mcp-trellis 0.1.0

package/dist/http.js

@@ -0,0 +1,38 @@
+/** JSON `error` body / audit reason when a host port throws. */
+export const INTERNAL_ERROR = "internal_error";
+export const corsHeaders = (extra) => ({
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
+    ...extra,
+});
+export const jsonResponse = (data, status = 200, extraHeaders, options) => {
+    const cors = options?.cors !== false;
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            ...(cors ? corsHeaders() : {}),
+            ...extraHeaders,
+        },
+    });
+};
+export const emptyResponse = (status) => new Response(null, { status, headers: corsHeaders() });
+export const optionsResponse = (options) => new Response(null, {
+    status: 204,
+    headers: options?.cors === false ? { "Cache-Control": "no-store" } : corsHeaders(),
+});
+export const methodNotAllowed = (message = "Method not allowed", options) => jsonResponse({ error: message }, 405, undefined, options);
+/**
+ * OPTIONS → 204; allowed verb → null (continue); otherwise → 405.
+ * Shared by OAuth handlers that all need the same method gate.
+ */
+export const requireHttpMethod = (request, allowed, options) => {
+    if (request.method === "OPTIONS")
+        return optionsResponse(options);
+    if (allowed.has(request.method))
+        return null;
+    return jsonResponse({ detail: "method not allowed" }, 405, undefined, options);
+};
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,KAA8B,EACN,EAAE,CAAC,CAAC;IAC5B,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,mDAAmD;IACrD,GAAG,KAAK;CACT,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,IAAa,EACb,MAAM,GAAG,GAAG,EACZ,YAAqC,EACrC,OAA6B,EACnB,EAAE;IACZ,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,YAAY;SAChB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAY,EAAE,CACxD,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA6B,EAAY,EAAE,CACzE,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;CACnF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAO,GAAG,oBAAoB,EAC9B,OAA6B,EACnB,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAAgB,EAChB,OAA4B,EAC5B,OAA6B,EACZ,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,YAAY,CACjB,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAChC,GAAG,EACH,SAAS,EACT,OAAO,CACR,CAAC;AACJ,CAAC,CAAC"}

package/dist/jsonrpc.d.ts

@@ -0,0 +1,32 @@
+export type JsonRpcId = string | number | null;
+export type JsonRpcRequest = {
+    jsonrpc?: string;
+    id?: JsonRpcId;
+    method?: string;
+    params?: Record<string, unknown>;
+    result?: unknown;
+    error?: unknown;
+};
+export type JsonRpcSuccess = {
+    jsonrpc: "2.0";
+    id: JsonRpcId;
+    result: unknown;
+};
+export type JsonRpcFailure = {
+    jsonrpc: "2.0";
+    id: JsonRpcId;
+    error: {
+        code: number;
+        message: string;
+    };
+};
+export type JsonRpcResponse = JsonRpcSuccess | JsonRpcFailure;
+export declare const JSONRPC_PARSE_ERROR = -32700;
+export declare const JSONRPC_INVALID_REQUEST = -32600;
+export declare const JSONRPC_METHOD_NOT_FOUND = -32601;
+export declare const JSONRPC_INVALID_PARAMS = -32602;
+export declare const JSONRPC_INTERNAL_ERROR = -32603;
+export declare const JSONRPC_UNAUTHORIZED = -32001;
+export declare const rpcResult: (id: JsonRpcId, result: unknown) => JsonRpcSuccess;
+export declare const rpcError: (id: JsonRpcId, code: number, message: string) => JsonRpcFailure;
+//# sourceMappingURL=jsonrpc.d.ts.map

package/dist/jsonrpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAE9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAC1C,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAC/C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C,eAAO,MAAM,SAAS,GACpB,IAAI,SAAS,EACb,QAAQ,OAAO,KACd,cAID,CAAC;AAEH,eAAO,MAAM,QAAQ,GACnB,IAAI,SAAS,EACb,MAAM,MAAM,EACZ,SAAS,MAAM,KACd,cAID,CAAC"}

