mcp-trellis 0.2.1 → 2.1.0

package/dist/methods.js

@@ -1,114 +0,0 @@
-import { JSONRPC_METHOD_NOT_FOUND, JSONRPC_UNAUTHORIZED, rpcError, rpcResult, } from "./jsonrpc.js";
-import { emptyResponse, jsonResponse } from "./http.js";
-import { pickProtocolVersion } from "./protocol.js";
-import { wwwAuthenticateHeader, } from "./auth/bearer.js";
-export const DEFAULT_PUBLIC_METHODS = new Set([
-    "initialize",
-    "ping",
-    "notifications/initialized",
-    "initialized",
-]);
-const NOTIFICATION_PREDICATES = [
-    (body) => typeof body.method === "string" && body.method.startsWith("notifications/"),
-    (body) => body.method === "initialized",
-    (body) => body.id === undefined && body.method === undefined && "result" in body,
-];
-export const isNotification = (body) => NOTIFICATION_PREDICATES.some((predicate) => predicate(body));
-export const resolveWww = (options, req) => typeof options.wwwAuthenticate === "function"
-    ? options.wwwAuthenticate(req)
-    : options.wwwAuthenticate;
-export const unauthorized = (www, message = "Unauthorized") => jsonResponse(rpcError(null, JSONRPC_UNAUTHORIZED, message), 401, {
-    "WWW-Authenticate": wwwAuthenticateHeader(www),
-});
-/**
- * Invoke the audit metrics hook, swallowing any failure.
- * Telemetry must never turn a served response into a transport error —
- * this is the only call path to `ports.audit`.
- */
-export const safeAudit = async (options, entry) => {
-    try {
-        await options.ports.audit?.(entry);
-    }
-    catch {
-        // Intentionally ignored.
-    }
-};
-export const hasScope = (principal, scope) => {
-    if (!scope)
-        return true;
-    return principal.scopes.includes(scope) || principal.scopes.includes("*");
-};
-const METHODS = {
-    initialize: async ({ id, body, options }) => jsonResponse(rpcResult(id, {
-        protocolVersion: pickProtocolVersion(body.params),
-        capabilities: { tools: {} },
-        serverInfo: options.serverInfo,
-        instructions: options.instructions ?? "",
-    })),
-    ping: async ({ id }) => jsonResponse(rpcResult(id, {})),
-    "tools/list": async ({ id, options }) => jsonResponse(rpcResult(id, { tools: options.registry.list() })),
-    "tools/call": async ({ req, body, id, principal, ctx, options }) => {
-        const params = body.params ?? {};
-        const name = String(params.name ?? "");
-        const rawArgs = params.arguments;
-        const args = rawArgs !== null &&
-            typeof rawArgs === "object" &&
-            !Array.isArray(rawArgs)
-            ? rawArgs
-            : {};
-        const tool = options.registry.get(name);
-        if (tool?.scope && (!principal || !hasScope(principal, tool.scope))) {
-            await safeAudit(options, {
-                method: "tools/call",
-                tool: name,
-                principalId: principal?.id,
-                ok: false,
-                error: "missing_scope",
-                durationMs: 0,
-            });
-            return unauthorized(resolveWww(options, req), `Missing scope: ${tool.scope}`);
-        }
-        const started = Date.now();
-        const result = await options.registry.call(name, ctx, args);
-        await safeAudit(options, {
-            method: "tools/call",
-            tool: name,
-            principalId: principal?.id,
-            ok: !result.isError,
-            error: result.isError ? result.content[0]?.text : undefined,
-            durationMs: Date.now() - started,
-        });
-        return jsonResponse(rpcResult(id, result));
-    },
-};
-export const dispatchRpc = async (input) => {
-    const { req, body, options, publicMethods } = input;
-    const method = body.method ?? "";
-    // Notifications omit `id`; explicit null is a valid request id (JSON-RPC).
-    const id = body.id === undefined ? null : body.id;
-    const toolName = method === "tools/call" ? String(body.params?.name ?? "") : undefined;
-    const isPublic = publicMethods.has(method) || method.startsWith("notifications/");
-    let principal = null;
-    if (!isPublic) {
-        principal = await options.ports.authenticate(req, method, toolName);
-        if (!principal) {
-            await safeAudit(options, {
-                method,
-                tool: toolName,
-                ok: false,
-                error: "unauthorized",
-                durationMs: 0,
-            });
-            return unauthorized(resolveWww(options, req));
-        }
-    }
-    const handler = METHODS[method];
-    if (!handler) {
-        if (body.id === undefined)
-            return emptyResponse(202);
-        return jsonResponse(rpcError(body.id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${method}`));
-    }
-    const ctx = await options.ports.context(req, principal);
-    return handler({ req, body, id, principal, ctx, options });
-};
-//# sourceMappingURL=methods.js.map

