mcp-trellis 0.2.1 → 1.0.0

package/dist/oauth/secrethash.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Constant-time confidential-client secret hashing.
+ *
+ * `ClientStore.verifySecret` puts comparison in the host's hands by design
+ * — the library must never see or persist plaintext credentials. But that
+ * also means a host that writes `stored === presented` gets a timing oracle
+ * with no warning, while the library ships a perfectly good
+ * `timingSafeEqual` and uses it everywhere else it compares secrets
+ * (auth-code HMAC/seal, PKCE). `ClientStore.secretHash` is the alternative:
+ * the host still owns storage, but hands the library a stored hash instead
+ * of doing the comparison itself, and the library does the compare with
+ * the same primitive it already trusts.
+ *
+ * Keyed by `codeSecret`, HKDF-derived for this specific purpose — not a
+ * separate pepper the host has to generate, store, and keep in sync with
+ * hashing and verification. This project's whole pitch is "one secret";
+ * adding a second one just for client-secret hashing would undercut that
+ * for a feature only confidential clients (Gemini Enterprise, in practice)
+ * even use.
+ *
+ * HMAC-SHA256, not a slow password hash (PBKDF2/bcrypt/scrypt/argon2):
+ * client secrets are high-entropy, machine-generated values, not
+ * human-chosen passwords, so a fast keyed hash is cryptographically
+ * adequate here — and a slow hash would burn real CPU budget on every
+ * token exchange, on every runtime this library targets, including
+ * Cloudflare Workers' request-scoped CPU limits. If your client secrets
+ * are human-chosen, don't use this — do a real password hash inside your
+ * own `verifySecret` instead.
+ */
+/**
+ * Hash a client secret for storage in your `ClientStore.secretHash` lookup.
+ * Call this once, at registration time, with the same `codeSecret` value
+ * your `createOAuthRouter`/`createMcpApp` is configured with — store only
+ * the result, never the plaintext secret.
+ */
+export declare const hashClientSecret: (secret: string, codeSecretValue: string) => Promise<string>;
+/**
+ * Verify a presented secret against a stored hash from `hashClientSecret`.
+ * Constant-time. Used internally by `firstClientAuthError` when
+ * `ClientStore.secretHash` is configured — exported for hosts that want
+ * the same check outside the token endpoint (e.g. a client-management API).
+ */
+export declare const verifyClientSecret: (presented: string, stored: string, codeSecretValue: string) => Promise<boolean>;
+//# sourceMappingURL=secrethash.d.ts.map

package/dist/oauth/secrethash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrethash.d.ts","sourceRoot":"","sources":["../../src/oauth/secrethash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA8BH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,iBAAiB,MAAM,KACtB,OAAO,CAAC,MAAM,CAIhB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,QAAQ,MAAM,EACd,iBAAiB,MAAM,KACtB,OAAO,CAAC,OAAO,CAIjB,CAAC"}

