mcp-trellis 0.2.1 → 2.1.0

package/dist/oauth/cimd/cimd.js

@@ -0,0 +1,132 @@
+/**
+ * Client ID Metadata Documents (CIMD) — HTTPS URL `client_id` metadata.
+ * Off by default (`cimd: true`). SSRF guards live in `cimd-ssrf.ts`.
+ *
+ * ponytail: DNS checked before/after fetch; TCP connect is not pinned (Web
+ * fetch). Upgrade: custom dispatcher dialing the resolved IP + Host header.
+ */
+import { readBoundedText } from "../../http/body.js";
+import { parseCacheMaxAge, parseDocument } from "./cimd-parse.js";
+import { assertSafeUrl, defaultLookup } from "./cimd-ssrf.js";
+const CIMD_MAX_BYTES = 5 * 1024;
+const CIMD_TIMEOUT_MS = 10_000;
+const CIMD_MAX_REDIRECTS = 3;
+/** Build fetch options from router/app CIMD ports. */
+export const cimdFetchOpts = (ports) => ({
+    ...(ports.cimdCache !== undefined ? { cache: ports.cimdCache } : {}),
+    ...(ports.cimdLookup !== undefined ? { lookup: ports.cimdLookup } : {}),
+});
+/** True when `client_id` is an HTTPS URL eligible for CIMD resolution. */
+export const isCimdClientId = (clientId) => {
+    try {
+        const url = new URL(clientId);
+        return (url.protocol === "https:" &&
+            url.username === "" &&
+            url.password === "" &&
+            url.hash === "" &&
+            Boolean(url.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+const readCimdBody = async (ctx, response, current) => {
+    if (!response.ok)
+        return null;
+    // Stream-capped at CIMD_MAX_BYTES; signal cancels the locked reader on hop
+    // timeout (body.cancel() is a no-op while getReader() holds the lock).
+    try {
+        const text = await readBoundedText(response, CIMD_MAX_BYTES, ctx.signal);
+        // Re-check DNS after the body — see file-level ponytail on connect pinning.
+        await assertSafeUrl(current, ctx.lookup);
+        return {
+            doc: parseDocument(ctx.clientId, text),
+            maxAge: parseCacheMaxAge(response.headers.get("cache-control")),
+        };
+    }
+    catch {
+        return null;
+    }
+};
+const followRedirect = async (ctx, response, current) => {
+    const location = response.headers.get("location");
+    if (!location || ctx.redirect === CIMD_MAX_REDIRECTS)
+        return null;
+    const next = new URL(location, current);
+    // Same-origin only: a cross-origin hop would let an open redirect on a
+    // reputable host vouch for a document the attacker actually serves.
+    if (next.origin !== new URL(ctx.clientId).origin)
+        return null;
+    await assertSafeUrl(next, ctx.lookup);
+    return next;
+};
+const getCimdResponse = (fetchImpl, url, signal) => fetchImpl(url, {
+    method: "GET",
+    redirect: "manual",
+    signal,
+    headers: { Accept: "application/json" },
+});
+/** One request under its own timeout. */
+const fetchHop = async (settings, current, redirect) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), settings.timeoutMs);
+    const ctx = {
+        clientId: settings.clientId,
+        lookup: settings.lookup,
+        redirect,
+        signal: controller.signal,
+    };
+    try {
+        const response = await getCimdResponse(settings.fetch, current.toString(), controller.signal);
+        if (response.status >= 300 && response.status < 400) {
+            const next = await followRedirect(ctx, response, current);
+            return next ? { next } : { done: null };
+        }
+        // `await` keeps the body read inside this try — without it `finally`
+        // clears the timer as soon as headers arrive.
+        return { done: await readCimdBody(ctx, response, current) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+};
+const fetchCimdDocument = async (settings) => {
+    let current = new URL(settings.clientId);
+    await assertSafeUrl(current, settings.lookup);
+    for (let redirect = 0; redirect <= CIMD_MAX_REDIRECTS; redirect++) {
+        const hop = await fetchHop(settings, current, redirect);
+        if ("done" in hop)
+            return hop.done;
+        current = hop.next;
+    }
+    return null;
+};
+/**
+ * Fetch and validate a CIMD document for `clientId` (the HTTPS URL itself).
+ * Returns null on any validation / network failure — callers map that to
+ * `unauthorized_client` without leaking fetch details to the connector.
+ */
+export const resolveCimdClient = async (clientId, options = {}) => {
+    if (!isCimdClientId(clientId))
+        return null;
+    const cached = options.cache ? await options.cache.get(clientId) : null;
+    if (cached)
+        return cached;
+    try {
+        const result = await fetchCimdDocument({
+            clientId,
+            fetch: options.fetch ?? globalThis.fetch,
+            lookup: options.lookup ?? defaultLookup,
+            timeoutMs: options.timeoutMs ?? CIMD_TIMEOUT_MS,
+        });
+        if (!result)
+            return null;
+        if (options.cache)
+            await options.cache.set(clientId, result.doc, result.maxAge);
+        return result.doc;
+    }
+    catch {
+        return null;
+    }
+};
+//# sourceMappingURL=cimd.js.map

