mcp-trellis 0.2.1 → 2.1.0

package/dist/oauth/endpoints/consent-page.d.ts

@@ -0,0 +1,5 @@
+/** The built-in consent interstitial, used when the host supplies no `consent.render`. */
+import type { ConsentRequest } from "../types.js";
+/** Built-in hardened interstitial — used whenever the host doesn't supply `consent.render`. */
+export declare const renderBuiltInConsent: (input: ConsentRequest) => Response;
+//# sourceMappingURL=consent-page.d.ts.map

package/dist/oauth/endpoints/consent-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-page.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent-page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA+BlD,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,GAAI,OAAO,cAAc,KAAG,QAmC5D,CAAC"}

package/dist/oauth/endpoints/consent-page.js

@@ -0,0 +1,63 @@
+/** The built-in consent interstitial, used when the host supplies no `consent.render`. */
+const ESCAPE_HTML = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;",
+};
+const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ESCAPE_HTML[ch] ?? ch);
+/**
+ * `form-action` governs where a form (and the redirect chain it triggers)
+ * may end up — not just the immediate POST target. Chromium enforces it on
+ * the 302 this page's own submission produces, so `'self'` alone blocks the
+ * approve/deny POST to `${oauthPath}/consent` from ever reaching a
+ * `redirectUri` on another origin (the common case — Claude, Gemini,
+ * loopback clients). `redirectUri` is already validated by `authorize.ts`
+ * before this renders, so its origin is safe to add here.
+ */
+const consentSecurityHeaders = (redirectUri) => ({
+    "Content-Security-Policy": `default-src 'none'; style-src 'unsafe-inline'; ` +
+        `form-action 'self' ${new URL(redirectUri).origin}; frame-ancestors 'none'`,
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "no-referrer",
+    "Cache-Control": "no-store",
+});
+/** Built-in hardened interstitial — used whenever the host doesn't supply `consent.render`. */
+export const renderBuiltInConsent = (input) => {
+    const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Authorize access</title>
+<style>
+  body { font: 16px system-ui, sans-serif; max-width: 32rem; margin: 3rem auto; padding: 0 1rem; }
+  dl { display: grid; grid-template-columns: auto 1fr; gap: 0.25rem 1rem; }
+  dt { font-weight: 600; }
+  button { font-size: 1rem; padding: 0.5rem 1.25rem; margin-right: 0.5rem; }
+</style>
+</head>
+<body>
+<h1>Authorize access</h1>
+<p><strong>${escapeHtml(input.clientId)}</strong> is requesting access to your account.</p>
+<dl>
+  <dt>Redirect URI</dt><dd>${escapeHtml(input.redirectUri)}</dd>
+  <dt>Scope</dt><dd>${escapeHtml(input.scope.join(" ") || "(none)")}</dd>
+  <dt>Resource</dt><dd>${escapeHtml(input.resource)}</dd>
+</dl>
+<form method="POST" action="${escapeHtml(input.oauthPath)}/consent">
+  <input type="hidden" name="consent_ticket" value="${escapeHtml(input.ticket)}">
+  <button type="submit" name="approved" value="true">Allow</button>
+  <button type="submit" name="approved" value="false">Deny</button>
+</form>
+</body>
+</html>`;
+    return new Response(html, {
+        status: 200,
+        headers: {
+            "Content-Type": "text/html; charset=utf-8",
+            ...consentSecurityHeaders(input.redirectUri),
+        },
+    });
+};
+//# sourceMappingURL=consent-page.js.map

