mcp-trellis 1.0.0 → 2.1.0

package/dist/oauth/policy/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAuCF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAGF,CAAC"}

package/dist/oauth/policy/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAkBzE,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB,CAAC,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAEpG,8FAA8F;AAC9F,MAAM,4BAA4B,GAAG,CAAC,GAAW,EAAW,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE;IACX,IAAI,4BAA4B,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}

package/dist/oauth/policy/reqbody.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shared JSON/form body reader for `/token` and `/revoke`. Both accept both
+ * encodings: a client that revokes with the same `Content-Type` it used at
+ * `/token` must not get a misleading `token required` and assume the token
+ * is dead.
+ */
+/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
+export declare const readOAuthBody: (request: Request) => Promise<Record<string, string>>;
+/**
+ * Runs `read` and turns its two failure modes into the `Response` every
+ * caller here (`/token`, `/consent`, `/revoke`, `/register`) already
+ * produced by hand: a body over the cap is always 413 `invalid_request`;
+ * anything else — bad JSON, an unbalanced form, a non-scalar field — is 400
+ * with `invalidBodyErrorCode`, `invalid_request` for everyone except
+ * `/register`'s RFC 7591 `invalid_client_metadata`.
+ */
+export declare const readBodyOrError: <T>(read: () => Promise<T>, invalidBodyErrorCode?: string) => Promise<T | Response>;
+//# sourceMappingURL=reqbody.d.ts.map

package/dist/oauth/policy/reqbody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reqbody.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGpF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,EACrC,MAAM,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,uBAAsB,MAAoC,KACzD,OAAO,CAAC,CAAC,GAAG,QAAQ,CAStB,CAAC"}

package/dist/oauth/policy/reqbody.js

@@ -0,0 +1,68 @@
+/**
+ * Shared JSON/form body reader for `/token` and `/revoke`. Both accept both
+ * encodings: a client that revokes with the same `Content-Type` it used at
+ * `/token` must not get a misleading `token required` and assume the token
+ * is dead.
+ */
+import { BodyTooLargeError, DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../../http/body.js";
+import { isJsonObject } from "../../util/json.js";
+import { oauthError } from "../config.js";
+import { OAUTH_ERRORS } from "../constants.js";
+const readJsonBody = async (request) => {
+    const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
+    const body = JSON.parse(text);
+    if (!isJsonObject(body))
+        throw new Error("malformed request body");
+    const entries = Object.entries(body).filter(([, value]) => value != null);
+    // `String({})` / `String([])` silently produce "[object Object]" — a
+    // truthy, non-empty string every downstream `?? ""` check happily accepts
+    // as a real value. Reject a non-scalar field outright instead of
+    // stringifying it into something that looks like real (garbage) input.
+    const nonScalar = entries.find(([, value]) => typeof value === "object");
+    if (nonScalar) {
+        throw new Error(`malformed request body: "${nonScalar[0]}" must be a scalar value`);
+    }
+    return Object.fromEntries(entries.map(([key, value]) => [key, String(value)]));
+};
+const readFormBody = async (request) => {
+    const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
+    const params = new URLSearchParams(text);
+    // A repeated key (`grant_type=a&grant_type=b`) is ambiguous, not a
+    // "last one wins" situation — reject it rather than silently picking
+    // whichever value URLSearchParams' entries() happens to iterate last,
+    // which invites the request meaning one thing to a layer that reads the
+    // first occurrence and another to one that reads the last.
+    const body = {};
+    for (const [key, value] of params) {
+        if (Object.hasOwn(body, key)) {
+            throw new Error(`malformed request body: duplicate "${key}" parameter`);
+        }
+        body[key] = value;
+    }
+    return body;
+};
+/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
+export const readOAuthBody = async (request) => {
+    const ctype = request.headers.get("Content-Type") ?? "";
+    return ctype.includes("application/json") ? readJsonBody(request) : readFormBody(request);
+};
+/**
+ * Runs `read` and turns its two failure modes into the `Response` every
+ * caller here (`/token`, `/consent`, `/revoke`, `/register`) already
+ * produced by hand: a body over the cap is always 413 `invalid_request`;
+ * anything else — bad JSON, an unbalanced form, a non-scalar field — is 400
+ * with `invalidBodyErrorCode`, `invalid_request` for everyone except
+ * `/register`'s RFC 7591 `invalid_client_metadata`.
+ */
+export const readBodyOrError = async (read, invalidBodyErrorCode = OAUTH_ERRORS.invalidRequest) => {
+    try {
+        return await read();
+    }
+    catch (caught) {
+        if (caught instanceof BodyTooLargeError) {
+            return oauthError(OAUTH_ERRORS.invalidRequest, 413, "request body too large");
+        }
+        return oauthError(invalidBodyErrorCode, 400, "malformed request body");
+    }
+};
+//# sourceMappingURL=reqbody.js.map

package/dist/oauth/policy/reqbody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reqbody.js","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAsB,EACtB,uBAA+B,YAAY,CAAC,cAAc,EACnC,EAAE;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/{resource.d.ts → policy/resource.d.ts}