package/dist/jsonrpc.js

@@ -0,0 +1,17 @@
+export const JSONRPC_PARSE_ERROR = -32700;
+export const JSONRPC_INVALID_REQUEST = -32600;
+export const JSONRPC_METHOD_NOT_FOUND = -32601;
+export const JSONRPC_INVALID_PARAMS = -32602;
+export const JSONRPC_INTERNAL_ERROR = -32603;
+export const JSONRPC_UNAUTHORIZED = -32001;
+export const rpcResult = (id, result) => ({
+    jsonrpc: "2.0",
+    id,
+    result,
+});
+export const rpcError = (id, code, message) => ({
+    jsonrpc: "2.0",
+    id,
+    error: { code, message },
+});
+//# sourceMappingURL=jsonrpc.js.map

package/dist/jsonrpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AAE3C,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,EAAa,EACb,MAAe,EACC,EAAE,CAAC,CAAC;IACpB,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,IAAY,EACZ,OAAe,EACC,EAAE,CAAC,CAAC;IACpB,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC"}

package/dist/methods.d.ts

@@ -0,0 +1,52 @@
+import { type JsonRpcRequest } from "./jsonrpc.js";
+import type { ToolRegistry } from "./registry.js";
+import { type WwwAuthenticateOptions } from "./auth/bearer.js";
+export type Principal = {
+    id: string;
+    scopes: string[];
+};
+export type AuditEntry = {
+    /** JSON-RPC method, or `""` for transport-level rejections made before parsing. */
+    method: string;
+    tool?: string;
+    principalId?: string;
+    ok: boolean;
+    error?: string;
+    durationMs: number;
+};
+export type McpPorts<TCtx> = {
+    authenticate: (req: Request, method: string, tool?: string) => Promise<Principal | null>;
+    context: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
+    audit?: (entry: AuditEntry) => void | Promise<void>;
+};
+export type ServerInfo = {
+    name: string;
+    version: string;
+};
+export type McpHandlerOptions<TCtx> = {
+    registry: ToolRegistry<TCtx>;
+    ports: McpPorts<TCtx>;
+    serverInfo: ServerInfo;
+    instructions?: string;
+    wwwAuthenticate: WwwAuthenticateOptions | ((req: Request) => WwwAuthenticateOptions);
+    /** Methods that skip auth (default: initialize, ping, notifications/*). */
+    publicMethods?: Set<string>;
+};
+export declare const DEFAULT_PUBLIC_METHODS: Set<string>;
+export declare const isNotification: (body: JsonRpcRequest) => boolean;
+export declare const resolveWww: <TCtx>(options: McpHandlerOptions<TCtx>, req: Request) => WwwAuthenticateOptions;
+export declare const unauthorized: (www: WwwAuthenticateOptions, message?: string) => Response;
+/**
+ * Invoke the audit port, swallowing any failure.
+ * Telemetry must never turn a served response into a transport error —
+ * this is the only call path to `ports.audit`.
+ */
+export declare const safeAudit: <TCtx>(options: McpHandlerOptions<TCtx>, entry: AuditEntry) => Promise<void>;
+export declare const hasScope: (principal: Principal, scope: string | undefined) => boolean;
+export declare const dispatchRpc: <TCtx>(input: {
+    req: Request;
+    body: JsonRpcRequest;
+    options: McpHandlerOptions<TCtx>;
+    publicMethods: Set<string>;
+}) => Promise<Response>;
+//# sourceMappingURL=methods.d.ts.map