package/dist/methods.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"methods.js","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EAGpB,QAAQ,EACR,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAqD1B,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,MAAM;IACN,2BAA2B;IAC3B,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAA6C;IACxE,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC7E,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,aAAa;IACvC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,IAAI,IAAI;CACzE,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAoB,EAAW,EAAE,CAC9D,uBAAuB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,OAAgC,EAChC,GAAY,EACY,EAAE,CAC1B,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU;IAC3C,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;AAE9B,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAA2B,EAC3B,OAAO,GAAG,cAAc,EACd,EAAE,CACZ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE;IAC/D,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,CAAC;CAC/C,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAgC,EAChC,KAAiB,EACF,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,SAAoB,EACpB,KAAyB,EAChB,EAAE;IACX,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC,CAAC;AAWF,MAAM,OAAO,GAAG;IACd,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,YAAY,CACV,SAAS,CAAC,EAAE,EAAE;QACZ,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QACjD,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;KACzC,CAAC,CACH;IAEH,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAEvD,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CACtC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEjE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,MAAM,IAAI,GACR,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,SAAS,EAAE,EAAE;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EACxB,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,CAAC,OAAO,EAAE;YACvB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,SAAS,EAAE,EAAE;YAC1B,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;YACnB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;YAC3D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACmD,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAQ,KAKvC,EAAqB,EAAE;IACtB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,2EAA2E;IAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,MAAM,QAAQ,GACZ,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,QAAQ,GACZ,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACnE,IAAI,SAAS,GAAqB,IAAI,CAAC;IAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,cAAc;gBACrB,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAI,OAAsD,CACrE,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QACrD,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC,CAAC"}

package/dist/oauth/authorize.d.ts

@@ -1,3 +0,0 @@
-import { type OAuthRouterOptions } from "./types.js";
-export declare const handleAuthorize: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
-//# sourceMappingURL=authorize.d.ts.map

package/dist/oauth/authorize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAYA,OAAO,EAKL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AAmDpB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAoFlB,CAAC"}

