mcp-trellis 0.2.1 → 2.1.0

package/dist/app-options.d.ts

@@ -0,0 +1,132 @@
+import type { ClientName } from "./clients.js";
+import type { AuditEntry, Principal, ServerInfo } from "./mcp/methods.js";
+import type { ToolDef } from "./mcp/registry.js";
+import type { CimdCache } from "./oauth/cimd/types.js";
+import type { CodeStore } from "./oauth/crypto/codes.js";
+import type { ClientStore, ConsentOptions, MintAccessTokenInput, MintedToken, OAuthAuditEntry, OAuthUser, RefreshAccessTokenInput, RevokeTokenInput } from "./oauth/types.js";
+/** One sink for both MCP tool-call and OAuth AS audit events. */
+export type UnifiedAuditEntry = ({
+    source: "mcp";
+} & AuditEntry) | ({
+    source: "oauth";
+} & OAuthAuditEntry);
+/** What your token verification returns. The library checks the audience. */
+export type VerifiedToken = {
+    userId: string;
+    scopes: string[];
+    /** RFC 8707 audience the token was minted for. */
+    audience: string;
+    /** Optional host claims passed through to `context` via `Principal`. */
+    claims?: Record<string, unknown>;
+};
+export type McpAppAuth = {
+    /**
+     * Secret(s) that seal auth codes, consent tickets, and self-issued DCR
+     * client assertions, and key `ClientStore.secretHash`. Pass a string, or
+     * an array for key rotation — the first
+     * entry seals new material, every entry is tried when unsealing/verifying.
+     * See `OAuthPorts.codeSecret` for the full rotation contract.
+     */
+    codeSecret: string | string[] | ((req: Request) => string | string[] | Promise<string | string[]>);
+    /** Resolve the logged-in user, or null → redirect to `loginUrl`. */
+    resolveUser: (req: Request) => Promise<OAuthUser | null>;
+    /** Where to send unauthenticated authorize requests. */
+    loginUrl: (req: Request, nextPath: string) => string;
+    /** Mint an access token; embed `resource` as the audience. */
+    mintAccessToken: (input: MintAccessTokenInput) => Promise<MintedToken>;
+    /**
+     * Decode and validate a bearer token. Return its `audience` —
+     * `createMcpApp` rejects tokens minted for a different resource itself,
+     * so this check cannot be forgotten.
+     */
+    verifyToken: (token: string, req: Request) => Promise<VerifiedToken | null>;
+    refreshAccessToken?: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
+    /** RFC 7009 — presence mounts `/revoke` and advertises it. */
+    revokeToken?: (input: RevokeTokenInput) => Promise<void>;
+    codeStore?: CodeStore;
+    /** Required when any configured client is pre-registered (e.g. Gemini). */
+    clientStore?: ClientStore;
+    /**
+     * Opt-in OAuth-side metrics hook — see the tool-call `audit` below for
+     * the general shape. This one sees the real reason behind a collapsed
+     * `invalid_client` or a rejected `codeSecret`, which the caller never
+     * does. Omit for silence.
+     */
+    audit?: (entry: OAuthAuditEntry) => void | Promise<void>;
+};
+export type McpAppOptions<TCtx> = {
+    serverInfo: ServerInfo;
+    tools: ToolDef<TCtx>[];
+    auth: McpAppAuth;
