mcp-trellis 0.1.0

package/dist/oauth/scope.js

@@ -0,0 +1,24 @@
+/** OAuth scope handling — space-delimited sets (RFC 6749 §3.3). */
+import { OAUTH_ERRORS } from "./constants.js";
+import { oauthError } from "./types.js";
+export const parseScope = (raw) => raw
+    .split(" ")
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0);
+export const formatScope = (scopes) => scopes.join(" ");
+/**
+ * Scopes the client asked for, or the full advertised set when `scope` is omitted.
+ * Duplicates are collapsed so the granted string is stable.
+ */
+export const requestedScopes = (raw, advertised) => {
+    const parsed = raw ? parseScope(raw) : [...advertised];
+    return [...new Set(parsed)];
+};
+/** Any scope outside the advertised set → invalid_scope. */
+export const firstScopeError = (requested, advertised) => {
+    const unknown = requested.find((scope) => !advertised.includes(scope));
+    if (unknown === undefined)
+        return null;
+    return oauthError(OAUTH_ERRORS.invalidScope, 400, `unsupported scope: ${unknown}`);
+};
+//# sourceMappingURL=scope.js.map

package/dist/oauth/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAY,EAAE,CAClD,GAAG;KACA,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;KAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,GAAW,EACX,UAAoB,EACV,EAAE;IACZ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAmB,EACnB,UAAoB,EACH,EAAE;IACnB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,sBAAsB,OAAO,EAAE,CAChC,CAAC;AACJ,CAAC,CAAC"}

package/dist/oauth/token.d.ts

@@ -0,0 +1,3 @@
+import { type OAuthRouterOptions } from "./types.js";
+export declare const handleToken: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
+//# sourceMappingURL=token.d.ts.map

package/dist/oauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AA4KpB,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CA4ClB,CAAC"}