package/dist/oauth/cimd/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK9D,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAgB7B,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAG7B,EAA8C,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,YAAY,GAAG,KAAK,EACxB,GAAa,EACb,QAAkB,EAClB,OAAY,EACqB,EAAE;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzE,4EAA4E;QAC5E,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;YACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;SAChE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,GAAa,EACb,QAAkB,EAClB,OAAY,EACS,EAAE;IACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAuB,EAAE,GAAW,EAAE,MAAmB,EAAE,EAAE,CACpF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;IAClB,MAAM;IACN,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;CACxC,CAAC,CAAC;AAYL,yCAAyC;AACzC,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAuB,EACvB,OAAY,EACZ,QAAgB,EACI,EAAE;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,GAAG,GAAa;QACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,qEAAqE;QACrE,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAuB,EAAmC,EAAE;IAC3F,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,kBAAkB,EAAE,QAAQ,EAAE,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,QAAgB,EAChB,UAA4B,EAAE,EACA,EAAE;IAChC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/cimd/types.d.ts

@@ -0,0 +1,12 @@
+/** CIMD document and cache shapes, shared by the fetcher and the parser. */
+export type CimdDocument = {
+    client_id: string;
+    redirect_uris: string[];
+    client_name?: string;
+    token_endpoint_auth_method?: string;
+};
+export type CimdCache = {
+    get: (clientId: string) => Promise<CimdDocument | null> | CimdDocument | null;
+    set: (clientId: string, doc: CimdDocument, maxAgeSeconds: number) => Promise<void> | void;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/cimd/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3F,CAAC"}

package/dist/oauth/cimd/types.js

@@ -0,0 +1,3 @@
+/** CIMD document and cache shapes, shared by the fetcher and the parser. */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/oauth/cimd/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,4EAA4E"}