package/dist/oauth/authorize.js

@@ -1,109 +0,0 @@
-import { requireHttpMethod } from "../http.js";
-import { issueAuthCode } from "./codes.js";
-import { OAUTH_ERRORS } from "./constants.js";
-import { isAllowedRedirectUri, } from "./redirect.js";
-import { canonicalResource, firstResourceError, } from "./resource.js";
-import { firstScopeError, formatScope, requestedScopes } from "./scope.js";
-import { advertisedScopes, oauthError, unregisteredClientError, resolveSecret, } from "./types.js";
-const GET_ONLY = new Set(["GET"]);
-/**
- * A pre-registered client is bound to its own redirect URIs.
- * Only unknown (dynamic / public) clients fall back to the global allowlist.
- */
-const redirectAllowed = (redirectUri, registered, allowlist) => {
-    if (!redirectUri)
-        return false;
-    if (registered)
-        return registered.redirectUris.includes(redirectUri);
-    return isAllowedRedirectUri(redirectUri, allowlist);
-};
-const firstAuthzError = (input) => {
-    const rule = [
-        {
-            ok: input.responseType === "code",
-            description: "response_type must be code",
-        },
-        {
-            ok: redirectAllowed(input.redirectUri, input.registered, input.redirect),
-            description: "invalid redirect_uri",
-        },
-        {
-            ok: Boolean(input.codeChallenge) && input.challengeMethod === "S256",
-            description: "PKCE S256 code_challenge required",
-        },
-    ].find((entry) => !entry.ok);
-    if (rule) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, rule.description);
-    }
-    return firstResourceError(input.resource, input.expectedResource);
-};
-export const handleAuthorize = async (request, options) => {
-    const methodError = requireHttpMethod(request, GET_ONLY);
-    if (methodError)
-        return methodError;
-    const url = new URL(request.url);
-    const expectedResource = canonicalResource(url.origin, options.resourcePath);
-    const clientId = url.searchParams.get("client_id") ?? "";
-    if (!clientId) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
-    }
-    const registered = (await options.ports.clientStore?.get(clientId)) ?? null;
-    if (!registered) {
-        const unregistered = unregisteredClientError(options, {
-            code: OAUTH_ERRORS.unauthorizedClient,
-            status: 400,
-        });
-        if (unregistered)
-            return unregistered;
-    }
-    const authzError = firstAuthzError({
-        responseType: url.searchParams.get("response_type") ?? "",
-        redirectUri: url.searchParams.get("redirect_uri") ?? "",
-        codeChallenge: url.searchParams.get("code_challenge") ?? "",
-        challengeMethod: url.searchParams.get("code_challenge_method") ?? "S256",
-        resource: url.searchParams.get("resource") ?? "",
-        expectedResource,
-        registered,
-        redirect: options.redirect,
-    });
-    if (authzError)
-        return authzError;
-    const advertised = advertisedScopes(options);
-    const granted = requestedScopes(url.searchParams.get("scope") ?? "", advertised);
-    const scopeError = firstScopeError(granted, advertised);
-    if (scopeError)
-        return scopeError;
-    const user = await options.ports.resolveUser(request);
-    if (!user) {
-        const next = `${url.pathname}${url.search}`;
-        const login = options.ports.loginUrl(request, next);
-        let loginTarget;
-        try {
-            loginTarget = new URL(login, url.origin);
-        }
-        catch {
-            return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
-        }
-        if (loginTarget.protocol !== "http:" && loginTarget.protocol !== "https:") {
-            return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
-        }
-        return Response.redirect(loginTarget.toString(), 302);
-    }
-    const redirectUri = url.searchParams.get("redirect_uri") ?? "";
-    const secret = await resolveSecret(options.ports, request);
-    const code = await issueAuthCode(secret, {
-        clientId,
-        redirectUri,
-        codeChallenge: url.searchParams.get("code_challenge") ?? "",
-        userId: user.id,
-        resource: expectedResource,
-        scope: formatScope(granted),
-    });
-    const target = new URL(redirectUri);
-    target.searchParams.set("code", code);
-    const state = url.searchParams.get("state") ?? "";
-    if (state)
-        target.searchParams.set("state", state);
-    return Response.redirect(target.toString(), 302);
-};
-//# sourceMappingURL=authorize.js.map

package/dist/oauth/authorize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,oBAAoB,GAErB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,uBAAuB,EACvB,aAAa,GAGd,MAAM,YAAY,CAAC;AAEpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAElC;;;GAGG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,UAAmC,EACnC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAaF,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAmB,EAAE;IAC7D,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,KAAK,CAAC,YAAY,KAAK,MAAM;YACjC,WAAW,EAAE,4BAA4B;SAC1C;QACD;YACE,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;YACxE,WAAW,EAAE,sBAAsB;SACpC;QACD;YACE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM;YACpE,WAAW,EAAE,mCAAmC;SACjD;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GACd,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAE3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;YACrC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;IACxC,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;QACzD,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACvD,aAAa,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC3D,eAAe,EACb,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM;QACzD,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;QAChD,gBAAgB;QAChB,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EACnC,UAAU,CACX,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;QACvC,QAAQ;QACR,WAAW;QACX,aAAa,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC3D,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC,CAAC"}

package/dist/oauth/base64url.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/oauth/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,eAAO,MAAM,gBAAgB,GAAI,OAAO,WAAW,GAAG,UAAU,KAAG,MAOlE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,MACG,CAAC;AAEnD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,UAM5C,CAAC"}

package/dist/oauth/base64url.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/oauth/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAA+B,EAAU,EAAE;IAC1E,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CACtD,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAc,EAAE;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GACP,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC"}

