mcp-trellis 1.0.0 → 2.1.0

package/dist/mcp/tools.js

@@ -0,0 +1,166 @@
+/**
+ * Ergonomic tool authoring on top of `ToolDef` — turning "I have an API" into
+ * "I have an MCP tool" without hand-rolling validation or fetch plumbing.
+ *
+ * `inputSchema` (JSON Schema) stays required: it's what `tools/list` actually
+ * advertises to clients, and no library-agnostic way exists to derive it from
+ * an arbitrary Standard Schema validator. `input`, when supplied, is what
+ * actually parses and types `args` at call time — keep the two in sync.
+ */
+import { BodyTooLargeError, DEFAULT_MCP_BODY_LIMIT, readBoundedBytes } from "../http/body.js";
+import { pickDefined } from "../util/defined.js";
+const pathToString = (path) => (path ?? [])
+    .map((segment) => segment && typeof segment === "object" && "key" in segment
+    ? String(segment.key)
+    : String(segment))
+    .join(".");
+const parseWithSchema = async (schema, raw) => {
+    const result = await schema["~standard"].validate(raw);
+    const issues = result.issues;
+    if (issues?.length) {
+        return {
+            issues: issues.map((issue) => {
+                const path = pathToString(issue.path);
+                return path ? `${path}: ${issue.message}` : issue.message;
+            }),
+        };
+    }
+    return { value: result.value };
+};
+const issuesResult = (issues) => ({
+    content: [{ type: "text", text: issues.join("; ") }],
+    isError: true,
+});
+/**
+ * A `ToolDef` with typed, validated `args` — drop straight into
+ * `createToolRegistry` / `createMcpApp`'s `tools` array like any other tool.
+ */
+export const defineTool = (options) => ({
+    name: options.name,
+    description: options.description,
+    inputSchema: options.inputSchema,
+    ...pickDefined(options, ["scope"]),
+    handler: async (ctx, rawArgs) => {
+        if (!options.input)
+            return options.handler(ctx, rawArgs);
+        const parsed = await parseWithSchema(options.input, rawArgs);
+        if ("issues" in parsed)
+            return issuesResult(parsed.issues);
+        return options.handler(ctx, parsed.value);
+    },
+});
+const defaultRespond = (res) => res.text();
+/**
+ * Status only — the upstream body is never forwarded by default. This is a
+ * return value, not a thrown exception, so `onToolError` redaction never
+ * sees it; an upstream error page can echo internal detail, tokens or SQL
+ * into the tool result and audit log. Use `onError` to forward (a redacted
+ * version of) the body on purpose.
+ */
+const defaultErrorResult = (res) => {
+    const status = [res.status, res.statusText].filter(Boolean).join(" ");
+    return {
+        content: [{ type: "text", text: `Request failed: ${status}` }],
+        isError: true,
+    };
+};
+const DEFAULT_API_TOOL_TIMEOUT_MS = 30_000;
+const isTimeoutError = (caught) => {
+    if (!(caught instanceof Error))
+        return false;
+    return (caught.name === "TimeoutError" ||
+        caught.name === "AbortError" ||
+        caught.message === "body read aborted");
+};
+const timedOutResult = (timeoutMs) => ({
+    content: [{ type: "text", text: `Request timed out after ${timeoutMs}ms` }],
+    isError: true,
+});
+/** A timed-out fetch becomes a `ToolResult`; every other throw still propagates. */
+const fetchWithTimeout = async (fetchImpl, input, timeoutMs) => {
+    if (timeoutMs === false)
+        return { response: await fetchImpl(input) };
+    const signal = AbortSignal.timeout(timeoutMs);
+    try {
+        return { response: await fetchImpl(input, { signal }), signal };
+    }
+    catch (caught) {
+        if (isTimeoutError(caught))
+            return timedOutResult(timeoutMs);
+        throw caught;
+    }
+};
+/**
+ * Capped before `respond`/`onError` ever see it — an unbounded res.text()
+ * on the upstream body is the same memory-exhaustion shape an unbounded
+ * *incoming* body is (see body.ts). Rebuilt as a fresh Response from the
+ * raw bytes — not decoded text — so `respond`/`onError` can still call
+ * res.arrayBuffer()/res.blob() on binary bodies as well as res.text()/
+ * res.json(), exactly as if they'd read the original response themselves.
+ * An oversized body, or the timeout signal firing mid-body, becomes a
+ * `ToolResult`; every other throw still propagates.
+ */
+const boundResponse = async (res, maxResponseBytes, timeoutMs, signal) => {
+    let bytes;
+    try {
+        bytes = (await readBoundedBytes(res, maxResponseBytes, signal));
+    }
+    catch (caught) {
+        if (caught instanceof BodyTooLargeError) {
+            return {
+                content: [{ type: "text", text: `Response exceeded ${maxResponseBytes} bytes` }],
+                isError: true,
+            };
+        }
+        if (isTimeoutError(caught))
+            return timedOutResult(timeoutMs);
+        throw caught;
+    }
+    // The buffered body is already decoded and re-framed — the upstream
+    // encoding/length headers no longer describe it.
+    const headers = new Headers(res.headers);
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+    return new Response(bytes, { status: res.status, statusText: res.statusText, headers });
+};
+const runApi = async (options, ctx, args) => {
+    const fetchImpl = options.fetch ?? fetch;
+    const input = await options.request(ctx, args);
+    const timeoutMs = options.timeoutMs ?? DEFAULT_API_TOOL_TIMEOUT_MS;
+    const fetched = await fetchWithTimeout(fetchImpl, input, timeoutMs);
+    if (!("response" in fetched))
+        return fetched;
+    const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MCP_BODY_LIMIT;
+    const bounded = await boundResponse(fetched.response, maxResponseBytes, timeoutMs, fetched.signal);
+    if (!(bounded instanceof Response))
+        return bounded;
+    if (!bounded.ok)
+        return options.onError ? options.onError(bounded) : defaultErrorResult(bounded);
+    return (options.respond ?? defaultRespond)(bounded);
+};
+/**
+ * Wrap a single REST call as an MCP tool in one call: build the request from
+ * typed args, run it, and shape the response — no hand-rolled fetch/error
+ * plumbing per tool. Built on `defineTool`, so `input` gets the same
+ * validation-before-call treatment.
+ */
+export const apiTool = (options) => {
+    const core = {
+        name: options.name,
+        description: options.description,
+        inputSchema: options.inputSchema,
+        ...pickDefined(options, ["scope"]),
+    };
+    if (options.input) {
+        return defineTool({
+            ...core,
+            input: options.input,
+            handler: (ctx, args) => runApi(options, ctx, args),
+        });
+    }
+    return defineTool({
+        ...core,
+        handler: (ctx, args) => runApi(options, ctx, args),
+    });
+};
+//# sourceMappingURL=tools.js.map

