mcp-trellis 0.1.0

package/dist/oauth/codes.js

@@ -0,0 +1,93 @@
+import { randomBase64Url } from "./pkce.js";
+import { bytesToBase64Url, fromBase64Url, textToBase64Url } from "./base64url.js";
+import { timingSafeEqual } from "../auth/bearer.js";
+const CODE_TTL_MS = 600_000;
+/**
+ * Process-local jti → expMs map when no shared codeStore is provided.
+ * ponytail: single-process only; multi-instance → pass ports.codeStore (KV/Redis SET NX EX).
+ */
+const memoryUsed = new Map();
+const pruneMemory = (nowMs) => {
+    [...memoryUsed].forEach(([jti, exp]) => {
+        if (exp < nowMs)
+            memoryUsed.delete(jti);
+    });
+};
+const memoryCodeStore = {
+    consume: (jti, expMs) => {
+        const nowMs = Date.now();
+        pruneMemory(nowMs);
+        if (memoryUsed.has(jti))
+            return false;
+        memoryUsed.set(jti, expMs);
+        return true;
+    },
+};
+const hmacSign = async (secret, payload) => {
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
+    return bytesToBase64Url(sig);
+};
+/**
+ * Issue an HMAC-signed auth code.
+ * Single-use via codeStore, or pruning in-memory Map when omitted.
+ */
+export const issueAuthCode = async (secret, record, nowMs = Date.now()) => {
+    const body = {
+        ...record,
+        exp: nowMs + CODE_TTL_MS,
+        jti: randomBase64Url(12),
+    };
+    const payload = textToBase64Url(JSON.stringify(body));
+    const sig = await hmacSign(secret, payload);
+    return `${payload}.${sig}`;
+};
+export const consumeAuthCode = async (secret, code, options = {}) => {
+    if (!code || !secret)
+        return null;
+    const parts = code.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [payload, sig] = parts;
+    if (!payload || !sig)
+        return null;
+    const expected = await hmacSign(secret, payload);
+    if (!timingSafeEqual(sig, expected))
+        return null;
+    try {
+        const raw = new TextDecoder().decode(fromBase64Url(payload));
+        const data = JSON.parse(raw);
+        const nowMs = options.nowMs ?? Date.now();
+        if (typeof data.clientId !== "string" ||
+            typeof data.redirectUri !== "string" ||
+            typeof data.codeChallenge !== "string" ||
+            typeof data.userId !== "string" ||
+            typeof data.resource !== "string" ||
+            data.resource.length === 0 ||
+            typeof data.scope !== "string" ||
+            typeof data.exp !== "number" ||
+            data.exp < nowMs) {
+            return null;
+        }
+        if (typeof data.jti !== "string" || data.jti.length === 0)
+            return null;
+        const store = options.codeStore ?? memoryCodeStore;
+        const fresh = await store.consume(data.jti, data.exp);
+        if (!fresh)
+            return null;
+        return {
+            clientId: data.clientId,
+            redirectUri: data.redirectUri,
+            codeChallenge: data.codeChallenge,
+            userId: data.userId,
+            resource: data.resource,
+            scope: data.scope,
+            exp: data.exp,
+        };
+    }
+    catch {
+        return null;
+    }
+};
+export const newClientId = () => randomBase64Url(16);
+//# sourceMappingURL=codes.js.map

package/dist/oauth/codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/oauth/codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAuB7C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAQ,EAAE;IAC1C,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,KAAK;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAc;IACjC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,OAAe,EAAmB,EAAE;IAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,CAAC;IACF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,MAAmC,EACnC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EACD,EAAE;IACnB,MAAM,IAAI,GAAqC;QAC7C,GAAG,MAAM;QACT,GAAG,EAAE,KAAK,GAAG,WAAW;QACxB,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;KACzB,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAc,EACd,IAAY,EACZ,UAAqD,EAAE,EACvB,EAAE;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+C,CAAC;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,IACE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACjC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YACpC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YACtC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC/B,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC9B,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,IAAI,CAAC,GAAG,GAAG,KAAK,EAChB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvE,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC"}