@@ -1,5 +1,5 @@
 /** Canonical MCP resource URI (RFC 8707 / RFC 9728). */
-import { type OAuthErrorInfo } from "./types.js";
+import type { OAuthErrorInfo } from "../types.js";
 export declare const DEFAULT_RESOURCE_PATH = "/mcp";
 /**
  * Strips a trailing slash from a *configured* path (`resourcePath`,

package/dist/oauth/policy/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAIxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,MACA,CAAC;AAExD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,qBAAoC,KAAG,MAIxF,CAAC;AAmBF,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,OAGpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,cAAc,GAAG,IAQxF,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,QAAQ,GAAG,IAGnF,CAAC"}

package/dist/oauth/{resource.js → policy/resource.js}

@@ -1,6 +1,6 @@
 /** Canonical MCP resource URI (RFC 8707 / RFC 9728). */
-import { OAUTH_ERRORS } from "./constants.js";
-import { oauthError } from "./types.js";
+import { oauthError } from "../config.js";
+import { OAUTH_ERRORS } from "../constants.js";
 export const DEFAULT_RESOURCE_PATH = "/mcp";
 /**
  * Strips a trailing slash from a *configured* path (`resourcePath`,

package/dist/oauth/policy/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../src/oauth/policy/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9D,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAExD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,YAAY,GAAG,qBAAqB,EAAU,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IAC1F,OAAO,GAAG,IAAI,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAiB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAW,EAAE;IAC7E,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAyB,EAAE;IAC9F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,cAAc,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,aAAa,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAmB,EAAE;IACzF,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC,CAAC"}

package/dist/oauth/{scope.d.ts → policy/scope.d.ts}

@@ -1,11 +1,11 @@
 /** OAuth scope handling — space-delimited sets (RFC 6749 §3.3). */
-import { type OAuthErrorInfo } from "./types.js";
+import type { OAuthErrorInfo } from "../types.js";
 export declare const parseScope: (raw: string) => string[];
 export declare const formatScope: (scopes: string[]) => string;
 /**
  * Scopes the client asked for, or `fallback` when `scope` is omitted —
  * `fallback` is the full advertised set only for single-scope servers; see
- * `defaultScopes`/`assertScopeConfig` in `types.ts` for the multi-scope rule.
+ * `defaultScopes`/`assertScopeConfig` in `config.ts` for the multi-scope rule.
  * Duplicates are collapsed so the granted string is stable.
  */
 export declare const requestedScopes: (raw: string, fallback: string[]) => string[];

package/dist/oauth/policy/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAInE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAAM,EAIP,CAAC;AAEzC,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,EAAE,KAAG,MAA0B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,MAAM,EAGvE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,WAAW,MAAM,EAAE,EACnB,YAAY,MAAM,EAAE,KACnB,cAAc,GAAG,IAKnB,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,eAAe,GAAI,WAAW,MAAM,EAAE,EAAE,YAAY,MAAM,EAAE,KAAG,QAAQ,GAAG,IAGtF,CAAC"}

package/dist/oauth/{scope.js → policy/scope.js}

@@ -1,6 +1,6 @@
 /** OAuth scope handling — space-delimited sets (RFC 6749 §3.3). */
-import { OAUTH_ERRORS } from "./constants.js";
-import { oauthError } from "./types.js";
+import { oauthError } from "../config.js";
+import { OAUTH_ERRORS } from "../constants.js";
 export const parseScope = (raw) => raw
     .split(" ")
     .map((entry) => entry.trim())
@@ -9,7 +9,7 @@ export const formatScope = (scopes) => scopes.join(" ");
 /**
  * Scopes the client asked for, or `fallback` when `scope` is omitted —
  * `fallback` is the full advertised set only for single-scope servers; see
- * `defaultScopes`/`assertScopeConfig` in `types.ts` for the multi-scope rule.
+ * `defaultScopes`/`assertScopeConfig` in `config.ts` for the multi-scope rule.
  * Duplicates are collapsed so the granted string is stable.
  */
 export const requestedScopes = (raw, fallback) => {