+    /** Connector clients to serve. Default: `["claude"]`. */
+    clients?: ClientName[];
+    instructions?: string;
+    /** MCP endpoint path. Default `"/mcp"`. */
+    resourcePath?: string;
+    /** OAuth prefix. Default `` `${resourcePath}/oauth` ``. */
+    oauthPath?: string;
+    /** Scopes this server grants. Default `["mcp"]`. */
+    scopes?: string[];
+    /** Required when `scopes` has more than one entry — see `OAuthRouterOptions.defaultScopes`. */
+    defaultScopes?: string[];
+    realm?: string;
+    /** Extra exact-match redirect URIs beyond the client profiles. */
+    extraRedirectUris?: string[];
+    /** Allow loopback redirects (native clients). Default true. */
+    allowLoopback?: boolean;
+    /**
+     * Consent policy — policy, not a credential, so it sits alongside
+     * `allowLoopback` rather than under `auth`. Omit for the built-in
+     * hardened interstitial.
+     */
+    consent?: ConsentOptions;
+    /**
+     * Require every `client_id` to come from `clientStore` or this server's
+     * own `/register` (sealed assertion). Default **true** since 1.0.
+     * Set false only to accept invented public ids (pre-CIMD).
+     */
+    requireRegisteredClients?: boolean;
+    /**
+     * Validate tools/call args against each tool's `inputSchema`. Default
+     * **true** since 2.0. Set false only to skip schema checks intentionally.
+     */
+    validateArgs?: boolean;
+    /**
+     * See `OAuthRouterOptions.allowInMemoryCodeStore`. Default false.
+     */
+    allowInMemoryCodeStore?: boolean;
+    /**
+     * Opt into CIMD (HTTPS URL `client_id`s). Default **false** — see
+     * `OAuthRouterOptions.cimd`.
+     */
+    cimd?: boolean;
+    /**
+     * CIMD document cache. Strongly recommended with `cimd: true` — see
+     * `OAuthRouterOptions.cimdCache`.
+     */
+    cimdCache?: CimdCache;
+    /** Optional DNS lookup for CIMD SSRF checks. */
+    cimdLookup?: (hostname: string) => Promise<string[]>;
+    onToolError?: (error: unknown) => string;
+    /**
+     * Per-call context for tools, built only when a `tools/call` is about to
+     * run (see `McpPorts.context`). Defaults to an empty object.
+     */
+    context?: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
+    /**
+     * Unified metrics hook for MCP and OAuth events (`source: "mcp" | "oauth"`).
+     * Omit for silence. `auth.audit` overrides OAuth delivery when both are set.
+     * See `consoleAudit` or `examples/audit-store.ts`.
+     */
+    audit?: (entry: UnifiedAuditEntry) => void | Promise<void>;
+    /** Max time to wait for `audit` above before responding anyway. Default 1000ms. Also applied to `auth.audit`. */
+    auditTimeoutMs?: number;
+    /**
+     * Browser `Origin` allowlist for `/mcp` — see `McpHandlerOptions.allowedRequestOrigins`.
+     * Omitted → reject any request that sends `Origin`. Native clients omit the header.
+     */
+    allowedRequestOrigins?: string[];
+    /** Filter `tools/list` by scope. See `McpHandlerOptions.hideToolsOutsideScope`. Default false. */
+    hideToolsOutsideScope?: boolean;
+};
+//# sourceMappingURL=app-options.d.ts.map