package/dist/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA2BjD,MAAM,YAAY,GAAG,CAAC,IAAwC,EAAU,EAAE,CACxE,CAAC,IAAI,IAAI,EAAE,CAAC;KACT,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO;IACxD,CAAC,CAAC,MAAM,CAAE,OAA4B,CAAC,GAAG,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACpB;KACA,IAAI,CAAC,GAAG,CAAC,CAAC;AAEf,MAAM,eAAe,GAAG,KAAK,EAC3B,MAAyC,EACzC,GAAY,EACkB,EAAE;IAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YAC5D,CAAC,CAAC;SACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAG,MAA4B,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,MAAgB,EAAc,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AA2BH;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,OAAuC,EACxB,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC,IAAI;IAClB,WAAW,EAAE,OAAO,CAAC,WAAW;IAChC,WAAW,EAAE,OAAO,CAAC,WAAW;IAChC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC9B,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,QAAQ,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF,CAAC,CAAC;AAyCH,MAAM,cAAc,GAAG,CAAC,GAAa,EAAmB,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,GAAa,EAAc,EAAE;IACvD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,MAAM,EAAE,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAE3C,MAAM,cAAc,GAAG,CAAC,MAAe,EAAW,EAAE;IAClD,IAAI,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,cAAc;QAC9B,MAAM,CAAC,IAAI,KAAK,YAAY;QAC5B,MAAM,CAAC,OAAO,KAAK,mBAAmB,CACvC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,SAAyB,EAAc,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,SAAS,IAAI,EAAE,CAAC;IAC3E,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,SAAuB,EACvB,KAAiB,EACjB,SAAyB,EAC2C,EAAE;IACtE,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,KAAK,EACzB,GAAa,EACb,gBAAwB,EACxB,SAAyB,EACzB,MAAoB,EACY,EAAE;IAClC,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC7F,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;YACxC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,gBAAgB,QAAQ,EAAE,CAAC;gBAChF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC;IACf,CAAC;IACD,oEAAoE;IACpE,iDAAiD;IACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,KAAK,EAClB,OAA6B,EAC7B,GAAS,EACT,IAAU,EACoB,EAAE;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,2BAA2B,CAAC;IAEnE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,sBAAsB,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,OAAO,CAAC,QAAQ,EAChB,gBAAgB,EAChB,SAAS,EACT,OAAO,CAAC,MAAM,CACf,CAAC;IACF,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAEnD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjG,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,OAAoC,EACrB,EAAE;IACjB,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;KACnC,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,UAAU,CAAc;YAC7B,GAAG,IAAI;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAO;QACtB,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;KACnD,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/{validate.d.ts → mcp/validate.d.ts}

