
+				token,
+				clientId: typeof payload.client_id === "string" ? payload.client_id : typeof payload.azp === "string" ? payload.azp : sub,
+				scopes: scopesOf(payload.scope),
+				expiresAt: payload.exp,
+				resource: options.resource,
+				extra: {
+					issuer: options.issuer,
+					sub,
+					email,
+					emailVerified: options.requireEmailVerified === false || payload[emailVerifiedClaim] === true,
+					domain,
+					claims: payload
+				}
+			};
+		},
+		identityOf: identityFromAuth
+	};
+}
+/** Default identity mapper for custom verifiers using `AuthInfo.extra`. */
+function identityFromAuth(auth) {
+	const { issuer, sub, email, emailVerified, domain, claims } = auth.extra ?? {};
+	if (typeof issuer !== "string" || !issuer || typeof sub !== "string" || !sub) throw invalidToken("Verified token carried no issuer or subject.");
+	if (email !== void 0 && (typeof email !== "string" || !email)) throw invalidToken("Verified token carried an invalid email.");
+	return {
+		issuer,
+		sub,
+		email: typeof email === "string" ? email : void 0,
+		emailVerified: emailVerified === true,
+		domain: typeof domain === "string" ? domain : void 0,
+		claims: isRecord(claims) ? claims : {}
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** OAuth scope is a space-delimited string; some servers send an array anyway. */
+function scopesOf(scope) {
+	if (Array.isArray(scope)) return scope.filter((s) => typeof s === "string");
+	if (typeof scope === "string") return scope.split(" ").filter(Boolean);
+	return [];
+}
+//#endregion
+//#region src/handler.ts
+/** Where the resolved per-request context rides from the gate to the factory. */
+const CONTEXT_KEY = "mcp-authz.context";
+function createMcpFetch(options) {
+	const { resourceServerUrl, oauthMetadata, requiredScopes = ["mcp"], supportedScopes, toolScopes, capabilityScopes, policy, createServer, contextExtraKey = CONTEXT_KEY, healthPath = "/health", legacy = "reject", maxRequestBytes = 1048576 } = options;
+	if (toolScopes && capabilityScopes) throw new Error("Pass either `toolScopes` or `capabilityScopes`, not both.");
+	const scopeMap = capabilityScopes ?? toolScopes;
+	if (scopeMap && options.scopesForRequest) throw new Error("Pass a declarative scope map or `scopesForRequest`, not both.");
+	const scopesForRequest = options.scopesForRequest;
+	const advertisedScopes = [.../* @__PURE__ */ new Set([
+		...requiredScopes,
+		...supportedScopes ?? [],
+		...Object.values(scopeMap ?? {}).flatMap((scope) => typeof scope === "string" ? [scope] : [...scope])
+	])];
+	if (policy && options.authorize) throw new Error("Pass either `policy` or `authorize`, not both.");
+	if (!policy && !options.authorize && !options.resolve) throw new Error("createMcpFetch needs a `policy`, `authorize`, or `resolve`.");
+	const required = options.permissions ?? createServer.permissions;
+	const granted = new Set([...policy?.roles.values() ?? []].flat());
+	if (policy && required) {
+		const { error, warning } = reconcile(policy.roles, required);
+		if (warning) console.warn(warning);
+		if (error) throw new Error(error);
+	}
+	const enrich = options.resolve;
+	const authorize = async (identity) => {
+		if (!policy && !options.authorize) return void 0;
+		const principal = policy ? policy(identity) : await options.authorize(identity);
+		if (!isPrincipal(principal)) throw new Error("The authorizer returned an invalid principal. Use `createPrincipal` to construct one.");
+		if (principal.permissions.length === 0) {
+			await emitDecision(options.onDecision, principal, "deny", "not_permitted");
+			throw AccessDeniedError.notPermitted(principalLabel(principal));
+		}
+		return principal;
+	};
+	const enrichIdentity = async (identity, principal) => {
+		if (!policy && !options.authorize) return enrich(identity, void 0);
+		try {
+			const context = enrich ? await enrich(identity, principal) : principal;
+			await emitDecision(options.onDecision, principal, "allow");
+			return context;
+		} catch (error) {
+			if (error instanceof AccessDeniedError) await emitDecision(options.onDecision, principal, "deny", error.reason);
+			throw error;
+		}
+	};
+	if (options.tokenVerifier && options.verifier) throw new Error("Pass either `tokenVerifier` or built-in `verifier` options, not both.");
+	let tokenVerifier;
+	let mapIdentity;
+	if (options.tokenVerifier) {
+		tokenVerifier = options.tokenVerifier;
+		mapIdentity = options.identityFromAuth ?? identityFromAuth;