package/dist/oauth/constants.d.ts

@@ -0,0 +1,32 @@
+export declare const GRANT_TYPES: {
+    readonly authorizationCode: "authorization_code";
+    readonly refreshToken: "refresh_token";
+};
+export type GrantType = (typeof GRANT_TYPES)[keyof typeof GRANT_TYPES];
+export declare const OAUTH_ERRORS: {
+    readonly invalidRequest: "invalid_request";
+    readonly invalidGrant: "invalid_grant";
+    readonly unsupportedGrantType: "unsupported_grant_type";
+    readonly invalidRedirectUri: "invalid_redirect_uri";
+    /** Token endpoint — client authentication failed, or the client is unknown. */
+    readonly invalidClient: "invalid_client";
+    /** Authorization endpoint — this client may not use this method. RFC 6749 §4.1.2.1. */
+    readonly unauthorizedClient: "unauthorized_client";
+    /** Requested scope exceeds what this server advertises. */
+    readonly invalidScope: "invalid_scope";
+    /** RFC 8707 — requested resource is not acceptable. */
+    readonly invalidTarget: "invalid_target";
+    /** A host port threw. RFC 6749 §4.1.2.1 / §5.2 — our fault, not the client's. */
+    readonly serverError: "server_error";
+};
+export declare const TOKEN_ENDPOINT_AUTH_METHODS: {
+    /** Public client — PKCE is the only proof. */
+    readonly none: "none";
+    /** Credentials in the Authorization header. */
+    readonly basic: "client_secret_basic";
+    /** Credentials in the request body. */
+    readonly post: "client_secret_post";
+};
+export type TokenEndpointAuthMethod = (typeof TOKEN_ENDPOINT_AUTH_METHODS)[keyof typeof TOKEN_ENDPOINT_AUTH_METHODS];
+export declare const DEFAULT_SCOPE = "mcp";
+//# sourceMappingURL=constants.d.ts.map

package/dist/oauth/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW;;;CAGd,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEvE,eAAO,MAAM,YAAY;;;;;IAKvB,+EAA+E;;IAE/E,uFAAuF;;IAEvF,2DAA2D;;IAE3D,uDAAuD;;IAEvD,iFAAiF;;CAEzE,CAAC;AAEX,eAAO,MAAM,2BAA2B;IACtC,8CAA8C;;IAE9C,+CAA+C;;IAE/C,uCAAuC;;CAE/B,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,eAAO,MAAM,aAAa,QAAQ,CAAC"}

package/dist/oauth/constants.js

@@ -0,0 +1,30 @@
+export const GRANT_TYPES = {
+    authorizationCode: "authorization_code",
+    refreshToken: "refresh_token",
+};
+export const OAUTH_ERRORS = {
+    invalidRequest: "invalid_request",
+    invalidGrant: "invalid_grant",
+    unsupportedGrantType: "unsupported_grant_type",
+    invalidRedirectUri: "invalid_redirect_uri",
+    /** Token endpoint — client authentication failed, or the client is unknown. */
+    invalidClient: "invalid_client",
+    /** Authorization endpoint — this client may not use this method. RFC 6749 §4.1.2.1. */
+    unauthorizedClient: "unauthorized_client",
+    /** Requested scope exceeds what this server advertises. */
+    invalidScope: "invalid_scope",
+    /** RFC 8707 — requested resource is not acceptable. */
+    invalidTarget: "invalid_target",
+    /** A host port threw. RFC 6749 §4.1.2.1 / §5.2 — our fault, not the client's. */
+    serverError: "server_error",
+};
+export const TOKEN_ENDPOINT_AUTH_METHODS = {
+    /** Public client — PKCE is the only proof. */
+    none: "none",
+    /** Credentials in the Authorization header. */
+    basic: "client_secret_basic",
+    /** Credentials in the request body. */
+    post: "client_secret_post",
+};
+export const DEFAULT_SCOPE = "mcp";
+//# sourceMappingURL=constants.js.map