package/dist/oauth/secrethash.js

@@ -0,0 +1,66 @@
+/**
+ * Constant-time confidential-client secret hashing.
+ *
+ * `ClientStore.verifySecret` puts comparison in the host's hands by design
+ * — the library must never see or persist plaintext credentials. But that
+ * also means a host that writes `stored === presented` gets a timing oracle
+ * with no warning, while the library ships a perfectly good
+ * `timingSafeEqual` and uses it everywhere else it compares secrets
+ * (auth-code HMAC/seal, PKCE). `ClientStore.secretHash` is the alternative:
+ * the host still owns storage, but hands the library a stored hash instead
+ * of doing the comparison itself, and the library does the compare with
+ * the same primitive it already trusts.
+ *
+ * Keyed by `codeSecret`, HKDF-derived for this specific purpose — not a
+ * separate pepper the host has to generate, store, and keep in sync with
+ * hashing and verification. This project's whole pitch is "one secret";
+ * adding a second one just for client-secret hashing would undercut that
+ * for a feature only confidential clients (Gemini Enterprise, in practice)
+ * even use.
+ *
+ * HMAC-SHA256, not a slow password hash (PBKDF2/bcrypt/scrypt/argon2):
+ * client secrets are high-entropy, machine-generated values, not
+ * human-chosen passwords, so a fast keyed hash is cryptographically
+ * adequate here — and a slow hash would burn real CPU budget on every
+ * token exchange, on every runtime this library targets, including
+ * Cloudflare Workers' request-scoped CPU limits. If your client secrets
+ * are human-chosen, don't use this — do a real password hash inside your
+ * own `verifySecret` instead.
+ */
+import { timingSafeEqual } from "../auth/bearer.js";
+import { bytesToBase64Url } from "./base64url.js";
+const HASH_PREFIX = "hmac-sha256$";
+const HKDF_INFO = "mcp-trellis:client-secret-hash";
+const deriveHmacKey = async (codeSecretValue) => {
+    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(codeSecretValue), "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(0),
+        info: new TextEncoder().encode(HKDF_INFO),
+    }, material, { name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign"]);
+};
+/**
+ * Hash a client secret for storage in your `ClientStore.secretHash` lookup.
+ * Call this once, at registration time, with the same `codeSecret` value
+ * your `createOAuthRouter`/`createMcpApp` is configured with — store only
+ * the result, never the plaintext secret.
+ */
+export const hashClientSecret = async (secret, codeSecretValue) => {
+    const key = await deriveHmacKey(codeSecretValue);
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(secret));
+    return `${HASH_PREFIX}${bytesToBase64Url(sig)}`;
+};
+/**
+ * Verify a presented secret against a stored hash from `hashClientSecret`.
+ * Constant-time. Used internally by `firstClientAuthError` when
+ * `ClientStore.secretHash` is configured — exported for hosts that want
+ * the same check outside the token endpoint (e.g. a client-management API).
+ */
+export const verifyClientSecret = async (presented, stored, codeSecretValue) => {
+    if (!presented || !stored)
+        return false;
+    const recomputed = await hashClientSecret(presented, codeSecretValue);
+    return timingSafeEqual(recomputed, stored);
+};
+//# sourceMappingURL=secrethash.js.map

package/dist/oauth/secrethash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrethash.js","sourceRoot":"","sources":["../../src/oauth/secrethash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAEnD,MAAM,aAAa,GAAG,KAAK,EAAE,eAAuB,EAAsB,EAAE;IAC1E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,EACzC,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;KAC1C,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAc,EACd,eAAuB,EACN,EAAE;IACnB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,MAAc,EACd,eAAuB,EACL,EAAE;IACpB,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACtE,OAAO,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC,CAAC"}

package/dist/oauth/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AA4KpB,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CA4ClB,CAAC"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,kBAAkB,EAA4C,MAAM,YAAY,CAAC;AAuG/F,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAuClB,CAAC"}