package/dist/oauth/clientauth.d.ts

@@ -1,19 +0,0 @@
-/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
-import { type TokenEndpointAuthMethod } from "./constants.js";
-import { type OAuthRouterOptions } from "./types.js";
-export type ClientAuth = {
-    clientId: string;
-    secret: string | null;
-    method: TokenEndpointAuthMethod;
-};
-/** Credentials from the Authorization header, else from the body. */
-export declare const readClientAuth: (request: Request, body: Record<string, string>) => ClientAuth | null;
-/**
- * Enforce the registered auth method for known clients.
- *
- * An unknown client_id is treated as public — PKCE is its only proof —
- * unless `allowUnregisteredClients` is false, in which case it is rejected
- * rather than silently falling back to "no auth required".
- */
-export declare const firstClientAuthError: (auth: ClientAuth, options: OAuthRouterOptions) => Promise<Response | null>;
-//# sourceMappingURL=clientauth.d.ts.map

package/dist/oauth/clientauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../src/oauth/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAqBF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAef,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAwBzB,CAAC"}

package/dist/oauth/clientauth.js

@@ -1,76 +0,0 @@
-/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
-import { OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
-import { oauthError, unregisteredClientError, } from "./types.js";
-/** `Authorization: Basic base64(urlencode(id):urlencode(secret))`. */
-const parseBasicAuth = (header) => {
-    if (!header?.startsWith("Basic "))
-        return null;
-    try {
-        const decoded = atob(header.slice("Basic ".length).trim());
-        const separator = decoded.indexOf(":");
-        if (separator < 0)
-            return null;
-        const clientId = decodeURIComponent(decoded.slice(0, separator));
-        if (!clientId)
-            return null;
-        return {
-            clientId,
-            secret: decodeURIComponent(decoded.slice(separator + 1)),
-            method: TOKEN_ENDPOINT_AUTH_METHODS.basic,
-        };
-    }
-    catch {
-        return null;
-    }
-};
-/** Credentials from the Authorization header, else from the body. */
-export const readClientAuth = (request, body) => {
-    const basic = parseBasicAuth(request.headers.get("Authorization"));
-    if (basic)
-        return basic;
-    const clientId = body.client_id ?? "";
-    if (!clientId)
-        return null;
-    const secret = body.client_secret ?? "";
-    return {
-        clientId,
-        secret: secret.length > 0 ? secret : null,
-        method: secret.length > 0
-            ? TOKEN_ENDPOINT_AUTH_METHODS.post
-            : TOKEN_ENDPOINT_AUTH_METHODS.none,
-    };
-};
-const invalidClient = (description) => oauthError(OAUTH_ERRORS.invalidClient, 401, description);
-/**
- * Enforce the registered auth method for known clients.
- *
- * An unknown client_id is treated as public — PKCE is its only proof —
- * unless `allowUnregisteredClients` is false, in which case it is rejected
- * rather than silently falling back to "no auth required".
- */
-export const firstClientAuthError = async (auth, options) => {
-    const store = options.ports.clientStore;
-    const registered = (await store?.get(auth.clientId)) ?? null;
-    if (!registered) {
-        return unregisteredClientError(options, {
-            code: OAUTH_ERRORS.invalidClient,
-            status: 401,
-        });
-    }
-    const expected = registered.tokenEndpointAuthMethod;
-    if (expected === TOKEN_ENDPOINT_AUTH_METHODS.none)
-        return null;
-    if (auth.method !== expected) {
-        return invalidClient(`client requires ${expected}`);
-    }
-    if (!auth.secret)
-        return invalidClient("client_secret required");
-    if (!store?.verifySecret) {
-        return invalidClient("clientStore.verifySecret is not configured");
-    }
-    if (!(await store.verifySecret(auth.clientId, auth.secret))) {
-        return invalidClient("client authentication failed");
-    }
-    return null;
-};
-//# sourceMappingURL=clientauth.js.map

package/dist/oauth/clientauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../src/oauth/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,uBAAuB,GAExB,MAAM,YAAY,CAAC;AAQpB,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,2BAA2B,CAAC,IAAI;YAClC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KACrC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,WAAmB,EAAY,EAAE,CACtD,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EACD,EAAE;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,MAAM,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,uBAAuB,CAAC,OAAO,EAAE;YACtC,IAAI,EAAE,YAAY,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,aAAa,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC,wBAAwB,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/oauth/codes.d.ts