+	} else {
+		const published = typeof oauthMetadata.jwks_uri === "string" ? oauthMetadata.jwks_uri : void 0;
+		const jwksUri = options.verifier?.jwksUri ?? published;
+		if (!jwksUri) throw new Error("No JWKS to verify tokens against. Set `verifier.jwksUri`, use a custom `tokenVerifier`, or use `discoverOAuth(issuer)`, whose metadata carries `jwks_uri`.");
+		const builtIn = jwksVerifier({
+			...options.verifier,
+			jwksUri,
+			issuer: options.verifier?.issuer ?? oauthMetadata.issuer,
+			resource: options.verifier?.resource ?? resourceServerUrl
+		});
+		tokenVerifier = builtIn;
+		mapIdentity = options.identityFromAuth ?? builtIn.identityOf;
+	}
+	const resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(resourceServerUrl);
+	const metadataOptions = {
+		oauthMetadata,
+		resourceServerUrl,
+		scopesSupported: advertisedScopes
+	};
+	const mcp = createMcpHandler((ctx) => {
+		const context = ctx.authInfo?.extra?.[contextExtraKey];
+		if (context === void 0) throw new Error("Request reached the MCP factory with no resolved context.");
+		return createServer(context);
+	}, { legacy });
+	return async function mcpFetch(request) {
+		const metadata = oauthMetadataResponse(request, metadataOptions);
+		if (metadata) return metadata;
+		const { pathname } = new URL(request.url);
+		if (pathname === healthPath) return Response.json({
+			ok: true,
+			resource: resourceServerUrl.href,
+			authorization: policy ? {
+				mode: "policy",
+				roles: policy.roles.size,
+				permissions: granted.size
+			} : { mode: options.authorize ? "authorizer" : "resolver" },
+			capabilities: required?.size ?? "not declared"
+		});
+		if (pathname !== resourceServerUrl.pathname) return new Response(`No MCP endpoint at ${pathname}. This server answers on ${resourceServerUrl.pathname}, which is also the audience its tokens must carry.\n`, {
+			status: 404,
+			headers: { "Content-Type": "text/plain" }
+		});
+		const preflight = Boolean(scopeMap || scopesForRequest) && request.method.toUpperCase() === "POST" ? await preflightScopedRequest(request, maxRequestBytes) : void 0;
+		if (preflight instanceof Response) return preflight;
+		const scopes = preflight ? scopeMap ? [.../* @__PURE__ */ new Set([...requiredScopes, ...scopesForCapability(preflight.route.method, preflight.route.name, scopeMap, requiredScopes[0] ?? "mcp")])] : scopesForRequest(request, preflight.route) : requiredScopes;
+		const auth = await requireBearerAuth({
+			verifier: tokenVerifier,
+			requiredScopes,
+			resourceMetadataUrl
+		})(request);
+		if (auth instanceof Response) return auth;
+		let identity;
+		let principal;
+		try {
+			identity = mapIdentity(auth);
+			principal = await authorize(identity);
+		} catch (error) {
+			if (error instanceof AccessDeniedError) return policyDenied(error);
+			throw error;
+		}
+		const routePermission = preflight ? permissionForRoute(createServer.permissionForRoute, createServer.routePermissions, preflight.route) : void 0;
+		if (routePermission && principal && !principal.can(routePermission)) {
+			await emitDecision(options.onDecision, principal, "deny", "policy_denied");
+			return policyDenied(AccessDeniedError.notPermitted(principalLabel(principal), `the permission '${routePermission}'`));
+		}
+		if (scopes.filter((scope) => !auth.scopes.includes(scope)).length > 0) return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InsufficientScope, "Insufficient scope"), {
+			requiredScopes: scopes,
+			resourceMetadataUrl
+		});
+		let context;
+		try {
+			context = await enrichIdentity(identity, principal);
+		} catch (error) {
+			if (error instanceof AccessDeniedError) return policyDenied(error);
+			throw error;
+		}
+		return mcp.fetch(request, {
+			authInfo: {
+				...auth,
+				extra: {
+					...auth.extra,
+					[contextExtraKey]: context
+				}
+			},
+			...preflight ? { parsedBody: preflight.body } : {}
+		});
+	};
+}
+function policyDenied(error) {
+	return Response.json({
+		error: "forbidden",
+		reason: "policy_denied",
+		error_description: error.message
+	}, { status: 403 });
+}
+function permissionForRoute(resolver, permissions, route) {
+	if (!route.name || !resolver && !permissions) return void 0;
+	const kind = route.method === "tools/call" ? "tool" : route.method === "prompts/get" ? "prompt" : route.method === "resources/read" ? "resource" : void 0;