package/dist/oauth/token.js

@@ -0,0 +1,137 @@
+import { requireHttpMethod } from "../http.js";
+import { firstClientAuthError, readClientAuth } from "./clientauth.js";
+import { consumeAuthCode } from "./codes.js";
+import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
+import { verifyPkceS256 } from "./pkce.js";
+import { canonicalResource, firstResourceError, resourcesEqual, } from "./resource.js";
+import { oauthError, resolveSecret, tokenResponse, } from "./types.js";
+const POST_ONLY = new Set(["POST"]);
+const NO_CORS = { cors: false };
+const readJsonBody = async (request) => {
+    const body = (await request.json());
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        throw new Error("malformed request body");
+    }
+    return Object.fromEntries(Object.entries(body)
+        .filter(([, value]) => value != null)
+        .map(([key, value]) => [key, String(value)]));
+};
+const readFormBody = async (request) => {
+    const params = new URLSearchParams(await request.text());
+    return Object.fromEntries([...params.entries()]);
+};
+const BODY_READERS = [
+    { match: (ctype) => ctype.includes("application/json"), read: readJsonBody },
+    { match: () => true, read: readFormBody },
+];
+const readTokenBody = async (request) => {
+    const ctype = request.headers.get("Content-Type") ?? "";
+    const reader = BODY_READERS.find((entry) => entry.match(ctype))?.read ?? readFormBody;
+    return reader(request);
+};
+const handleRefresh = async ({ body, options, expectedResource, clientId, }) => {
+    if (!options.ports.refreshAccessToken) {
+        return oauthError(OAUTH_ERRORS.unsupportedGrantType, 400, "refresh_token not enabled");
+    }
+    const refreshToken = body.refresh_token ?? "";
+    if (!refreshToken) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "refresh_token required");
+    }
+    const resourceError = firstResourceError(body.resource ?? "", expectedResource);
+    if (resourceError)
+        return resourceError;
+    // ponytail: AS cannot verify the refresh token's original audience; the port owns that check.
+    const minted = await options.ports.refreshAccessToken({
+        refreshToken,
+        clientId,
+        resource: expectedResource,
+    });
+    if (!minted) {
+        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid refresh_token");
+    }
+    return tokenResponse(minted);
+};
+const firstAuthCodeMismatch = (record, body, clientId) => {
+    const rule = [
+        {
+            ok: record.redirectUri === (body.redirect_uri ?? ""),
+            description: "redirect_uri mismatch",
+        },
+        {
+            ok: record.clientId === clientId,
+            description: "client_id mismatch",
+        },
+    ].find((entry) => !entry.ok);
+    return rule
+        ? oauthError(OAUTH_ERRORS.invalidGrant, 400, rule.description)
+        : null;
+};
+const handleAuthCode = async ({ request, body, options, expectedResource, clientId, }) => {
+    const resourceError = firstResourceError(body.resource ?? "", expectedResource);
+    if (resourceError)
+        return resourceError;
+    const secret = await resolveSecret(options.ports, request);
+    const record = await consumeAuthCode(secret, body.code ?? "", {
+        codeStore: options.ports.codeStore,
+    });
+    if (!record) {
+        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid or expired code");
+    }
+    const mismatch = firstAuthCodeMismatch(record, body, clientId);
+    if (mismatch)
+        return mismatch;
+    if (!resourcesEqual(record.resource, expectedResource)) {
+        return oauthError(OAUTH_ERRORS.invalidTarget, 400, "auth code bound to a different resource");
+    }
+    if (!(await verifyPkceS256(body.code_verifier ?? "", record.codeChallenge))) {
+        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "pkce verification failed");
+    }
+    const minted = await options.ports.mintAccessToken({
+        userId: record.userId,
+        clientId,
+        scope: record.scope,
+        resource: record.resource,
+    });
+    return tokenResponse(minted, record.scope);
+};
+const GRANT_HANDLERS = {
+    [GRANT_TYPES.authorizationCode]: handleAuthCode,
+    [GRANT_TYPES.refreshToken]: handleRefresh,
+};
+export const handleToken = async (request, options) => {
+    const methodError = requireHttpMethod(request, POST_ONLY, NO_CORS);
+    if (methodError)
+        return methodError;
+    let body;
+    try {
+        body = await readTokenBody(request);
+    }
+    catch {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "malformed request body");
+    }
+    const auth = readClientAuth(request, body);
+    if (!auth) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
+    }
+    const clientAuthError = await firstClientAuthError(auth, options);
+    if (clientAuthError)
+        return clientAuthError;
+    const url = new URL(request.url);
+    const expectedResource = canonicalResource(url.origin, options.resourcePath);
+    const handler = GRANT_HANDLERS[body.grant_type ?? ""];
+    if (!handler) {
+        const supported = [GRANT_TYPES.authorizationCode];
+        if (options.ports.refreshAccessToken) {
+            supported.push(GRANT_TYPES.refreshToken);
+        }
+        return oauthError(OAUTH_ERRORS.unsupportedGrantType, 400, `supported: ${supported.join(", ")}`);
+    }
+    return handler({
+        request,
+        body,
+        options,
+        expectedResource,
+        clientId: auth.clientId,
+    });
+};
+//# sourceMappingURL=token.js.map

package/dist/oauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAuB,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAkB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,UAAU,EACV,aAAa,EACb,aAAa,GAEd,MAAM,YAAY,CAAC;AAEpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAazC,MAAM,YAAY,GAAG,KAAK,EACxB,OAAgB,EACiB,EAAE;IACnC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAY,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EACxB,OAAgB,EACiB,EAAE;IACnC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,YAAY,GAGb;IACH,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5E,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE;CAC1C,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EACzB,OAAgB,EACiB,EAAE;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,MAAM,GACV,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,YAAY,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAiB,KAAK,EAAE,EACzC,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,UAAU,CACf,YAAY,CAAC,oBAAoB,EACjC,GAAG,EACH,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CACtC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,gBAAgB,CACjB,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,8FAA8F;IAC9F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACpD,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,gBAAgB;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAAsB,EACtB,IAA4B,EAC5B,QAAgB,EACC,EAAE;IACnB,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACpD,WAAW,EAAE,uBAAuB;SACrC;QACD;YACE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAChC,WAAW,EAAE,oBAAoB;SAClC;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,IAAI;QACT,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiB,KAAK,EAAE,EAC1C,OAAO,EACP,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,MAAM,aAAa,GAAG,kBAAkB,CACtC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,gBAAgB,CACjB,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;QAC5D,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,UAAU,CACf,YAAY,CAAC,aAAa,EAC1B,GAAG,EACH,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc;IAC/C,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,UAAU,CACf,YAAY,CAAC,oBAAoB,EACjC,GAAG,EACH,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;QACb,OAAO;QACP,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/types.d.ts