@@ -1,30 +0,0 @@
-export type AuthCodeRecord = {
-    clientId: string;
-    redirectUri: string;
-    codeChallenge: string;
-    /** Consenting user id — required so minted tokens are bound. */
-    userId: string;
-    /** RFC 8707 resource indicator — audience for the eventual access token. */
-    resource: string;
-    /** Space-delimited scope granted at authorize time. */
-    scope: string;
-    exp: number;
-};
-export type CodeStore = {
-    /**
-     * Mark a code jti as consumed; return false if already used.
-     * `expMs` is the code expiry (ms since epoch) for TTL-backed stores.
-     */
-    consume: (jti: string, expMs: number) => Promise<boolean> | boolean;
-};
-/**
- * Issue an HMAC-signed auth code.
- * Single-use via codeStore, or pruning in-memory Map when omitted.
- */
-export declare const issueAuthCode: (secret: string, record: Omit<AuthCodeRecord, "exp">, nowMs?: number) => Promise<string>;
-export declare const consumeAuthCode: (secret: string, code: string, options?: {
-    codeStore?: CodeStore;
-    nowMs?: number;
-}) => Promise<AuthCodeRecord | null>;
-export declare const newClientId: () => string;
-//# sourceMappingURL=codes.d.ts.map

package/dist/oauth/codes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/oauth/codes.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACrE,CAAC;AAkCF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,QAAQ,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EACnC,cAAkB,KACjB,OAAO,CAAC,MAAM,CAShB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,UAAS;IAAE,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,KACtD,OAAO,CAAC,cAAc,GAAG,IAAI,CA8C/B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,MAA6B,CAAC"}

package/dist/oauth/codes.js

@@ -1,93 +0,0 @@
-import { randomBase64Url } from "./pkce.js";
-import { bytesToBase64Url, fromBase64Url, textToBase64Url } from "./base64url.js";
-import { timingSafeEqual } from "../auth/bearer.js";
-const CODE_TTL_MS = 600_000;
-/**
- * Process-local jti → expMs map when no shared codeStore is provided.
- * ponytail: single-process only; multi-instance → pass ports.codeStore (KV/Redis SET NX EX).
- */
-const memoryUsed = new Map();
-const pruneMemory = (nowMs) => {
-    [...memoryUsed].forEach(([jti, exp]) => {
-        if (exp < nowMs)
-            memoryUsed.delete(jti);
-    });
-};
-const memoryCodeStore = {
-    consume: (jti, expMs) => {
-        const nowMs = Date.now();
-        pruneMemory(nowMs);
-        if (memoryUsed.has(jti))
-            return false;
-        memoryUsed.set(jti, expMs);
-        return true;
-    },
-};
-const hmacSign = async (secret, payload) => {
-    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
-    return bytesToBase64Url(sig);
-};
-/**
- * Issue an HMAC-signed auth code.
- * Single-use via codeStore, or pruning in-memory Map when omitted.
- */
-export const issueAuthCode = async (secret, record, nowMs = Date.now()) => {
-    const body = {
-        ...record,
-        exp: nowMs + CODE_TTL_MS,
-        jti: randomBase64Url(12),
-    };
-    const payload = textToBase64Url(JSON.stringify(body));
-    const sig = await hmacSign(secret, payload);
-    return `${payload}.${sig}`;
-};
-export const consumeAuthCode = async (secret, code, options = {}) => {
-    if (!code || !secret)
-        return null;
-    const parts = code.split(".");
-    if (parts.length !== 2)
-        return null;
-    const [payload, sig] = parts;
-    if (!payload || !sig)
-        return null;
-    const expected = await hmacSign(secret, payload);
-    if (!timingSafeEqual(sig, expected))
-        return null;
-    try {
-        const raw = new TextDecoder().decode(fromBase64Url(payload));
-        const data = JSON.parse(raw);
-        const nowMs = options.nowMs ?? Date.now();
-        if (typeof data.clientId !== "string" ||
-            typeof data.redirectUri !== "string" ||
-            typeof data.codeChallenge !== "string" ||
-            typeof data.userId !== "string" ||
-            typeof data.resource !== "string" ||
-            data.resource.length === 0 ||
-            typeof data.scope !== "string" ||
-            typeof data.exp !== "number" ||
-            data.exp < nowMs) {
-            return null;
-        }
-        if (typeof data.jti !== "string" || data.jti.length === 0)
-            return null;
-        const store = options.codeStore ?? memoryCodeStore;
-        const fresh = await store.consume(data.jti, data.exp);
-        if (!fresh)
-            return null;
-        return {
-            clientId: data.clientId,
-            redirectUri: data.redirectUri,
-            codeChallenge: data.codeChallenge,
-            userId: data.userId,
-            resource: data.resource,
-            scope: data.scope,
-            exp: data.exp,
-        };
-    }
-    catch {
-        return null;
-    }
-};
-export const newClientId = () => randomBase64Url(16);
-//# sourceMappingURL=codes.js.map