package/dist/oauth/policy/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/oauth/policy/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAY,EAAE,CAClD,GAAG;KACA,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;KAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,QAAkB,EAAY,EAAE;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAmB,EACnB,UAAoB,EACG,EAAE;IACzB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,sBAAsB,OAAO,EAAE,EAAE,CAAC;AACxF,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAmB,EAAE,UAAoB,EAAmB,EAAE;IAC5F,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC,CAAC"}

package/dist/oauth/router.d.ts

@@ -1,21 +1,18 @@
-import { type OAuthRouterOptions } from "./types.js";
+import type { OAuthRouterOptions } from "./types.js";
 export type { MintedToken, OAuthAuditEntry, OAuthPorts, OAuthRouterOptions, OAuthUser, } from "./types.js";
 export type OAuthRouter = {
     /** Returns a Response when this request is OAuth-related; otherwise null. */
     tryHandle: (request: Request) => Promise<Response | null>;
 };
 export declare const createOAuthRouter: (options: OAuthRouterOptions) => OAuthRouter;
-export { type ClientAuth, firstClientAuthError, readClientAuth } from "./clientauth.js";
-export { type AuthCodeRecord, type CodeStore, consumeAuthCode, issueAuthCode, newClientId, } from "./codes.js";
-export type { ConsentOptions, ConsentRequest } from "./consent.js";
-export { buildErrorRedirectUrl } from "./consent.js";
+export { type CimdCache, type CimdDocument, isCimdClientId, resolveCimdClient, } from "./cimd/cimd.js";
 export { DEFAULT_SCOPE, GRANT_TYPES, OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, type TokenEndpointAuthMethod, } from "./constants.js";
-export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./metadata.js";
-export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./pkce.js";
-export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
-export { canonicalResource, DEFAULT_RESOURCE_PATH, firstResourceError, normalizeConfiguredPath, resourceErrorInfo, resourcesEqual, } from "./resource.js";
-export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./scope.js";
-export { hashClientSecret, verifyClientSecret } from "./secrethash.js";
-export type { ClientAssertion, ClientStore, MintAccessTokenInput, OAuthErrorInfo, RefreshAccessTokenInput, RegisteredClient, RevokeTokenInput, } from "./types.js";
-export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./types.js";
+export type { ClientAuth } from "./crypto/clientauth.js";
+export type { AuthCodeRecord, CodeStore } from "./crypto/codes.js";
+export { hashClientSecret, verifyClientSecret } from "./crypto/secrethash.js";
+export * from "./deprecated.js";
+export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./endpoints/metadata.js";
+export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./policy/redirect.js";
+export { canonicalResource, DEFAULT_RESOURCE_PATH, resourcesEqual, } from "./policy/resource.js";
+export type { ClientAssertion, ClientStore, ConsentOptions, ConsentRequest, MintAccessTokenInput, OAuthErrorInfo, RefreshAccessTokenInput, RegisteredClient, RevokeTokenInput, } from "./types.js";
 //# sourceMappingURL=router.d.ts.map

package/dist/oauth/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,kBAAkB,EAKxB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,WAAW,EACX,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,SAAS,GACV,MAAM,YAAY,CAAC;AA8DpB,MAAM,MAAM,WAAW,GAAG;IACxB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAIF,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,WA0F/D,CAAC;AAEF,OAAO,EAAE,KAAK,UAAU,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EACV,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,kBAAkB,EAA8B,MAAM,YAAY,CAAC;AAEjF,YAAY,EACV,WAAW,EACX,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,WAAW,GAAG;IACxB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAkGF,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,WA+C/D,CAAC;AAEF,OAAO,EACL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,cAAc,EACd,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE9E,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC"}

