mcp-trellis 0.2.1 → 1.0.0

package/dist/oauth/reqbody.js

@@ -0,0 +1,29 @@
+/**
+ * Shared JSON/form body reader for `/token` and `/revoke`. `/token` has
+ * always accepted both; `/revoke` used to parse form-only, so a client that
+ * revoked with `Content-Type: application/json` (matching how it likely
+ * called `/token`) got a silent `invalid_request "token required"` — the
+ * caller believes the token is dead when the request was never understood.
+ */
+import { DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../body.js";
+const readJsonBody = async (request) => {
+    const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
+    const body = JSON.parse(text);
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+        throw new Error("malformed request body");
+    }
+    return Object.fromEntries(Object.entries(body)
+        .filter(([, value]) => value != null)
+        .map(([key, value]) => [key, String(value)]));
+};
+const readFormBody = async (request) => {
+    const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
+    const params = new URLSearchParams(text);
+    return Object.fromEntries([...params.entries()]);
+};
+/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
+export const readOAuthBody = async (request) => {
+    const ctype = request.headers.get("Content-Type") ?? "";
+    return ctype.includes("application/json") ? readJsonBody(request) : readFormBody(request);
+};
+//# sourceMappingURL=reqbody.js.map

package/dist/oauth/reqbody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reqbody.js","sourceRoot":"","sources":["../../src/oauth/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEvE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC,CAAC"}

package/dist/oauth/resource.d.ts

@@ -1,7 +1,37 @@
 /** Canonical MCP resource URI (RFC 8707 / RFC 9728). */
+import { type OAuthErrorInfo } from "./types.js";
 export declare const DEFAULT_RESOURCE_PATH = "/mcp";
+/**
+ * Strips a trailing slash from a *configured* path (`resourcePath`,
+ * `oauthPath`) so `"/mcp/"` and `"/mcp"` can't produce divergent canonical
+ * resources — `canonicalResource` doesn't strip one itself, but
+ * `normalizeResource` (used to compare an incoming request's resource
+ * against it) does, so leaving a trailing slash in the *configured* value
+ * silently made every request fail to match. `"/"` stays `"/"`. Apply once
+ * at construction, not per request.
+ */
+export declare const normalizeConfiguredPath: (path: string) => string;
+/**
+ * Normalizes `resourcePath` internally (trailing slash stripped) so every
+ * caller gets a consistent result regardless of whether it read a raw
+ * `options.resourcePath` or a value some other layer already normalized —
+ * `"/mcp/"` and `"/mcp"` must produce the same canonical resource, since
+ * `resourcesEqual` compares against a normalized incoming request either
+ * way (see `normalizeResource` below). Centralizing the fix here, instead
+ * of only in the callers that happen to normalize their own config,
+ * removes an entire class of "which of these read the normalized value"
+ * bugs at the source.
+ */
 export declare const canonicalResource: (origin: string, resourcePath?: string) => string;
 export declare const resourcesEqual: (requested: string, expected: string) => boolean;
+/**
+ * Missing → invalid_request; mismatch → invalid_target. Info-only variant
+ * (no `Response` built) so a caller can choose how to deliver it —
+ * `/token` returns it directly as JSON via `firstResourceError` below;
+ * `/authorize` redirects it to the client's callback per RFC 6749 §4.1.2.1
+ * once `redirect_uri` itself is trusted (see `authorize.ts`).
+ */
+export declare const resourceErrorInfo: (requested: string, expected: string) => OAuthErrorInfo | null;
 /** Missing → invalid_request; mismatch → invalid_target. */
 export declare const firstResourceError: (requested: string, expected: string) => Response | null;
 //# sourceMappingURL=resource.d.ts.map

package/dist/oauth/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAKxD,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,qBAAoC,KACnC,MAMF,CAAC;AAmBF,eAAO,MAAM,cAAc,GACzB,WAAW,MAAM,EACjB,UAAU,MAAM,KACf,OAGF,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,UAAU,MAAM,KACf,QAAQ,GAAG,IAgBb,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAGxD,OAAO,EAAE,KAAK,cAAc,EAAc,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,MACA,CAAC;AAExD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,qBAAoC,KAAG,MAIxF,CAAC;AAmBF,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,OAGpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,cAAc,GAAG,IAQxF,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,QAAQ,GAAG,IAGnF,CAAC"}