package/dist/oauth/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB,EAAE,oBAAoB;IACvC,YAAY,EAAE,eAAe;CACrB,CAAC;AAIX,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc,EAAE,iBAAiB;IACjC,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,wBAAwB;IAC9C,kBAAkB,EAAE,sBAAsB;IAC1C,+EAA+E;IAC/E,aAAa,EAAE,gBAAgB;IAC/B,uFAAuF;IACvF,kBAAkB,EAAE,qBAAqB;IACzC,2DAA2D;IAC3D,YAAY,EAAE,eAAe;IAC7B,uDAAuD;IACvD,aAAa,EAAE,gBAAgB;IAC/B,iFAAiF;IACjF,WAAW,EAAE,cAAc;CACnB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,8CAA8C;IAC9C,IAAI,EAAE,MAAM;IACZ,+CAA+C;IAC/C,KAAK,EAAE,qBAAqB;IAC5B,uCAAuC;IACvC,IAAI,EAAE,oBAAoB;CAClB,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC"}

package/dist/oauth/metadata.d.ts

@@ -0,0 +1,45 @@
+import { type GrantType, type TokenEndpointAuthMethod } from "./constants.js";
+export type { GrantType } from "./constants.js";
+export type ProtectedResourceMetadata = {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    scopes_supported: string[];
+};
+export type AuthorizationServerMetadata = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    /** Omitted when this server does not accept dynamically registered clients. */
+    registration_endpoint?: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    token_endpoint_auth_methods_supported: TokenEndpointAuthMethod[];
+    scopes_supported: string[];
+    /** RFC 8707 — clients must send `resource` on authorize/token. */
+    resource_parameter_supported: boolean;
+    /** Omitted when `revokeToken` is not configured. */
+    revocation_endpoint?: string;
+    revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
+};
+export type MetadataOptions = {
+    origin: string;
+    /** MCP resource path, e.g. "/mcp". */
+    resourcePath?: string;
+    /** OAuth path prefix, e.g. "/mcp/oauth". */
+    oauthPath?: string;
+    /** Only advertise grants that are actually handled. */
+    grantTypes: GrantType[];
+    scopes?: string[];
+    /** Only advertise auth methods the configured clients actually use. */
+    tokenEndpointAuthMethods?: TokenEndpointAuthMethod[];
+    /** Advertise `registration_endpoint`. Default true. */
+    dcrEnabled?: boolean;
+    /** Advertise `revocation_endpoint`. Default false. */
+    revocationEnabled?: boolean;
+};
+export declare const protectedResourceMetadata: (options: MetadataOptions) => ProtectedResourceMetadata;
+export declare const authorizationServerMetadata: (options: MetadataOptions) => AuthorizationServerMetadata;
+export declare const mcpWwwAuthenticate: (origin: string, resourcePath?: string, realm?: string) => string;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,4BAA4B,EAAE,OAAO,CAAC;IACtC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0CAA0C,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,SAAS,eAAe,KACvB,yBAKD,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,SAAS,eAAe,KACvB,2BAyBF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,qBAAoC,EACpC,cAAa,KACZ,MAC2G,CAAC"}