@@ -7,16 +7,27 @@ export type JsonSchema = {
     items?: JsonSchema;
     minimum?: number;
     maximum?: number;
+    /** Only the boolean form is evaluated; a schema-valued form is unsupported. */
+    additionalProperties?: boolean | JsonSchema;
     description?: string;
     title?: string;
     [key: string]: unknown;
 };
+export declare const JSON_SCHEMA_TYPES: {
+    readonly string: "string";
+    readonly number: "number";
+    readonly integer: "integer";
+    readonly boolean: "boolean";
+    readonly object: "object";
+    readonly array: "array";
+    readonly null: "null";
+};
 /** Keywords `validateAgainstSchema` actually evaluates. */
 export declare const SUPPORTED_SCHEMA_KEYWORDS: ReadonlySet<string>;
 /**
  * Allowed on inputSchema but never evaluated (tools/list / generator metadata).
- * Semantically-enforcing keywords (`pattern`, `additionalProperties`, …) are
- * not ignored — with `validateArgs: true` they throw at construction.
+ * Semantically-enforcing keywords (`pattern`, `oneOf`, …) are not ignored —
+ * with `validateArgs: true` they throw at construction.
  */
 export declare const IGNORED_SCHEMA_KEYWORDS: ReadonlySet<string>;
 /**
@@ -26,27 +37,13 @@ export declare const IGNORED_SCHEMA_KEYWORDS: ReadonlySet<string>;
 export declare const unsupportedKeywords: (schema: JsonSchema, path?: string) => string[];
 /**
  * Paths where `properties`/`required` implies an object shape but `type`
- * doesn't say so — absent, or a single type/union not including
- * `"object"`. Without this, `{ properties: { x: { type: "string" } },
- * required: ["x"] }` validates *any* input, `{}` included: `typeMismatch`
- * short-circuits on a missing `type`, and the object-specific checks below
- * only ran when `schema.type === "object"`. Walks nested
- * `properties`/`items` the same way `unsupportedKeywords` does. Under
- * `validateArgs: true` this throws at construction instead of silently
- * validating nothing at runtime — `validateNode`'s dispatch-by-actual-type
- * (see below) is the separate runtime backstop for schemas that reach
- * validation unchecked (e.g. loaded from outside the tool definition).
+ * doesn't say so — absent, or a type/union without `"object"`. Such a
+ * schema would otherwise accept any input, `{}` included. Under
+ * `validateArgs: true` this throws at construction; `validateNode`'s
+ * dispatch on the value's runtime type is the backstop for schemas that
+ * reach validation unchecked.
  */
 export declare const missingObjectType: (schema: JsonSchema, path?: string) => string[];
-export declare const JSON_SCHEMA_TYPES: {
-    readonly string: "string";
-    readonly number: "number";
-    readonly integer: "integer";
-    readonly boolean: "boolean";
-    readonly object: "object";
-    readonly array: "array";
-    readonly null: "null";
-};
 /** Minimal JSON Schema subset used by MCP tool inputSchema. Empty = valid. */
 export declare const validateAgainstSchema: (value: unknown, schema: JsonSchema) => string[];
 //# sourceMappingURL=validate.d.ts.map