package/dist/oauth/resource.js

@@ -2,12 +2,31 @@
 import { OAUTH_ERRORS } from "./constants.js";
 import { oauthError } from "./types.js";
 export const DEFAULT_RESOURCE_PATH = "/mcp";
+/**
+ * Strips a trailing slash from a *configured* path (`resourcePath`,
+ * `oauthPath`) so `"/mcp/"` and `"/mcp"` can't produce divergent canonical
+ * resources — `canonicalResource` doesn't strip one itself, but
+ * `normalizeResource` (used to compare an incoming request's resource
+ * against it) does, so leaving a trailing slash in the *configured* value
+ * silently made every request fail to match. `"/"` stays `"/"`. Apply once
+ * at construction, not per request.
+ */
+export const normalizeConfiguredPath = (path) => path === "/" ? path : path.replace(/\/+$/, "") || "/";
+/**
+ * Normalizes `resourcePath` internally (trailing slash stripped) so every
+ * caller gets a consistent result regardless of whether it read a raw
+ * `options.resourcePath` or a value some other layer already normalized —
+ * `"/mcp/"` and `"/mcp"` must produce the same canonical resource, since
+ * `resourcesEqual` compares against a normalized incoming request either
+ * way (see `normalizeResource` below). Centralizing the fix here, instead
+ * of only in the callers that happen to normalize their own config,
+ * removes an entire class of "which of these read the normalized value"
+ * bugs at the source.
+ */
 export const canonicalResource = (origin, resourcePath = DEFAULT_RESOURCE_PATH) => {
     const base = origin.replace(/\/$/, "");
-    const path = resourcePath.startsWith("/")
-        ? resourcePath
-        : `/${resourcePath}`;
-    return `${base}${path}`;
+    const withLeadingSlash = resourcePath.startsWith("/") ? resourcePath : `/${resourcePath}`;
+    return `${base}${normalizeConfiguredPath(withLeadingSlash)}`;
 };
 /**
  * Normalize for RFC 8707 comparison.
@@ -31,14 +50,25 @@ export const resourcesEqual = (requested, expected) => {
     const a = normalizeResource(requested);
     return a !== null && a === normalizeResource(expected);
 };
-/** Missing → invalid_request; mismatch → invalid_target. */
-export const firstResourceError = (requested, expected) => {
+/**
+ * Missing → invalid_request; mismatch → invalid_target. Info-only variant
+ * (no `Response` built) so a caller can choose how to deliver it —
+ * `/token` returns it directly as JSON via `firstResourceError` below;
+ * `/authorize` redirects it to the client's callback per RFC 6749 §4.1.2.1
+ * once `redirect_uri` itself is trusted (see `authorize.ts`).
+ */
+export const resourceErrorInfo = (requested, expected) => {
     if (!requested) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "resource required (RFC 8707)");
+        return { code: OAUTH_ERRORS.invalidRequest, description: "resource required (RFC 8707)" };
     }
     if (!resourcesEqual(requested, expected)) {
-        return oauthError(OAUTH_ERRORS.invalidTarget, 400, "resource does not match this server");
+        return { code: OAUTH_ERRORS.invalidTarget, description: "resource does not match this server" };
     }
     return null;
 };
+/** Missing → invalid_request; mismatch → invalid_target. */
+export const firstResourceError = (requested, expected) => {
+    const issue = resourceErrorInfo(requested, expected);
+    return issue ? oauthError(issue.code, 400, issue.description) : null;
+};
 //# sourceMappingURL=resource.js.map

package/dist/oauth/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACd,YAAY,GAAG,qBAAqB,EAC5B,EAAE;IACV,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IACvB,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAiB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAiB,EACjB,QAAgB,EACP,EAAE;IACX,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAiB,EACjB,QAAgB,EACC,EAAE;IACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CACf,YAAY,CAAC,aAAa,EAC1B,GAAG,EACH,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAuB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9D,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAExD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,YAAY,GAAG,qBAAqB,EAAU,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IAC1F,OAAO,GAAG,IAAI,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAiB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAW,EAAE;IAC7E,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAyB,EAAE;IAC9F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,cAAc,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,aAAa,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAmB,EAAE;IACzF,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC,CAAC"}