package/dist/oauth/metadata.js

@@ -0,0 +1,36 @@
+import { DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
+import { canonicalResource, DEFAULT_RESOURCE_PATH } from "./resource.js";
+export const protectedResourceMetadata = (options) => ({
+    resource: canonicalResource(options.origin, options.resourcePath),
+    authorization_servers: [options.origin],
+    bearer_methods_supported: ["header"],
+    scopes_supported: options.scopes ?? [DEFAULT_SCOPE],
+});
+export const authorizationServerMetadata = (options) => {
+    const oauthPath = options.oauthPath ?? "/mcp/oauth";
+    const tokenEndpointAuthMethods = options.tokenEndpointAuthMethods ?? [
+        TOKEN_ENDPOINT_AUTH_METHODS.none,
+    ];
+    return {
+        issuer: options.origin,
+        authorization_endpoint: `${options.origin}${oauthPath}/authorize`,
+        token_endpoint: `${options.origin}${oauthPath}/token`,
+        ...(options.dcrEnabled !== false
+            ? { registration_endpoint: `${options.origin}${oauthPath}/register` }
+            : {}),
+        ...(options.revocationEnabled
+            ? {
+                revocation_endpoint: `${options.origin}${oauthPath}/revoke`,
+                revocation_endpoint_auth_methods_supported: tokenEndpointAuthMethods,
+            }
+            : {}),
+        response_types_supported: ["code"],
+        grant_types_supported: [...options.grantTypes],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,
+        scopes_supported: options.scopes ?? [DEFAULT_SCOPE],
+        resource_parameter_supported: true,
+    };
+};
+export const mcpWwwAuthenticate = (origin, resourcePath = DEFAULT_RESOURCE_PATH, realm = "mcp") => `Bearer realm="${realm}", resource_metadata="${origin}/.well-known/oauth-protected-resource${resourcePath}"`;
+//# sourceMappingURL=metadata.js.map

package/dist/oauth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,2BAA2B,GAG5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AA8CzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAwB,EACG,EAAE,CAAC,CAAC;IAC/B,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;IACjE,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAAwB,EACK,EAAE;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI;QACnE,2BAA2B,CAAC,IAAI;KACjC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,YAAY;QACjE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ;QACrD,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,WAAW,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC;gBACE,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,SAAS;gBAC3D,0CAA0C,EAAE,wBAAwB;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QAC9C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,wBAAwB;QAC/D,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;QACnD,4BAA4B,EAAE,IAAI;KACnC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,YAAY,GAAG,qBAAqB,EACpC,KAAK,GAAG,KAAK,EACL,EAAE,CACV,iBAAiB,KAAK,yBAAyB,MAAM,wCAAwC,YAAY,GAAG,CAAC"}

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,4 @@
+export declare const sha256Base64Url: (input: string) => Promise<string>;
+export declare const verifyPkceS256: (verifier: string, challenge: string) => Promise<boolean>;
+export declare const randomBase64Url: (byteLen: number) => string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAMnE,CAAC;AAEF,eAAO,MAAM,cAAc,GACzB,UAAU,MAAM,EAChB,WAAW,MAAM,KAChB,OAAO,CAAC,OAAO,CAIjB,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,MAGjD,CAAC"}

package/dist/oauth/pkce.js

@@ -0,0 +1,17 @@
+import { bytesToBase64Url } from "./base64url.js";
+import { timingSafeEqual } from "../auth/bearer.js";
+export const sha256Base64Url = async (input) => {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return bytesToBase64Url(digest);
+};
+export const verifyPkceS256 = async (verifier, challenge) => {
+    if (!verifier || !challenge)
+        return false;
+    const computed = await sha256Base64Url(verifier);
+    return timingSafeEqual(computed, challenge);
+};
+export const randomBase64Url = (byteLen) => {
+    const bytes = crypto.getRandomValues(new Uint8Array(byteLen));
+    return bytesToBase64Url(bytes);
+};
+//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAC;IACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,QAAgB,EAChB,SAAiB,EACC,EAAE;IACpB,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC,CAAC"}