package/dist/oauth/token.js

@@ -1,35 +1,15 @@
+import { BodyTooLargeError } from "../body.js";
 import { requireHttpMethod } from "../http.js";
 import { firstClientAuthError, readClientAuth } from "./clientauth.js";
 import { consumeAuthCode } from "./codes.js";
 import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
 import { verifyPkceS256 } from "./pkce.js";
-import { canonicalResource, firstResourceError, resourcesEqual, } from "./resource.js";
-import { oauthError, resolveSecret, tokenResponse, } from "./types.js";
+import { readOAuthBody } from "./reqbody.js";
+import { canonicalResource, firstResourceError, resourcesEqual } from "./resource.js";
+import { oauthError, resolveSecret, tokenResponse } from "./types.js";
 const POST_ONLY = new Set(["POST"]);
 const NO_CORS = { cors: false };
-const readJsonBody = async (request) => {
-    const body = (await request.json());
-    if (!body || typeof body !== "object" || Array.isArray(body)) {
-        throw new Error("malformed request body");
-    }
-    return Object.fromEntries(Object.entries(body)
-        .filter(([, value]) => value != null)
-        .map(([key, value]) => [key, String(value)]));
-};
-const readFormBody = async (request) => {
-    const params = new URLSearchParams(await request.text());
-    return Object.fromEntries([...params.entries()]);
-};
-const BODY_READERS = [
-    { match: (ctype) => ctype.includes("application/json"), read: readJsonBody },
-    { match: () => true, read: readFormBody },
-];
-const readTokenBody = async (request) => {
-    const ctype = request.headers.get("Content-Type") ?? "";
-    const reader = BODY_READERS.find((entry) => entry.match(ctype))?.read ?? readFormBody;
-    return reader(request);
-};
-const handleRefresh = async ({ body, options, expectedResource, clientId, }) => {
+const handleRefresh = async ({ body, options, expectedResource, clientId }) => {
     if (!options.ports.refreshAccessToken) {
         return oauthError(OAUTH_ERRORS.unsupportedGrantType, 400, "refresh_token not enabled");
     }
@@ -62,18 +42,14 @@ const firstAuthCodeMismatch = (record, body, clientId) => {
             description: "client_id mismatch",
         },
     ].find((entry) => !entry.ok);
-    return rule
-        ? oauthError(OAUTH_ERRORS.invalidGrant, 400, rule.description)
-        : null;
+    return rule ? oauthError(OAUTH_ERRORS.invalidGrant, 400, rule.description) : null;
 };
 const handleAuthCode = async ({ request, body, options, expectedResource, clientId, }) => {
     const resourceError = firstResourceError(body.resource ?? "", expectedResource);
     if (resourceError)
         return resourceError;
     const secret = await resolveSecret(options.ports, request);
-    const record = await consumeAuthCode(secret, body.code ?? "", {
-        codeStore: options.ports.codeStore,
-    });
+    const record = await consumeAuthCode(secret, body.code ?? "", options.ports.codeStore !== undefined ? { codeStore: options.ports.codeStore } : {});
     if (!record) {
         return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid or expired code");
     }
@@ -104,16 +80,19 @@ export const handleToken = async (request, options) => {
         return methodError;
     let body;
     try {
-        body = await readTokenBody(request);
+        body = await readOAuthBody(request);
     }
-    catch {
+    catch (exc) {
+        if (exc instanceof BodyTooLargeError) {
+            return oauthError(OAUTH_ERRORS.invalidRequest, 413, "request body too large");
+        }
         return oauthError(OAUTH_ERRORS.invalidRequest, 400, "malformed request body");
     }
     const auth = readClientAuth(request, body);
     if (!auth) {
         return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
     }
-    const clientAuthError = await firstClientAuthError(auth, options);
+    const clientAuthError = await firstClientAuthError(auth, options, request);
     if (clientAuthError)
         return clientAuthError;
     const url = new URL(request.url);

package/dist/oauth/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAuB,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAkB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,UAAU,EACV,aAAa,EACb,aAAa,GAEd,MAAM,YAAY,CAAC;AAEpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAazC,MAAM,YAAY,GAAG,KAAK,EACxB,OAAgB,EACiB,EAAE;IACnC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAY,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EACxB,OAAgB,EACiB,EAAE;IACnC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,YAAY,GAGb;IACH,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5E,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE;CAC1C,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EACzB,OAAgB,EACiB,EAAE;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,MAAM,GACV,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,YAAY,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAiB,KAAK,EAAE,EACzC,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,UAAU,CACf,YAAY,CAAC,oBAAoB,EACjC,GAAG,EACH,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CACtC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,gBAAgB,CACjB,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,8FAA8F;IAC9F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACpD,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,gBAAgB;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAAsB,EACtB,IAA4B,EAC5B,QAAgB,EACC,EAAE;IACnB,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACpD,WAAW,EAAE,uBAAuB;SACrC;QACD;YACE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAChC,WAAW,EAAE,oBAAoB;SAClC;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,IAAI;QACT,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiB,KAAK,EAAE,EAC1C,OAAO,EACP,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,MAAM,aAAa,GAAG,kBAAkB,CACtC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,gBAAgB,CACjB,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;QAC5D,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,UAAU,CACf,YAAY,CAAC,aAAa,EAC1B,GAAG,EACH,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc;IAC/C,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,UAAU,CACf,YAAY,CAAC,oBAAoB,EACjC,GAAG,EACH,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;QACb,OAAO;QACP,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAuB,eAAe,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,WAAW,EAAkB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAA2B,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAazC,MAAM,aAAa,GAAiB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC1F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,8FAA8F;IAC9F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACpD,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,gBAAgB;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAAsB,EACtB,IAA4B,EAC5B,QAAgB,EACC,EAAE;IACnB,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACpD,WAAW,EAAE,uBAAuB;SACrC;QACD;YACE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAChC,WAAW,EAAE,oBAAoB;SAClC;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiB,KAAK,EAAE,EAC1C,OAAO,EACP,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,EAAE,EACf,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CACpF,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc;IAC/C,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;QACb,OAAO;QACP,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/types.d.ts