package/dist/app-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-options.d.ts","sourceRoot":"","sources":["../src/app-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAE1B,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GACzB,CAAC;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GAAG,UAAU,CAAC,GAChC,CAAC;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,eAAe,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,UAAU,EACN,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,oEAAoE;IACpE,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,8DAA8D;IAC9D,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE;;;;OAIG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5E,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACrF,8DAA8D;IAC9D,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,IAAI,IAAI;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,gDAAgD;IAChD,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,iHAAiH;IACjH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,kGAAkG;IAClG,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC"}

package/dist/app-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=app-options.js.map

package/dist/app-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-options.js","sourceRoot":"","sources":["../src/app-options.ts"],"names":[],"mappings":""}

package/dist/app.d.ts

@@ -4,72 +4,8 @@
  * This layers over `createMcpHandler` and `createOAuthRouter`, which stay
  * exported for anyone who wants to compose the pieces themselves.
  */
-import { type ClientName } from "./clients.js";
-import type { AuditEntry, Principal, ServerInfo } from "./methods.js";
-import type { CodeStore } from "./oauth/codes.js";
-import type { ClientStore, MintAccessTokenInput, MintedToken, OAuthUser, RefreshAccessTokenInput, RevokeTokenInput } from "./oauth/types.js";
-import { type ToolDef } from "./registry.js";
-/** What your token verification returns. The library checks the audience. */
-export type VerifiedToken = {
-    userId: string;
-    scopes: string[];
-    /** RFC 8707 audience the token was minted for. */
-    audience: string;
-    /** Optional host claims passed through to `context` via `Principal`. */
-    claims?: Record<string, unknown>;
-};
-export type McpAppAuth = {
-    /** HMAC secret for signing auth codes. */
-    codeSecret: string | ((req: Request) => string | Promise<string>);
-    /** Resolve the logged-in user, or null → redirect to `loginUrl`. */
-    resolveUser: (req: Request) => Promise<OAuthUser | null>;
-    /** Where to send unauthenticated authorize requests. */
-    loginUrl: (req: Request, nextPath: string) => string;
-    /** Mint an access token; embed `resource` as the audience. */
-    mintAccessToken: (input: MintAccessTokenInput) => Promise<MintedToken>;
-    /**
-     * Decode and validate a bearer token. Return its `audience` —
-     * `createMcpApp` rejects tokens minted for a different resource itself,
-     * so this check cannot be forgotten.
-     */
-    verifyToken: (token: string, req: Request) => Promise<VerifiedToken | null>;
-    refreshAccessToken?: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
-    /** RFC 7009 — presence mounts `/revoke` and advertises it. */
-    revokeToken?: (input: RevokeTokenInput) => Promise<void>;
-    codeStore?: CodeStore;
-    /** Required when any configured client is pre-registered (e.g. Gemini). */
-    clientStore?: ClientStore;
-};
-export type McpAppOptions<TCtx> = {
-    serverInfo: ServerInfo;
-    tools: ToolDef<TCtx>[];
-    auth: McpAppAuth;
-    /** Connector clients to serve. Default: `["claude"]`. */
-    clients?: ClientName[];
-    instructions?: string;
-    /** MCP endpoint path. Default `"/mcp"`. */
-    resourcePath?: string;
-    /** OAuth prefix. Default `` `${resourcePath}/oauth` ``. */
-    oauthPath?: string;
-    /** Scopes this server grants. Default `["mcp"]`. */
-    scopes?: string[];
-    realm?: string;
-    /** Extra exact-match redirect URIs beyond the client profiles. */
-    extraRedirectUris?: string[];
-    /** Allow loopback redirects (native clients). Default true. */
-    allowLoopback?: boolean;
-    validateArgs?: boolean;
-    onToolError?: (exc: unknown) => string;
-    /** Per-request context for tools. Defaults to an empty object. */
-    context?: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
-    /**
-     * Opt-in metrics hook — same as `McpPorts.audit`. Pass a function to get
-     * per-request entries (tools + denials); omit for silence. The library
-     * never stores or prints these itself. See `consoleAudit` or
-     * `examples/audit-store.ts`.
-     */
-    audit?: (entry: AuditEntry) => void | Promise<void>;
-};
+import type { McpAppOptions } from "./app-options.js";
+export type { McpAppAuth, McpAppOptions, UnifiedAuditEntry, VerifiedToken, } from "./app-options.js";
 export type McpApp = {
     fetch: (request: Request) => Promise<Response>;
 };

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAEjE,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,oEAAoE;IACpE,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,8DAA8D;IAC9D,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE;;;;OAIG;IACH,WAAW,EAAE,CACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,OAAO,KACT,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnC,kBAAkB,CAAC,EAAE,CACnB,KAAK,EAAE,uBAAuB,KAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,IAAI,IAAI;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACvC,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,IAAI,EAC/B,SAAS,aAAa,CAAC,IAAI,CAAC,KAC3B,MA2FF,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA0BtD,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAwLF,eAAO,MAAM,YAAY,GAAI,IAAI,EAAE,SAAS,aAAa,CAAC,IAAI,CAAC,KAAG,MA8CjE,CAAC"}