package/dist/oauth/codes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/oauth/codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAuB7C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAQ,EAAE;IAC1C,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,KAAK;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAc;IACjC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,OAAe,EAAmB,EAAE;IAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,CAAC;IACF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,MAAmC,EACnC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EACD,EAAE;IACnB,MAAM,IAAI,GAAqC;QAC7C,GAAG,MAAM;QACT,GAAG,EAAE,KAAK,GAAG,WAAW;QACxB,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;KACzB,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAc,EACd,IAAY,EACZ,UAAqD,EAAE,EACvB,EAAE;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+C,CAAC;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,IACE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACjC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YACpC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YACtC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC/B,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC9B,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,IAAI,CAAC,GAAG,GAAG,KAAK,EAChB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvE,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC"}

package/dist/oauth/metadata.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,4BAA4B,EAAE,OAAO,CAAC;IACtC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0CAA0C,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,SAAS,eAAe,KACvB,yBAKD,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,SAAS,eAAe,KACvB,2BAyBF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,qBAAoC,EACpC,cAAa,KACZ,MAC2G,CAAC"}

package/dist/oauth/metadata.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,2BAA2B,GAG5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AA8CzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAwB,EACG,EAAE,CAAC,CAAC;IAC/B,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;IACjE,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAAwB,EACK,EAAE;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI;QACnE,2BAA2B,CAAC,IAAI;KACjC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,YAAY;QACjE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ;QACrD,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,WAAW,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC;gBACE,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,SAAS;gBAC3D,0CAA0C,EAAE,wBAAwB;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QAC9C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,wBAAwB;QAC/D,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;QACnD,4BAA4B,EAAE,IAAI;KACnC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,YAAY,GAAG,qBAAqB,EACpC,KAAK,GAAG,KAAK,EACL,EAAE,CACV,iBAAiB,KAAK,yBAAyB,MAAM,wCAAwC,YAAY,GAAG,CAAC"}

package/dist/oauth/pkce.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAMnE,CAAC;AAEF,eAAO,MAAM,cAAc,GACzB,UAAU,MAAM,EAChB,WAAW,MAAM,KAChB,OAAO,CAAC,OAAO,CAIjB,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,MAGjD,CAAC"}

package/dist/oauth/pkce.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAC;IACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,QAAgB,EAChB,SAAiB,EACC,EAAE;IACpB,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC,CAAC"}

package/dist/oauth/redirect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/oauth/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAmCF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAA2E,CAAC"}