package/dist/oauth/endpoints/consent-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-page.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent-page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAI1F,MAAM,WAAW,GAA2B;IAC1C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,CAAC,WAAmB,EAA0B,EAAE,CAAC,CAAC;IAC/E,yBAAyB,EACvB,iDAAiD;QACjD,sBAAsB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,0BAA0B;IAC7E,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAY,EAAE;IACtE,MAAM,IAAI,GAAG;;;;;;;;;;;;;;aAcF,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;6BAEV,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;sBACpC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;yBAC1C,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;8BAErB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;sDACH,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;;;;;QAKtE,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC;SAC7C;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/endpoints/consent.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The consent step between a resolved user and code issuance (RFC 6749
+ * §4.1.1 "the resource owner grants or denies the ... request").
+ *
+ * `/authorize` seals everything the eventual `/consent` POST needs into an
+ * opaque, single-use ticket — the ticket carries `clientId`, `redirectUri`,
+ * `codeChallenge`, `resource`, and `scope` from the *validated* request, so
+ * `handleConsent` trusts nothing from the POST body except which ticket and
+ * whether the user approved it. Nothing else in that body is read.
+ */
+import type { ConsentRequest, OAuthRouterOptions, RegisteredClient, ResolvedOAuthRouterOptions } from "../types.js";
+type ConsentTicketPayload = {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    userId: string;
+    resource: string;
+    scope: string;
+    state: string;
+    exp: number;
+    jti: string;
+};
+export declare const issueConsentTicket: (secret: string, payload: Omit<ConsentTicketPayload, "exp" | "jti">) => Promise<string>;
+export declare const renderConsent: (options: OAuthRouterOptions, input: ConsentRequest) => Promise<Response>;
+/** Only honored when `clientStore` actually resolves the id — never a self-invented one. */
+export declare const isPreApproved: (options: OAuthRouterOptions, clientId: string, registered: RegisteredClient | null) => boolean;
+export declare const handleConsent: (request: Request, options: ResolvedOAuthRouterOptions) => Promise<Response>;
+export {};
+//# sourceMappingURL=consent.d.ts.map

package/dist/oauth/endpoints/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAElB,gBAAgB,EAChB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAMrB,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,SAAS,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,KAAK,CAAC,KACjD,OAAO,CAAC,MAAM,CAKkB,CAAC;AAEpC,eAAO,MAAM,aAAa,GACxB,SAAS,kBAAkB,EAC3B,OAAO,cAAc,KACpB,OAAO,CAAC,QAAQ,CAA6D,CAAC;AAEjF,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GACxB,SAAS,kBAAkB,EAC3B,UAAU,MAAM,EAChB,YAAY,gBAAgB,GAAG,IAAI,KAClC,OAC0F,CAAC;AAyD9F,eAAO,MAAM,aAAa,GACxB,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAmClB,CAAC"}