package/dist/oauth/revoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAKjC,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAUjE,eAAO,MAAM,YAAY,GACvB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAuBlB,CAAC"}
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAOjC,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,YAAY,CAAC;AAQjE,eAAO,MAAM,YAAY,GACvB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CA8BlB,CAAC"}

package/dist/oauth/revoke.js

@@ -1,7 +1,9 @@
 /** RFC 7009 token revocation. */
+import { BodyTooLargeError } from "../body.js";
 import { requireHttpMethod } from "../http.js";
 import { firstClientAuthError, readClientAuth } from "./clientauth.js";
 import { OAUTH_ERRORS } from "./constants.js";
+import { readOAuthBody } from "./reqbody.js";
 import { oauthError } from "./types.js";
 const POST_ONLY = new Set(["POST"]);
 const NO_CORS = { cors: false };
@@ -10,20 +12,30 @@ export const handleRevoke = async (request, options) => {
     const methodError = requireHttpMethod(request, POST_ONLY, NO_CORS);
     if (methodError)
         return methodError;
-    const body = Object.fromEntries(new URLSearchParams(await request.text()).entries());
+    let body;
+    try {
+        body = await readOAuthBody(request);
+    }
+    catch (exc) {
+        if (exc instanceof BodyTooLargeError) {
+            return oauthError(OAUTH_ERRORS.invalidRequest, 413, "request body too large");
+        }
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "malformed request body");
+    }
     const token = body.token ?? "";
     if (!token)
         return oauthError(OAUTH_ERRORS.invalidRequest, 400, "token required");
     const auth = readClientAuth(request, body);
     if (!auth)
         return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
-    const clientAuthError = await firstClientAuthError(auth, options);
+    const clientAuthError = await firstClientAuthError(auth, options, request);
     if (clientAuthError)
         return clientAuthError;
+    const hint = tokenTypeHintOf(body.token_type_hint);
     await options.ports.revokeToken?.({
         token,
         clientId: auth.clientId,
-        tokenTypeHint: tokenTypeHintOf(body.token_type_hint),
+        ...(hint !== undefined ? { tokenTypeHint: hint } : {}),
     });
     return new Response(null, { status: 200, headers: { "Cache-Control": "no-store" } });
 };

package/dist/oauth/revoke.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAA2B,MAAM,YAAY,CAAC;AAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAEzC,MAAM,eAAe,GAAG,CACtB,IAAwB,EACsB,EAAE,CAChD,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CACpD,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAElF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAErF,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC;KACrD,CAAC,CAAC;IAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC,CAAC"}
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAA2B,UAAU,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAEzC,MAAM,eAAe,GAAG,CAAC,IAAwB,EAAgD,EAAE,CACjG,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAElF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAErF,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;IAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC,CAAC"}