package/dist/oauth/router.js

@@ -1,119 +1,103 @@
-import { BodyTooLargeError, DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../body.js";
-import { INTERNAL_ERROR, jsonResponse, requireHttpMethod } from "../http.js";
-import { handleAuthorize } from "./authorize.js";
-import { handleConsent } from "./consent.js";
-import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
-import { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
-import { DEFAULT_RESOURCE_PATH, normalizeConfiguredPath } from "./resource.js";
-import { handleRevoke } from "./revoke.js";
-import { seal } from "./sealed.js";
-import { handleToken } from "./token.js";
-import { assertCodeSecret, assertScopeConfig, oauthError, resolveSecret, safeOAuthAudit, unregisteredClientsAllowed, } from "./types.js";
-import { handleWellKnown } from "./wellknown.js";
-const POST_ONLY = new Set(["POST"]);
-const handleRegister = async (request, options) => {
-    const methodError = requireHttpMethod(request, POST_ONLY);
-    if (methodError)
-        return methodError;
-    let suppliedRedirectUris = false;
-    let redirectUris = [];
-    try {
-        const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
-        const body = JSON.parse(text);
-        const raw = body.redirect_uris;
-        if (Array.isArray(raw)) {
-            suppliedRedirectUris = true;
-            redirectUris = raw
-                .map((u) => String(u))
-                .filter((uri) => isAllowedRedirectUri(uri, options.redirect));
-        }
-    }
-    catch (exc) {
-        if (exc instanceof BodyTooLargeError) {
-            return oauthError(OAUTH_ERRORS.invalidRequest, 413, "request body too large");
-        }
-        redirectUris = [];
-    }
-    // No redirect_uris in the body: fall back to the Claude callback only if
-    // this server's own allowlist actually accepts it — never advertise a
-    // redirect_uri that `/authorize` would go on to reject (e.g. `clients`
-    // without `"claude"`, where `createMcpApp` sets `allowClaude: false`).
-    if (!suppliedRedirectUris && isAllowedRedirectUri(CLAUDE_CALLBACK, options.redirect)) {
-        redirectUris = [CLAUDE_CALLBACK];
-    }
-    if (redirectUris.length === 0) {
-        return oauthError(OAUTH_ERRORS.invalidRedirectUri, 400, suppliedRedirectUris
-            ? "no allowed redirect_uris"
-            : "redirect_uris required — this server has no default redirect_uri");
-    }
-    // Zero storage: the client_id *is* the registration record — a sealed,
-    // self-verifying assertion of the redirect_uris this call just validated.
-    // `/authorize` unseals it and binds the client to exactly this list,
-    // the same protection a stored registration would give a pre-registered id.
-    const secret = await resolveSecret(options.ports, request);
-    const clientId = await seal(secret, "client", { redirectUris });
-    return jsonResponse({
-        client_id: clientId,
-        client_id_issued_at: Math.floor(Date.now() / 1000),
-        token_endpoint_auth_method: "none",
-        redirect_uris: redirectUris,
-        grant_types: [GRANT_TYPES.authorizationCode],
-        response_types: ["code"],
-    });
-};
-export const createOAuthRouter = (options) => {
+import { errorReason, INTERNAL_ERROR } from "../http/http.js";
+import { safeOAuthAudit } from "./audit.js";
+import { assertCodeSecret, assertScopeConfig, oauthError, unregisteredClientsAllowed, } from "./config.js";
+import { DEFAULT_OAUTH_PATH, OAUTH_ERRORS } from "./constants.js";
+import { processCodeStore } from "./crypto/codes.js";
+import { handleAuthorize } from "./endpoints/authorize.js";
+import { handleConsent } from "./endpoints/consent.js";
+import { handleRegister } from "./endpoints/register.js";
+import { handleRevoke } from "./endpoints/revoke.js";
+import { handleToken } from "./endpoints/token.js";
+import { handleWellKnown } from "./endpoints/wellknown.js";
+import { DEFAULT_RESOURCE_PATH, normalizeConfiguredPath } from "./policy/resource.js";
+/**
+ * Function-form `codeSecret` is re-validated on every call in
+ * `resolveSecrets`, since its value can vary per request; a string or array
+ * form is fixed for the life of this router, so fail fast at construction
+ * instead of at the first request.
+ */
+const assertRouterOptions = (options) => {
     if (!unregisteredClientsAllowed(options) && !options.ports.clientStore) {
         throw new Error("allowUnregisteredClients: false requires ports.clientStore " +
             "so pre-registered clients can be resolved");
     }
-    // Function-form codeSecret is re-validated on every call in resolveSecret,
-    // since its value can vary per request; a string form is fixed for the
-    // life of this router, so fail fast at construction instead of at the
-    // first request.
+    if (!options.ports.codeStore && !options.allowInMemoryCodeStore) {
+        throw new Error("ports.codeStore is required (shared jti store for auth-code / consent single-use). " +
+            "Pass a CodeStore, or set allowInMemoryCodeStore: true for single-process demos/tests only");
+    }
     if (typeof options.ports.codeSecret === "string") {
         assertCodeSecret(options.ports.codeSecret);
     }
+    if (Array.isArray(options.ports.codeSecret)) {
+        if (options.ports.codeSecret.length === 0) {
+            throw new Error("codeSecret array must not be empty — at least one key is required");
+        }
+        options.ports.codeSecret.forEach(assertCodeSecret);
+    }
     assertScopeConfig(options);
-    // Normalized once here, not per request — "/mcp/" and "/mcp" must never
-    // produce divergent canonical resources (canonicalResource doesn't strip
-    // a trailing slash itself; normalizeResource, used to compare an
-    // incoming request's resource against it, does).
+};
+/**
+ * Normalized once, not per request, so "/mcp/" and "/mcp" yield one
+ * canonical resource, and the routing table, discovery documents and the
+ * consent form action all agree on `oauthPath`.
+ */
+const normalizeRouterPaths = (options) => {
     const resourcePath = normalizeConfiguredPath(options.resourcePath ?? DEFAULT_RESOURCE_PATH);
-    const oauthPath = options.oauthPath ?? "/mcp/oauth";
+    const oauthPath = normalizeConfiguredPath(options.oauthPath ?? DEFAULT_OAUTH_PATH);