package/dist/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,IAAI,IAAI;IAC3B,YAAY,EAAE,CACZ,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,KACV,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,IAAI,IAAI;IACpC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EACX,sBAAsB,GACtB,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,sBAAsB,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,sBAAsB,aAKjC,CAAC;AAUH,eAAO,MAAM,cAAc,GAAI,MAAM,cAAc,KAAG,OACQ,CAAC;AAE/D,eAAO,MAAM,UAAU,GAAI,IAAI,EAC7B,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,KAAK,OAAO,KACX,sBAG0B,CAAC;AAE9B,eAAO,MAAM,YAAY,GACvB,KAAK,sBAAsB,EAC3B,gBAAwB,KACvB,QAGC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAU,IAAI,EAClC,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,OAAO,UAAU,KAChB,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,QAAQ,GACnB,WAAW,SAAS,EACpB,OAAO,MAAM,GAAG,SAAS,KACxB,OAGF,CAAC;AAoEF,eAAO,MAAM,WAAW,GAAU,IAAI,EAAE,OAAO;IAC7C,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B,KAAG,OAAO,CAAC,QAAQ,CAsCnB,CAAC"}

package/dist/methods.js

@@ -0,0 +1,114 @@
+import { JSONRPC_METHOD_NOT_FOUND, JSONRPC_UNAUTHORIZED, rpcError, rpcResult, } from "./jsonrpc.js";
+import { emptyResponse, jsonResponse } from "./http.js";
+import { pickProtocolVersion } from "./protocol.js";
+import { wwwAuthenticateHeader, } from "./auth/bearer.js";
+export const DEFAULT_PUBLIC_METHODS = new Set([
+    "initialize",
+    "ping",
+    "notifications/initialized",
+    "initialized",
+]);
+const NOTIFICATION_PREDICATES = [
+    (body) => typeof body.method === "string" && body.method.startsWith("notifications/"),
+    (body) => body.method === "initialized",
+    (body) => body.id === undefined && body.method === undefined && "result" in body,
+];
+export const isNotification = (body) => NOTIFICATION_PREDICATES.some((predicate) => predicate(body));
+export const resolveWww = (options, req) => typeof options.wwwAuthenticate === "function"
+    ? options.wwwAuthenticate(req)
+    : options.wwwAuthenticate;
+export const unauthorized = (www, message = "Unauthorized") => jsonResponse(rpcError(null, JSONRPC_UNAUTHORIZED, message), 401, {
+    "WWW-Authenticate": wwwAuthenticateHeader(www),
+});
+/**
+ * Invoke the audit port, swallowing any failure.
+ * Telemetry must never turn a served response into a transport error —
+ * this is the only call path to `ports.audit`.
+ */
+export const safeAudit = async (options, entry) => {
+    try {
+        await options.ports.audit?.(entry);
+    }
+    catch {
+        // Intentionally ignored.
+    }
+};
+export const hasScope = (principal, scope) => {
+    if (!scope)
+        return true;
+    return principal.scopes.includes(scope) || principal.scopes.includes("*");
+};
+const METHODS = {
+    initialize: async ({ id, body, options }) => jsonResponse(rpcResult(id, {
+        protocolVersion: pickProtocolVersion(body.params),
+        capabilities: { tools: {} },
+        serverInfo: options.serverInfo,
+        instructions: options.instructions ?? "",
+    })),
+    ping: async ({ id }) => jsonResponse(rpcResult(id, {})),
+    "tools/list": async ({ id, options }) => jsonResponse(rpcResult(id, { tools: options.registry.list() })),
+    "tools/call": async ({ req, body, id, principal, ctx, options }) => {
+        const params = body.params ?? {};
+        const name = String(params.name ?? "");
+        const rawArgs = params.arguments;
+        const args = rawArgs !== null &&
+            typeof rawArgs === "object" &&
+            !Array.isArray(rawArgs)
+            ? rawArgs
+            : {};
+        const tool = options.registry.get(name);
+        if (tool?.scope && (!principal || !hasScope(principal, tool.scope))) {
+            await safeAudit(options, {
+                method: "tools/call",
+                tool: name,
+                principalId: principal?.id,
+                ok: false,
+                error: "missing_scope",
+                durationMs: 0,
+            });
+            return unauthorized(resolveWww(options, req), `Missing scope: ${tool.scope}`);
+        }
+        const started = Date.now();
+        const result = await options.registry.call(name, ctx, args);
+        await safeAudit(options, {
+            method: "tools/call",
+            tool: name,
+            principalId: principal?.id,
+            ok: !result.isError,
+            error: result.isError ? result.content[0]?.text : undefined,
+            durationMs: Date.now() - started,
+        });
+        return jsonResponse(rpcResult(id, result));
+    },
+};
+export const dispatchRpc = async (input) => {
+    const { req, body, options, publicMethods } = input;
+    const method = body.method ?? "";
+    // Notifications omit `id`; explicit null is a valid request id (JSON-RPC).
+    const id = body.id === undefined ? null : body.id;
+    const toolName = method === "tools/call" ? String(body.params?.name ?? "") : undefined;
+    const isPublic = publicMethods.has(method) || method.startsWith("notifications/");
+    let principal = null;
+    if (!isPublic) {
+        principal = await options.ports.authenticate(req, method, toolName);
+        if (!principal) {
+            await safeAudit(options, {
+                method,
+                tool: toolName,
+                ok: false,
+                error: "unauthorized",
+                durationMs: 0,
+            });
+            return unauthorized(resolveWww(options, req));
+        }
+    }
+    const handler = METHODS[method];
+    if (!handler) {
+        if (body.id === undefined)
+            return emptyResponse(202);
+        return jsonResponse(rpcError(body.id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${method}`));
+    }
+    const ctx = await options.ports.context(req, principal);
+    return handler({ req, body, id, principal, ctx, options });
+};
+//# sourceMappingURL=methods.js.map