package/dist/oauth/router.d.ts

@@ -1,18 +1,21 @@
 import { type OAuthRouterOptions } from "./types.js";
-export type { OAuthUser, MintedToken, OAuthPorts, OAuthRouterOptions, } from "./types.js";
+export type { MintedToken, OAuthAuditEntry, OAuthPorts, OAuthRouterOptions, OAuthUser, } from "./types.js";
 export type OAuthRouter = {
     /** Returns a Response when this request is OAuth-related; otherwise null. */
     tryHandle: (request: Request) => Promise<Response | null>;
 };
 export declare const createOAuthRouter: (options: OAuthRouterOptions) => OAuthRouter;
-export { authorizationServerMetadata, protectedResourceMetadata, mcpWwwAuthenticate, } from "./metadata.js";
-export { canonicalResource, resourcesEqual, DEFAULT_RESOURCE_PATH, firstResourceError, } from "./resource.js";
-export { isAllowedRedirectUri, CLAUDE_CALLBACK } from "./redirect.js";
-export { issueAuthCode, consumeAuthCode, newClientId, type AuthCodeRecord, type CodeStore, } from "./codes.js";
-export { verifyPkceS256, sha256Base64Url, randomBase64Url } from "./pkce.js";
-export { GRANT_TYPES, OAUTH_ERRORS, DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, type TokenEndpointAuthMethod, } from "./constants.js";
-export { parseScope, formatScope, requestedScopes, firstScopeError, } from "./scope.js";
-export { readClientAuth, firstClientAuthError, type ClientAuth } from "./clientauth.js";
-export { unregisteredClientsAllowed } from "./types.js";
-export type { MintAccessTokenInput, RefreshAccessTokenInput, RevokeTokenInput, ClientStore, RegisteredClient, } from "./types.js";
+export { type ClientAuth, firstClientAuthError, readClientAuth } from "./clientauth.js";
+export { type AuthCodeRecord, type CodeStore, consumeAuthCode, issueAuthCode, newClientId, } from "./codes.js";
+export type { ConsentOptions, ConsentRequest } from "./consent.js";
+export { buildErrorRedirectUrl } from "./consent.js";
+export { DEFAULT_SCOPE, GRANT_TYPES, OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, type TokenEndpointAuthMethod, } from "./constants.js";
+export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./metadata.js";
+export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./pkce.js";
+export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
+export { canonicalResource, DEFAULT_RESOURCE_PATH, firstResourceError, normalizeConfiguredPath, resourceErrorInfo, resourcesEqual, } from "./resource.js";
+export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./scope.js";
+export { hashClientSecret, verifyClientSecret } from "./secrethash.js";
+export type { ClientAssertion, ClientStore, MintAccessTokenInput, OAuthErrorInfo, RefreshAccessTokenInput, RegisteredClient, RevokeTokenInput, } from "./types.js";
+export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./types.js";
 //# sourceMappingURL=router.d.ts.map

package/dist/oauth/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAMpB,YAAY,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAsDpB,MAAM,MAAM,WAAW,GAAG;IACxB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAIF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,kBAAkB,KAC1B,WA4DF,CAAC;AAEF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,GACjB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,kBAAkB,EAKxB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,WAAW,EACX,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,SAAS,GACV,MAAM,YAAY,CAAC;AA8DpB,MAAM,MAAM,WAAW,GAAG;IACxB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAIF,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,WA0F/D,CAAC;AAEF,OAAO,EAAE,KAAK,UAAU,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EACV,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,YAAY,CAAC"}