     if (oauthPath === resourcePath) {
         throw new Error(`oauthPath (${oauthPath}) must not equal resourcePath — they would shadow each other`);
     }
     if (resourcePath.startsWith("/.well-known")) {
         throw new Error(`resourcePath (${resourcePath}) must not start with /.well-known — reserved for OAuth discovery documents`);
     }
-    const prmPaths = new Set([
-        "/.well-known/oauth-protected-resource",
-        `/.well-known/oauth-protected-resource${resourcePath}`,
-    ]);
-    const asPaths = new Set([
-        "/.well-known/oauth-authorization-server",
-        `/.well-known/oauth-authorization-server${resourcePath}`,
-    ]);
-    const routes = {
-        ...(unregisteredClientsAllowed(options)
-            ? {
-                [`${oauthPath}/register`]: (request) => handleRegister(request, options),
-            }
-            : {}),
-        [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, options),
-        [`${oauthPath}/consent`]: (request) => handleConsent(request, options),
-        [`${oauthPath}/token`]: (request) => handleToken(request, options),
-        ...(options.ports.revokeToken
-            ? {
-                [`${oauthPath}/revoke`]: (request) => handleRevoke(request, options),
-            }
-            : {}),
+    return {
+        resourcePath,
+        oauthPath,
+        prmPaths: new Set([
+            "/.well-known/oauth-protected-resource",
+            `/.well-known/oauth-protected-resource${resourcePath}`,
+        ]),
+        asPaths: new Set([
+            "/.well-known/oauth-authorization-server",
+            `/.well-known/oauth-authorization-server${resourcePath}`,
+        ]),
+    };
+};
+const buildRoutes = (options, normalizedOptions, oauthPath) => ({
+    ...(unregisteredClientsAllowed(options)
+        ? {
+            [`${oauthPath}/register`]: (request) => handleRegister(request, normalizedOptions),
+        }
+        : {}),
+    [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, normalizedOptions),
+    [`${oauthPath}/consent`]: (request) => handleConsent(request, normalizedOptions),
+    [`${oauthPath}/token`]: (request) => handleToken(request, normalizedOptions),
+    ...(options.ports.revokeToken
+        ? {
+            [`${oauthPath}/revoke`]: (request) => handleRevoke(request, normalizedOptions),
+        }
+        : {}),
+});
+export const createOAuthRouter = (options) => {
+    assertRouterOptions(options);
+    // Resolved once; `assertRouterOptions` already required
+    // `allowInMemoryCodeStore` before the process store can be reached.
+    const codeStore = options.ports.codeStore ?? processCodeStore;
+    const ports = { ...options.ports, codeStore };
+    const { resourcePath, oauthPath, prmPaths, asPaths } = normalizeRouterPaths(options);
+    // Handlers read paths from here, never from the caller's raw options.
+    const normalizedOptions = {
+        ...options,
+        resourcePath,
+        oauthPath,
+        ports,
     };
+    const routes = buildRoutes(options, normalizedOptions, oauthPath);
     return {
         tryHandle: async (request) => {
             try {
                 const path = new URL(request.url).pathname;
-                const known = await handleWellKnown(request, options, {
+                const known = await handleWellKnown(request, normalizedOptions, {
                     prmPaths,
                     asPaths,
                     resourcePath,
@@ -124,31 +108,25 @@ export const createOAuthRouter = (options) => {
                 const route = routes[path];
                 return route ? await route(request) : null;
             }
-            catch (exc) {
-                // A host port (resolveUser/mintAccessToken/clientStore/...) threw,
-                // or codeSecret failed validation (assertCodeSecret, e.g. a
-                // per-request function returning something too short). We only
-                // ever reach here on a route this router owns, so answer with a
-                // real error instead of throwing out of `tryHandle` — the caller
-                // gets the generic server_error; ports.audit gets the real reason.
-                await safeOAuthAudit(options, {
+            catch (caught) {
+                // A host port threw, or a per-request codeSecret failed validation.
+                // Only routes this router owns get here: the caller sees a generic
+                // server_error, ports.audit gets the real reason.
+                await safeOAuthAudit(normalizedOptions, {
                     event: "server_error",
-                    reason: exc instanceof Error ? exc.message : String(exc),
+                    reason: errorReason(caught),
                 });
                 return oauthError(OAUTH_ERRORS.serverError, 500, INTERNAL_ERROR);
             }
         },
     };
 };
-export { firstClientAuthError, readClientAuth } from "./clientauth.js";
-export { consumeAuthCode, issueAuthCode, newClientId, } from "./codes.js";
-export { buildErrorRedirectUrl } from "./consent.js";
+export { isCimdClientId, resolveCimdClient, } from "./cimd/cimd.js";
 export { DEFAULT_SCOPE, GRANT_TYPES, OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
-export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./metadata.js";
-export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./pkce.js";
-export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
-export { canonicalResource, DEFAULT_RESOURCE_PATH, firstResourceError, normalizeConfiguredPath, resourceErrorInfo, resourcesEqual, } from "./resource.js";
-export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./scope.js";
-export { hashClientSecret, verifyClientSecret } from "./secrethash.js";
-export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./types.js";
+export { hashClientSecret, verifyClientSecret } from "./crypto/secrethash.js";
+// Moved to `mcp-trellis/advanced`; deprecated aliases until 3.0.
+export * from "./deprecated.js";
+export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./endpoints/metadata.js";
+export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./policy/redirect.js";
+export { canonicalResource, DEFAULT_RESOURCE_PATH, resourcesEqual, } from "./policy/resource.js";
 //# sourceMappingURL=router.js.map

