mcp-trellis 1.0.0 → 2.1.0

package/dist/oauth/{sealed.js → crypto/sealed.js}

@@ -1,7 +1,6 @@
 /**
- * AES-GCM sealing for short-lived, self-describing tokens derived from the
- * same `codeSecret` as auth codes (HMAC today, AES-GCM from Phase 2 —
- * see `codes.ts`).
+ * AES-GCM sealing for short-lived, self-describing tokens (auth codes,
+ * consent tickets, DCR client assertions), all keyed from `codeSecret`.
  *
  * Domain separation is mandatory, not a nice-to-have: a consent ticket must
  * never unseal as a client-id assertion, and neither must ever unseal as an
@@ -10,20 +9,15 @@
  * two independent reasons decryption fails across types, not one.
  */
 import { bytesToBase64Url, fromBase64Url } from "./base64url.js";
+import { hkdfKey } from "./hkdf.js";
 const HKDF_INFO_PREFIX = "mcp-trellis:sealed:";
 const IV_BYTES = 12;
-const deriveKey = async (secret, type, usage) => {
-    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: new Uint8Array(0),
-        info: new TextEncoder().encode(`${HKDF_INFO_PREFIX}${type}`),
-    }, material, { name: "AES-GCM", length: 256 }, false, [usage]);
-};
+const AES_GCM_256 = { name: "AES-GCM", length: 256 };
+/** Same key material for "encrypt" and "decrypt" — WebCrypto just restricts the derived key's own `usages`. */
+const sealingKey = (secret, type, usage) => hkdfKey(secret, { info: `${HKDF_INFO_PREFIX}${type}`, algorithm: AES_GCM_256, usage });
 /** Seals `payload` as an opaque, type-bound string. */
 export const seal = async (secret, type, payload) => {
-    const key = await deriveKey(secret, type, "encrypt");
+    const key = await sealingKey(secret, type, "encrypt");
     const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
     const additionalData = new TextEncoder().encode(type);
     const plaintext = new TextEncoder().encode(JSON.stringify(payload));
@@ -41,7 +35,7 @@ export const unseal = async (secret, type, sealed) => {
     if (!ivPart || !ciphertextPart)
         return null;
     try {
-        const key = await deriveKey(secret, type, "decrypt");
+        const key = await sealingKey(secret, type, "decrypt");
         const iv = fromBase64Url(ivPart);
         if (iv.byteLength !== IV_BYTES)
             return null;
@@ -54,4 +48,18 @@ export const unseal = async (secret, type, sealed) => {
         return null;
     }
 };
+/**
+ * Rotation-aware unseal: tries each `secrets` entry in order, returning the
+ * index of the one that actually worked so a caller can audit "sealed under
+ * a non-primary key" without a second decrypt pass. `secrets` is expected
+ * non-empty (callers resolve it via `resolveSecrets`, which enforces that).
+ */
+export const unsealAny = async (secrets, type, sealed) => {
+    for (const [keyIndex, secret] of secrets.entries()) {
+        const value = await unseal(secret, type, sealed);
+        if (value !== null)
+            return { value, keyIndex };
+    }
+    return null;
+};
 //# sourceMappingURL=sealed.js.map

package/dist/oauth/crypto/sealed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.js","sourceRoot":"","sources":["../../../src/oauth/crypto/sealed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,MAAM,WAAW,GAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAEtE,+GAA+G;AAC/G,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,IAAgB,EAChB,KAA4B,EACR,EAAE,CACtB,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,gBAAgB,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AAEzF,uDAAuD;AACvD,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAK,MAAc,EAAE,IAAgB,EAAE,OAAU,EAAmB,EAAE;IAC7F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EACvC,GAAG,EACH,SAAS,CACV,CAAC;IACF,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;AACnE,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,MAAc,EACd,IAAgB,EAChB,MAAc,EACK,EAAE;IACrB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EACvC,GAAG,EACH,UAAU,CACX,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAA0B,EAC1B,IAAgB,EAChB,MAAc,EACkC,EAAE;IAClD,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAI,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/oauth/{secrethash.d.ts → crypto/secrethash.d.ts}