package/dist/oauth/config.d.ts

@@ -0,0 +1,51 @@
+/** OAuth construction asserts and small response helpers. */
+import type { MintedToken, OAuthPorts, OAuthRouterOptions } from "./types.js";
+/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
+export declare const unregisteredClientsAllowed: (options: OAuthRouterOptions) => boolean;
+/** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
+export declare const registeredClientsRequired: (options: OAuthRouterOptions) => boolean;
+/** Scopes this AS advertises and is willing to grant. */
+export declare const advertisedScopes: (options: OAuthRouterOptions) => string[];
+/**
+ * Scopes granted when a client omits `scope`. Falls back to the full
+ * advertised set only when that set has at most one entry — see
+ * `assertScopeConfig`, which forbids the ambiguous multi-scope case at
+ * construction instead of silently over-granting here.
+ */
+export declare const defaultScopes: (options: OAuthRouterOptions) => string[];
+/**
+ * A multi-scope server MUST say what an omitted `scope` grants — the
+ * alternative (silently granting everything advertised) is exactly the
+ * escalation least-privilege scoping exists to prevent.
+ *
+ * This controls only what a *token* is granted at authorize time —
+ * `defaultScopes: []` still leaves any tool that omits `ToolDef.scope`
+ * callable by a principal holding zero scopes, since that check happens
+ * per tool-call, not here. `createMcpApp` has the matching guard on the
+ * tool side: it refuses to construct with an unscoped tool once `scopes`
+ * has more than one entry (`assertToolScopesConfigured` in `app.ts`).
+ */
+export declare const assertScopeConfig: (options: OAuthRouterOptions) => void;
+export declare const assertCodeSecret: (secret: string) => void;
+/**
+ * Resolves `codeSecret` to a non-empty key list — a single string becomes a
+ * one-element array. The **first** entry is the one every caller here uses
+ * to seal new material or hash new client secrets; the full array is what a
+ * caller trying to unseal/verify existing material tries in order (see
+ * `unsealAny`, `verifyClientSecretAny`). Every entry is validated the same
+ * way a lone string always was.
+ */
+export declare const resolveSecrets: (ports: OAuthPorts, request: Request) => Promise<readonly [string, ...string[]]>;
+export declare const oauthError: (error: string, status: number, description?: string) => Response;
+/** Direct JSON error when this AS does not serve unknown `client_id`s. */
+export declare const unregisteredClientError: (options: OAuthRouterOptions, reject: {
+    code: string;
+    status: number;
+}) => Response | null;
+/**
+ * `grantedScope` is what the auth code carried (or a narrowed refresh
+ * request); the port may narrow it further. With neither, `scope` is
+ * omitted (optional when unchanged, RFC 6749 §5.1) rather than guessed.
+ */
+export declare const tokenResponse: (minted: MintedToken, grantedScope?: string) => Response;
+//# sourceMappingURL=config.d.ts.map

package/dist/oauth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GAAI,SAAS,kBAAkB,KAAG,OAC7B,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,OAC5B,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,kBAAkB,KAAG,MAAM,EACd,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,IAY/D,CAAC;AAaF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,IAYjD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,UAAU,EACjB,SAAS,OAAO,KACf,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAUxC,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,QAK7E,CAAC;AAKL,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAGb,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,EAAE,eAAe,MAAM,KAAG,QAa1E,CAAC"}