package/dist/oauth/router.js

@@ -1,12 +1,14 @@
+import { BodyTooLargeError, DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../body.js";
 import { INTERNAL_ERROR, jsonResponse, requireHttpMethod } from "../http.js";
-import { newClientId } from "./codes.js";
+import { handleAuthorize } from "./authorize.js";
+import { handleConsent } from "./consent.js";
 import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
 import { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
-import { DEFAULT_RESOURCE_PATH } from "./resource.js";
-import { oauthError, unregisteredClientsAllowed, } from "./types.js";
-import { handleAuthorize } from "./authorize.js";
-import { handleToken } from "./token.js";
+import { DEFAULT_RESOURCE_PATH, normalizeConfiguredPath } from "./resource.js";
 import { handleRevoke } from "./revoke.js";
+import { seal } from "./sealed.js";
+import { handleToken } from "./token.js";
+import { assertCodeSecret, assertScopeConfig, oauthError, resolveSecret, safeOAuthAudit, unregisteredClientsAllowed, } from "./types.js";
 import { handleWellKnown } from "./wellknown.js";
 const POST_ONLY = new Set(["POST"]);
 const handleRegister = async (request, options) => {
@@ -16,7 +18,8 @@ const handleRegister = async (request, options) => {
     let suppliedRedirectUris = false;
     let redirectUris = [];
     try {
-        const body = (await request.json());
+        const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
+        const body = JSON.parse(text);
         const raw = body.redirect_uris;
         if (Array.isArray(raw)) {
             suppliedRedirectUris = true;
@@ -25,7 +28,10 @@ const handleRegister = async (request, options) => {
                 .filter((uri) => isAllowedRedirectUri(uri, options.redirect));
         }
     }
-    catch {
+    catch (exc) {
+        if (exc instanceof BodyTooLargeError) {
+            return oauthError(OAUTH_ERRORS.invalidRequest, 413, "request body too large");
+        }
         redirectUris = [];
     }
     // No redirect_uris in the body: fall back to the Claude callback only if
@@ -40,8 +46,14 @@ const handleRegister = async (request, options) => {
             ? "no allowed redirect_uris"
             : "redirect_uris required — this server has no default redirect_uri");
     }
+    // Zero storage: the client_id *is* the registration record — a sealed,
+    // self-verifying assertion of the redirect_uris this call just validated.
+    // `/authorize` unseals it and binds the client to exactly this list,
+    // the same protection a stored registration would give a pre-registered id.
+    const secret = await resolveSecret(options.ports, request);
+    const clientId = await seal(secret, "client", { redirectUris });
     return jsonResponse({
-        client_id: newClientId(),
+        client_id: clientId,
         client_id_issued_at: Math.floor(Date.now() / 1000),
         token_endpoint_auth_method: "none",
         redirect_uris: redirectUris,
@@ -54,8 +66,26 @@ export const createOAuthRouter = (options) => {
         throw new Error("allowUnregisteredClients: false requires ports.clientStore " +
             "so pre-registered clients can be resolved");
     }
-    const resourcePath = options.resourcePath ?? DEFAULT_RESOURCE_PATH;
+    // Function-form codeSecret is re-validated on every call in resolveSecret,
+    // since its value can vary per request; a string form is fixed for the
+    // life of this router, so fail fast at construction instead of at the
+    // first request.
+    if (typeof options.ports.codeSecret === "string") {
+        assertCodeSecret(options.ports.codeSecret);
+    }
+    assertScopeConfig(options);
+    // Normalized once here, not per request — "/mcp/" and "/mcp" must never
+    // produce divergent canonical resources (canonicalResource doesn't strip
+    // a trailing slash itself; normalizeResource, used to compare an
+    // incoming request's resource against it, does).
+    const resourcePath = normalizeConfiguredPath(options.resourcePath ?? DEFAULT_RESOURCE_PATH);
     const oauthPath = options.oauthPath ?? "/mcp/oauth";
+    if (oauthPath === resourcePath) {
+        throw new Error(`oauthPath (${oauthPath}) must not equal resourcePath — they would shadow each other`);
+    }
+    if (resourcePath.startsWith("/.well-known")) {
+        throw new Error(`resourcePath (${resourcePath}) must not start with /.well-known — reserved for OAuth discovery documents`);
+    }
     const prmPaths = new Set([
         "/.well-known/oauth-protected-resource",
         `/.well-known/oauth-protected-resource${resourcePath}`,
@@ -71,6 +101,7 @@ export const createOAuthRouter = (options) => {
             }
             : {}),
         [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, options),
+        [`${oauthPath}/consent`]: (request) => handleConsent(request, options),
         [`${oauthPath}/token`]: (request) => handleToken(request, options),
         ...(options.ports.revokeToken
             ? {
@@ -93,22 +124,31 @@ export const createOAuthRouter = (options) => {
                 const route = routes[path];
                 return route ? await route(request) : null;
             }
-            catch {
-                // A host port (resolveUser/mintAccessToken/clientStore/...) threw.
-                // We only ever reach here on a route this router owns, so answer
-                // with a real error instead of throwing out of `tryHandle`.
+            catch (exc) {
+                // A host port (resolveUser/mintAccessToken/clientStore/...) threw,
+                // or codeSecret failed validation (assertCodeSecret, e.g. a
+                // per-request function returning something too short). We only
+                // ever reach here on a route this router owns, so answer with a
+                // real error instead of throwing out of `tryHandle` — the caller
+                // gets the generic server_error; ports.audit gets the real reason.
+                await safeOAuthAudit(options, {
+                    event: "server_error",
+                    reason: exc instanceof Error ? exc.message : String(exc),
+                });
                 return oauthError(OAUTH_ERRORS.serverError, 500, INTERNAL_ERROR);
             }
         },
     };
 };
-export { authorizationServerMetadata, protectedResourceMetadata, mcpWwwAuthenticate, } from "./metadata.js";
-export { canonicalResource, resourcesEqual, DEFAULT_RESOURCE_PATH, firstResourceError, } from "./resource.js";
-export { isAllowedRedirectUri, CLAUDE_CALLBACK } from "./redirect.js";
-export { issueAuthCode, consumeAuthCode, newClientId, } from "./codes.js";
-export { verifyPkceS256, sha256Base64Url, randomBase64Url } from "./pkce.js";
-export { GRANT_TYPES, OAUTH_ERRORS, DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
-export { parseScope, formatScope, requestedScopes, firstScopeError, } from "./scope.js";
-export { readClientAuth, firstClientAuthError } from "./clientauth.js";
-export { unregisteredClientsAllowed } from "./types.js";
+export { firstClientAuthError, readClientAuth } from "./clientauth.js";
+export { consumeAuthCode, issueAuthCode, newClientId, } from "./codes.js";
+export { buildErrorRedirectUrl } from "./consent.js";
+export { DEFAULT_SCOPE, GRANT_TYPES, OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
+export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./metadata.js";
+export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./pkce.js";
+export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
+export { canonicalResource, DEFAULT_RESOURCE_PATH, firstResourceError, normalizeConfiguredPath, resourceErrorInfo, resourcesEqual, } from "./resource.js";
+export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./scope.js";
+export { hashClientSecret, verifyClientSecret } from "./secrethash.js";
+export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./types.js";
 //# sourceMappingURL=router.js.map