package/dist/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EAGpB,QAAQ,EACR,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AA4C1B,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,MAAM;IACN,2BAA2B;IAC3B,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAA6C;IACxE,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC7E,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,aAAa;IACvC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,IAAI,IAAI;CACzE,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAoB,EAAW,EAAE,CAC9D,uBAAuB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,OAAgC,EAChC,GAAY,EACY,EAAE,CAC1B,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU;IAC3C,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;AAE9B,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAA2B,EAC3B,OAAO,GAAG,cAAc,EACd,EAAE,CACZ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE;IAC/D,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,CAAC;CAC/C,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAgC,EAChC,KAAiB,EACF,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,SAAoB,EACpB,KAAyB,EAChB,EAAE;IACX,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC,CAAC;AAWF,MAAM,OAAO,GAAG;IACd,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,YAAY,CACV,SAAS,CAAC,EAAE,EAAE;QACZ,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QACjD,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;KACzC,CAAC,CACH;IAEH,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAEvD,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CACtC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEjE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,MAAM,IAAI,GACR,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,SAAS,EAAE,EAAE;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EACxB,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,CAAC,OAAO,EAAE;YACvB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,SAAS,EAAE,EAAE;YAC1B,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;YACnB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;YAC3D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACmD,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAQ,KAKvC,EAAqB,EAAE;IACtB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,2EAA2E;IAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,MAAM,QAAQ,GACZ,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,QAAQ,GACZ,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACnE,IAAI,SAAS,GAAqB,IAAI,CAAC;IAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,cAAc;gBACrB,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAI,OAAsD,CACrE,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QACrD,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC,CAAC"}

package/dist/oauth/authorize.d.ts

@@ -0,0 +1,3 @@
+import { type OAuthRouterOptions } from "./types.js";
+export declare const handleAuthorize: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/oauth/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAYA,OAAO,EAKL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AAmDpB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAoFlB,CAAC"}