package/dist/oauth/config.js

@@ -0,0 +1,108 @@
+/** OAuth construction asserts and small response helpers. */
+import { jsonResponse } from "../http/http.js";
+import { DEFAULT_SCOPE } from "./constants.js";
+/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
+export const unregisteredClientsAllowed = (options) => options.allowUnregisteredClients !== false;
+/** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
+export const registeredClientsRequired = (options) => options.requireRegisteredClients !== false;
+/** Scopes this AS advertises and is willing to grant. */
+export const advertisedScopes = (options) => options.scopes ?? [DEFAULT_SCOPE];
+/**
+ * Scopes granted when a client omits `scope`. Falls back to the full
+ * advertised set only when that set has at most one entry — see
+ * `assertScopeConfig`, which forbids the ambiguous multi-scope case at
+ * construction instead of silently over-granting here.
+ */
+export const defaultScopes = (options) => options.defaultScopes ?? advertisedScopes(options);
+/**
+ * A multi-scope server MUST say what an omitted `scope` grants — the
+ * alternative (silently granting everything advertised) is exactly the
+ * escalation least-privilege scoping exists to prevent.
+ *
+ * This controls only what a *token* is granted at authorize time —
+ * `defaultScopes: []` still leaves any tool that omits `ToolDef.scope`
+ * callable by a principal holding zero scopes, since that check happens
+ * per tool-call, not here. `createMcpApp` has the matching guard on the
+ * tool side: it refuses to construct with an unscoped tool once `scopes`
+ * has more than one entry (`assertToolScopesConfigured` in `app.ts`).
+ */
+export const assertScopeConfig = (options) => {
+    const advertised = advertisedScopes(options);
+    if (advertised.length > 1 && !options.defaultScopes) {
+        throw new Error("scopes has more than one entry — defaultScopes must say what an omitted " +
+            "scope request grants (e.g. defaultScopes: [] for least privilege)");
+    }
+    const unknown = (options.defaultScopes ?? []).find((scope) => !advertised.includes(scope));
+    if (unknown !== undefined) {
+        throw new Error(`defaultScopes contains "${unknown}", which is not in scopes`);
+    }
+};
+/**
+ * `codeSecret` can forge an auth code for any userId/scope/resource, so a
+ * weak or copy-pasted one is a full authorization bypass, not a footgun.
+ * Copy-paste from this package's docs is the realistic failure mode: every
+ * published example secret is either under the length floor or carries
+ * the marker below (enforced by test/oauth/crypto/codesecret.test.ts).
+ */
+const MIN_CODE_SECRET_LENGTH = 32;
+const DENYLISTED_CODE_SECRET_MARKER = "do-not-reuse";
+const GENERATE_HINT = "generate one with `openssl rand -base64 32`";
+export const assertCodeSecret = (secret) => {
+    // Checked before the length rule so a copied example is named for what it is.
+    if (secret.includes(DENYLISTED_CODE_SECRET_MARKER)) {
+        throw new Error(`codeSecret must not be a literal published in this package's own docs or examples — ${GENERATE_HINT}`);
+    }
+    if (secret.length < MIN_CODE_SECRET_LENGTH) {
+        throw new Error(`codeSecret must be at least ${MIN_CODE_SECRET_LENGTH} characters (got ${secret.length}) — ${GENERATE_HINT}`);
+    }
+};
+/**
+ * Resolves `codeSecret` to a non-empty key list — a single string becomes a
+ * one-element array. The **first** entry is the one every caller here uses
+ * to seal new material or hash new client secrets; the full array is what a
+ * caller trying to unseal/verify existing material tries in order (see
+ * `unsealAny`, `verifyClientSecretAny`). Every entry is validated the same
+ * way a lone string always was.
+ */
+export const resolveSecrets = async (ports, request) => {
+    const resolved = typeof ports.codeSecret === "function" ? await ports.codeSecret(request) : ports.codeSecret;
+    const secrets = Array.isArray(resolved) ? resolved : [resolved];
+    if (secrets.length === 0) {
+        throw new Error("codeSecret must resolve to at least one key, not an empty array");
+    }
+    secrets.forEach(assertCodeSecret);
+    // Cast is sound: the length check above guarantees at least one element.
+    return secrets;
+};
+export const oauthError = (error, status, description) => jsonResponse({
+    data: description ? { error, error_description: description } : { error },
+    status,
+    cors: false,
+});
+const UNREGISTERED_CLIENT_DESCRIPTION = "unknown client_id — this server only serves pre-registered clients";
+/** Direct JSON error when this AS does not serve unknown `client_id`s. */
+export const unregisteredClientError = (options, reject) => {
+    if (unregisteredClientsAllowed(options))
+        return null;
+    return oauthError(reject.code, reject.status, UNREGISTERED_CLIENT_DESCRIPTION);
+};
+/**
+ * `grantedScope` is what the auth code carried (or a narrowed refresh
+ * request); the port may narrow it further. With neither, `scope` is
+ * omitted (optional when unchanged, RFC 6749 §5.1) rather than guessed.
+ */
+export const tokenResponse = (minted, grantedScope) => {
+    const scope = minted.scope ?? grantedScope;
+    return jsonResponse({
+        data: {
+            access_token: minted.accessToken,
+            token_type: minted.tokenType ?? "bearer",
+            expires_in: minted.expiresIn,
+            ...(scope !== undefined ? { scope } : {}),
+            ...(minted.refreshToken ? { refresh_token: minted.refreshToken } : {}),
+        },
+        status: 200,
+        cors: false,
+    });
+};
+//# sourceMappingURL=config.js.map