package/dist/oauth/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,UAAU,EACV,0BAA0B,GAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,YAAY,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,oBAAoB;YAClB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,kEAAkE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,WAAW,EAAE;QACxB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,0BAA0B,EAAE,MAAM;QAClC,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;QAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAA2B,EACd,EAAE;IACf,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,uCAAuC;QACvC,wCAAwC,YAAY,EAAE;KACvD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,yCAAyC;QACzC,0CAA0C,YAAY,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiC;QAC3C,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC9C,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;YAC3B,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC5C,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;oBACpD,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,iEAAiE;gBACjE,4DAA4D;gBAC5D,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,GAGZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAmB,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAGjB,UAAU,EACV,aAAa,EACb,cAAc,EACd,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAUjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAgB,EAAE,OAA2B,EAAqB,EAAE;IAChG,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,YAAY,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,oBAAoB;YAClB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,kEAAkE,CACvE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,YAAY,EAA4B,CAAC,CAAC;IAE1F,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,0BAA0B,EAAE,MAAM;QAClC,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;QAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,iBAAiB;IACjB,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE3B,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,iDAAiD;IACjD,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IAEpD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,uCAAuC;QACvC,wCAAwC,YAAY,EAAE;KACvD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,yCAAyC;QACzC,0CAA0C,YAAY,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiC;QAC3C,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;aAClF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QACtE,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;YAC3B,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aAC9E;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;oBACpD,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,4DAA4D;gBAC5D,+DAA+D;gBAC/D,gEAAgE;gBAChE,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,cAAc,CAAC,OAAO,EAAE;oBAC5B,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACzD,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAmB,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAGL,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAUvE,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,YAAY,CAAC"}

package/dist/oauth/scope.d.ts

@@ -1,11 +1,20 @@
 /** OAuth scope handling — space-delimited sets (RFC 6749 §3.3). */
+import { type OAuthErrorInfo } from "./types.js";
 export declare const parseScope: (raw: string) => string[];
 export declare const formatScope: (scopes: string[]) => string;
 /**
- * Scopes the client asked for, or the full advertised set when `scope` is omitted.
+ * Scopes the client asked for, or `fallback` when `scope` is omitted —
+ * `fallback` is the full advertised set only for single-scope servers; see
+ * `defaultScopes`/`assertScopeConfig` in `types.ts` for the multi-scope rule.
  * Duplicates are collapsed so the granted string is stable.
  */
-export declare const requestedScopes: (raw: string, advertised: string[]) => string[];
+export declare const requestedScopes: (raw: string, fallback: string[]) => string[];
+/**
+ * Any scope outside the advertised set → invalid_scope. Info-only variant
+ * — see `resource.ts`'s `resourceErrorInfo` for why this isn't a
+ * `Response` directly: `/authorize` needs to redirect this, not return it.
+ */
+export declare const scopeErrorInfo: (requested: string[], advertised: string[]) => OAuthErrorInfo | null;
 /** Any scope outside the advertised set → invalid_scope. */
 export declare const firstScopeError: (requested: string[], advertised: string[]) => Response | null;
 //# sourceMappingURL=scope.d.ts.map