@@ -0,0 +1,115 @@
+import { type TokenEndpointAuthMethod } from "./constants.js";
+import type { CodeStore } from "./codes.js";
+import type { RedirectAllowlistOptions } from "./redirect.js";
+export type OAuthUser = {
+    id: string;
+};
+/**
+ * A client registered ahead of time (pre-registration).
+ * Gemini Enterprise and other confidential clients arrive this way —
+ * the org registers with its own IdP and configures the pair here.
+ */
+export type RegisteredClient = {
+    clientId: string;
+    /** Exact-match redirect URIs. Checked instead of the global allowlist. */
+    redirectUris: string[];
+    tokenEndpointAuthMethod: TokenEndpointAuthMethod;
+};
+export type ClientStore = {
+    /** Resolve a pre-registered client, or null when unknown. */
+    get: (clientId: string) => Promise<RegisteredClient | null>;
+    /**
+     * Verify a presented client secret. Required for confidential clients.
+     * Secret storage and comparison stay in your implementation — the library
+     * never sees or persists credentials.
+     */
+    verifySecret?: (clientId: string, presented: string) => Promise<boolean>;
+};
+export type MintedToken = {
+    accessToken: string;
+    tokenType?: string;
+    expiresIn: number;
+    scope?: string;
+    refreshToken?: string;
+};
+export type MintAccessTokenInput = {
+    userId: string;
+    clientId: string;
+    scope: string;
+    /** RFC 8707 resource — mint with aud bound to this URI. */
+    resource: string;
+};
+export type RefreshAccessTokenInput = {
+    refreshToken: string;
+    clientId: string;
+    /**
+     * RFC 8707 resource for the refreshed access token.
+     * Implementations MUST reject refresh tokens not originally issued for this resource.
+     */
+    resource: string;
+};
+export type RevokeTokenInput = {
+    token: string;
+    clientId: string;
+    tokenTypeHint?: "access_token" | "refresh_token";
+};
+export type OAuthPorts = {
+    /** HMAC secret for signing auth codes. */
+    codeSecret: string | ((req: Request) => string | Promise<string>);
+    /** Resolve the logged-in user, or null → redirect to login. */
+    resolveUser: (req: Request) => Promise<OAuthUser | null>;
+    /** Where to send unauthenticated authorize requests. */
+    loginUrl: (req: Request, nextPath: string) => string;
+    /** Mint an access token bound to the consenting user and resource audience. */
+    mintAccessToken: (input: MintAccessTokenInput) => Promise<MintedToken>;
+    /** Optional refresh_token grant. Presence advertises the grant. */
+    refreshAccessToken?: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
+    /**
+     * RFC 7009. Presence mounts `/revoke` and advertises `revocation_endpoint`.
+     * Well-formed authenticated revoke is HTTP 200 even if the token is unknown
+     * (`invalid_request` / `invalid_client` still apply). `verifyToken` and
+     * `refreshAccessToken` MUST consult the same store; unknown tokens and
+     * tokens not issued to `clientId` MUST no-op (not throw).
+     */
+    revokeToken?: (input: RevokeTokenInput) => Promise<void>;
+    /** Shared single-use jti store for multi-instance; in-memory default otherwise. */
+    codeStore?: CodeStore;
+    /** Pre-registered clients. Required to serve confidential clients. */
+    clientStore?: ClientStore;
+};
+export type OAuthRouterOptions = {
+    ports: OAuthPorts;
+    resourcePath?: string;
+    oauthPath?: string;
+    realm?: string;
+    scopes?: string[];
+    redirect?: RedirectAllowlistOptions;
+    /** Advertised in AS metadata. Defaults to `["none"]` (public clients only). */
+    tokenEndpointAuthMethods?: TokenEndpointAuthMethod[];
+    /**
+     * Allow a `client_id` not resolved by `clientStore` to authorize and
+     * exchange tokens as a public client (PKCE only — no secret).
+     *
+     * Default **true** (DCR / CIMD connectors). Set **false** when every
+     * client is pre-registered: `/register` is unmounted, dropped from AS
+     * metadata, and an unrecognized `client_id` is rejected with
+     * `unauthorized_client` at `authorize` and `invalid_client` at `token`
+     * and `revoke`. `createMcpApp` derives this from `clients` via
+     * `hasDynamicClient`.
+     */
+    allowUnregisteredClients?: boolean;
+};
+/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
+export declare const unregisteredClientsAllowed: (options: OAuthRouterOptions) => boolean;
+/** Scopes this AS advertises and is willing to grant. */
+export declare const advertisedScopes: (options: OAuthRouterOptions) => string[];
+export declare const resolveSecret: (ports: OAuthPorts, req: Request) => Promise<string>;
+export declare const oauthError: (error: string, status: number, description?: string) => Response;
+/** Direct JSON error when this AS does not serve unknown `client_id`s. */
+export declare const unregisteredClientError: (options: OAuthRouterOptions, reject: {
+    code: string;
+    status: number;
+}) => Response | null;
+/** `grantedScope` is what the auth code carried; the port may narrow it further. */
+export declare const tokenResponse: (minted: MintedToken, grantedScope?: string) => Response;
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1E,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,CACnB,KAAK,EAAE,uBAAuB,KAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GACrC,SAAS,kBAAkB,KAC1B,OAAqD,CAAC;AAEzD,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC,eAAO,MAAM,aAAa,GACxB,OAAO,UAAU,EACjB,KAAK,OAAO,KACX,OAAO,CAAC,MAAM,CAGhB,CAAC;AAEF,eAAO,MAAM,UAAU,GACrB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,cAAc,MAAM,KACnB,QAMA,CAAC;AAKJ,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAOb,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,aAAa,GACxB,QAAQ,WAAW,EACnB,eAAe,MAAM,KACpB,QAYA,CAAC"}