package/dist/app.js

@@ -5,65 +5,111 @@
  * exported for anyone who wants to compose the pieces themselves.
  */
 import { parseBearer } from "./auth/bearer.js";
-import { DEFAULT_CLIENTS, assertClientsConfigured, hasDynamicClient, authMethodsFor, redirectUrisFor, } from "./clients.js";
-import { createMcpHandler } from "./dispatch.js";
-import { INTERNAL_ERROR, jsonResponse } from "./http.js";
+import { assertClientsConfigured, authMethodsFor, DEFAULT_CLIENTS, hasDynamicClient, redirectUrisFor, } from "./clients.js";
+import { errorReason, INTERNAL_ERROR, jsonResponse } from "./http/http.js";
+import { createMcpHandler } from "./mcp/dispatch.js";
+import { safeAudit } from "./mcp/methods.js";
+import { createToolRegistry } from "./mcp/registry.js";
+import { safeOAuthAudit } from "./oauth/audit.js";
+import { DEFAULT_SCOPE } from "./oauth/constants.js";
+import { canonicalResource, DEFAULT_RESOURCE_PATH, normalizeConfiguredPath, resourcesEqual, } from "./oauth/policy/resource.js";
 import { createOAuthRouter } from "./oauth/router.js";
-import { DEFAULT_RESOURCE_PATH, canonicalResource, resourcesEqual, } from "./oauth/resource.js";
-import { createToolRegistry } from "./registry.js";
-export const createMcpApp = (options) => {
-    const resourcePath = options.resourcePath ?? DEFAULT_RESOURCE_PATH;
-    const oauthPath = options.oauthPath ?? `${resourcePath}/oauth`;
-    const clients = options.clients ?? DEFAULT_CLIENTS;
-    const realm = options.realm ?? options.serverInfo.name;
-    assertClientsConfigured(clients, options.auth.clientStore);
-    const registry = createToolRegistry(options.tools, {
-        validateArgs: options.validateArgs,
-        onToolError: options.onToolError,
-    });
-    /**
-     * The audience check lives here, not in user code — a token minted for
-     * another MCP server must never be accepted by this one.
-     */
-    const authenticate = async (req) => {
-        const token = parseBearer(req.headers.get("authorization"));
+import { pickDefined } from "./util/defined.js";
+/**
+ * On a multi-scope server a tool with no `scope` is callable by a principal
+ * holding none of the advertised scopes, silently defeating
+ * `defaultScopes: []`. Single-scope servers have no such ambiguity. Pass
+ * `scope: null` on a tool to state the omission on purpose.
+ */
+const assertToolScopesConfigured = (tools, scopes) => {
+    if (scopes.length <= 1)
+        return;
+    const unscoped = tools.filter((tool) => tool.scope === undefined).map((tool) => tool.name);
+    if (unscoped.length === 0)
+        return;
+    throw new Error(`scopes has more than one entry (${scopes.join(", ")}), but these tools have no ` +
+        `scope and would be callable by any authenticated principal regardless of what ` +
+        `scopes it holds: ${unscoped.join(", ")}. Set scope: "<one of the entries above>" ` +
+        `on each, or scope: null to state the omission on purpose.`);
+};
+/**
+ * The audience check lives here, not in user code — a token minted for
+ * another MCP server must never be accepted by this one.
+ */
+const buildAuthenticate = (options, resourcePath) => {
+    return async (request) => {
+        const token = parseBearer(request.headers.get("authorization"));
         if (!token)
             return null;
-        const verified = await options.auth.verifyToken(token, req);
+        const verified = await options.auth.verifyToken(token, request);
         if (!verified)
             return null;
-        const expected = canonicalResource(new URL(req.url).origin, resourcePath);
+        const expected = canonicalResource(new URL(request.url).origin, resourcePath);
         if (!resourcesEqual(verified.audience, expected))
             return null;
-        return { id: verified.userId, scopes: verified.scopes, claims: verified.claims };
+        return {
+            id: verified.userId,
+            scopes: verified.scopes,
+            ...(verified.claims !== undefined ? { claims: verified.claims } : {}),
+        };
     };
-    const handler = createMcpHandler({
+};
+/** Top-level `audit` wraps MCP + OAuth; `auth.audit` wins for OAuth if both set. */