@@ -41,4 +41,18 @@ export declare const hashClientSecret: (secret: string, codeSecretValue: string)
  * the same check outside the token endpoint (e.g. a client-management API).
  */
 export declare const verifyClientSecret: (presented: string, stored: string, codeSecretValue: string) => Promise<boolean>;
+/**
+ * Rotation-aware `verifyClientSecret`: a hash stored under an older
+ * `codeSecret` must keep verifying until it's re-hashed under the current
+ * one. Always tries every entry in `codeSecretValues` — even after an
+ * earlier one matches — for the *unknown-client* dummy-compare call site in
+ * `clientauth.ts`, where `stored` is a fixed dummy hash that never matches
+ * any real key: looping the same number of times whether or not a key list
+ * is configured for rotation keeps that call's cost from leaking how many
+ * keys are configured.
+ */
+export declare const verifyClientSecretAny: (presented: string, stored: string, codeSecretValues: readonly string[]) => Promise<{
+    ok: boolean;
+    keyIndex: number | null;
+}>;
 //# sourceMappingURL=secrethash.d.ts.map

package/dist/oauth/crypto/secrethash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrethash.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/secrethash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAWH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,iBAAiB,MAAM,KACtB,OAAO,CAAC,MAAM,CAQhB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,QAAQ,MAAM,EACd,iBAAiB,MAAM,KACtB,OAAO,CAAC,OAAO,CAIjB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAChC,WAAW,MAAM,EACjB,QAAQ,MAAM,EACd,kBAAkB,SAAS,MAAM,EAAE,KAClC,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAQlD,CAAC"}

package/dist/oauth/{secrethash.js → crypto/secrethash.js}

@@ -27,19 +27,12 @@
  * are human-chosen, don't use this — do a real password hash inside your
  * own `verifySecret` instead.
  */
-import { timingSafeEqual } from "../auth/bearer.js";
+import { timingSafeEqual } from "../../auth/bearer.js";
 import { bytesToBase64Url } from "./base64url.js";
+import { hkdfKey } from "./hkdf.js";
 const HASH_PREFIX = "hmac-sha256$";
 const HKDF_INFO = "mcp-trellis:client-secret-hash";
-const deriveHmacKey = async (codeSecretValue) => {
-    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(codeSecretValue), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: new Uint8Array(0),
-        info: new TextEncoder().encode(HKDF_INFO),
-    }, material, { name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign"]);
-};
+const HMAC_SHA256 = { name: "HMAC", hash: "SHA-256", length: 256 };
 /**
  * Hash a client secret for storage in your `ClientStore.secretHash` lookup.
  * Call this once, at registration time, with the same `codeSecret` value
@@ -47,7 +40,11 @@ const deriveHmacKey = async (codeSecretValue) => {
  * the result, never the plaintext secret.
  */
 export const hashClientSecret = async (secret, codeSecretValue) => {
-    const key = await deriveHmacKey(codeSecretValue);
+    const key = await hkdfKey(codeSecretValue, {
+        info: HKDF_INFO,
+        algorithm: HMAC_SHA256,
+        usage: "sign",
+    });
     const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(secret));
     return `${HASH_PREFIX}${bytesToBase64Url(sig)}`;
 };
@@ -63,4 +60,23 @@ export const verifyClientSecret = async (presented, stored, codeSecretValue) =>
     const recomputed = await hashClientSecret(presented, codeSecretValue);
     return timingSafeEqual(recomputed, stored);
 };
+/**
+ * Rotation-aware `verifyClientSecret`: a hash stored under an older
+ * `codeSecret` must keep verifying until it's re-hashed under the current
+ * one. Always tries every entry in `codeSecretValues` — even after an
+ * earlier one matches — for the *unknown-client* dummy-compare call site in
+ * `clientauth.ts`, where `stored` is a fixed dummy hash that never matches
+ * any real key: looping the same number of times whether or not a key list
+ * is configured for rotation keeps that call's cost from leaking how many
+ * keys are configured.
+ */
+export const verifyClientSecretAny = async (presented, stored, codeSecretValues) => {
+    let matchedIndex = null;
+    for (const [keyIndex, codeSecretValue] of codeSecretValues.entries()) {
+        if (await verifyClientSecret(presented, stored, codeSecretValue)) {
+            matchedIndex ??= keyIndex;
+        }
+    }
+    return { ok: matchedIndex !== null, keyIndex: matchedIndex };
+};
 //# sourceMappingURL=secrethash.js.map