package/dist/oauth/types.js

@@ -0,0 +1,28 @@
+import { DEFAULT_SCOPE } from "./constants.js";
+import { jsonResponse } from "../http.js";
+/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
+export const unregisteredClientsAllowed = (options) => options.allowUnregisteredClients !== false;
+/** Scopes this AS advertises and is willing to grant. */
+export const advertisedScopes = (options) => options.scopes ?? [DEFAULT_SCOPE];
+export const resolveSecret = async (ports, req) => {
+    if (typeof ports.codeSecret === "string")
+        return ports.codeSecret;
+    return ports.codeSecret(req);
+};
+export const oauthError = (error, status, description) => jsonResponse(description ? { error, error_description: description } : { error }, status, undefined, { cors: false });
+const UNREGISTERED_CLIENT_DESCRIPTION = "unknown client_id — this server only serves pre-registered clients";
+/** Direct JSON error when this AS does not serve unknown `client_id`s. */
+export const unregisteredClientError = (options, reject) => {
+    if (unregisteredClientsAllowed(options))
+        return null;
+    return oauthError(reject.code, reject.status, UNREGISTERED_CLIENT_DESCRIPTION);
+};
+/** `grantedScope` is what the auth code carried; the port may narrow it further. */
+export const tokenResponse = (minted, grantedScope) => jsonResponse({
+    access_token: minted.accessToken,
+    token_type: minted.tokenType ?? "bearer",
+    expires_in: minted.expiresIn,
+    scope: minted.scope ?? grantedScope ?? DEFAULT_SCOPE,
+    ...(minted.refreshToken ? { refresh_token: minted.refreshToken } : {}),
+}, 200, undefined, { cors: false });
+//# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAgC,MAAM,gBAAgB,CAAC;AAG7E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6G1C,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,OAA2B,EAClB,EAAE,CAAC,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAEzD,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,KAAiB,EACjB,GAAY,EACK,EAAE;IACnB,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAClE,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAa,EACb,MAAc,EACd,WAAoB,EACV,EAAE,CACZ,YAAY,CACV,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACnE,MAAM,EACN,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AAEJ,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,MAAM,EACb,+BAA+B,CAChC,CAAC;AACJ,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAmB,EACnB,YAAqB,EACX,EAAE,CACZ,YAAY,CACV;IACE,YAAY,EAAE,MAAM,CAAC,WAAW;IAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;IACxC,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY,IAAI,aAAa;IACpD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACvE,EACD,GAAG,EACH,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC"}