package/dist/oauth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA2B,EAAW,EAAE,CACjF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAA2B,EAAW,EAAE,CAChF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA2B,EAAY,EAAE,CACrE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IACrE,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,2BAA2B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,6BAA6B,GAAG,cAAc,CAAC;AACrD,MAAM,aAAa,GAAG,6CAA6C,CAAC;AAEpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAQ,EAAE;IACvD,8EAA8E;IAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,uFAAuF,aAAa,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,+BAA+B,sBAAsB,oBAAoB,MAAM,CAAC,MAAM,OAAO,aAAa,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,KAAiB,EACjB,OAAgB,EACyB,EAAE;IAC3C,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClC,yEAAyE;IACzE,OAAO,OAAgC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,WAAoB,EAAY,EAAE,CAC1F,YAAY,CAAC;IACX,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;IACzE,MAAM;IACN,IAAI,EAAE,KAAK;CACZ,CAAC,CAAC;AAEL,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAE,YAAqB,EAAY,EAAE;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC;IAC3C,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE;YACJ,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;YACxC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/constants.d.ts

@@ -8,16 +8,22 @@ export declare const OAUTH_ERRORS: {
     readonly invalidGrant: "invalid_grant";
     readonly unsupportedGrantType: "unsupported_grant_type";
     readonly invalidRedirectUri: "invalid_redirect_uri";
+    /** RFC 7591 §3.2.2 — DCR `/register`: a client metadata field's value itself is invalid. */
+    readonly invalidClientMetadata: "invalid_client_metadata";
     /** Token endpoint — client authentication failed, or the client is unknown. */
     readonly invalidClient: "invalid_client";
     /** Authorization endpoint — this client may not use this method. RFC 6749 §4.1.2.1. */
     readonly unauthorizedClient: "unauthorized_client";
+    /** Authorization endpoint — `response_type` isn't one this server supports. RFC 6749 §4.1.2.1. */
+    readonly unsupportedResponseType: "unsupported_response_type";
     /** Requested scope exceeds what this server advertises. */
     readonly invalidScope: "invalid_scope";
     /** RFC 8707 — requested resource is not acceptable. */
     readonly invalidTarget: "invalid_target";
     /** A host port threw. RFC 6749 §4.1.2.1 / §5.2 — our fault, not the client's. */
     readonly serverError: "server_error";
+    /** RFC 6749 §4.1.2.1 — the resource owner denied consent. */
+    readonly accessDenied: "access_denied";
 };
 export declare const TOKEN_ENDPOINT_AUTH_METHODS: {
     /** Public client — PKCE is the only proof. */
@@ -29,4 +35,13 @@ export declare const TOKEN_ENDPOINT_AUTH_METHODS: {
 };
 export type TokenEndpointAuthMethod = (typeof TOKEN_ENDPOINT_AUTH_METHODS)[keyof typeof TOKEN_ENDPOINT_AUTH_METHODS];
 export declare const DEFAULT_SCOPE = "mcp";
+/** Default OAuth path prefix when `oauthPath` is unset. Router, `/authorize`, and metadata must agree. */
+export declare const DEFAULT_OAUTH_PATH = "/mcp/oauth";
+/**
+ * Cap on a client's redirect URIs, self-registered or from a CIMD document.
+ * RFC 7591 sets none, but `/register` seals the whole list into the
+ * `client_id`, which then travels as an `/authorize` query parameter with
+ * real length ceilings (browsers, proxies, logs). A client needs a handful.
+ */
+export declare const MAX_CLIENT_REDIRECT_URIS = 10;
 //# sourceMappingURL=constants.d.ts.map