+	return kind ? resolver?.(kind, route.name) ?? permissions?.get(`${kind}:${route.name}`) : void 0;
+}
+async function emitDecision(sink, principal, decision, reason) {
+	await sink?.({
+		issuer: principal.issuer,
+		sub: principal.sub,
+		email: principal.email,
+		decision,
+		roles: principal.roles,
+		permissions: principal.permissions,
+		...reason ? { reason } : {},
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+function principalLabel(principal) {
+	return principal.email ?? `${principal.issuer}#${principal.sub}`;
+}
+function isPrincipal(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.sub === "string" && typeof candidate.email === "string" && Array.isArray(candidate.roles) && candidate.roles.every((role) => typeof role === "string") && Array.isArray(candidate.permissions) && candidate.permissions.every((permission) => typeof permission === "string") && typeof candidate.can === "function";
+}
+async function preflightScopedRequest(request, maxBytes) {
+	if (!isJsonContentType(request.headers.get("content-type"))) return protocolError(415, -32e3, "Per-capability scopes require an application/json body.");
+	const raw = await readCapped(request, maxBytes);
+	if (raw === void 0) return protocolError(413, -32e3, `Request body exceeds the ${maxBytes} byte limit.`);
+	let body;
+	try {
+		body = JSON.parse(raw);
+	} catch {
+		return protocolError(400, -32700, "Parse error: the request body is not valid JSON");
+	}
+	const route = classifyScopedRequest(request, body);
+	if (route.kind === "reject") return protocolError(route.httpStatus, route.code, route.message, route.data, route.id);
+	if (route.kind !== "modern") return protocolError(400, -32020, "Per-capability scopes require a 2026-07-28 request with matching MCP routing headers.", void 0, requestId(body));
+	return {
+		body,
+		route
+	};
+}
+function requestId(body) {
+	if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
+	const id = body.id;
+	return typeof id === "string" || typeof id === "number" ? id : null;
+}
+function protocolError(status, code, message, data, id = null) {
+	return Response.json({
+		jsonrpc: "2.0",
+		error: {
+			code,
+			message,
+			...data === void 0 ? {} : { data }
+		},
+		id
+	}, { status });
+}
+/**
+* The body as text, or `undefined` when it is over the cap.
+*
+* Reads the clone chunk by chunk and stops at the limit rather than buffering
+* first and measuring after, because measuring after is how an unauthenticated
+* caller decides how much memory this process spends.
+*/
+async function readCapped(request, maxBytes) {
+	const declared = Number(request.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > maxBytes) return void 0;
+	const body = request.clone().body;
+	if (!body) return "";
+	const reader = body.getReader();
+	const chunks = [];
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			reader.cancel().catch(() => {});
+			return;
+		}
+		chunks.push(value);
+	}
+	const joined = new Uint8Array(total);
+	let at = 0;
+	for (const chunk of chunks) {
+		joined.set(chunk, at);
+		at += chunk.byteLength;
+	}
+	return new TextDecoder().decode(joined);
+}
+//#endregion
+//#region src/tools.ts
+/** The audit call every permitted invocation makes, whatever kind it is. */
+function auditing(kind, name, permission, audit, principal, onAudit) {
+	return async (args, run) => {
+		if (!onAudit) return run();
+		const started = performance.now();
+		const base = {
+			issuer: principal.issuer,
+			sub: principal.sub,
+			email: principal.email,
+			kind,
+			name,
+			permission,
+			resource: audit?.(args),
+			decision: "allow"
+		};
+		await onAudit({
+			...base,
+			phase: "attempt",
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		try {
+			const result = await run();
+			await onAudit({
+				...base,
+				phase: "success",
+				at: (/* @__PURE__ */ new Date()).toISOString(),
+				durationMs: performance.now() - started
+			});
+			return result;
+		} catch (error) {
+			await onAudit({
+				...base,
+				phase: "failure",
+				at: (/* @__PURE__ */ new Date()).toISOString(),
+				durationMs: performance.now() - started,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			throw error;
+		}
+	};
+}
+function toolsFor(handlerContext) {
+	return function tool(name, config, handler) {
+		const { permission, audit, ...toolConfig } = config;
+		return {
+			label: name,
+			kind: "tool",
+			routeName: name,
+			permission,
+			register(server, principal, context, onAudit) {