package/dist/oauth/redirect.js

@@ -1,26 +0,0 @@
-export const CLAUDE_CALLBACK = "https://claude.ai/api/mcp/auth_callback";
-const isClaudeCallback = (uri, options) => options.allowClaude !== false && uri === CLAUDE_CALLBACK;
-const isExtraAllowed = (uri, options) => Boolean(options.extra?.includes(uri));
-/** WHATWG URL keeps IPv6 hosts bracketed, so `[::1]` is the parsed hostname. */
-const LOOPBACK_HOSTS = new Set(["127.0.0.1", "[::1]", "localhost"]);
-const isLoopbackHttp = (uri, options) => {
-    if (options.allowLoopback === false)
-        return false;
-    try {
-        const parsed = new URL(uri);
-        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-            return false;
-        }
-        return LOOPBACK_HOSTS.has(parsed.hostname);
-    }
-    catch {
-        return false;
-    }
-};
-const REDIRECT_PREDICATES = [
-    isClaudeCallback,
-    isExtraAllowed,
-    isLoopbackHttp,
-];
-export const isAllowedRedirectUri = (uri, options = {}) => REDIRECT_PREDICATES.some((predicate) => predicate(uri, options));
-//# sourceMappingURL=redirect.js.map

package/dist/oauth/redirect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../src/oauth/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAgBzE,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CACzD,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAExC,gFAAgF;AAChF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEpE,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB;IAC/C,gBAAgB;IAChB,cAAc;IACd,cAAc;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC"}

package/dist/oauth/resource.d.ts

@@ -1,7 +0,0 @@
-/** Canonical MCP resource URI (RFC 8707 / RFC 9728). */
-export declare const DEFAULT_RESOURCE_PATH = "/mcp";
-export declare const canonicalResource: (origin: string, resourcePath?: string) => string;
-export declare const resourcesEqual: (requested: string, expected: string) => boolean;
-/** Missing → invalid_request; mismatch → invalid_target. */
-export declare const firstResourceError: (requested: string, expected: string) => Response | null;
-//# sourceMappingURL=resource.d.ts.map

package/dist/oauth/resource.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAKxD,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,qBAAoC,KACnC,MAMF,CAAC;AAmBF,eAAO,MAAM,cAAc,GACzB,WAAW,MAAM,EACjB,UAAU,MAAM,KACf,OAGF,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,UAAU,MAAM,KACf,QAAQ,GAAG,IAgBb,CAAC"}

package/dist/oauth/resource.js

@@ -1,44 +0,0 @@
-/** Canonical MCP resource URI (RFC 8707 / RFC 9728). */
-import { OAUTH_ERRORS } from "./constants.js";
-import { oauthError } from "./types.js";
-export const DEFAULT_RESOURCE_PATH = "/mcp";
-export const canonicalResource = (origin, resourcePath = DEFAULT_RESOURCE_PATH) => {
-    const base = origin.replace(/\/$/, "");
-    const path = resourcePath.startsWith("/")
-        ? resourcePath
-        : `/${resourcePath}`;
-    return `${base}${path}`;
-};
-/**
- * Normalize for RFC 8707 comparison.
- * Rejects fragments (MUST NOT). Includes query so tenants cannot alias.
- * ponytail: exact match after WHATWG URL parse; upgrade to RFC 3986 if
- * non-ASCII hosts or exotic percent-encoding show up.
- */
-const normalizeResource = (uri) => {
-    try {
-        const u = new URL(uri);
-        if (u.hash)
-            return null;
-        const path = u.pathname.replace(/\/$/, "") || "/";
-        return `${u.protocol}//${u.host}${path}${u.search}`;
-    }
-    catch {
-        return null;
-    }
-};
-export const resourcesEqual = (requested, expected) => {
-    const a = normalizeResource(requested);
-    return a !== null && a === normalizeResource(expected);
-};
-/** Missing → invalid_request; mismatch → invalid_target. */
-export const firstResourceError = (requested, expected) => {
-    if (!requested) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "resource required (RFC 8707)");
-    }
-    if (!resourcesEqual(requested, expected)) {
-        return oauthError(OAUTH_ERRORS.invalidTarget, 400, "resource does not match this server");
-    }
-    return null;
-};
-//# sourceMappingURL=resource.js.map

package/dist/oauth/resource.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACd,YAAY,GAAG,qBAAqB,EAC5B,EAAE;IACV,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IACvB,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAiB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAiB,EACjB,QAAgB,EACP,EAAE;IACX,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAiB,EACjB,QAAgB,EACC,EAAE;IACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CACf,YAAY,CAAC,aAAa,EAC1B,GAAG,EACH,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/oauth/revoke.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAKjC,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAUjE,eAAO,MAAM,YAAY,GACvB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAuBlB,CAAC"}