package/dist/oauth/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW;;;CAGd,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEvE,eAAO,MAAM,YAAY;;;;;IAKvB,+EAA+E;;IAE/E,uFAAuF;;IAEvF,2DAA2D;;IAE3D,uDAAuD;;IAEvD,iFAAiF;;CAEzE,CAAC;AAEX,eAAO,MAAM,2BAA2B;IACtC,8CAA8C;;IAE9C,+CAA+C;;IAE/C,uCAAuC;;CAE/B,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,eAAO,MAAM,aAAa,QAAQ,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW;;;CAGd,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEvE,eAAO,MAAM,YAAY;;;;;IAKvB,4FAA4F;;IAE5F,+EAA+E;;IAE/E,uFAAuF;;IAEvF,kGAAkG;;IAElG,2DAA2D;;IAE3D,uDAAuD;;IAEvD,iFAAiF;;IAEjF,6DAA6D;;CAErD,CAAC;AAEX,eAAO,MAAM,2BAA2B;IACtC,8CAA8C;;IAE9C,+CAA+C;;IAE/C,uCAAuC;;CAE/B,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAEjF,eAAO,MAAM,aAAa,QAAQ,CAAC;AAEnC,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC"}

package/dist/oauth/constants.js

@@ -7,16 +7,22 @@ export const OAUTH_ERRORS = {
     invalidGrant: "invalid_grant",
     unsupportedGrantType: "unsupported_grant_type",
     invalidRedirectUri: "invalid_redirect_uri",
+    /** RFC 7591 §3.2.2 — DCR `/register`: a client metadata field's value itself is invalid. */
+    invalidClientMetadata: "invalid_client_metadata",
     /** Token endpoint — client authentication failed, or the client is unknown. */
     invalidClient: "invalid_client",
     /** Authorization endpoint — this client may not use this method. RFC 6749 §4.1.2.1. */
     unauthorizedClient: "unauthorized_client",
+    /** Authorization endpoint — `response_type` isn't one this server supports. RFC 6749 §4.1.2.1. */
+    unsupportedResponseType: "unsupported_response_type",
     /** Requested scope exceeds what this server advertises. */
     invalidScope: "invalid_scope",
     /** RFC 8707 — requested resource is not acceptable. */
     invalidTarget: "invalid_target",
     /** A host port threw. RFC 6749 §4.1.2.1 / §5.2 — our fault, not the client's. */
     serverError: "server_error",
+    /** RFC 6749 §4.1.2.1 — the resource owner denied consent. */
+    accessDenied: "access_denied",
 };
 export const TOKEN_ENDPOINT_AUTH_METHODS = {
     /** Public client — PKCE is the only proof. */
@@ -27,4 +33,13 @@ export const TOKEN_ENDPOINT_AUTH_METHODS = {
     post: "client_secret_post",
 };
 export const DEFAULT_SCOPE = "mcp";
+/** Default OAuth path prefix when `oauthPath` is unset. Router, `/authorize`, and metadata must agree. */
+export const DEFAULT_OAUTH_PATH = "/mcp/oauth";
+/**
+ * Cap on a client's redirect URIs, self-registered or from a CIMD document.
+ * RFC 7591 sets none, but `/register` seals the whole list into the
+ * `client_id`, which then travels as an `/authorize` query parameter with
+ * real length ceilings (browsers, proxies, logs). A client needs a handful.
+ */
+export const MAX_CLIENT_REDIRECT_URIS = 10;
 //# sourceMappingURL=constants.js.map