package/dist/oauth/endpoints/consent.js

@@ -0,0 +1,98 @@
+/**
+ * The consent step between a resolved user and code issuance (RFC 6749
+ * §4.1.1 "the resource owner grants or denies the ... request").
+ *
+ * `/authorize` seals everything the eventual `/consent` POST needs into an
+ * opaque, single-use ticket — the ticket carries `clientId`, `redirectUri`,
+ * `codeChallenge`, `resource`, and `scope` from the *validated* request, so
+ * `handleConsent` trusts nothing from the POST body except which ticket and
+ * whether the user approved it. Nothing else in that body is read.
+ */
+import { NO_CORS, POST_ONLY, requireHttpMethod } from "../../http/http.js";
+import { auditLegacyKeyUsage } from "../audit.js";
+import { oauthError, resolveSecrets } from "../config.js";
+import { OAUTH_ERRORS } from "../constants.js";
+import { issueAuthCode } from "../crypto/codes.js";
+import { seal, unsealAny } from "../crypto/sealed.js";
+import { readBodyOrError, readOAuthBody } from "../policy/reqbody.js";
+import { codeRedirect, errorRedirect } from "./callback.js";
+import { renderBuiltInConsent } from "./consent-page.js";
+const CONSENT_TICKET_TTL_MS = 300_000;
+export const issueConsentTicket = (secret, payload) => seal(secret, "consent", {
+    ...payload,
+    exp: Date.now() + CONSENT_TICKET_TTL_MS,
+    jti: crypto.randomUUID(),
+});
+export const renderConsent = async (options, input) => (options.consent?.render ?? renderBuiltInConsent)(input);
+/** Only honored when `clientStore` actually resolves the id — never a self-invented one. */
+export const isPreApproved = (options, clientId, registered) => Boolean(registered) && (options.consent?.preApprovedClientIds?.includes(clientId) ?? false);
+/** Unseals `ticket`, checks its expiry/jti shape, and audits a legacy-key unseal. */
+const readValidTicket = async (request, options, ticket) => {
+    const secrets = await resolveSecrets(options.ports, request);
+    const unsealed = await unsealAny(secrets, "consent", ticket);
+    const payload = unsealed?.value ?? null;
+    if (!payload ||
+        typeof payload.exp !== "number" ||
+        payload.exp < Date.now() ||
+        typeof payload.jti !== "string" ||
+        !payload.jti) {
+        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid or expired consent_ticket");
+    }
+    await auditLegacyKeyUsage(options, {
+        clientId: payload.clientId,
+        keyIndex: unsealed?.keyIndex,
+        source: "consent ticket unsealed",
+    });
+    return { payload, secrets };
+};
+/**
+ * The resolved user, once the ticket is confirmed as theirs and burned.
+ * Consumed only after the user check — a POST from the wrong session must
+ * not burn the rightful user's ticket — but before either outcome (code or
+ * denial), so single-use holds. Auth codes share this store; the `ct:`
+ * prefix keeps a ticket's jti apart from a code's.
+ */
+const consumeTicketForUser = async (request, options, payload) => {
+    const user = await options.ports.resolveUser(request);
+    if (!user || user.id !== payload.userId) {
+        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "consent_ticket does not match the current user");
+    }
+    const fresh = await options.ports.codeStore.consume(`ct:${payload.jti}`, payload.exp);
+    return fresh ? user : oauthError(OAUTH_ERRORS.invalidGrant, 400, "consent_ticket already used");
+};
+export const handleConsent = async (request, options) => {
+    const methodError = requireHttpMethod(request, POST_ONLY, NO_CORS);
+    if (methodError)
+        return methodError;
+    const body = await readBodyOrError(() => readOAuthBody(request));
+    if (body instanceof Response)
+        return body;
+    const ticket = body.consent_ticket ?? "";
+    if (!ticket) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "consent_ticket required");
+    }
+    const resolved = await readValidTicket(request, options, ticket);
+    if (resolved instanceof Response)
+        return resolved;
+    const { payload, secrets } = resolved;
+    const user = await consumeTicketForUser(request, options, payload);
+    if (user instanceof Response)
+        return user;
+    const callback = {
+        redirectUri: payload.redirectUri,
+        state: payload.state,
+        issuer: new URL(request.url).origin,
+    };
+    if (body.approved !== "true")
+        return errorRedirect(callback, OAUTH_ERRORS.accessDenied);
+    const code = await issueAuthCode(secrets[0], {
+        clientId: payload.clientId,
+        redirectUri: payload.redirectUri,
+        codeChallenge: payload.codeChallenge,
+        userId: user.id,
+        resource: payload.resource,
+        scope: payload.scope,
+    });
+    return codeRedirect(callback, code);
+};
+//# sourceMappingURL=consent.js.map

package/dist/oauth/endpoints/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAQtE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,qBAAqB,GAAG,OAAO,CAAC;AActC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,OAAkD,EACjC,EAAE,CACnB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE;IACtB,GAAG,OAAO;IACV,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;IACvC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;CACM,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAA2B,EAC3B,KAAqB,EACF,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC;AAEjF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAA2B,EAC3B,QAAgB,EAChB,UAAmC,EAC1B,EAAE,CACX,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;AAO9F,qFAAqF;AACrF,MAAM,eAAe,GAAG,KAAK,EAC3B,OAAgB,EAChB,OAA2B,EAC3B,MAAc,EACuB,EAAE;IACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAuB,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IACxC,IACE,CAAC,OAAO;QACR,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACxB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,OAAO,CAAC,GAAG,EACZ,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,KAAK,EAChC,OAAgB,EAChB,OAAmC,EACnC,OAA6B,EACE,EAAE;IACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;AAClG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,QAAQ,YAAY,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAG;QACf,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IAExF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC,CAAC"}