package/dist/oauth/wellknown.d.ts

@@ -0,0 +1,8 @@
+import { type OAuthRouterOptions } from "./types.js";
+export declare const handleWellKnown: (request: Request, options: OAuthRouterOptions, paths: {
+    prmPaths: Set<string>;
+    asPaths: Set<string>;
+    resourcePath: string;
+    oauthPath: string;
+}) => Promise<Response | null>;
+//# sourceMappingURL=wellknown.d.ts.map

package/dist/oauth/wellknown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wellknown.d.ts","sourceRoot":"","sources":["../../src/oauth/wellknown.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAUpB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,EAC3B,OAAO;IACL,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,KACA,OAAO,CAAC,QAAQ,GAAG,IAAI,CAuBzB,CAAC"}

package/dist/oauth/wellknown.js

@@ -0,0 +1,35 @@
+import { jsonResponse, requireHttpMethod } from "../http.js";
+import { authorizationServerMetadata, protectedResourceMetadata, } from "./metadata.js";
+import { GRANT_TYPES } from "./constants.js";
+import { unregisteredClientsAllowed, } from "./types.js";
+const GET_ONLY = new Set(["GET"]);
+const grantTypesOf = (ports) => {
+    const grants = [GRANT_TYPES.authorizationCode];
+    if (ports.refreshAccessToken)
+        grants.push(GRANT_TYPES.refreshToken);
+    return grants;
+};
+export const handleWellKnown = async (request, options, paths) => {
+    const url = new URL(request.url);
+    const path = url.pathname;
+    if (!paths.prmPaths.has(path) && !paths.asPaths.has(path))
+        return null;
+    const methodError = requireHttpMethod(request, GET_ONLY);
+    if (methodError)
+        return methodError;
+    const metaOpts = {
+        origin: url.origin,
+        resourcePath: paths.resourcePath,
+        oauthPath: paths.oauthPath,
+        grantTypes: grantTypesOf(options.ports),
+        scopes: options.scopes,
+        tokenEndpointAuthMethods: options.tokenEndpointAuthMethods,
+        dcrEnabled: unregisteredClientsAllowed(options),
+        revocationEnabled: Boolean(options.ports.revokeToken),
+    };
+    const body = paths.prmPaths.has(path)
+        ? protectedResourceMetadata(metaOpts)
+        : authorizationServerMetadata(metaOpts);
+    return jsonResponse(body);
+};
+//# sourceMappingURL=wellknown.js.map

package/dist/oauth/wellknown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wellknown.js","sourceRoot":"","sources":["../../src/oauth/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,0BAA0B,GAG3B,MAAM,YAAY,CAAC;AAEpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAElC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAe,EAAE;IACtD,MAAM,MAAM,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,kBAAkB;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EAC3B,KAKC,EACyB,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;QAC1D,UAAU,EAAE,0BAA0B,CAAC,OAAO,CAAC;QAC/C,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC"}

package/dist/protocol.d.ts

@@ -0,0 +1,4 @@
+export declare const PROTOCOL_VERSIONS: Set<string>;
+export declare const DEFAULT_PROTOCOL_VERSION = "2024-11-05";
+export declare const pickProtocolVersion: (params?: Record<string, unknown>) => string;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,aAI5B,CAAC;AAEH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,mBAAmB,GAC9B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,MAMF,CAAC"}