package/dist/oauth/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB,EAAE,oBAAoB;IACvC,YAAY,EAAE,eAAe;CACrB,CAAC;AAIX,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc,EAAE,iBAAiB;IACjC,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,wBAAwB;IAC9C,kBAAkB,EAAE,sBAAsB;IAC1C,+EAA+E;IAC/E,aAAa,EAAE,gBAAgB;IAC/B,uFAAuF;IACvF,kBAAkB,EAAE,qBAAqB;IACzC,2DAA2D;IAC3D,YAAY,EAAE,eAAe;IAC7B,uDAAuD;IACvD,aAAa,EAAE,gBAAgB;IAC/B,iFAAiF;IACjF,WAAW,EAAE,cAAc;CACnB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,8CAA8C;IAC9C,IAAI,EAAE,MAAM;IACZ,+CAA+C;IAC/C,KAAK,EAAE,qBAAqB;IAC5B,uCAAuC;IACvC,IAAI,EAAE,oBAAoB;CAClB,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB,EAAE,oBAAoB;IACvC,YAAY,EAAE,eAAe;CACrB,CAAC;AAIX,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc,EAAE,iBAAiB;IACjC,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,wBAAwB;IAC9C,kBAAkB,EAAE,sBAAsB;IAC1C,4FAA4F;IAC5F,qBAAqB,EAAE,yBAAyB;IAChD,+EAA+E;IAC/E,aAAa,EAAE,gBAAgB;IAC/B,uFAAuF;IACvF,kBAAkB,EAAE,qBAAqB;IACzC,kGAAkG;IAClG,uBAAuB,EAAE,2BAA2B;IACpD,2DAA2D;IAC3D,YAAY,EAAE,eAAe;IAC7B,uDAAuD;IACvD,aAAa,EAAE,gBAAgB;IAC/B,iFAAiF;IACjF,WAAW,EAAE,cAAc;IAC3B,6DAA6D;IAC7D,YAAY,EAAE,eAAe;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,8CAA8C;IAC9C,IAAI,EAAE,MAAM;IACZ,+CAA+C;IAC/C,KAAK,EAAE,qBAAqB;IAC5B,uCAAuC;IACvC,IAAI,EAAE,oBAAoB;CAClB,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC"}

package/dist/oauth/{base64url.d.ts → crypto/base64url.d.ts}

@@ -1,5 +1,4 @@
 /** Shared base64url helpers (WebCrypto / DOM — no Node Buffer). */
 export declare const bytesToBase64Url: (bytes: ArrayBuffer | Uint8Array) => string;
-export declare const textToBase64Url: (text: string) => string;
-export declare const fromBase64Url: (text: string) => Uint8Array;
+export declare const fromBase64Url: (text: string) => Uint8Array<ArrayBuffer>;
 //# sourceMappingURL=base64url.d.ts.map

package/dist/oauth/crypto/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,eAAO,MAAM,gBAAgB,GAAI,OAAO,WAAW,GAAG,UAAU,KAAG,MAIlE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,UAAU,CAAC,WAAW,CAKlE,CAAC"}

package/dist/oauth/{base64url.js → crypto/base64url.js}

@@ -2,12 +2,8 @@
 export const bytesToBase64Url = (bytes) => {
     const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
     const binary = Array.from(u8, (byte) => String.fromCharCode(byte)).join("");
-    return btoa(binary)
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/, "");
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 };
-export const textToBase64Url = (text) => bytesToBase64Url(new TextEncoder().encode(text));
 export const fromBase64Url = (text) => {
     const padded = text.replace(/-/g, "+").replace(/_/g, "/");
     const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));

package/dist/oauth/crypto/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../../src/oauth/crypto/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAA+B,EAAU,EAAE;IAC1E,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAA2B,EAAE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC"}

package/dist/oauth/crypto/clientauth.d.ts

@@ -0,0 +1,13 @@
+/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
+import { type TokenEndpointAuthMethod } from "../constants.js";
+import type { OAuthRouterOptions } from "../types.js";
+export type ClientAuth = {
+    clientId: string;
+    secret: string | null;
+    method: TokenEndpointAuthMethod;
+};
+/** Credentials from the Authorization header, else from the body. */
+export declare const readClientAuth: (request: Request, body: Record<string, string>) => ClientAuth | null;
+/** Enforce the registered auth method for known clients — see the helpers above for each branch. */
+export declare const firstClientAuthError: (auth: ClientAuth, options: OAuthRouterOptions, request: Request) => Promise<Response | null>;
+//# sourceMappingURL=clientauth.d.ts.map

package/dist/oauth/crypto/clientauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAU9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAIrB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AA6BF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAaf,CAAC;AA2LF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,EAC3B,SAAS,OAAO,KACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAMzB,CAAC"}