package/dist/oauth/{metadata.d.ts → endpoints/metadata.d.ts}

@@ -1,5 +1,5 @@
-import { type GrantType, type TokenEndpointAuthMethod } from "./constants.js";
-export type { GrantType } from "./constants.js";
+import { type GrantType, type TokenEndpointAuthMethod } from "../constants.js";
+export type { GrantType } from "../constants.js";
 export type ProtectedResourceMetadata = {
     resource: string;
     authorization_servers: string[];
@@ -22,22 +22,28 @@ export type AuthorizationServerMetadata = {
     /** Omitted when `revokeToken` is not configured. */
     revocation_endpoint?: string;
     revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
+    /** RFC 9207 — authorize redirect includes `iss`. */
+    authorization_response_iss_parameter_supported?: boolean;
+    /** Client ID Metadata Documents (MCP 2026-07-28). */
+    client_id_metadata_document_supported?: boolean;
 };
 export type MetadataOptions = {
     origin: string;
     /** MCP resource path, e.g. "/mcp". */
-    resourcePath?: string;
+    resourcePath?: string | undefined;
     /** OAuth path prefix, e.g. "/mcp/oauth". */
-    oauthPath?: string;
+    oauthPath?: string | undefined;
     /** Only advertise grants that are actually handled. */
     grantTypes: GrantType[];
-    scopes?: string[];
+    scopes?: string[] | undefined;
     /** Only advertise auth methods the configured clients actually use. */
-    tokenEndpointAuthMethods?: TokenEndpointAuthMethod[];
+    tokenEndpointAuthMethods?: TokenEndpointAuthMethod[] | undefined;
     /** Advertise `registration_endpoint`. Default true. */
-    dcrEnabled?: boolean;
+    dcrEnabled?: boolean | undefined;
     /** Advertise `revocation_endpoint`. Default false. */
-    revocationEnabled?: boolean;
+    revocationEnabled?: boolean | undefined;
+    /** Advertise CIMD support. Default false. */
+    cimdSupported?: boolean | undefined;
 };
 export declare const protectedResourceMetadata: (options: MetadataOptions) => ProtectedResourceMetadata;
 export declare const authorizationServerMetadata: (options: MetadataOptions) => AuthorizationServerMetadata;

package/dist/oauth/endpoints/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,4BAA4B,EAAE,OAAO,CAAC;IACtC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0CAA0C,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACvE,oDAAoD;IACpD,8CAA8C,CAAC,EAAE,OAAO,CAAC;IACzD,qDAAqD;IACrD,qCAAqC,CAAC,EAAE,OAAO,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uDAAuD;IACvD,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC;IACjE,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,6CAA6C;IAC7C,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAAI,SAAS,eAAe,KAAG,yBAKnE,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,SAAS,eAAe,KACvB,2BA2BF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,qBAAoC,EACpC,cAAa,KACZ,MAIC,CAAC"}

package/dist/oauth/{metadata.js → endpoints/metadata.js}

@@ -1,5 +1,6 @@
-import { DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
-import { canonicalResource, DEFAULT_RESOURCE_PATH } from "./resource.js";
+import { wwwAuthenticateHeader } from "../../auth/bearer.js";
+import { DEFAULT_OAUTH_PATH, DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, } from "../constants.js";
+import { canonicalResource, DEFAULT_RESOURCE_PATH } from "../policy/resource.js";
 export const protectedResourceMetadata = (options) => ({
     resource: canonicalResource(options.origin, options.resourcePath),
     authorization_servers: [options.origin],
@@ -7,7 +8,7 @@ export const protectedResourceMetadata = (options) => ({
     scopes_supported: options.scopes ?? [DEFAULT_SCOPE],
 });
 export const authorizationServerMetadata = (options) => {
-    const oauthPath = options.oauthPath ?? "/mcp/oauth";
+    const oauthPath = options.oauthPath ?? DEFAULT_OAUTH_PATH;
     const tokenEndpointAuthMethods = options.tokenEndpointAuthMethods ?? [
         TOKEN_ENDPOINT_AUTH_METHODS.none,
     ];
@@ -30,7 +31,12 @@ export const authorizationServerMetadata = (options) => {
         token_endpoint_auth_methods_supported: tokenEndpointAuthMethods,
         scopes_supported: options.scopes ?? [DEFAULT_SCOPE],
         resource_parameter_supported: true,
+        authorization_response_iss_parameter_supported: true,
+        ...(options.cimdSupported ? { client_id_metadata_document_supported: true } : {}),
     };
 };
-export const mcpWwwAuthenticate = (origin, resourcePath = DEFAULT_RESOURCE_PATH, realm = "mcp") => `Bearer realm="${realm}", resource_metadata="${origin}/.well-known/oauth-protected-resource${resourcePath}"`;
+export const mcpWwwAuthenticate = (origin, resourcePath = DEFAULT_RESOURCE_PATH, realm = "mcp") => wwwAuthenticateHeader({
+    realm,
+    resourceMetadataUrl: `${origin}/.well-known/oauth-protected-resource${resourcePath}`,
+});
 //# sourceMappingURL=metadata.js.map