package/dist/mcp/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/mcp/validate.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IACvB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAC;AAkBX,2DAA2D;AAC3D,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CASxD,CAAC;AAUH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAYtD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,UAAU,EAAE,aAAa,KAAG,MAAM,EAU7E,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,UAAU,EAAE,aAAa,KAAG,MAAM,EAS3E,CAAC;AAiHF,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,GAAI,OAAO,OAAO,EAAE,QAAQ,UAAU,KAAG,MAAM,EAC5C,CAAC"}

package/dist/{validate.js → mcp/validate.js}

@@ -1,3 +1,25 @@
+export const JSON_SCHEMA_TYPES = {
+    string: "string",
+    number: "number",
+    integer: "integer",
+    boolean: "boolean",
+    object: "object",
+    array: "array",
+    null: "null",
+};
+/** `schema.type` as an array either way — a single type is a union of one. */
+const declaredTypesOf = (schema) => schema.type ? (Array.isArray(schema.type) ? schema.type : [schema.type]) : [];
+/**
+ * Direct subschemas the walkers below descend into (`properties.*`, `items`),
+ * each with the path it is reported under.
+ */
+const childSchemas = (schema, path) => [
+    ...Object.entries(schema.properties ?? {}).map(([key, child]) => [
+        child,
+        `${path}.properties.${key}`,
+    ]),
+    ...(schema.items ? [[schema.items, `${path}.items`]] : []),
+];
 /** Keywords `validateAgainstSchema` actually evaluates. */
 export const SUPPORTED_SCHEMA_KEYWORDS = new Set([
     "type",
@@ -7,11 +29,17 @@ export const SUPPORTED_SCHEMA_KEYWORDS = new Set([
     "items",
     "minimum",
     "maximum",
+    "additionalProperties",
 ]);
+/** Supported only in these value shapes; any other value is reported as unsupported. */
+const SUPPORTED_KEYWORD_VALUES = {
+    additionalProperties: (value) => typeof value === "boolean",
+};
+const isSupportedKeyword = (key, value) => SUPPORTED_SCHEMA_KEYWORDS.has(key) && (SUPPORTED_KEYWORD_VALUES[key]?.(value) ?? true);
 /**
  * Allowed on inputSchema but never evaluated (tools/list / generator metadata).
- * Semantically-enforcing keywords (`pattern`, `additionalProperties`, …) are
- * not ignored — with `validateArgs: true` they throw at construction.
+ * Semantically-enforcing keywords (`pattern`, `oneOf`, …) are not ignored —
+ * with `validateArgs: true` they throw at construction.
  */
 export const IGNORED_SCHEMA_KEYWORDS = new Set([
     "description",
@@ -31,46 +59,27 @@ export const IGNORED_SCHEMA_KEYWORDS = new Set([
  * Walks nested `properties` / `items`.
  */
 export const unsupportedKeywords = (schema, path = "args") => {
-    const local = Object.keys(schema).flatMap((key) => SUPPORTED_SCHEMA_KEYWORDS.has(key) || IGNORED_SCHEMA_KEYWORDS.has(key)
-        ? []
-        : [`${path}.${key}`]);
-    const fromProperties = Object.entries(schema.properties ?? {}).flatMap(([key, child]) => unsupportedKeywords(child, `${path}.properties.${key}`));
-    const fromItems = schema.items ? unsupportedKeywords(schema.items, `${path}.items`) : [];
-    return [...local, ...fromProperties, ...fromItems];
+    const local = Object.entries(schema).flatMap(([key, value]) => isSupportedKeyword(key, value) || IGNORED_SCHEMA_KEYWORDS.has(key) ? [] : [`${path}.${key}`]);
+    return [
+        ...local,
+        ...childSchemas(schema, path).flatMap(([child, childPath]) => unsupportedKeywords(child, childPath)),
+    ];
 };
 /**
  * Paths where `properties`/`required` implies an object shape but `type`
- * doesn't say so — absent, or a single type/union not including
- * `"object"`. Without this, `{ properties: { x: { type: "string" } },
- * required: ["x"] }` validates *any* input, `{}` included: `typeMismatch`
- * short-circuits on a missing `type`, and the object-specific checks below
- * only ran when `schema.type === "object"`. Walks nested
- * `properties`/`items` the same way `unsupportedKeywords` does. Under