+const buildAuditAdapters = (options) => {
+    const unifiedAudit = options.audit;
+    const toMcpAudit = unifiedAudit !== undefined
+        ? (entry) => unifiedAudit({ source: "mcp", ...entry })
+        : undefined;
+    const oauthAudit = options.auth.audit ??
+        (unifiedAudit !== undefined
+            ? (entry) => unifiedAudit({ source: "oauth", ...entry })
+            : undefined);
+    return { toMcpAudit, oauthAudit };
+};
+const buildMcpHandlerOptions = (options, input) => {
+    const { resourcePath, realm, registry, authenticate, toMcpAudit } = input;
+    return {
         registry,
         serverInfo: options.serverInfo,
-        instructions: options.instructions,
-        wwwAuthenticate: (req) => ({
+        ...pickDefined(options, [
+            "instructions",
+            "auditTimeoutMs",
+            "allowedRequestOrigins",
+            "hideToolsOutsideScope",
+        ]),
+        wwwAuthenticate: (request) => ({
             realm,
-            resourceMetadataUrl: `${new URL(req.url).origin}/.well-known/oauth-protected-resource${resourcePath}`,
+            resourceMetadataUrl: `${new URL(request.url).origin}/.well-known/oauth-protected-resource${resourcePath}`,
         }),
         ports: {
             authenticate,
             context: options.context ?? (() => ({})),
-            audit: options.audit,
+            ...(toMcpAudit !== undefined ? { audit: toMcpAudit } : {}),
         },
-    });
-    const oauth = createOAuthRouter({
+    };
+};
+const buildOAuthOptions = (options, input) => {
+    const { resourcePath, oauthPath, realm, clients, oauthAudit } = input;
+    return {
         resourcePath,
         oauthPath,
         realm,
-        scopes: options.scopes,
+        ...pickDefined(options, [
+            "scopes",
+            "defaultScopes",
+            "auditTimeoutMs",
+            "allowInMemoryCodeStore",
+            "cimd",
+            "cimdCache",
+            "cimdLookup",
+            "requireRegisteredClients",
+            "consent",
+        ]),
         tokenEndpointAuthMethods: authMethodsFor(clients),
         allowUnregisteredClients: hasDynamicClient(clients),
         redirect: {
             // Client profiles are the source of truth for callbacks.
-            extra: [
-                ...redirectUrisFor(clients),
-                ...(options.extraRedirectUris ?? []),
-            ],
+            extra: [...redirectUrisFor(clients), ...(options.extraRedirectUris ?? [])],
             allowClaude: false,
             allowLoopback: options.allowLoopback ?? true,
         },
@@ -72,30 +118,77 @@ export const createMcpApp = (options) => {
             resolveUser: options.auth.resolveUser,
             loginUrl: options.auth.loginUrl,
             mintAccessToken: options.auth.mintAccessToken,
-            refreshAccessToken: options.auth.refreshAccessToken,
-            revokeToken: options.auth.revokeToken,
-            codeStore: options.auth.codeStore,
-            clientStore: options.auth.clientStore,
+            ...pickDefined(options.auth, [
+                "refreshAccessToken",
+                "revokeToken",
+                "codeStore",
+                "clientStore",
+            ]),
+            ...(oauthAudit !== undefined ? { audit: oauthAudit } : {}),
         },
+    };
+};
+const createAppFetch = (parts) => async (request) => {
+    try {
+        const oauthResponse = await parts.oauth.tryHandle(request);
+        if (oauthResponse)
+            return oauthResponse;
+        const requestPath = normalizeConfiguredPath(new URL(request.url).pathname);
+        if (requestPath === parts.resourcePath)
+            return await parts.handler.fetch(request);
+        return jsonResponse({ data: { error: "Not found" }, status: 404 });
+    }
+    catch (caught) {
+        // Defense in depth: `oauth` and `handler` already turn port failures
+        // into responses, but `fetch` must never reject, and this path is
+        // audited so it is never silent.
+        const reason = errorReason(caught);
+        await safeOAuthAudit(parts.oauthOptions, { event: "server_error", reason });