@@ -1,5 +1,6 @@
-import { type TokenEndpointAuthMethod } from "./constants.js";
 import type { CodeStore } from "./codes.js";
+import type { ConsentOptions } from "./consent.js";
+import { type TokenEndpointAuthMethod } from "./constants.js";
 import type { RedirectAllowlistOptions } from "./redirect.js";
 export type OAuthUser = {
     id: string;
@@ -15,15 +16,33 @@ export type RegisteredClient = {
     redirectUris: string[];
     tokenEndpointAuthMethod: TokenEndpointAuthMethod;
 };
+/**
+ * The payload sealed into a `client_id` this server itself issued via
+ * `/register` (see `sealed.ts`, type `"client"`). Zero storage: the id
+ * *is* the registration record, self-verifying against `codeSecret`.
+ */
+export type ClientAssertion = {
+    redirectUris: string[];
+};
 export type ClientStore = {
     /** Resolve a pre-registered client, or null when unknown. */
     get: (clientId: string) => Promise<RegisteredClient | null>;
     /**
-     * Verify a presented client secret. Required for confidential clients.
-     * Secret storage and comparison stay in your implementation — the library
-     * never sees or persists credentials.
+     * Verify a presented client secret yourself. Secret storage and
+     * comparison stay entirely in your implementation — the library never
+     * sees or persists credentials. Prefer `secretHash` below when you can:
+     * a hand-rolled `stored === presented` here is a timing oracle with no
+     * warning from the library.
      */
     verifySecret?: (clientId: string, presented: string) => Promise<boolean>;
+    /**
+     * Preferred over `verifySecret`: return the stored hash (from
+     * `hashClientSecret`) for `clientId`, or `null` when unknown, and the
+     * library does the comparison with the same constant-time primitive it
+     * uses everywhere else. Checked first when both are present. See
+     * `secrethash.ts`.
+     */
+    secretHash?: (clientId: string) => Promise<string | null>;
 };
 export type MintedToken = {
     accessToken: string;
@@ -51,7 +70,22 @@ export type RefreshAccessTokenInput = {
 export type RevokeTokenInput = {
     token: string;
     clientId: string;
-    tokenTypeHint?: "access_token" | "refresh_token";
+    tokenTypeHint?: "access_token" | "refresh_token" | undefined;
+};
+/**
+ * OAuth-side metrics hook, mirroring `McpPorts.audit` on the MCP side.
+ * `reason` is intentionally more specific than what the caller ever sees —
+ * `/token` and `/revoke` collapse every client-auth failure to one generic
+ * `invalid_client` (closing an enumeration oracle; see `clientauth.ts`),
+ * and a rejected `codeSecret` surfaces to the caller only as `server_error`
+ * — this port is where an operator gets the real reason back, without
+ * handing it to an unauthenticated caller.
+ */
+export type OAuthAuditEntry = {
+    /** Machine-stable event name, e.g. "client_auth_failed", "server_error". */
+    event: string;
+    clientId?: string | undefined;
+    reason: string;
 };
 export type OAuthPorts = {
     /** HMAC secret for signing auth codes. */
@@ -63,7 +97,7 @@ export type OAuthPorts = {
     /** Mint an access token bound to the consenting user and resource audience. */
     mintAccessToken: (input: MintAccessTokenInput) => Promise<MintedToken>;
     /** Optional refresh_token grant. Presence advertises the grant. */
-    refreshAccessToken?: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
+    refreshAccessToken?: ((input: RefreshAccessTokenInput) => Promise<MintedToken | null>) | undefined;
     /**
      * RFC 7009. Presence mounts `/revoke` and advertises `revocation_endpoint`.
      * Well-formed authenticated revoke is HTTP 200 even if the token is unknown
@@ -71,18 +105,40 @@ export type OAuthPorts = {
      * `refreshAccessToken` MUST consult the same store; unknown tokens and
      * tokens not issued to `clientId` MUST no-op (not throw).
      */
-    revokeToken?: (input: RevokeTokenInput) => Promise<void>;
+    revokeToken?: ((input: RevokeTokenInput) => Promise<void>) | undefined;
     /** Shared single-use jti store for multi-instance; in-memory default otherwise. */
-    codeStore?: CodeStore;
+    codeStore?: CodeStore | undefined;
     /** Pre-registered clients. Required to serve confidential clients. */