package/dist/oauth/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAGjB,UAAU,EACV,aAAa,EACb,cAAc,EACd,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAUjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAgB,EAAE,OAA2B,EAAqB,EAAE;IAChG,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,YAAY,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,oBAAoB;YAClB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,kEAAkE,CACvE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,YAAY,EAA4B,CAAC,CAAC;IAE1F,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,0BAA0B,EAAE,MAAM;QAClC,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;QAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,iBAAiB;IACjB,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE3B,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,iDAAiD;IACjD,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IAEpD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,uCAAuC;QACvC,wCAAwC,YAAY,EAAE;KACvD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,yCAAyC;QACzC,0CAA0C,YAAY,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiC;QAC3C,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;aAClF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QACtE,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;YAC3B,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aAC9E;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;oBACpD,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,4DAA4D;gBAC5D,+DAA+D;gBAC/D,gEAAgE;gBAChE,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,cAAc,CAAC,OAAO,EAAE;oBAC5B,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACzD,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAmB,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAGL,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAUvE,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAkBtF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IAChE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAA2B,EAAe,EAAE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEnF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,IAAI,GAAG,CAAC;YAChB,uCAAuC;YACvC,wCAAwC,YAAY,EAAE;SACvD,CAAC;QACF,OAAO,EAAE,IAAI,GAAG,CAAC;YACf,yCAAyC;YACzC,0CAA0C,YAAY,EAAE;SACzD,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,OAA2B,EAC3B,iBAA6C,EAC7C,SAAiB,EACa,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;SAC5F;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC7F,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACzF,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC3B,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC;SACxF;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,wDAAwD;IACxD,oEAAoE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAC9D,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAE9C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAErF,sEAAsE;IACtE,MAAM,iBAAiB,GAA+B;QACpD,GAAG,OAAO;QACV,YAAY;QACZ,SAAS;QACT,KAAK;KACN,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAElE,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE;oBAC9D,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,cAAc,CAAC,iBAAiB,EAAE;oBACtC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;iBAC5B,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAGL,cAAc,EACd,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,iEAAiE;AACjE,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC"}