package/dist/oauth/endpoints/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,aAAa,EAEb,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAoDjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAwB,EAA6B,EAAE,CAAC,CAAC;IACjG,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;IACjE,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAAwB,EACK,EAAE;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI;QACnE,2BAA2B,CAAC,IAAI;KACjC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,YAAY;QACjE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ;QACrD,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,WAAW,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC;gBACE,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,SAAS;gBAC3D,0CAA0C,EAAE,wBAAwB;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QAC9C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,wBAAwB;QAC/D,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;QACnD,4BAA4B,EAAE,IAAI;QAClC,8CAA8C,EAAE,IAAI;QACpD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,YAAY,GAAG,qBAAqB,EACpC,KAAK,GAAG,KAAK,EACL,EAAE,CACV,qBAAqB,CAAC;IACpB,KAAK;IACL,mBAAmB,EAAE,GAAG,MAAM,wCAAwC,YAAY,EAAE;CACrF,CAAC,CAAC"}

package/dist/oauth/endpoints/register.d.ts

@@ -0,0 +1,10 @@
+/**
+ * RFC 7591 Dynamic Client Registration — `POST ${oauthPath}/register`.
+ *
+ * Zero storage: the issued `client_id` is a sealed assertion of the validated
+ * `redirect_uris` (see `sealed.ts`). Unauthenticated callers can still mint
+ * their own id; consent + `requireRegisteredClients` address impersonation.
+ */
+import type { OAuthRouterOptions } from "../types.js";
+export declare const handleRegister: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
+//# sourceMappingURL=register.d.ts.map

package/dist/oauth/endpoints/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/register.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,KAAK,EAAmB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAsFvE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAgBlB,CAAC"}