package/dist/oauth/redirect.d.ts

@@ -0,0 +1,11 @@
+export declare const CLAUDE_CALLBACK = "https://claude.ai/api/mcp/auth_callback";
+export type RedirectAllowlistOptions = {
+    /** Extra exact-match redirect URIs. */
+    extra?: string[];
+    /** Allow http(s) loopback hosts — 127.0.0.1, [::1], localhost (any port). Default true. */
+    allowLoopback?: boolean;
+    /** Allow the Claude.ai Custom Connector callback. Default true. */
+    allowClaude?: boolean;
+};
+export declare const isAllowedRedirectUri: (uri: string, options?: RedirectAllowlistOptions) => boolean;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/oauth/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/oauth/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAmCF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAA2E,CAAC"}

package/dist/oauth/redirect.js

@@ -0,0 +1,26 @@
+export const CLAUDE_CALLBACK = "https://claude.ai/api/mcp/auth_callback";
+const isClaudeCallback = (uri, options) => options.allowClaude !== false && uri === CLAUDE_CALLBACK;
+const isExtraAllowed = (uri, options) => Boolean(options.extra?.includes(uri));
+/** WHATWG URL keeps IPv6 hosts bracketed, so `[::1]` is the parsed hostname. */
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "[::1]", "localhost"]);
+const isLoopbackHttp = (uri, options) => {
+    if (options.allowLoopback === false)
+        return false;
+    try {
+        const parsed = new URL(uri);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            return false;
+        }
+        return LOOPBACK_HOSTS.has(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+};
+const REDIRECT_PREDICATES = [
+    isClaudeCallback,
+    isExtraAllowed,
+    isLoopbackHttp,
+];
+export const isAllowedRedirectUri = (uri, options = {}) => REDIRECT_PREDICATES.some((predicate) => predicate(uri, options));
+//# sourceMappingURL=redirect.js.map

package/dist/oauth/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../src/oauth/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAgBzE,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CACzD,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAExC,gFAAgF;AAChF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEpE,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB;IAC/C,gBAAgB;IAChB,cAAc;IACd,cAAc;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC"}

package/dist/oauth/resource.d.ts

@@ -0,0 +1,7 @@
+/** Canonical MCP resource URI (RFC 8707 / RFC 9728). */
+export declare const DEFAULT_RESOURCE_PATH = "/mcp";
+export declare const canonicalResource: (origin: string, resourcePath?: string) => string;
+export declare const resourcesEqual: (requested: string, expected: string) => boolean;
+/** Missing → invalid_request; mismatch → invalid_target. */
+export declare const firstResourceError: (requested: string, expected: string) => Response | null;
+//# sourceMappingURL=resource.d.ts.map

package/dist/oauth/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAKxD,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,qBAAoC,KACnC,MAMF,CAAC;AAmBF,eAAO,MAAM,cAAc,GACzB,WAAW,MAAM,EACjB,UAAU,MAAM,KACf,OAGF,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,UAAU,MAAM,KACf,QAAQ,GAAG,IAgBb,CAAC"}

package/dist/oauth/resource.js

@@ -0,0 +1,44 @@
+/** Canonical MCP resource URI (RFC 8707 / RFC 9728). */
+import { OAUTH_ERRORS } from "./constants.js";
+import { oauthError } from "./types.js";
+export const DEFAULT_RESOURCE_PATH = "/mcp";
+export const canonicalResource = (origin, resourcePath = DEFAULT_RESOURCE_PATH) => {
+    const base = origin.replace(/\/$/, "");
+    const path = resourcePath.startsWith("/")
+        ? resourcePath
+        : `/${resourcePath}`;
+    return `${base}${path}`;
+};
+/**
+ * Normalize for RFC 8707 comparison.
+ * Rejects fragments (MUST NOT). Includes query so tenants cannot alias.
+ * ponytail: exact match after WHATWG URL parse; upgrade to RFC 3986 if
+ * non-ASCII hosts or exotic percent-encoding show up.
+ */
+const normalizeResource = (uri) => {
+    try {
+        const u = new URL(uri);
+        if (u.hash)
+            return null;
+        const path = u.pathname.replace(/\/$/, "") || "/";
+        return `${u.protocol}//${u.host}${path}${u.search}`;
+    }
+    catch {
+        return null;
+    }
+};
+export const resourcesEqual = (requested, expected) => {
+    const a = normalizeResource(requested);
+    return a !== null && a === normalizeResource(expected);
+};
+/** Missing → invalid_request; mismatch → invalid_target. */
+export const firstResourceError = (requested, expected) => {
+    if (!requested) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "resource required (RFC 8707)");
+    }
+    if (!resourcesEqual(requested, expected)) {
+        return oauthError(OAUTH_ERRORS.invalidTarget, 400, "resource does not match this server");
+    }
+    return null;
+};
+//# sourceMappingURL=resource.js.map