+				if (!principal.can(permission)) return;
+				const record = auditing("tool", name, permission, audit, principal, onAudit);
+				server.registerTool(name, toolConfig, (async (args) => {
+					return record(args, () => handler(args, handlerContext(context, principal)));
+				}));
+			}
+		};
+	};
+}
+function promptsFor(handlerContext) {
+	return function prompt(name, config, handler) {
+		const { permission, audit, ...promptConfig } = config;
+		return {
+			label: `prompt:${name}`,
+			kind: "prompt",
+			routeName: name,
+			permission,
+			register(server, principal, context, onAudit) {
+				if (!principal.can(permission)) return;
+				const record = auditing("prompt", name, permission, audit, principal, onAudit);
+				server.registerPrompt(name, promptConfig, (async (args) => {
+					return record(args, () => handler(args, handlerContext(context, principal)));
+				}));
+			}
+		};
+	};
+}
+function resourcesFor(handlerContext) {
+	return function resource(name, config, handler) {
+		const { permission, audit, uri, ...metadata } = config;
+		const routeTemplate = typeof uri === "string" ? new UriTemplate(uri) : uri.uriTemplate;
+		return {
+			label: `resource:${name}`,
+			kind: "resource",
+			...typeof uri === "string" ? { routeName: uri } : {},
+			routeMatches: (target) => routeTemplate.match(target) !== null,
+			permission,
+			register(server, principal, context, onAudit) {
+				if (!principal.can(permission)) return;
+				const record = auditing("resource", name, permission, audit, principal, onAudit);
+				server.registerResource(name, uri, metadata, (async (target) => {
+					return record(target, () => handler(target, handlerContext(context, principal)));
+				}));
+			}
+		};
+	};
+}
+function buildServer(definitions, options, principalOf) {
+	const permissions = /* @__PURE__ */ new Map();
+	const routePermissions = /* @__PURE__ */ new Map();
+	for (const definition of definitions) {
+		if (permissions.has(definition.label)) throw new Error(`'${definition.label}' is registered twice.`);
+		permissions.set(definition.label, definition.permission);
+		if (definition.routeName !== void 0) routePermissions.set(`${definition.kind}:${definition.routeName}`, definition.permission);
+	}
+	const factory = (context) => {
+		const principal = principalOf(context);
+		const enabled = definitions.filter((definition) => principal.can(definition.permission));
+		const declared = {
+			...enabled.some((definition) => definition.kind === "tool") ? { tools: {} } : {},
+			...enabled.some((definition) => definition.kind === "prompt") ? { prompts: {} } : {},
+			...enabled.some((definition) => definition.kind === "resource") ? { resources: {} } : {}
+		};
+		const { onAudit, mcp: mcpOptions = {}, ...serverInfo } = options;
+		const server = new McpServer(serverInfo, {
+			...mcpOptions,
+			capabilities: {
+				...mcpOptions.capabilities,
+				...declared
+			}
+		});
+		for (const definition of enabled) definition.register(server, principal, context, onAudit);
+		return server;
+	};
+	return Object.assign(factory, {
+		permissions,
+		routePermissions,
+		permissionForRoute: (kind, name) => definitions.find((definition) => definition.kind === kind && (definition.routeMatches?.(name) ?? definition.routeName === name))?.permission
+	});
+}
+/**
+* Everything bound to one policy: `permission` accepts only what that policy can
+* grant, in all four places, from one call.
+*
+* The policy is a type carrier here and is never invoked. Authorization happens
+* once per request when the principal is resolved, not once per definition.
+*
+* ```ts
+* const { tool, prompt, resource, server } = authz(policy);
+* ```
+*/
+function bindAuthz(_permissions, principalOf, handlerContext) {
+	return {
+		tool: toolsFor(handlerContext),
+		prompt: promptsFor(handlerContext),
+		resource: resourcesFor(handlerContext),
+		server: (definitions, options) => buildServer(definitions, options, principalOf)
+	};
+}
+function authz(policy, options) {
+	if (options) return bindAuthz(policy, options.principal, (context) => context);
+	return bindAuthz(policy, (principal) => principal, (_context, principal) => ({ principal }));
+}
+//#endregion
+export { AccessDeniedError, authz, createMcpFetch, createPrincipal, decodeMcpNameHeader, definePermissions, definePolicy, discoverOAuth, gate, identityFromAuth, jwksVerifier, reconcile, scopesForCapability, scopesFromMcpHeaders };