+        await safeAudit(parts.mcpHandlerOptions, {
+            method: "",
+            ok: false,
+            error: reason,
+            durationMs: 0,
+        });
+        return jsonResponse({ data: { error: INTERNAL_ERROR }, status: 500 });
+    }
+};
+export const createMcpApp = (options) => {
+    // "/mcp/" and "/mcp" must route identically.
+    const resourcePath = normalizeConfiguredPath(options.resourcePath ?? DEFAULT_RESOURCE_PATH);
+    // Avoid "//oauth" when the resource is mounted at "/".
+    const oauthPath = options.oauthPath ?? (resourcePath === "/" ? "/oauth" : `${resourcePath}/oauth`);
+    const clients = options.clients ?? DEFAULT_CLIENTS;
+    const realm = options.realm ?? options.serverInfo.name;
+    assertClientsConfigured(clients, options.auth.clientStore);
+    assertToolScopesConfigured(options.tools, options.scopes ?? [DEFAULT_SCOPE]);
+    const registry = createToolRegistry(options.tools, pickDefined(options, ["validateArgs", "onToolError"]));
+    const authenticate = buildAuthenticate(options, resourcePath);
+    const { toMcpAudit, oauthAudit } = buildAuditAdapters(options);
+    // Built once and shared with the `fetch` catch path below, so the fallback
+    // audit sees exactly the same ports/timeout as the handler itself.
+    const mcpHandlerOptions = buildMcpHandlerOptions(options, {
+        resourcePath,
+        realm,
+        registry,
+        authenticate,
+        toMcpAudit,
+    });
+    const oauthOptions = buildOAuthOptions(options, {
+        resourcePath,
+        oauthPath,
+        realm,
+        clients,
+        oauthAudit,
     });
     return {
-        fetch: async (request) => {
-            try {
-                const oauthResponse = await oauth.tryHandle(request);
-                if (oauthResponse)
-                    return oauthResponse;
-                if (new URL(request.url).pathname === resourcePath) {
-                    return await handler.fetch(request);
-                }
-                return jsonResponse({ error: "Not found" }, 404);
-            }
-            catch {
-                // Both `oauth` and `handler` already turn port failures into a
-                // Response themselves — this is defense in depth, not the primary
-                // guard. `fetch` must never reject.
-                return jsonResponse({ error: INTERNAL_ERROR }, 500);
-            }
-        },
+        fetch: createAppFetch({
+            resourcePath,
+            oauth: createOAuthRouter(oauthOptions),
+            oauthOptions,
+            handler: createMcpHandler(mcpHandlerOptions),
+            mcpHandlerOptions,
+        }),
     };
 };
 //# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,eAAe,GAEhB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAAE,kBAAkB,EAAgB,MAAM,eAAe,CAAC;AA2EjE,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAA4B,EACpB,EAAE;IACV,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,YAAY,QAAQ,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAEvD,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,kBAAkB,CAAO,OAAO,CAAC,KAAK,EAAE;QACvD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,YAAY,GAAG,KAAK,EAAE,GAAY,EAA6B,EAAE;QACrE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACnF,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,gBAAgB,CAAO;QACrC,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK;YACL,mBAAmB,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,YAAY,EAAE;SACtG,CAAC;QACF,KAAK,EAAE;YACL,YAAY;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAS,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,YAAY;QACZ,SAAS;QACT,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,wBAAwB,EAAE,cAAc,CAAC,OAAO,CAAC;QACjD,wBAAwB,EAAE,gBAAgB,CAAC,OAAO,CAAC;QACnD,QAAQ,EAAE;YACR,yDAAyD;YACzD,KAAK,EAAE;gBACL,GAAG,eAAe,CAAC,OAAO,CAAC;gBAC3B,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACrC;YACD,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;SAC7C;QACD,KAAK,EAAE;YACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;YACnC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB;YACnD,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS;YACjC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;SACtC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,aAAa;oBAAE,OAAO,aAAa,CAAC;gBAExC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBACnD,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,kEAAkE;gBAClE,oCAAoC;gBACpC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,cAAc,EAEd,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAA2C,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAmC,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAgB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAahD;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAO,KAAsB,EAAE,MAAgB,EAAQ,EAAE;IAC1F,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;QAC/E,gFAAgF;QAChF,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;QACnF,2DAA2D,CAC9D,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CACxB,OAA4B,EAC5B,YAAoB,EAC+B,EAAE;IACrD,OAAO,KAAK,EAAE,OAAgB,EAA6B,EAAE;QAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,MAAM;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,CACzB,OAA4B,EAI5B,EAAE;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,UAAU,GACd,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,CAAC,KAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,CAAC,KAAK;QAClB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,CAAC,KAAsB,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;YACzE,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,OAA4B,EAC5B,KAMC,EACwB,EAAE;IAC3B,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC1E,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,WAAW,CAAC,OAAO,EAAE;YACtB,cAAc;YACd,gBAAgB;YAChB,uBAAuB;YACvB,uBAAuB;SACxB,CAAC;QACF,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,KAAK;YACL,mBAAmB,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,YAAY,EAAE;SAC1G,CAAC;QACF,KAAK,EAAE;YACL,YAAY;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAS,CAAC;YAChD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,OAA4B,EAC5B,KAOC,EACmB,EAAE;IACtB,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtE,OAAO;QACL,YAAY;QACZ,SAAS;QACT,KAAK;QACL,GAAG,WAAW,CAAC,OAAO,EAAE;YACtB,QAAQ;YACR,eAAe;YACf,gBAAgB;YAChB,wBAAwB;YACxB,MAAM;YACN,WAAW;YACX,YAAY;YACZ,0BAA0B;YAC1B,SAAS;SACV,CAAC;QACF,wBAAwB,EAAE,cAAc,CAAC,OAAO,CAAC;QACjD,wBAAwB,EAAE,gBAAgB,CAAC,OAAO,CAAC;QACnD,QAAQ,EAAE;YACR,yDAAyD;YACzD,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAC1E,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;SAC7C;QACD,KAAK,EAAE;YACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;YACnC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC3B,oBAAoB;gBACpB,aAAa;gBACb,WAAW;gBACX,aAAa;aACd,CAAC;YACF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC;AACJ,CAAC,CAAC;AAWF,MAAM,cAAc,GAClB,CAAO,KAAqB,EAAmB,EAAE,CACjD,KAAK,EAAE,OAAO,EAAE,EAAE;IAChB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC;QAExC,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,WAAW,KAAK,KAAK,CAAC,YAAY;YAAE,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClF,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,qEAAqE;QACrE,kEAAkE;QAClE,iCAAiC;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,SAAS,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACvC,MAAM,EAAE,EAAE;YACV,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAO,OAA4B,EAAU,EAAE;IACzE,6CAA6C;IAC7C,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,uDAAuD;IACvD,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAEvD,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,0BAA0B,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,kBAAkB,CACjC,OAAO,CAAC,KAAK,EACb,WAAW,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CACtD,CAAC;IAEF,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE/D,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,EAAE;QACxD,YAAY;QACZ,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE;QAC9C,YAAY;QACZ,SAAS;QACT,KAAK;QACL,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,cAAc,CAAC;YACpB,YAAY;YACZ,KAAK,EAAE,iBAAiB,CAAC,YAAY,CAAC;YACtC,YAAY;YACZ,OAAO,EAAE,gBAAgB,CAAO,iBAAiB,CAAC;YAClD,iBAAiB;SAClB,CAAC;KACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/audit.d.ts