- * `validateArgs: true` this throws at construction instead of silently
- * validating nothing at runtime — `validateNode`'s dispatch-by-actual-type
- * (see below) is the separate runtime backstop for schemas that reach
- * validation unchecked (e.g. loaded from outside the tool definition).
+ * doesn't say so — absent, or a type/union without `"object"`. Such a
+ * schema would otherwise accept any input, `{}` included. Under
+ * `validateArgs: true` this throws at construction; `validateNode`'s
+ * dispatch on the value's runtime type is the backstop for schemas that
+ * reach validation unchecked.
  */
 export const missingObjectType = (schema, path = "args") => {
-    const declaredTypes = schema.type
-        ? Array.isArray(schema.type)
-            ? schema.type
-            : [schema.type]
-        : [];
     const impliesObject = schema.properties !== undefined || schema.required !== undefined;
-    const local = impliesObject && !declaredTypes.includes(JSON_SCHEMA_TYPES.object) ? [path] : [];
-    const fromProperties = Object.entries(schema.properties ?? {}).flatMap(([key, child]) => missingObjectType(child, `${path}.properties.${key}`));
-    const fromItems = schema.items ? missingObjectType(schema.items, `${path}.items`) : [];
-    return [...local, ...fromProperties, ...fromItems];
-};
-export const JSON_SCHEMA_TYPES = {
-    string: "string",
-    number: "number",
-    integer: "integer",
-    boolean: "boolean",
-    object: "object",
-    array: "array",
-    null: "null",
+    const declaresObject = declaredTypesOf(schema).includes(JSON_SCHEMA_TYPES.object);
+    return [
+        ...(impliesObject && !declaresObject ? [path] : []),
+        ...childSchemas(schema, path).flatMap(([child, childPath]) => missingObjectType(child, childPath)),
+    ];
 };
 const runtimeTypeOf = (value) => {
     if (value === null)
@@ -83,8 +92,6 @@ const TYPE_MATCHERS = {
     [JSON_SCHEMA_TYPES.integer]: (actual, value) => actual === JSON_SCHEMA_TYPES.number && Number.isInteger(value),
 };
 const matchesDeclaredType = (actual, value, declared) => TYPE_MATCHERS[declared]?.(actual, value) ?? actual === declared;
-/** `schema.type` as an array either way — a single type is a union of one. */
-const declaredTypesOf = (schema) => schema.type ? (Array.isArray(schema.type) ? schema.type : [schema.type]) : [];
 const typeMismatch = (value, schema, path) => {
     const declared = declaredTypesOf(schema);
     if (declared.length === 0)
@@ -124,13 +131,24 @@ const objectErrors = (value, schema, path) => {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return [];
     const record = value;
+    // `Object.hasOwn`, not `key in record` — `in` also matches inherited
+    // Object.prototype members (`toString`, `constructor`, `hasOwnProperty`,
+    // …), so `required: ["toString"]` would pass against `{}` and a
+    // `properties: { constructor: {...} }` entry would validate against the
+    // prototype's own `constructor`, neither of which is an actual argument
+    // the caller supplied.
     const requiredErrors = (schema.required ?? [])
-        .filter((key) => !(key in record))
+        .filter((key) => !Object.hasOwn(record, key))
         .map((key) => `${path}.${key}: required`);
     const propertyErrors = Object.entries(schema.properties ?? {})
-        .filter(([key]) => key in record)
+        .filter(([key]) => Object.hasOwn(record, key))
         .flatMap(([key, propSchema]) => validateNode(record[key], propSchema, `${path}.${key}`));
-    return [...requiredErrors, ...propertyErrors];
+    const extraErrors = schema.additionalProperties === false
+        ? Object.keys(record)
+            .filter((key) => !Object.hasOwn(schema.properties ?? {}, key))
+            .map((key) => `${path}.${key}: not allowed`)
+        : [];
+    return [...requiredErrors, ...propertyErrors, ...extraErrors];
 };
 const arrayErrors = (value, schema, path) => {
     const items = schema.items;