-    clientStore?: ClientStore;
+    clientStore?: ClientStore | undefined;
+    /**
+     * Opt-in metrics hook. Pass any function to see the real reason behind a
+     * collapsed `invalid_client` or a rejected `codeSecret`. Omit it and the
+     * library stays silent. Throwing never fails the request — same
+     * guarantee as `McpPorts.audit`.
+     */
+    audit?: ((entry: OAuthAuditEntry) => void | Promise<void>) | undefined;
 };
+/**
+ * Invoke `ports.audit`, swallowing any failure — the OAuth-side twin of
+ * `methods.ts`'s `safeAudit`. No timeout wrapper here: unlike the MCP
+ * side, nothing here is expected to be a slow, request-scoped metrics
+ * call in the same way, and adding one would be complexity without a
+ * demonstrated need — revisit if that changes.
+ */
+export declare const safeOAuthAudit: (options: OAuthRouterOptions, entry: OAuthAuditEntry) => Promise<void>;
 export type OAuthRouterOptions = {
     ports: OAuthPorts;
     resourcePath?: string;
     oauthPath?: string;
     realm?: string;
     scopes?: string[];
+    /**
+     * Scopes granted when a client omits `scope` entirely. Required when
+     * `scopes` advertises more than one — with only one advertised scope
+     * there's no escalation to prevent, so it defaults to that scope.
+     * Must be a subset of `scopes`.
+     */
+    defaultScopes?: string[];
     redirect?: RedirectAllowlistOptions;
     /** Advertised in AS metadata. Defaults to `["none"]` (public clients only). */
     tokenEndpointAuthMethods?: TokenEndpointAuthMethod[];
@@ -98,12 +154,53 @@ export type OAuthRouterOptions = {
      * `hasDynamicClient`.
      */
     allowUnregisteredClients?: boolean;
+    /**
+     * Require every `client_id` to have gone through `clientStore` or this
+     * server's own `/register` (whose issued ids are self-verifying sealed
+     * assertions — see `sealed.ts`). Unlike `allowUnregisteredClients: false`,
+     * DCR stays mounted; a client just can't invent an id out of thin air.
+     *
+     * Default **true** since 1.0. Set **false** only when you intentionally
+     * accept arbitrary public `client_id`s (pre-CIMD connectors that invent ids).
+     */
+    requireRegisteredClients?: boolean;
+    /**
+     * Consent policy. Policy, not a credential — sits alongside `redirect`,
+     * not under `ports`. Omit for the built-in hardened interstitial.
+     */
+    consent?: ConsentOptions;
 };
 /** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
 export declare const unregisteredClientsAllowed: (options: OAuthRouterOptions) => boolean;
+/** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
+export declare const registeredClientsRequired: (options: OAuthRouterOptions) => boolean;
 /** Scopes this AS advertises and is willing to grant. */
 export declare const advertisedScopes: (options: OAuthRouterOptions) => string[];
+/**
+ * Scopes granted when a client omits `scope`. Falls back to the full
+ * advertised set only when that set has at most one entry — see
+ * `assertScopeConfig`, which forbids the ambiguous multi-scope case at
+ * construction instead of silently over-granting here.
+ */
+export declare const defaultScopes: (options: OAuthRouterOptions) => string[];
+/**
+ * A multi-scope server MUST say what an omitted `scope` grants — the
+ * alternative (silently granting everything advertised) is exactly the
+ * escalation least-privilege scoping exists to prevent.
+ */
+export declare const assertScopeConfig: (options: OAuthRouterOptions) => void;
+export declare const assertCodeSecret: (secret: string) => void;
 export declare const resolveSecret: (ports: OAuthPorts, req: Request) => Promise<string>;
+/**
+ * An OAuth error's code and description without a `Response` built yet —
+ * lets a caller choose delivery: `oauthError` below for a direct JSON
+ * body, or a redirect to the client's own callback (RFC 6749 §4.1.2.1,
+ * see `authorize.ts` and `consent.ts`).
+ */
+export type OAuthErrorInfo = {
+    code: string;
+    description: string;
+};
 export declare const oauthError: (error: string, status: number, description?: string) => Response;
 /** Direct JSON error when this AS does not serve unknown `client_id`s. */
 export declare const unregisteredClientError: (options: OAuthRouterOptions, reject: {