package/dist/oauth/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACd,YAAY,GAAG,qBAAqB,EAC5B,EAAE;IACV,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IACvB,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAiB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAiB,EACjB,QAAgB,EACP,EAAE;IACX,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAiB,EACjB,QAAgB,EACC,EAAE;IACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CACf,YAAY,CAAC,aAAa,EAC1B,GAAG,EACH,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/oauth/revoke.d.ts

@@ -0,0 +1,4 @@
+/** RFC 7009 token revocation. */
+import { type OAuthRouterOptions } from "./types.js";
+export declare const handleRevoke: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
+//# sourceMappingURL=revoke.d.ts.map

package/dist/oauth/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAKjC,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAUjE,eAAO,MAAM,YAAY,GACvB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAuBlB,CAAC"}

package/dist/oauth/revoke.js

@@ -0,0 +1,30 @@
+/** RFC 7009 token revocation. */
+import { requireHttpMethod } from "../http.js";
+import { firstClientAuthError, readClientAuth } from "./clientauth.js";
+import { OAUTH_ERRORS } from "./constants.js";
+import { oauthError } from "./types.js";
+const POST_ONLY = new Set(["POST"]);
+const NO_CORS = { cors: false };
+const tokenTypeHintOf = (hint) => hint === "access_token" || hint === "refresh_token" ? hint : undefined;
+export const handleRevoke = async (request, options) => {
+    const methodError = requireHttpMethod(request, POST_ONLY, NO_CORS);
+    if (methodError)
+        return methodError;
+    const body = Object.fromEntries(new URLSearchParams(await request.text()).entries());
+    const token = body.token ?? "";
+    if (!token)
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "token required");
+    const auth = readClientAuth(request, body);
+    if (!auth)
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
+    const clientAuthError = await firstClientAuthError(auth, options);
+    if (clientAuthError)
+        return clientAuthError;
+    await options.ports.revokeToken?.({
+        token,
+        clientId: auth.clientId,
+        tokenTypeHint: tokenTypeHintOf(body.token_type_hint),
+    });
+    return new Response(null, { status: 200, headers: { "Cache-Control": "no-store" } });
+};
+//# sourceMappingURL=revoke.js.map

package/dist/oauth/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAA2B,MAAM,YAAY,CAAC;AAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAEzC,MAAM,eAAe,GAAG,CACtB,IAAwB,EACsB,EAAE,CAChD,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CACpD,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAElF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAErF,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC;KACrD,CAAC,CAAC;IAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC,CAAC"}