package/dist/oauth/authorize.js

@@ -0,0 +1,109 @@
+import { requireHttpMethod } from "../http.js";
+import { issueAuthCode } from "./codes.js";
+import { OAUTH_ERRORS } from "./constants.js";
+import { isAllowedRedirectUri, } from "./redirect.js";
+import { canonicalResource, firstResourceError, } from "./resource.js";
+import { firstScopeError, formatScope, requestedScopes } from "./scope.js";
+import { advertisedScopes, oauthError, unregisteredClientError, resolveSecret, } from "./types.js";
+const GET_ONLY = new Set(["GET"]);
+/**
+ * A pre-registered client is bound to its own redirect URIs.
+ * Only unknown (dynamic / public) clients fall back to the global allowlist.
+ */
+const redirectAllowed = (redirectUri, registered, allowlist) => {
+    if (!redirectUri)
+        return false;
+    if (registered)
+        return registered.redirectUris.includes(redirectUri);
+    return isAllowedRedirectUri(redirectUri, allowlist);
+};
+const firstAuthzError = (input) => {
+    const rule = [
+        {
+            ok: input.responseType === "code",
+            description: "response_type must be code",
+        },
+        {
+            ok: redirectAllowed(input.redirectUri, input.registered, input.redirect),
+            description: "invalid redirect_uri",
+        },
+        {
+            ok: Boolean(input.codeChallenge) && input.challengeMethod === "S256",
+            description: "PKCE S256 code_challenge required",
+        },
+    ].find((entry) => !entry.ok);
+    if (rule) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, rule.description);
+    }
+    return firstResourceError(input.resource, input.expectedResource);
+};
+export const handleAuthorize = async (request, options) => {
+    const methodError = requireHttpMethod(request, GET_ONLY);
+    if (methodError)
+        return methodError;
+    const url = new URL(request.url);
+    const expectedResource = canonicalResource(url.origin, options.resourcePath);
+    const clientId = url.searchParams.get("client_id") ?? "";
+    if (!clientId) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
+    }
+    const registered = (await options.ports.clientStore?.get(clientId)) ?? null;
+    if (!registered) {
+        const unregistered = unregisteredClientError(options, {
+            code: OAUTH_ERRORS.unauthorizedClient,
+            status: 400,
+        });
+        if (unregistered)
+            return unregistered;
+    }
+    const authzError = firstAuthzError({
+        responseType: url.searchParams.get("response_type") ?? "",
+        redirectUri: url.searchParams.get("redirect_uri") ?? "",
+        codeChallenge: url.searchParams.get("code_challenge") ?? "",
+        challengeMethod: url.searchParams.get("code_challenge_method") ?? "S256",
+        resource: url.searchParams.get("resource") ?? "",
+        expectedResource,
+        registered,
+        redirect: options.redirect,
+    });
+    if (authzError)
+        return authzError;
+    const advertised = advertisedScopes(options);
+    const granted = requestedScopes(url.searchParams.get("scope") ?? "", advertised);
+    const scopeError = firstScopeError(granted, advertised);
+    if (scopeError)
+        return scopeError;
+    const user = await options.ports.resolveUser(request);
+    if (!user) {
+        const next = `${url.pathname}${url.search}`;
+        const login = options.ports.loginUrl(request, next);
+        let loginTarget;
+        try {
+            loginTarget = new URL(login, url.origin);
+        }
+        catch {
+            return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
+        }
+        if (loginTarget.protocol !== "http:" && loginTarget.protocol !== "https:") {
+            return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
+        }
+        return Response.redirect(loginTarget.toString(), 302);
+    }
+    const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+    const secret = await resolveSecret(options.ports, request);
+    const code = await issueAuthCode(secret, {
+        clientId,
+        redirectUri,
+        codeChallenge: url.searchParams.get("code_challenge") ?? "",
+        userId: user.id,
+        resource: expectedResource,
+        scope: formatScope(granted),
+    });
+    const target = new URL(redirectUri);
+    target.searchParams.set("code", code);
+    const state = url.searchParams.get("state") ?? "";
+    if (state)
+        target.searchParams.set("state", state);
+    return Response.redirect(target.toString(), 302);
+};
+//# sourceMappingURL=authorize.js.map