package/dist/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1E,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,CACnB,KAAK,EAAE,uBAAuB,KAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GACrC,SAAS,kBAAkB,KAC1B,OAAqD,CAAC;AAEzD,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC,eAAO,MAAM,aAAa,GACxB,OAAO,UAAU,EACjB,KAAK,OAAO,KACX,OAAO,CAAC,MAAM,CAGhB,CAAC;AAEF,eAAO,MAAM,UAAU,GACrB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,cAAc,MAAM,KACnB,QAMA,CAAC;AAKJ,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAOb,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,aAAa,GACxB,QAAQ,WAAW,EACnB,eAAe,MAAM,KACpB,QAYA,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAiB,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EACf,CAAC,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GACjE,SAAS,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GACzB,SAAS,kBAAkB,EAC3B,OAAO,eAAe,KACrB,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GAAI,SAAS,kBAAkB,KAAG,OAC7B,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,OAC5B,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,kBAAkB,KAAG,MAAM,EACd,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,IAY/D,CAAC;AAgBF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,IAajD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,OAAO,UAAU,EAAE,KAAK,OAAO,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,QAM9E,CAAC;AAKJ,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAGb,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,EAAE,eAAe,MAAM,KAAG,QAYxE,CAAC"}

package/dist/oauth/types.js

@@ -1,13 +1,76 @@
-import { DEFAULT_SCOPE } from "./constants.js";
 import { jsonResponse } from "../http.js";
+import { DEFAULT_SCOPE } from "./constants.js";
+/**
+ * Invoke `ports.audit`, swallowing any failure — the OAuth-side twin of
+ * `methods.ts`'s `safeAudit`. No timeout wrapper here: unlike the MCP
+ * side, nothing here is expected to be a slow, request-scoped metrics
+ * call in the same way, and adding one would be complexity without a
+ * demonstrated need — revisit if that changes.
+ */
+export const safeOAuthAudit = async (options, entry) => {
+    try {
+        await options.ports.audit?.(entry);
+    }
+    catch {
+        // Intentionally ignored.
+    }
+};
 /** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
 export const unregisteredClientsAllowed = (options) => options.allowUnregisteredClients !== false;
+/** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
+export const registeredClientsRequired = (options) => options.requireRegisteredClients !== false;
 /** Scopes this AS advertises and is willing to grant. */
 export const advertisedScopes = (options) => options.scopes ?? [DEFAULT_SCOPE];
+/**
+ * Scopes granted when a client omits `scope`. Falls back to the full
+ * advertised set only when that set has at most one entry — see
+ * `assertScopeConfig`, which forbids the ambiguous multi-scope case at
+ * construction instead of silently over-granting here.
+ */
+export const defaultScopes = (options) => options.defaultScopes ?? advertisedScopes(options);
+/**
+ * A multi-scope server MUST say what an omitted `scope` grants — the
+ * alternative (silently granting everything advertised) is exactly the
+ * escalation least-privilege scoping exists to prevent.
+ */
+export const assertScopeConfig = (options) => {
+    const advertised = advertisedScopes(options);
+    if (advertised.length > 1 && !options.defaultScopes) {
+        throw new Error("scopes has more than one entry — defaultScopes must say what an omitted " +
+            "scope request grants (e.g. defaultScopes: [] for least privilege)");
+    }
+    const unknown = (options.defaultScopes ?? []).find((scope) => !advertised.includes(scope));
+    if (unknown !== undefined) {
+        throw new Error(`defaultScopes contains "${unknown}", which is not in scopes`);
+    }
+};
+/**
+ * `codeSecret` can forge an auth code for any userId/scope/resource, so a
+ * weak or copy-pasted one is a full authorization bypass, not a footgun.
+ * The literals here are the exact strings this package's own docs/examples
+ * publish — copy-paste is the realistic failure mode.
+ */
+const MIN_CODE_SECRET_LENGTH = 32;
+const DENYLISTED_CODE_SECRETS = new Set([
+    "e2e-code-secret-value",
+    "change-me",
+    "test-secret-value",
+]);
+const GENERATE_HINT = "generate one with `openssl rand -base64 32`";
+export const assertCodeSecret = (secret) => {
+    // Checked before the length rule so a denylisted literal is always named
+    // for what it is, even if a future literal happens to be 32+ characters.
+    if (DENYLISTED_CODE_SECRETS.has(secret)) {
+        throw new Error(`codeSecret must not be a literal published in this package's own docs or examples — ${GENERATE_HINT}`);
+    }
+    if (secret.length < MIN_CODE_SECRET_LENGTH) {
+        throw new Error(`codeSecret must be at least ${MIN_CODE_SECRET_LENGTH} characters (got ${secret.length}) — ${GENERATE_HINT}`);
+    }
+};
 export const resolveSecret = async (ports, req) => {
-    if (typeof ports.codeSecret === "string")
-        return ports.codeSecret;
-    return ports.codeSecret(req);
+    const secret = typeof ports.codeSecret === "string" ? ports.codeSecret : await ports.codeSecret(req);
+    assertCodeSecret(secret);
+    return secret;
 };
 export const oauthError = (error, status, description) => jsonResponse(description ? { error, error_description: description } : { error }, status, undefined, { cors: false });
 const UNREGISTERED_CLIENT_DESCRIPTION = "unknown client_id — this server only serves pre-registered clients";