package/dist/mcp/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/mcp/validate.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,8EAA8E;AAC9E,MAAM,eAAe,GAAG,CAAC,MAAkB,EAAY,EAAE,CACvD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAAkB,EAAE,IAAY,EAA+B,EAAE,CAAC;IACtF,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAwB,EAAE,CAAC;QACrF,KAAK;QACL,GAAG,IAAI,eAAe,GAAG,EAAE;KAC5B,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACnF,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,MAAM;IACN,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO;IACP,SAAS;IACT,SAAS;IACT,sBAAsB;CACvB,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,wBAAwB,GAAgD;IAC5E,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,SAAS;CAC5D,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,KAAc,EAAW,EAAE,CAClE,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAClE,aAAa;IACb,OAAO;IACP,SAAS;IACT,KAAK;IACL,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAkB,EAAE,IAAI,GAAG,MAAM,EAAY,EAAE;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC5D,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAC7F,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAC3D,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CACtC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAkB,EAAE,IAAI,GAAG,MAAM,EAAY,EAAE;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;IACvF,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO;QACL,GAAG,CAAC,aAAa,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAC3D,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CACpC;KACF,CAAC;AACJ,CAAC,CAAC;AAIF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC;IACzD,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAgE;IACjF,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAC7C,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;CACjE,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,KAAc,EAAE,QAAgB,EAAW,EAAE,CACxF,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,CAAC;AAElE,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAE,IAAY,EAAY,EAAE;IAClF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAE,IAAY,EAAY,EAAE;IAChF,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,YAAY,GAIb;IACH;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK;QACtC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,mBAAmB,KAAK,EAAE;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK;QACtC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,mBAAmB,KAAK,EAAE;KAC5D;CACF,CAAC;AAEF,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,YAAY,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,wEAAwE;IACxE,uBAAuB;IACvB,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,YAAY,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;SAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SAC7C,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GACf,MAAM,CAAC,oBAAoB,KAAK,KAAK;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;aAC7D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,eAAe,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,CAAC,GAAG,cAAc,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,aAAa,GAAgC;IACjD,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,YAAY;IACxC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,WAAW;IACtC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW;IACvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,WAAW;CACzC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAE,IAAY,EAAY,EAAE;IAClF,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7C,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,sDAAsD;IACtD,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC;QAClC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAY,EAAE,CACpF,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC"}