package/dist/oauth/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,oBAAoB,GAErB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,uBAAuB,EACvB,aAAa,GAGd,MAAM,YAAY,CAAC;AAEpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAElC;;;GAGG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,UAAmC,EACnC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAaF,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAmB,EAAE;IAC7D,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,KAAK,CAAC,YAAY,KAAK,MAAM;YACjC,WAAW,EAAE,4BAA4B;SAC1C;QACD;YACE,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;YACxE,WAAW,EAAE,sBAAsB;SACpC;QACD;YACE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM;YACpE,WAAW,EAAE,mCAAmC;SACjD;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GACd,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAE3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;YACrC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;IACxC,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;QACzD,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACvD,aAAa,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC3D,eAAe,EACb,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM;QACzD,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;QAChD,gBAAgB;QAChB,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EACnC,UAAU,CACX,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;QACvC,QAAQ;QACR,WAAW;QACX,aAAa,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC3D,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC,CAAC"}

package/dist/oauth/base64url.d.ts

@@ -0,0 +1,5 @@
+/** Shared base64url helpers (WebCrypto / DOM — no Node Buffer). */
+export declare const bytesToBase64Url: (bytes: ArrayBuffer | Uint8Array) => string;
+export declare const textToBase64Url: (text: string) => string;
+export declare const fromBase64Url: (text: string) => Uint8Array;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/oauth/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/oauth/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,eAAO,MAAM,gBAAgB,GAAI,OAAO,WAAW,GAAG,UAAU,KAAG,MAOlE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,MACG,CAAC;AAEnD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,UAM5C,CAAC"}

package/dist/oauth/base64url.js

@@ -0,0 +1,17 @@
+/** Shared base64url helpers (WebCrypto / DOM — no Node Buffer). */
+export const bytesToBase64Url = (bytes) => {
+    const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    const binary = Array.from(u8, (byte) => String.fromCharCode(byte)).join("");
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+};
+export const textToBase64Url = (text) => bytesToBase64Url(new TextEncoder().encode(text));
+export const fromBase64Url = (text) => {
+    const padded = text.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+    const bin = atob(padded + pad);
+    return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+};
+//# sourceMappingURL=base64url.js.map

package/dist/oauth/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/oauth/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAA+B,EAAU,EAAE;IAC1E,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CACtD,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAc,EAAE;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GACP,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC"}

package/dist/oauth/clientauth.d.ts

@@ -0,0 +1,19 @@
+/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
+import { type TokenEndpointAuthMethod } from "./constants.js";
+import { type OAuthRouterOptions } from "./types.js";
+export type ClientAuth = {
+    clientId: string;
+    secret: string | null;
+    method: TokenEndpointAuthMethod;
+};
+/** Credentials from the Authorization header, else from the body. */
+export declare const readClientAuth: (request: Request, body: Record<string, string>) => ClientAuth | null;
+/**
+ * Enforce the registered auth method for known clients.
+ *
+ * An unknown client_id is treated as public — PKCE is its only proof —
+ * unless `allowUnregisteredClients` is false, in which case it is rejected
+ * rather than silently falling back to "no auth required".
+ */
+export declare const firstClientAuthError: (auth: ClientAuth, options: OAuthRouterOptions) => Promise<Response | null>;
+//# sourceMappingURL=clientauth.d.ts.map

package/dist/oauth/clientauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../src/oauth/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAqBF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAef,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAwBzB,CAAC"}