package/dist/oauth/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAgC,MAAM,gBAAgB,CAAC;AAG7E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6G1C,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,OAA2B,EAClB,EAAE,CAAC,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAEzD,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,KAAiB,EACjB,GAAY,EACK,EAAE;IACnB,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAClE,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAa,EACb,MAAc,EACd,WAAoB,EACV,EAAE,CACZ,YAAY,CACV,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACnE,MAAM,EACN,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AAEJ,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,MAAM,EACb,+BAA+B,CAChC,CAAC;AACJ,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAmB,EACnB,YAAqB,EACX,EAAE,CACZ,YAAY,CACV;IACE,YAAY,EAAE,MAAM,CAAC,WAAW;IAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;IACxC,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY,IAAI,aAAa;IACpD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACvE,EACD,GAAG,EACH,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1C,OAAO,EAAE,aAAa,EAAgC,MAAM,gBAAgB,CAAC;AAiI7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAA2B,EAC3B,KAAsB,EACP,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC,CAAC;AA+CF,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA2B,EAAW,EAAE,CACjF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAA2B,EAAW,EAAE,CAChF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA2B,EAAY,EAAE,CACrE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IACrE,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,2BAA2B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,uBAAuB;IACvB,WAAW;IACX,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,6CAA6C,CAAC;AAEpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAQ,EAAE;IACvD,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,uFAAuF,aAAa,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,+BAA+B,sBAAsB,oBAAoB,MAAM,CAAC,MAAM,OAAO,aAAa,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,KAAiB,EAAE,GAAY,EAAmB,EAAE;IACtF,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxF,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,WAAoB,EAAY,EAAE,CAC1F,YAAY,CACV,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACnE,MAAM,EACN,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AAEJ,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAE,YAAqB,EAAY,EAAE,CACpF,YAAY,CACV;IACE,YAAY,EAAE,MAAM,CAAC,WAAW;IAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;IACxC,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY,IAAI,aAAa;IACpD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACvE,EACD,GAAG,EACH,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC"}

package/dist/oauth/wellknown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wellknown.d.ts","sourceRoot":"","sources":["../../src/oauth/wellknown.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAUpB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,EAC3B,OAAO;IACL,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,KACA,OAAO,CAAC,QAAQ,GAAG,IAAI,CAuBzB,CAAC"}
+{"version":3,"file":"wellknown.d.ts","sourceRoot":"","sources":["../../src/oauth/wellknown.ts"],"names":[],"mappings":"AAOA,OAAO,EAAmB,KAAK,kBAAkB,EAA8B,MAAM,YAAY,CAAC;AAUlG,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,EAC3B,OAAO;IACL,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,KACA,OAAO,CAAC,QAAQ,GAAG,IAAI,CAyBzB,CAAC"}

package/dist/oauth/wellknown.js

@@ -1,7 +1,7 @@
 import { jsonResponse, requireHttpMethod } from "../http.js";
-import { authorizationServerMetadata, protectedResourceMetadata, } from "./metadata.js";
 import { GRANT_TYPES } from "./constants.js";
-import { unregisteredClientsAllowed, } from "./types.js";
+import { authorizationServerMetadata, protectedResourceMetadata, } from "./metadata.js";
+import { unregisteredClientsAllowed } from "./types.js";
 const GET_ONLY = new Set(["GET"]);
 const grantTypesOf = (ports) => {
     const grants = [GRANT_TYPES.authorizationCode];
@@ -22,8 +22,10 @@ export const handleWellKnown = async (request, options, paths) => {
         resourcePath: paths.resourcePath,
         oauthPath: paths.oauthPath,
         grantTypes: grantTypesOf(options.ports),
-        scopes: options.scopes,
-        tokenEndpointAuthMethods: options.tokenEndpointAuthMethods,
+        ...(options.scopes !== undefined ? { scopes: options.scopes } : {}),
+        ...(options.tokenEndpointAuthMethods !== undefined
+            ? { tokenEndpointAuthMethods: options.tokenEndpointAuthMethods }
+            : {}),
         dcrEnabled: unregisteredClientsAllowed(options),
         revocationEnabled: Boolean(options.ports.revokeToken),
     };