package/dist/oauth/endpoints/register.js

@@ -0,0 +1,96 @@
+/**
+ * RFC 7591 Dynamic Client Registration — `POST ${oauthPath}/register`.
+ *
+ * Zero storage: the issued `client_id` is a sealed assertion of the validated
+ * `redirect_uris` (see `sealed.ts`). Unauthenticated callers can still mint
+ * their own id; consent + `requireRegisteredClients` address impersonation.
+ */
+import { DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../../http/body.js";
+import { jsonResponse, POST_ONLY, requireHttpMethod } from "../../http/http.js";
+import { isJsonObject } from "../../util/json.js";
+import { oauthError, resolveSecrets } from "../config.js";
+import { GRANT_TYPES, MAX_CLIENT_REDIRECT_URIS, OAUTH_ERRORS } from "../constants.js";
+import { seal } from "../crypto/sealed.js";
+import { CLAUDE_CALLBACK, isAllowedRedirectUri } from "../policy/redirect.js";
+import { readBodyOrError } from "../policy/reqbody.js";
+/**
+ * Malformed JSON or a non-object body is an error, never "no redirect_uris
+ * supplied" — that would silently register the Claude-callback default for
+ * a request that was never understood.
+ */
+const parseRegisterBody = (text) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    return isJsonObject(parsed)
+        ? parsed
+        : oauthError(OAUTH_ERRORS.invalidClientMetadata, 400, "request body must be a JSON object");
+};
+/** The allowed, non-empty `redirect_uris` to seal, or the error explaining why there are none. */
+const resolveRegisterRedirectUris = (body, options) => {
+    const raw = body.redirect_uris;
+    if (raw === undefined) {
+        // Fall back to the Claude callback only if this server's own allowlist
+        // accepts it — never advertise a redirect_uri `/authorize` would reject
+        // (e.g. `clients` without `"claude"`, where `allowClaude` is false).
+        return isAllowedRedirectUri(CLAUDE_CALLBACK, options.redirect)
+            ? [CLAUDE_CALLBACK]
+            : oauthError(OAUTH_ERRORS.invalidRedirectUri, 400, "redirect_uris required — this server has no default redirect_uri");
+    }
+    if (!Array.isArray(raw)) {
+        return oauthError(OAUTH_ERRORS.invalidClientMetadata, 400, "redirect_uris must be an array");
+    }
+    if (raw.length > MAX_CLIENT_REDIRECT_URIS) {
+        return oauthError(OAUTH_ERRORS.invalidClientMetadata, 400, `redirect_uris must have at most ${MAX_CLIENT_REDIRECT_URIS} entries`);
+    }
+    const allowed = raw.map(String).filter((uri) => isAllowedRedirectUri(uri, options.redirect));
+    return allowed.length > 0
+        ? allowed
+        : oauthError(OAUTH_ERRORS.invalidRedirectUri, 400, "no allowed redirect_uris");
+};
+/**
+ * Zero storage: the client_id *is* the registration record — a sealed,
+ * self-verifying assertion of the redirect_uris just validated, which
+ * `/authorize` binds the client to. Always sealed with the primary
+ * `codeSecret`, so new ids verify with the fewest keys going forward.
+ */
+const issueRegistration = async (request, options, redirectUris) => {
+    const secrets = await resolveSecrets(options.ports, request);
+    const issuedAt = Math.floor(Date.now() / 1000);
+    const clientId = await seal(secrets[0], "client", {
+        redirectUris,
+        iat: issuedAt,
+    });
+    // RFC 7591 §3.2.1: a successful registration is 201 Created.
+    return jsonResponse({
+        status: 201,
+        data: {
+            client_id: clientId,
+            client_id_issued_at: issuedAt,
+            token_endpoint_auth_method: "none",
+            redirect_uris: redirectUris,
+            grant_types: [GRANT_TYPES.authorizationCode],
+            response_types: ["code"],
+        },
+    });
+};
+export const handleRegister = async (request, options) => {
+    const methodError = requireHttpMethod(request, POST_ONLY);
+    if (methodError)
+        return methodError;
+    const text = await readBodyOrError(() => readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT), OAUTH_ERRORS.invalidClientMetadata);
+    if (text instanceof Response)
+        return text;
+    const body = parseRegisterBody(text);
+    if (body instanceof Response)
+        return body;
+    const redirectUris = resolveRegisterRedirectUris(body, options);
+    if (redirectUris instanceof Response)
+        return redirectUris;
+    return issueRegistration(request, options, redirectUris);
+};
+//# sourceMappingURL=register.js.map

package/dist/oauth/endpoints/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/register.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAsC,EAAE;IAC7E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,2BAA2B,GAAG,CAClC,IAA6B,EAC7B,OAA2B,EACN,EAAE;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,OAAO,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC5D,CAAC,CAAC,CAAC,eAAe,CAAC;YACnB,CAAC,CAAC,UAAU,CACR,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,kEAAkE,CACnE,CAAC;IACR,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC1C,OAAO,UAAU,CACf,YAAY,CAAC,qBAAqB,EAClC,GAAG,EACH,mCAAmC,wBAAwB,UAAU,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAC7B,OAAgB,EAChB,OAA2B,EAC3B,YAAsB,EACH,EAAE;IACrB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE;QAChD,YAAY;QACZ,GAAG,EAAE,QAAQ;KACY,CAAC,CAAC;IAE7B,6DAA6D;IAC7D,OAAO,YAAY,CAAC;QAClB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,QAAQ;YAC7B,0BAA0B,EAAE,MAAM;YAClC,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;SACzB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,EACxD,YAAY,CAAC,qBAAqB,CACnC,CAAC;IACF,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,YAAY,YAAY,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC,CAAC"}

package/dist/oauth/{revoke.d.ts → endpoints/revoke.d.ts}

@@ -1,4 +1,4 @@
 /** RFC 7009 token revocation. */
-import { type OAuthRouterOptions } from "./types.js";
+import type { OAuthRouterOptions } from "../types.js";
 export declare const handleRevoke: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
 //# sourceMappingURL=revoke.d.ts.map

package/dist/oauth/endpoints/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAOjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAKtD,eAAO,MAAM,YAAY,GACvB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAuBlB,CAAC"}