package/dist/protocol.js

@@ -0,0 +1,14 @@
+export const PROTOCOL_VERSIONS = new Set([
+    "2024-11-05",
+    "2025-03-26",
+    "2025-06-18",
+]);
+export const DEFAULT_PROTOCOL_VERSION = "2024-11-05";
+export const pickProtocolVersion = (params) => {
+    const requested = params?.protocolVersion;
+    if (typeof requested === "string" && PROTOCOL_VERSIONS.has(requested)) {
+        return requested;
+    }
+    return DEFAULT_PROTOCOL_VERSION;
+};
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,YAAY;IACZ,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAgC,EACxB,EAAE;IACV,MAAM,SAAS,GAAG,MAAM,EAAE,eAAe,CAAC;IAC1C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,37 @@
+import type { JsonSchema } from "./validate.js";
+export type ToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+};
+export type ToolHandler<TCtx> = (ctx: TCtx, args: Record<string, unknown>) => Promise<ToolResult | string> | ToolResult | string;
+export type ToolDef<TCtx> = {
+    name: string;
+    description: string;
+    inputSchema: JsonSchema;
+    scope?: string;
+    handler: ToolHandler<TCtx>;
+};
+export type ToolListEntry = {
+    name: string;
+    description: string;
+    inputSchema: JsonSchema;
+};
+export type ToolRegistry<TCtx> = {
+    list: () => ToolListEntry[];
+    get: (name: string) => ToolDef<TCtx> | undefined;
+    call: (name: string, ctx: TCtx, args: Record<string, unknown>) => Promise<ToolResult>;
+};
+export type RegistryOptions = {
+    /** Validate tools/call args against inputSchema. Default false. */
+    validateArgs?: boolean;
+    /**
+     * Map tool exceptions to client-visible text.
+     * Default: `"Tool execution failed"` (no exception leakage).
+     */
+    onToolError?: (exc: unknown) => string;
+};
+export declare const createToolRegistry: <TCtx>(tools: ToolDef<TCtx>[], options?: RegistryOptions) => ToolRegistry<TCtx>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,IAAI,IAAI,CAC9B,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,UAAU,GAAG,MAAM,CAAC;AAExD,MAAM,MAAM,OAAO,CAAC,IAAI,IAAI;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,IAAI,IAAI;IAC/B,IAAI,EAAE,MAAM,aAAa,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACjD,IAAI,EAAE,CACJ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACxC,CAAC;AAoCF,eAAO,MAAM,kBAAkB,GAAI,IAAI,EACrC,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EACtB,UAAS,eAAoB,KAC5B,YAAY,CAAC,IAAI,CAgCnB,CAAC"}