package/dist/oauth/audit.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Invoke `ports.audit`, swallowing any failure and racing it against
+ * `auditTimeoutMs` — the OAuth-side twin of `methods.ts`'s `safeAudit`.
+ * A hanging sink must not stall `/token` or `/authorize` error responses.
+ */
+import type { OAuthAuditEntry, OAuthRouterOptions } from "./types.js";
+export declare const safeOAuthAudit: (options: OAuthRouterOptions, entry: OAuthAuditEntry) => Promise<void>;
+/**
+ * Fires `legacy_code_secret_used` when a value was recovered with a
+ * rotation-array entry other than the primary (`keyIndex > 0`) — the signal
+ * every codeSecret rotation site (`/authorize`, `/consent`, `/token`,
+ * `firstClientAuthError`) uses to tell an operator which old keys are still
+ * live. A no-op for the common case (`keyIndex === 0`, or none at all).
+ */
+export declare const auditLegacyKeyUsage: (options: OAuthRouterOptions, usage: {
+    clientId: string;
+    keyIndex: number | null | undefined;
+    source: string;
+}) => Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/oauth/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/oauth/audit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEtE,eAAO,MAAM,cAAc,GACzB,SAAS,kBAAkB,EAC3B,OAAO,eAAe,KACrB,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,kBAAkB,EAC3B,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KAC/E,OAAO,CAAC,IAAI,CAOd,CAAC"}

package/dist/oauth/audit.js

@@ -0,0 +1,29 @@
+/**
+ * Invoke `ports.audit`, swallowing any failure and racing it against
+ * `auditTimeoutMs` — the OAuth-side twin of `methods.ts`'s `safeAudit`.
+ * A hanging sink must not stall `/token` or `/authorize` error responses.
+ */
+import { DEFAULT_AUDIT_TIMEOUT_MS, runAuditBounded } from "../http/http.js";
+export const safeOAuthAudit = async (options, entry) => {
+    const audit = options.ports.audit;
+    if (!audit)
+        return;
+    await runAuditBounded(() => audit(entry), options.auditTimeoutMs ?? DEFAULT_AUDIT_TIMEOUT_MS);
+};
+/**
+ * Fires `legacy_code_secret_used` when a value was recovered with a
+ * rotation-array entry other than the primary (`keyIndex > 0`) — the signal
+ * every codeSecret rotation site (`/authorize`, `/consent`, `/token`,
+ * `firstClientAuthError`) uses to tell an operator which old keys are still
+ * live. A no-op for the common case (`keyIndex === 0`, or none at all).
+ */
+export const auditLegacyKeyUsage = async (options, usage) => {
+    if (!usage.keyIndex)
+        return;
+    await safeOAuthAudit(options, {
+        event: "legacy_code_secret_used",
+        clientId: usage.clientId,
+        reason: `${usage.source} with codeSecret[${usage.keyIndex}]`,
+    });
+};
+//# sourceMappingURL=audit.js.map

package/dist/oauth/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/oauth/audit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAG5E,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAA2B,EAC3B,KAAsB,EACP,EAAE;IACjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,OAA2B,EAC3B,KAAgF,EACjE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO;IAC5B,MAAM,cAAc,CAAC,OAAO,EAAE;QAC5B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,QAAQ,GAAG;KAC7D,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/cimd/cimd-parse.d.ts

@@ -0,0 +1,4 @@
+import type { CimdDocument } from "./types.js";
+export declare const parseCacheMaxAge: (header: string | null) => number;
+export declare const parseDocument: (clientId: string, text: string) => CimdDocument;
+//# sourceMappingURL=cimd-parse.d.ts.map

package/dist/oauth/cimd/cimd-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-parse.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-parse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,GAAG,IAAI,KAAG,MAGxD,CAAC;AAoCF,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,YAsB9D,CAAC"}