package/dist/oauth/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAKnE,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAAM,EAIP,CAAC;AAEzC,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,EAAE,KAAG,MAA0B,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,KAAK,MAAM,EACX,YAAY,MAAM,EAAE,KACnB,MAAM,EAGR,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,eAAe,GAC1B,WAAW,MAAM,EAAE,EACnB,YAAY,MAAM,EAAE,KACnB,QAAQ,GAAG,IAQb,CAAC"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAGnE,OAAO,EAAE,KAAK,cAAc,EAAc,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAAM,EAIP,CAAC;AAEzC,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,EAAE,KAAG,MAA0B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,MAAM,EAGvE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,WAAW,MAAM,EAAE,EACnB,YAAY,MAAM,EAAE,KACnB,cAAc,GAAG,IAKnB,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,eAAe,GAAI,WAAW,MAAM,EAAE,EAAE,YAAY,MAAM,EAAE,KAAG,QAAQ,GAAG,IAGtF,CAAC"}

package/dist/oauth/scope.js

@@ -7,18 +7,29 @@ export const parseScope = (raw) => raw
     .filter((entry) => entry.length > 0);
 export const formatScope = (scopes) => scopes.join(" ");
 /**
- * Scopes the client asked for, or the full advertised set when `scope` is omitted.
+ * Scopes the client asked for, or `fallback` when `scope` is omitted —
+ * `fallback` is the full advertised set only for single-scope servers; see
+ * `defaultScopes`/`assertScopeConfig` in `types.ts` for the multi-scope rule.
  * Duplicates are collapsed so the granted string is stable.
  */
-export const requestedScopes = (raw, advertised) => {
-    const parsed = raw ? parseScope(raw) : [...advertised];
+export const requestedScopes = (raw, fallback) => {
+    const parsed = raw ? parseScope(raw) : [...fallback];
     return [...new Set(parsed)];
 };
+/**
+ * Any scope outside the advertised set → invalid_scope. Info-only variant
+ * — see `resource.ts`'s `resourceErrorInfo` for why this isn't a
+ * `Response` directly: `/authorize` needs to redirect this, not return it.
+ */
+export const scopeErrorInfo = (requested, advertised) => {
+    const unknown = requested.find((scope) => !advertised.includes(scope));
+    return unknown === undefined
+        ? null
+        : { code: OAUTH_ERRORS.invalidScope, description: `unsupported scope: ${unknown}` };
+};
 /** Any scope outside the advertised set → invalid_scope. */
 export const firstScopeError = (requested, advertised) => {
-    const unknown = requested.find((scope) => !advertised.includes(scope));
-    if (unknown === undefined)
-        return null;
-    return oauthError(OAUTH_ERRORS.invalidScope, 400, `unsupported scope: ${unknown}`);
+    const issue = scopeErrorInfo(requested, advertised);
+    return issue ? oauthError(issue.code, 400, issue.description) : null;
 };
 //# sourceMappingURL=scope.js.map

package/dist/oauth/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAY,EAAE,CAClD,GAAG;KACA,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;KAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,GAAW,EACX,UAAoB,EACV,EAAE;IACZ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAmB,EACnB,UAAoB,EACH,EAAE;IACnB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,sBAAsB,OAAO,EAAE,CAChC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAuB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAY,EAAE,CAClD,GAAG;KACA,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;KAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,QAAkB,EAAY,EAAE;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAmB,EACnB,UAAoB,EACG,EAAE;IACzB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,sBAAsB,OAAO,EAAE,EAAE,CAAC;AACxF,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAmB,EAAE,UAAoB,EAAmB,EAAE;IAC5F,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC,CAAC"}

package/dist/oauth/sealed.d.ts

@@ -0,0 +1,17 @@
+/**
+ * AES-GCM sealing for short-lived, self-describing tokens derived from the
+ * same `codeSecret` as auth codes (HMAC today, AES-GCM from Phase 2 —
+ * see `codes.ts`).
+ *
+ * Domain separation is mandatory, not a nice-to-have: a consent ticket must
+ * never unseal as a client-id assertion, and neither must ever unseal as an
+ * auth code. HKDF derives an independent AES-256 key per `SealedType` from
+ * the same secret, and the type is also bound in as AEAD associated data —
+ * two independent reasons decryption fails across types, not one.
+ */
+export type SealedType = "consent" | "client" | "code";
+/** Seals `payload` as an opaque, type-bound string. */
+export declare const seal: <T>(secret: string, type: SealedType, payload: T) => Promise<string>;
+/** Unseals a string sealed with the same `secret` and `type`; `null` on any mismatch or tamper. */
+export declare const unseal: <T>(secret: string, type: SealedType, sealed: string) => Promise<T | null>;
+//# sourceMappingURL=sealed.d.ts.map