package/dist/oauth/router.d.ts

@@ -0,0 +1,18 @@
+import { type OAuthRouterOptions } from "./types.js";
+export type { OAuthUser, MintedToken, OAuthPorts, OAuthRouterOptions, } from "./types.js";
+export type OAuthRouter = {
+    /** Returns a Response when this request is OAuth-related; otherwise null. */
+    tryHandle: (request: Request) => Promise<Response | null>;
+};
+export declare const createOAuthRouter: (options: OAuthRouterOptions) => OAuthRouter;
+export { authorizationServerMetadata, protectedResourceMetadata, mcpWwwAuthenticate, } from "./metadata.js";
+export { canonicalResource, resourcesEqual, DEFAULT_RESOURCE_PATH, firstResourceError, } from "./resource.js";
+export { isAllowedRedirectUri, CLAUDE_CALLBACK } from "./redirect.js";
+export { issueAuthCode, consumeAuthCode, newClientId, type AuthCodeRecord, type CodeStore, } from "./codes.js";
+export { verifyPkceS256, sha256Base64Url, randomBase64Url } from "./pkce.js";
+export { GRANT_TYPES, OAUTH_ERRORS, DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, type TokenEndpointAuthMethod, } from "./constants.js";
+export { parseScope, formatScope, requestedScopes, firstScopeError, } from "./scope.js";
+export { readClientAuth, firstClientAuthError, type ClientAuth } from "./clientauth.js";
+export { unregisteredClientsAllowed } from "./types.js";
+export type { MintAccessTokenInput, RefreshAccessTokenInput, RevokeTokenInput, ClientStore, RegisteredClient, } from "./types.js";
+//# sourceMappingURL=router.d.ts.map

package/dist/oauth/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAMpB,YAAY,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,kBAAkB,GACnB,MAAM,YAAY,CAAC;AA4CpB,MAAM,MAAM,WAAW,GAAG;IACxB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAIF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,kBAAkB,KAC1B,WA4DF,CAAC;AAEF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,GACjB,MAAM,YAAY,CAAC"}

package/dist/oauth/router.js

@@ -0,0 +1,105 @@
+import { INTERNAL_ERROR, jsonResponse, requireHttpMethod } from "../http.js";
+import { newClientId } from "./codes.js";
+import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
+import { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
+import { DEFAULT_RESOURCE_PATH } from "./resource.js";
+import { oauthError, unregisteredClientsAllowed, } from "./types.js";
+import { handleAuthorize } from "./authorize.js";
+import { handleToken } from "./token.js";
+import { handleRevoke } from "./revoke.js";
+import { handleWellKnown } from "./wellknown.js";
+const POST_ONLY = new Set(["POST"]);
+const handleRegister = async (request, options) => {
+    const methodError = requireHttpMethod(request, POST_ONLY);
+    if (methodError)
+        return methodError;
+    let suppliedRedirectUris = false;
+    let redirectUris = [];
+    try {
+        const body = (await request.json());
+        const raw = body.redirect_uris;
+        if (Array.isArray(raw)) {
+            suppliedRedirectUris = true;
+            redirectUris = raw
+                .map((u) => String(u))
+                .filter((uri) => isAllowedRedirectUri(uri, options.redirect));
+        }
+    }
+    catch {
+        redirectUris = [];
+    }
+    if (suppliedRedirectUris && redirectUris.length === 0) {
+        return oauthError(OAUTH_ERRORS.invalidRedirectUri, 400, "no allowed redirect_uris");
+    }
+    return jsonResponse({
+        client_id: newClientId(),
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+        token_endpoint_auth_method: "none",
+        redirect_uris: redirectUris.length > 0 ? redirectUris : [CLAUDE_CALLBACK],
+        grant_types: [GRANT_TYPES.authorizationCode],
+        response_types: ["code"],
+    });
+};
+export const createOAuthRouter = (options) => {
+    if (!unregisteredClientsAllowed(options) && !options.ports.clientStore) {
+        throw new Error("allowUnregisteredClients: false requires ports.clientStore " +
+            "so pre-registered clients can be resolved");
+    }
+    const resourcePath = options.resourcePath ?? DEFAULT_RESOURCE_PATH;
+    const oauthPath = options.oauthPath ?? "/mcp/oauth";
+    const prmPaths = new Set([
+        "/.well-known/oauth-protected-resource",
+        `/.well-known/oauth-protected-resource${resourcePath}`,
+    ]);
+    const asPaths = new Set([
+        "/.well-known/oauth-authorization-server",
+        `/.well-known/oauth-authorization-server${resourcePath}`,
+    ]);
+    const routes = {
+        ...(unregisteredClientsAllowed(options)
+            ? {
+                [`${oauthPath}/register`]: (request) => handleRegister(request, options),
+            }
+            : {}),
+        [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, options),
+        [`${oauthPath}/token`]: (request) => handleToken(request, options),
+        ...(options.ports.revokeToken
+            ? {
+                [`${oauthPath}/revoke`]: (request) => handleRevoke(request, options),
+            }
+            : {}),
+    };
+    return {
+        tryHandle: async (request) => {
+            try {
+                const path = new URL(request.url).pathname;
+                const known = await handleWellKnown(request, options, {
+                    prmPaths,
+                    asPaths,
+                    resourcePath,
+                    oauthPath,
+                });
+                if (known)
+                    return known;
+                const route = routes[path];
+                return route ? await route(request) : null;
+            }
+            catch {
+                // A host port (resolveUser/mintAccessToken/clientStore/...) threw.
+                // We only ever reach here on a route this router owns, so answer
+                // with a real error instead of throwing out of `tryHandle`.
+                return oauthError(OAUTH_ERRORS.serverError, 500, INTERNAL_ERROR);
+            }
+        },
+    };
+};
+export { authorizationServerMetadata, protectedResourceMetadata, mcpWwwAuthenticate, } from "./metadata.js";
+export { canonicalResource, resourcesEqual, DEFAULT_RESOURCE_PATH, firstResourceError, } from "./resource.js";
+export { isAllowedRedirectUri, CLAUDE_CALLBACK } from "./redirect.js";
+export { issueAuthCode, consumeAuthCode, newClientId, } from "./codes.js";
+export { verifyPkceS256, sha256Base64Url, randomBase64Url } from "./pkce.js";
+export { GRANT_TYPES, OAUTH_ERRORS, DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
+export { parseScope, formatScope, requestedScopes, firstScopeError, } from "./scope.js";
+export { readClientAuth, firstClientAuthError } from "./clientauth.js";
+export { unregisteredClientsAllowed } from "./types.js";
+//# sourceMappingURL=router.js.map