package/dist/oauth/cimd/cimd-parse.js

@@ -0,0 +1,70 @@
+import { isJsonObject } from "../../util/json.js";
+import { MAX_CLIENT_REDIRECT_URIS } from "../constants.js";
+import { isLoopbackHostname } from "./cimd-ssrf.js";
+const DEFAULT_CACHE_SECONDS = 300;
+const MAX_CACHE_SECONDS = 3600;
+export const parseCacheMaxAge = (header) => {
+    const maxAge = header ? /(?:^|,)\s*max-age=(\d+)/i.exec(header)?.[1] : undefined;
+    return maxAge === undefined ? DEFAULT_CACHE_SECONDS : Math.min(Number(maxAge), MAX_CACHE_SECONDS);
+};
+const assertHttpRedirectUri = (uri) => {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        throw new Error("CIMD redirect_uris entries must be absolute URLs");
+    }
+    if (parsed.username || parsed.password || parsed.hash) {
+        throw new Error("CIMD redirect_uris must not carry credentials or a fragment");
+    }
+    if (parsed.protocol === "https:")
+        return;
+    if (parsed.protocol === "http:") {
+        if (!isLoopbackHostname(parsed.hostname)) {
+            throw new Error("CIMD http redirect_uris must be loopback (127.0.0.1 / ::1)");
+        }
+        return;
+    }
+    throw new Error("CIMD redirect_uris must be http(s)");
+};
+const parseRedirectUris = (rawUris) => {
+    if (!Array.isArray(rawUris) || rawUris.length === 0) {
+        throw new Error("CIMD document must include a non-empty redirect_uris array");
+    }
+    if (rawUris.length > MAX_CLIENT_REDIRECT_URIS) {
+        throw new Error(`CIMD redirect_uris must have at most ${MAX_CLIENT_REDIRECT_URIS} entries`);
+    }
+    return rawUris.map((u) => {
+        if (typeof u !== "string" || !u)
+            throw new Error("CIMD redirect_uris entries must be strings");
+        assertHttpRedirectUri(u);
+        return u;
+    });
+};
+export const parseDocument = (clientId, text) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error("CIMD document is not JSON");
+    }
+    if (!isJsonObject(parsed))
+        throw new Error("CIMD document must be a JSON object");
+    const record = parsed;
+    if (record.client_id !== clientId) {
+        throw new Error("CIMD document client_id must equal the request URL exactly");
+    }
+    const authMethod = record.token_endpoint_auth_method;
+    if (authMethod !== undefined && authMethod !== "none") {
+        throw new Error("CIMD clients must be public (token_endpoint_auth_method none)");
+    }
+    return {
+        client_id: clientId,
+        redirect_uris: parseRedirectUris(record.redirect_uris),
+        ...(typeof record.client_name === "string" ? { client_name: record.client_name } : {}),
+        token_endpoint_auth_method: "none",
+    };
+};
+//# sourceMappingURL=cimd-parse.js.map

package/dist/oauth/cimd/cimd-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-parse.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAqB,EAAU,EAAE;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACpG,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAQ,EAAE;IAClD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,OAAgB,EAAY,EAAE;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,wBAAwB,UAAU,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC/F,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAgB,EAAE;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,0BAA0B,CAAC;IACrD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC;QACtD,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,0BAA0B,EAAE,MAAM;KACnC,CAAC;AACJ,CAAC,CAAC"}

package/dist/oauth/cimd/cimd-ssrf.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SSRF guards for CIMD URL fetch: hostname normalization, private/NAT64
+ * IP blocks, and DNS lookup before connect.
+ */
+export declare const isLoopbackHostname: (hostname: string) => boolean;
+export declare const defaultLookup: (hostname: string) => Promise<string[]>;
+export declare const assertSafeUrl: (url: URL, lookup: (hostname: string) => Promise<string[]>) => Promise<void>;
+//# sourceMappingURL=cimd-ssrf.d.ts.map

package/dist/oauth/cimd/cimd-ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-ssrf.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoLH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAEL,CAAC;AAElD,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAQtE,CAAC;AAiBF,eAAO,MAAM,aAAa,GACxB,KAAK,GAAG,EACR,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,KAC9C,OAAO,CAAC,IAAI,CASd,CAAC"}