package/dist/oauth/sealed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.d.ts","sourceRoot":"","sources":["../../src/oauth/sealed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AA+BvD,uDAAuD;AACvD,eAAO,MAAM,IAAI,GAAU,CAAC,EAAE,QAAQ,MAAM,EAAE,MAAM,UAAU,EAAE,SAAS,CAAC,KAAG,OAAO,CAAC,MAAM,CAW1F,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,MAAM,GAAU,CAAC,EAC5B,QAAQ,MAAM,EACd,MAAM,UAAU,EAChB,QAAQ,MAAM,KACb,OAAO,CAAC,CAAC,GAAG,IAAI,CAsBlB,CAAC"}

package/dist/oauth/sealed.js

@@ -0,0 +1,57 @@
+/**
+ * AES-GCM sealing for short-lived, self-describing tokens derived from the
+ * same `codeSecret` as auth codes (HMAC today, AES-GCM from Phase 2 —
+ * see `codes.ts`).
+ *
+ * Domain separation is mandatory, not a nice-to-have: a consent ticket must
+ * never unseal as a client-id assertion, and neither must ever unseal as an
+ * auth code. HKDF derives an independent AES-256 key per `SealedType` from
+ * the same secret, and the type is also bound in as AEAD associated data —
+ * two independent reasons decryption fails across types, not one.
+ */
+import { bytesToBase64Url, fromBase64Url } from "./base64url.js";
+const HKDF_INFO_PREFIX = "mcp-trellis:sealed:";
+const IV_BYTES = 12;
+const deriveKey = async (secret, type, usage) => {
+    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(0),
+        info: new TextEncoder().encode(`${HKDF_INFO_PREFIX}${type}`),
+    }, material, { name: "AES-GCM", length: 256 }, false, [usage]);
+};
+/** Seals `payload` as an opaque, type-bound string. */
+export const seal = async (secret, type, payload) => {
+    const key = await deriveKey(secret, type, "encrypt");
+    const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+    const additionalData = new TextEncoder().encode(type);
+    const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+    const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, key, plaintext);
+    return `${bytesToBase64Url(iv)}.${bytesToBase64Url(ciphertext)}`;
+};
+/** Unseals a string sealed with the same `secret` and `type`; `null` on any mismatch or tamper. */
+export const unseal = async (secret, type, sealed) => {
+    if (!sealed)
+        return null;
+    const parts = sealed.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [ivPart, ciphertextPart] = parts;
+    if (!ivPart || !ciphertextPart)
+        return null;
+    try {
+        const key = await deriveKey(secret, type, "decrypt");
+        const iv = fromBase64Url(ivPart);
+        if (iv.byteLength !== IV_BYTES)
+            return null;
+        const ciphertext = fromBase64Url(ciphertextPart);
+        const additionalData = new TextEncoder().encode(type);
+        const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv, additionalData }, key, ciphertext);
+        return JSON.parse(new TextDecoder().decode(plaintext));
+    }
+    catch {
+        return null;
+    }
+};
+//# sourceMappingURL=sealed.js.map

package/dist/oauth/sealed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.js","sourceRoot":"","sources":["../../src/oauth/sealed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIjE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,MAAM,SAAS,GAAG,KAAK,EACrB,MAAc,EACd,IAAgB,EAChB,KAA4B,EACR,EAAE;IACtB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,gBAAgB,GAAG,IAAI,EAAE,CAAC;KAC7D,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAK,MAAc,EAAE,IAAgB,EAAE,OAAU,EAAmB,EAAE;IAC7F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EACvC,GAAG,EACH,SAAS,CACV,CAAC;IACF,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;AACnE,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,MAAc,EACd,IAAgB,EAChB,MAAc,EACK,EAAE;IACrB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EACvC,GAAG,EACH,UAAU,CACX,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}