package/dist/oauth/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,UAAU,EACV,0BAA0B,GAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,oBAAoB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,WAAW,EAAE;QACxB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,0BAA0B,EAAE,MAAM;QAClC,aAAa,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;QAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAA2B,EACd,EAAE;IACf,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,uCAAuC;QACvC,wCAAwC,YAAY,EAAE;KACvD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,yCAAyC;QACzC,0CAA0C,YAAY,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiC;QAC3C,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC9C,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;YAC3B,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC5C,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;oBACpD,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,iEAAiE;gBACjE,4DAA4D;gBAC5D,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,GAGZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAmB,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}

package/dist/oauth/scope.d.ts

@@ -0,0 +1,11 @@
+/** OAuth scope handling — space-delimited sets (RFC 6749 §3.3). */
+export declare const parseScope: (raw: string) => string[];
+export declare const formatScope: (scopes: string[]) => string;
+/**
+ * Scopes the client asked for, or the full advertised set when `scope` is omitted.
+ * Duplicates are collapsed so the granted string is stable.
+ */
+export declare const requestedScopes: (raw: string, advertised: string[]) => string[];
+/** Any scope outside the advertised set → invalid_scope. */
+export declare const firstScopeError: (requested: string[], advertised: string[]) => Response | null;
+//# sourceMappingURL=scope.d.ts.map

package/dist/oauth/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAKnE,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAAM,EAIP,CAAC;AAEzC,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,EAAE,KAAG,MAA0B,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,KAAK,MAAM,EACX,YAAY,MAAM,EAAE,KACnB,MAAM,EAGR,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,eAAe,GAC1B,WAAW,MAAM,EAAE,EACnB,YAAY,MAAM,EAAE,KACnB,QAAQ,GAAG,IAQb,CAAC"}