package/dist/oauth/{revoke.js → endpoints/revoke.js}

@@ -1,29 +1,31 @@
 /** RFC 7009 token revocation. */
-import { requireHttpMethod } from "../http.js";
-import { firstClientAuthError, readClientAuth } from "./clientauth.js";
-import { OAUTH_ERRORS } from "./constants.js";
-import { oauthError } from "./types.js";
-const POST_ONLY = new Set(["POST"]);
-const NO_CORS = { cors: false };
+import { NO_CORS, POST_ONLY, requireHttpMethod } from "../../http/http.js";
+import { oauthError } from "../config.js";
+import { OAUTH_ERRORS } from "../constants.js";
+import { firstClientAuthError, readClientAuth } from "../crypto/clientauth.js";
+import { readBodyOrError, readOAuthBody } from "../policy/reqbody.js";
 const tokenTypeHintOf = (hint) => hint === "access_token" || hint === "refresh_token" ? hint : undefined;
 export const handleRevoke = async (request, options) => {
     const methodError = requireHttpMethod(request, POST_ONLY, NO_CORS);
     if (methodError)
         return methodError;
-    const body = Object.fromEntries(new URLSearchParams(await request.text()).entries());
+    const body = await readBodyOrError(() => readOAuthBody(request));
+    if (body instanceof Response)
+        return body;
     const token = body.token ?? "";
     if (!token)
         return oauthError(OAUTH_ERRORS.invalidRequest, 400, "token required");
     const auth = readClientAuth(request, body);
     if (!auth)
         return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
-    const clientAuthError = await firstClientAuthError(auth, options);
+    const clientAuthError = await firstClientAuthError(auth, options, request);
     if (clientAuthError)
         return clientAuthError;
+    const hint = tokenTypeHintOf(body.token_type_hint);
     await options.ports.revokeToken?.({
         token,
         clientId: auth.clientId,
-        tokenTypeHint: tokenTypeHintOf(body.token_type_hint),
+        ...(hint !== undefined ? { tokenTypeHint: hint } : {}),
     });
     return new Response(null, { status: 200, headers: { "Cache-Control": "no-store" } });
 };

package/dist/oauth/endpoints/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGtE,MAAM,eAAe,GAAG,CAAC,IAAwB,EAAgD,EAAE,CACjG,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAElF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAErF,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;IAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC,CAAC"}

package/dist/oauth/endpoints/token.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedOAuthRouterOptions } from "../types.js";
+export declare const handleToken: (request: Request, options: ResolvedOAuthRouterOptions) => Promise<Response>;
+//# sourceMappingURL=token.d.ts.map

package/dist/oauth/endpoints/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AA+G9D,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAgClB,CAAC"}