@@ -1,4 +1,4 @@
-import type { AuditEntry } from "./methods.js";
+import type { UnifiedAuditEntry } from "./app-options.js";
 /**
  * Convenience `audit` sink that logs each entry to the console.
  *
@@ -10,9 +10,9 @@ import type { AuditEntry } from "./methods.js";
  *   createMcpApp({ ..., audit: consoleAudit })
  *   createMcpApp({ ..., audit: (entry) => { void insert(entry) } })
  *
- * Failures (`ok: false`, including transport-level denials and tool
- * exceptions) go to `console.error`; everything else to `console.log`.
- * Entries never carry raw exceptions or stack traces (see `AuditEntry`).
+ * MCP failures (`ok: false`) go to `console.error`; MCP successes and
+ * OAuth events go to `console.log`. Entries never carry raw exceptions or
+ * stack traces (see `AuditEntry` / `OAuthAuditEntry`).
  */
-export declare const consoleAudit: (entry: AuditEntry) => void;
+export declare const consoleAudit: (entry: UnifiedAuditEntry) => void;
 //# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,UAAU,KAAG,IAiBhD,CAAC"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,iBAAiB,KAAG,IA8BvD,CAAC"}

package/dist/audit.js

@@ -9,13 +9,25 @@
  *   createMcpApp({ ..., audit: consoleAudit })
  *   createMcpApp({ ..., audit: (entry) => { void insert(entry) } })
  *
- * Failures (`ok: false`, including transport-level denials and tool
- * exceptions) go to `console.error`; everything else to `console.log`.
- * Entries never carry raw exceptions or stack traces (see `AuditEntry`).
+ * MCP failures (`ok: false`) go to `console.error`; MCP successes and
+ * OAuth events go to `console.log`. Entries never carry raw exceptions or
+ * stack traces (see `AuditEntry` / `OAuthAuditEntry`).
  */
 export const consoleAudit = (entry) => {
+    if (entry.source === "oauth") {
+        const line = [
+            `[mcp-trellis] oauth`,
+            entry.event,
+            entry.clientId ? `client=${entry.clientId}` : undefined,
+            `reason=${entry.reason}`,
+        ]
+            .filter(Boolean)
+            .join(" ");
+        console.log(line);
+        return;
+    }
     const line = [
-        `[mcp-trellis] ${entry.method || "(transport)"}`,
+        `[mcp-trellis] mcp ${entry.method || "(transport)"}`,
         entry.tool ? `tool=${entry.tool}` : undefined,
         entry.ok ? "ok" : "fail",
         `${entry.durationMs}ms`,
@@ -24,11 +36,10 @@ export const consoleAudit = (entry) => {
     ]
         .filter(Boolean)
         .join(" ");
-    if (entry.ok) {
-        console.log(line);
-    }
-    else {
+    if (!entry.ok) {
         console.error(line);
+        return;
     }
+    console.log(line);
 };
 //# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAQ,EAAE;IACtD,MAAM,IAAI,GAAG;QACX,iBAAiB,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE;QAChD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACxB,GAAG,KAAK,CAAC,UAAU,IAAI;QACvB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;KACjD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAQ,EAAE;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG;YACX,qBAAqB;YACrB,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YACvD,UAAU,KAAK,CAAC,MAAM,EAAE;SACzB;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG;QACX,qBAAqB,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE;QACpD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACxB,GAAG,KAAK,CAAC,UAAU,IAAI;QACvB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;KACjD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC,CAAC"}

package/dist/auth/bearer.d.ts

@@ -1,5 +1,4 @@
 /** Bearer auth helpers for MCP (RFC 9728 WWW-Authenticate). */
-export declare const BEARER_PREFIX = "Bearer ";
 /** Above any real JWT / HMAC sig; prevents allocation DoS on attacker input. */
 export declare const MAX_COMPARE_LENGTH = 4096;
 export declare const parseBearer: (authorization: string | null) => string | null;
@@ -14,6 +13,10 @@ export type WwwAuthenticateOptions = {
     realm: string;
     /** Absolute URL to RFC 9728 protected resource metadata. */
     resourceMetadataUrl: string;
+    /** RFC 6750 §3.1 error code, e.g. `"insufficient_scope"`. Omitted on a plain 401. */
+    error?: string | undefined;
+    /** RFC 6750 §3.1 — the scope(s) that would satisfy the request. Paired with `error`. */
+    scope?: string | undefined;
 };
 export declare const wwwAuthenticateHeader: (options: WwwAuthenticateOptions) => string;
 /** RFC 6750 §2.3 uses `access_token`; also reject legacy `token`. */

package/dist/auth/bearer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAE/D,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,eAAO,MAAM,WAAW,GAAI,eAAe,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAInE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAWtD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,OAGhE,CAAC;AAEJ,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,SAAS,sBAAsB,KAC9B,MAC6F,CAAC;AAEjG,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,GAAI,KAAK,GAAG,KAAG,OAC2B,CAAC"}
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAI/D,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAKvC,eAAO,MAAM,WAAW,GAAI,eAAe,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAMnE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAetD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,OACN,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAMF,eAAO,MAAM,qBAAqB,GAAI,SAAS,sBAAsB,KAAG,MAQvE,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,GAAI,KAAK,GAAG,KAAG,OAC2B,CAAC"}