package/dist/oauth/crypto/secrethash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrethash.js","sourceRoot":"","sources":["../../../src/oauth/crypto/secrethash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAEnD,MAAM,WAAW,GAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAc,EACd,eAAuB,EACN,EAAE;IACnB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE;QACzC,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,WAAW;QACtB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,MAAc,EACd,eAAuB,EACL,EAAE;IACpB,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACtE,OAAO,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,SAAiB,EACjB,MAAc,EACd,gBAAmC,EACgB,EAAE;IACrD,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACrE,IAAI,MAAM,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YACjE,YAAY,KAAK,QAAQ,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,YAAY,KAAK,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC/D,CAAC,CAAC"}

package/dist/oauth/deprecated.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `mcp-trellis/oauth` aliases for symbols that moved to
+ * `mcp-trellis/advanced`. Declared as consts so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+import * as advanced from "../advanced.js";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const readClientAuth: (request: Request, body: Record<string, string>) => advanced.ClientAuth | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const firstClientAuthError: (auth: advanced.ClientAuth, options: import("./types.js").OAuthRouterOptions, request: Request) => Promise<Response | null>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const firstResourceError: (requested: string, expected: string) => Response | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const resourceErrorInfo: (requested: string, expected: string) => import("./types.js").OAuthErrorInfo | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const normalizeConfiguredPath: (path: string) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const firstScopeError: (requested: string[], advertised: string[]) => Response | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const scopeErrorInfo: (requested: string[], advertised: string[]) => import("./types.js").OAuthErrorInfo | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const parseScope: (raw: string) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const requestedScopes: (raw: string, fallback: string[]) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const formatScope: (scopes: string[]) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const issueAuthCode: (secret: string, record: Omit<advanced.AuthCodeRecord, "exp">, nowMs?: number) => Promise<string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const consumeAuthCode: (secret: string | readonly string[], code: string, options?: {
+    codeStore?: advanced.CodeStore | undefined;
+    nowMs?: number | undefined;
+}) => Promise<advanced.AuthCodeRecord | null>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const newClientId: () => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const randomBase64Url: (byteLen: number) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const sha256Base64Url: (input: string) => Promise<string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const verifyPkceS256: (verifier: string, challenge: string) => Promise<boolean>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const buildErrorRedirectUrl: (redirectUri: string, error: string, description: string, state: string, issuer?: string) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const advertisedScopes: (options: import("./types.js").OAuthRouterOptions) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const defaultScopes: (options: import("./types.js").OAuthRouterOptions) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const registeredClientsRequired: (options: import("./types.js").OAuthRouterOptions) => boolean;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const unregisteredClientsAllowed: (options: import("./types.js").OAuthRouterOptions) => boolean;
+//# sourceMappingURL=deprecated.d.ts.map

package/dist/oauth/deprecated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,sEAAsE;AACtE,eAAO,MAAM,cAAc,gFAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,6HAAgC,CAAC;AAClE,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,0DAA8B,CAAC;AAC9D,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,qFAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,0BAAmC,CAAC;AACxE,sEAAsE;AACtE,eAAO,MAAM,eAAe,gEAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,cAAc,2FAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,UAAU,2BAAsB,CAAC;AAC9C,sEAAsE;AACtE,eAAO,MAAM,eAAe,+CAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,WAAW,8BAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,aAAa,mGAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,eAAe;aAmBqzE,CAAC;SAA8B,CAAC;6CAnB1zE,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,WAAW,cAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,eAAe,6BAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,eAAe,oCAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,cAAc,2DAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,qGAAiC,CAAC;AACpE,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,gEAA4B,CAAC;AAC1D,sEAAsE;AACtE,eAAO,MAAM,aAAa,gEAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,+DAAqC,CAAC;AAC5E,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,+DAAsC,CAAC"}