package/dist/registry.js

@@ -0,0 +1,61 @@
+import { validateAgainstSchema } from "./validate.js";
+const DEFAULT_TOOL_ERROR = "Tool execution failed";
+/**
+ * Map a tool exception to client-visible text.
+ * A throwing or non-string `onToolError` falls back to the redacted default —
+ * a mapper must never turn a tool failure into a transport failure.
+ */
+const resolveToolError = (exc, onToolError) => {
+    if (!onToolError)
+        return DEFAULT_TOOL_ERROR;
+    try {
+        const mapped = onToolError(exc);
+        return typeof mapped === "string" && mapped.length > 0
+            ? mapped
+            : DEFAULT_TOOL_ERROR;
+    }
+    catch {
+        return DEFAULT_TOOL_ERROR;
+    }
+};
+const asToolResult = (out) => {
+    if (typeof out === "string") {
+        return { content: [{ type: "text", text: out }], isError: false };
+    }
+    return out;
+};
+const errorResult = (message) => ({
+    content: [{ type: "text", text: message }],
+    isError: true,
+});
+export const createToolRegistry = (tools, options = {}) => {
+    const byName = new Map(tools.map((t) => [t.name, t]));
+    if (byName.size !== tools.length) {
+        throw new Error("duplicate tool names in registry");
+    }
+    return {
+        list: () => tools.map(({ name, description, inputSchema }) => ({
+            name,
+            description,
+            inputSchema,
+        })),
+        get: (name) => byName.get(name),
+        call: async (name, ctx, args) => {
+            const tool = byName.get(name);
+            if (!tool)
+                return errorResult(`Unknown tool: ${name}`);
+            if (options.validateArgs) {
+                const errors = validateAgainstSchema(args, tool.inputSchema);
+                if (errors.length > 0)
+                    return errorResult(errors.join("; "));
+            }
+            try {
+                return asToolResult(await tool.handler(ctx, args));
+            }
+            catch (exc) {
+                return errorResult(resolveToolError(exc, options.onToolError));
+            }
+        },
+    };
+};
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AA8CtD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CACvB,GAAY,EACZ,WAA2C,EACnC,EAAE;IACV,IAAI,CAAC,WAAW;QAAE,OAAO,kBAAkB,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,kBAAkB,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,GAAwB,EAAc,EAAE;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,OAAe,EAAc,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAsB,EACtB,UAA2B,EAAE,EACT,EAAE;IACtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CACT,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI;YACJ,WAAW;YACX,WAAW;SACZ,CAAC,CAAC;QAEL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAE/B,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAEvD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,WAAW,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,11 @@
+export { createMcpApp, type McpApp, type McpAppOptions, type McpAppAuth, type VerifiedToken, } from "./app.js";
+export { CLIENT_PROFILES, DEFAULT_CLIENTS, authMethodsFor, redirectUrisFor, preRegisteredClients, hasDynamicClient, type ClientName, type ClientProfile, } from "./clients.js";
+export { createMcpHandler, type McpHandler, type McpHandlerOptions, type McpPorts, type Principal, type AuditEntry, type ServerInfo, } from "./dispatch.js";
+export { createToolRegistry, type ToolDef, type ToolHandler, type ToolResult, type ToolRegistry, type ToolListEntry, type RegistryOptions, } from "./registry.js";
+export { defineTool, apiTool, type StandardSchemaV1, type DefineToolOptions, type ApiToolOptions, type ApiRequest, } from "./tools.js";
+export { rpcResult, rpcError, JSONRPC_PARSE_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_INVALID_PARAMS, JSONRPC_INTERNAL_ERROR, JSONRPC_UNAUTHORIZED, type JsonRpcId, type JsonRpcRequest, type JsonRpcResponse, } from "./jsonrpc.js";
+export { pickProtocolVersion, PROTOCOL_VERSIONS, DEFAULT_PROTOCOL_VERSION, } from "./protocol.js";
+export { parseBearer, timingSafeEqual, matchesAny, wwwAuthenticateHeader, rejectQueryToken, type WwwAuthenticateOptions, } from "./auth/bearer.js";
+export { validateAgainstSchema, JSON_SCHEMA_TYPES, type JsonSchema } from "./validate.js";
+export { jsonResponse, emptyResponse, optionsResponse, corsHeaders, methodNotAllowed, } from "./http.js";
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC"}

package/dist/server.js

@@ -0,0 +1,11 @@
+export { createMcpApp, } from "./app.js";
+export { CLIENT_PROFILES, DEFAULT_CLIENTS, authMethodsFor, redirectUrisFor, preRegisteredClients, hasDynamicClient, } from "./clients.js";
+export { createMcpHandler, } from "./dispatch.js";
+export { createToolRegistry, } from "./registry.js";
+export { defineTool, apiTool, } from "./tools.js";
+export { rpcResult, rpcError, JSONRPC_PARSE_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_INVALID_PARAMS, JSONRPC_INTERNAL_ERROR, JSONRPC_UNAUTHORIZED, } from "./jsonrpc.js";
+export { pickProtocolVersion, PROTOCOL_VERSIONS, DEFAULT_PROTOCOL_VERSION, } from "./protocol.js";
+export { parseBearer, timingSafeEqual, matchesAny, wwwAuthenticateHeader, rejectQueryToken, } from "./auth/bearer.js";
+export { validateAgainstSchema, JSON_SCHEMA_TYPES } from "./validate.js";
+export { jsonResponse, emptyResponse, optionsResponse, corsHeaders, methodNotAllowed, } from "./http.js";
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAKb,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,GAOjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,GAOnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,GAKR,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GAIrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAmB,MAAM,eAAe,CAAC;AAE1F,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC"}