package/dist/oauth/wellknown.js.map

@@ -1 +1 @@
-{"version":3,"file":"wellknown.js","sourceRoot":"","sources":["../../src/oauth/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,0BAA0B,GAG3B,MAAM,YAAY,CAAC;AAEpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAElC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAe,EAAE;IACtD,MAAM,MAAM,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,kBAAkB;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EAC3B,KAKC,EACyB,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;QAC1D,UAAU,EAAE,0BAA0B,CAAC,OAAO,CAAC;QAC/C,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC"}
+{"version":3,"file":"wellknown.js","sourceRoot":"","sources":["../../src/oauth/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,2BAA2B,EAE3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAA4C,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAElG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAElC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAe,EAAE;IACtD,MAAM,MAAM,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,kBAAkB;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EAC3B,KAKC,EACyB,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,wBAAwB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,0BAA0B,CAAC,OAAO,CAAC;QAC/C,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC"}

package/dist/protocol.d.ts

@@ -1,4 +1,18 @@
 export declare const PROTOCOL_VERSIONS: Set<string>;
-export declare const DEFAULT_PROTOCOL_VERSION = "2024-11-05";
+/**
+ * Answered on `initialize` when the client's requested version is missing
+ * or unrecognized. The spec's guidance is to respond with a version the
+ * server supports, preferring the latest — not the oldest one, which is
+ * what this constant did before.
+ */
+export declare const DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+/**
+ * The assumed protocol version for a request that omits the
+ * `MCP-Protocol-Version` header — distinct from `DEFAULT_PROTOCOL_VERSION`
+ * above. This is the 2025-06-18 spec's own backwards-compatibility rule
+ * for the header specifically (introduced in that revision, so a header-less
+ * request predates it), not a "pick the newest" preference.
+ */
+export declare const ASSUMED_HEADER_PROTOCOL_VERSION = "2025-03-26";
 export declare const pickProtocolVersion: (params?: Record<string, unknown>) => string;
 //# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,aAI5B,CAAC;AAEH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,mBAAmB,GAC9B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,MAMF,CAAC"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,aAAsD,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAAe,CAAC;AAE5D,eAAO,MAAM,mBAAmB,GAAI,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAMtE,CAAC"}

package/dist/protocol.js

@@ -1,9 +1,19 @@
-export const PROTOCOL_VERSIONS = new Set([
-    "2024-11-05",
-    "2025-03-26",
-    "2025-06-18",
-]);
-export const DEFAULT_PROTOCOL_VERSION = "2024-11-05";
+export const PROTOCOL_VERSIONS = new Set(["2024-11-05", "2025-03-26", "2025-06-18"]);
+/**
+ * Answered on `initialize` when the client's requested version is missing
+ * or unrecognized. The spec's guidance is to respond with a version the
+ * server supports, preferring the latest — not the oldest one, which is
+ * what this constant did before.
+ */
+export const DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+/**
+ * The assumed protocol version for a request that omits the
+ * `MCP-Protocol-Version` header — distinct from `DEFAULT_PROTOCOL_VERSION`
+ * above. This is the 2025-06-18 spec's own backwards-compatibility rule
+ * for the header specifically (introduced in that revision, so a header-less
+ * request predates it), not a "pick the newest" preference.
+ */
+export const ASSUMED_HEADER_PROTOCOL_VERSION = "2025-03-26";
 export const pickProtocolVersion = (params) => {
     const requested = params?.protocolVersion;
     if (typeof requested === "string" && PROTOCOL_VERSIONS.has(requested)) {

package/dist/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,YAAY;IACZ,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAgC,EACxB,EAAE;IACV,MAAM,SAAS,GAAG,MAAM,EAAE,eAAe,CAAC;IAC1C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CAAC;AAE5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAgC,EAAU,EAAE;IAC9E,MAAM,SAAS,GAAG,MAAM,EAAE,eAAe,CAAC;IAC1C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC,CAAC"}