package/dist/oauth/clientauth.js

@@ -0,0 +1,76 @@
+/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
+import { OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
+import { oauthError, unregisteredClientError, } from "./types.js";
+/** `Authorization: Basic base64(urlencode(id):urlencode(secret))`. */
+const parseBasicAuth = (header) => {
+    if (!header?.startsWith("Basic "))
+        return null;
+    try {
+        const decoded = atob(header.slice("Basic ".length).trim());
+        const separator = decoded.indexOf(":");
+        if (separator < 0)
+            return null;
+        const clientId = decodeURIComponent(decoded.slice(0, separator));
+        if (!clientId)
+            return null;
+        return {
+            clientId,
+            secret: decodeURIComponent(decoded.slice(separator + 1)),
+            method: TOKEN_ENDPOINT_AUTH_METHODS.basic,
+        };
+    }
+    catch {
+        return null;
+    }
+};
+/** Credentials from the Authorization header, else from the body. */
+export const readClientAuth = (request, body) => {
+    const basic = parseBasicAuth(request.headers.get("Authorization"));
+    if (basic)
+        return basic;
+    const clientId = body.client_id ?? "";
+    if (!clientId)
+        return null;
+    const secret = body.client_secret ?? "";
+    return {
+        clientId,
+        secret: secret.length > 0 ? secret : null,
+        method: secret.length > 0
+            ? TOKEN_ENDPOINT_AUTH_METHODS.post
+            : TOKEN_ENDPOINT_AUTH_METHODS.none,
+    };
+};
+const invalidClient = (description) => oauthError(OAUTH_ERRORS.invalidClient, 401, description);
+/**
+ * Enforce the registered auth method for known clients.
+ *
+ * An unknown client_id is treated as public — PKCE is its only proof —
+ * unless `allowUnregisteredClients` is false, in which case it is rejected
+ * rather than silently falling back to "no auth required".
+ */
+export const firstClientAuthError = async (auth, options) => {
+    const store = options.ports.clientStore;
+    const registered = (await store?.get(auth.clientId)) ?? null;
+    if (!registered) {
+        return unregisteredClientError(options, {
+            code: OAUTH_ERRORS.invalidClient,
+            status: 401,
+        });
+    }
+    const expected = registered.tokenEndpointAuthMethod;
+    if (expected === TOKEN_ENDPOINT_AUTH_METHODS.none)
+        return null;
+    if (auth.method !== expected) {
+        return invalidClient(`client requires ${expected}`);
+    }
+    if (!auth.secret)
+        return invalidClient("client_secret required");
+    if (!store?.verifySecret) {
+        return invalidClient("clientStore.verifySecret is not configured");
+    }
+    if (!(await store.verifySecret(auth.clientId, auth.secret))) {
+        return invalidClient("client authentication failed");
+    }
+    return null;
+};
+//# sourceMappingURL=clientauth.js.map

package/dist/oauth/clientauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../src/oauth/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,uBAAuB,GAExB,MAAM,YAAY,CAAC;AAQpB,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,2BAA2B,CAAC,IAAI;YAClC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KACrC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,WAAmB,EAAY,EAAE,CACtD,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EACD,EAAE;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,MAAM,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,uBAAuB,CAAC,OAAO,EAAE;YACtC,IAAI,EAAE,YAAY,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,aAAa,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC,wBAAwB,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/oauth/codes.d.ts

@@ -0,0 +1,30 @@
+export type AuthCodeRecord = {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    /** Consenting user id — required so minted tokens are bound. */
+    userId: string;
+    /** RFC 8707 resource indicator — audience for the eventual access token. */
+    resource: string;
+    /** Space-delimited scope granted at authorize time. */
+    scope: string;
+    exp: number;
+};
+export type CodeStore = {
+    /**
+     * Mark a code jti as consumed; return false if already used.
+     * `expMs` is the code expiry (ms since epoch) for TTL-backed stores.
+     */
+    consume: (jti: string, expMs: number) => Promise<boolean> | boolean;
+};
+/**
+ * Issue an HMAC-signed auth code.
+ * Single-use via codeStore, or pruning in-memory Map when omitted.
+ */
+export declare const issueAuthCode: (secret: string, record: Omit<AuthCodeRecord, "exp">, nowMs?: number) => Promise<string>;
+export declare const consumeAuthCode: (secret: string, code: string, options?: {
+    codeStore?: CodeStore;
+    nowMs?: number;
+}) => Promise<AuthCodeRecord | null>;
+export declare const newClientId: () => string;
+//# sourceMappingURL=codes.d.ts.map

package/dist/oauth/codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/oauth/codes.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACrE,CAAC;AAkCF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,QAAQ,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EACnC,cAAkB,KACjB,OAAO,CAAC,MAAM,CAShB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,UAAS;IAAE,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,KACtD,OAAO,CAAC,cAAc,GAAG,IAAI,CA8C/B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,MAA6B,CAAC"}