package/dist/oauth/{token.js → endpoints/token.js}

@@ -1,35 +1,14 @@
-import { requireHttpMethod } from "../http.js";
-import { firstClientAuthError, readClientAuth } from "./clientauth.js";
-import { consumeAuthCode } from "./codes.js";
-import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
-import { verifyPkceS256 } from "./pkce.js";
-import { canonicalResource, firstResourceError, resourcesEqual, } from "./resource.js";
-import { oauthError, resolveSecret, tokenResponse, } from "./types.js";
-const POST_ONLY = new Set(["POST"]);
-const NO_CORS = { cors: false };
-const readJsonBody = async (request) => {
-    const body = (await request.json());
-    if (!body || typeof body !== "object" || Array.isArray(body)) {
-        throw new Error("malformed request body");
-    }
-    return Object.fromEntries(Object.entries(body)
-        .filter(([, value]) => value != null)
-        .map(([key, value]) => [key, String(value)]));
-};
-const readFormBody = async (request) => {
-    const params = new URLSearchParams(await request.text());
-    return Object.fromEntries([...params.entries()]);
-};
-const BODY_READERS = [
-    { match: (ctype) => ctype.includes("application/json"), read: readJsonBody },
-    { match: () => true, read: readFormBody },
-];
-const readTokenBody = async (request) => {
-    const ctype = request.headers.get("Content-Type") ?? "";
-    const reader = BODY_READERS.find((entry) => entry.match(ctype))?.read ?? readFormBody;
-    return reader(request);
-};
-const handleRefresh = async ({ body, options, expectedResource, clientId, }) => {
+import { NO_CORS, POST_ONLY, requireHttpMethod } from "../../http/http.js";
+import { auditLegacyKeyUsage } from "../audit.js";
+import { advertisedScopes, oauthError, resolveSecrets, tokenResponse } from "../config.js";
+import { GRANT_TYPES, OAUTH_ERRORS } from "../constants.js";
+import { firstClientAuthError, readClientAuth } from "../crypto/clientauth.js";
+import { consumeAuthCodeDetailed } from "../crypto/codes.js";
+import { verifyPkceS256 } from "../crypto/pkce.js";
+import { readBodyOrError, readOAuthBody } from "../policy/reqbody.js";
+import { canonicalResource, firstResourceError, resourcesEqual } from "../policy/resource.js";
+import { firstScopeError, formatScope, requestedScopes } from "../policy/scope.js";
+const handleRefresh = async ({ body, options, expectedResource, clientId }) => {
     if (!options.ports.refreshAccessToken) {
         return oauthError(OAUTH_ERRORS.unsupportedGrantType, 400, "refresh_token not enabled");
     }
@@ -40,15 +19,26 @@ const handleRefresh = async ({ body, options, expectedResource, clientId, }) =>
     const resourceError = firstResourceError(body.resource ?? "", expectedResource);
     if (resourceError)
         return resourceError;
-    // ponytail: AS cannot verify the refresh token's original audience; the port owns that check.
+    // RFC 6749 §6: client MAY request a reduced scope; omit → host keeps original.
+    let requestedScope;
+    if (body.scope !== undefined && body.scope !== "") {
+        const requested = requestedScopes(body.scope, []);
+        const scopeError = firstScopeError(requested, advertisedScopes(options));
+        if (scopeError)
+            return scopeError;
+        requestedScope = formatScope(requested);
+    }
+    // ponytail: AS cannot verify the refresh token's original audience/grant; the port owns those checks.
     const minted = await options.ports.refreshAccessToken({
         refreshToken,
         clientId,
         resource: expectedResource,
+        ...(requestedScope !== undefined ? { scope: requestedScope } : {}),
     });
     if (!minted) {
         return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid refresh_token");
     }
+    // Scope in the response must come from the port — not the client's request.
     return tokenResponse(minted);
 };
 const firstAuthCodeMismatch = (record, body, clientId) => {
@@ -62,21 +52,21 @@ const firstAuthCodeMismatch = (record, body, clientId) => {
             description: "client_id mismatch",
         },
     ].find((entry) => !entry.ok);
-    return rule
-        ? oauthError(OAUTH_ERRORS.invalidGrant, 400, rule.description)
-        : null;
+    return rule ? oauthError(OAUTH_ERRORS.invalidGrant, 400, rule.description) : null;
 };
 const handleAuthCode = async ({ request, body, options, expectedResource, clientId, }) => {
     const resourceError = firstResourceError(body.resource ?? "", expectedResource);
     if (resourceError)
         return resourceError;
-    const secret = await resolveSecret(options.ports, request);
-    const record = await consumeAuthCode(secret, body.code ?? "", {
+    const secrets = await resolveSecrets(options.ports, request);
+    const consumed = await consumeAuthCodeDetailed(secrets, body.code ?? "", {
         codeStore: options.ports.codeStore,
     });
-    if (!record) {
+    if (!consumed) {
         return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid or expired code");
     }
+    const { record, keyIndex } = consumed;
+    await auditLegacyKeyUsage(options, { clientId, keyIndex, source: "auth code redeemed" });
     const mismatch = firstAuthCodeMismatch(record, body, clientId);
     if (mismatch)
         return mismatch;
@@ -102,18 +92,14 @@ export const handleToken = async (request, options) => {
     const methodError = requireHttpMethod(request, POST_ONLY, NO_CORS);
     if (methodError)
         return methodError;
-    let body;
-    try {
-        body = await readTokenBody(request);
-    }
-    catch {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "malformed request body");
-    }
+    const body = await readBodyOrError(() => readOAuthBody(request));
+    if (body instanceof Response)
+        return body;
     const auth = readClientAuth(request, body);
     if (!auth) {
         return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
     }
-    const clientAuthError = await firstClientAuthError(auth, options);
+    const clientAuthError = await firstClientAuthError(auth, options, request);
     if (clientAuthError)
         return clientAuthError;
     const url = new URL(request.url);