package/dist/oauth/deprecated.js

@@ -0,0 +1,49 @@
+/**
+ * `mcp-trellis/oauth` aliases for symbols that moved to
+ * `mcp-trellis/advanced`. Declared as consts so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+import * as advanced from "../advanced.js";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const readClientAuth = advanced.readClientAuth;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const firstClientAuthError = advanced.firstClientAuthError;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const firstResourceError = advanced.firstResourceError;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const resourceErrorInfo = advanced.resourceErrorInfo;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const normalizeConfiguredPath = advanced.normalizeConfiguredPath;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const firstScopeError = advanced.firstScopeError;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const scopeErrorInfo = advanced.scopeErrorInfo;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const parseScope = advanced.parseScope;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const requestedScopes = advanced.requestedScopes;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const formatScope = advanced.formatScope;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const issueAuthCode = advanced.issueAuthCode;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const consumeAuthCode = advanced.consumeAuthCode;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const newClientId = advanced.newClientId;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const randomBase64Url = advanced.randomBase64Url;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const sha256Base64Url = advanced.sha256Base64Url;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const verifyPkceS256 = advanced.verifyPkceS256;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const buildErrorRedirectUrl = advanced.buildErrorRedirectUrl;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const advertisedScopes = advanced.advertisedScopes;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const defaultScopes = advanced.defaultScopes;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const registeredClientsRequired = advanced.registeredClientsRequired;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const unregisteredClientsAllowed = advanced.unregisteredClientsAllowed;
+//# sourceMappingURL=deprecated.js.map

package/dist/oauth/deprecated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC;AAClE,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;AAC9D,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;AACxE,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,0BAA0B,CAAC"}

package/dist/oauth/endpoints/authorize.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedOAuthRouterOptions } from "../types.js";
+export declare const handleAuthorize: (request: Request, options: ResolvedOAuthRouterOptions) => Promise<Response>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/oauth/endpoints/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAKV,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAiPrB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAuClB,CAAC"}

package/dist/oauth/endpoints/authorize.js

@@ -0,0 +1,209 @@
+import { GET_ONLY, requireHttpMethod } from "../../http/http.js";
+import { auditLegacyKeyUsage } from "../audit.js";
+import { cimdFetchOpts, isCimdClientId, resolveCimdClient } from "../cimd/cimd.js";
+import { advertisedScopes, defaultScopes, oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientError, } from "../config.js";
+import { OAUTH_ERRORS } from "../constants.js";
+import { issueAuthCode } from "../crypto/codes.js";
+import { unsealAny } from "../crypto/sealed.js";
+import { isAllowedRedirectUri } from "../policy/redirect.js";
+import { canonicalResource, resourceErrorInfo } from "../policy/resource.js";
+import { formatScope, requestedScopes, scopeErrorInfo } from "../policy/scope.js";
+import { codeRedirect, errorRedirect, secureRedirect } from "./callback.js";
+import { isPreApproved, issueConsentTicket, renderConsent } from "./consent.js";
+/** BASE64URL(SHA-256(verifier)) without padding is always exactly 43 characters. */
+const S256_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+/** Reflected into `Location` on denial — an unbounded `state` is a header-size DoS knob. */
+const MAX_STATE_LENGTH = 2048;
+/**
+ * A client bound to a known redirect-URI list — either pre-registered via
+ * `clientStore`, or a sealed assertion this server itself issued via
+ * `/register` (see `sealed.ts`). Unbound clients fall back to the global
+ * allowlist, unless `requireRegisteredClients` forbids that entirely.
+ */
+const redirectAllowed = (redirectUri, boundRedirectUris, allowlist) => {
+    if (!redirectUri)
+        return false;
+    if (boundRedirectUris)
+        return boundRedirectUris.includes(redirectUri);
+    return isAllowedRedirectUri(redirectUri, allowlist);
+};
+const redirectToLogin = (request, url, options) => {
+    const next = `${url.pathname}${url.search}`;
+    const login = options.ports.loginUrl(request, next);
+    let loginTarget;
+    try {
+        loginTarget = new URL(login, url.origin);
+    }
+    catch {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
+    }
+    if (loginTarget.protocol !== "http:" && loginTarget.protocol !== "https:") {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
+    }
+    return secureRedirect(loginTarget.toString());
+};
+/**
+ * Resolves `client_id` against `clientStore`, this server's own sealed
+ * `/register` assertions, and (when enabled) CIMD — in that order — and
+ * rejects when none recognize it and the config requires one to. A sealed
+ * assertion binds its own `redirectUris` like a pre-registered client,
+ * without ever touching storage.
+ */
+const resolveAuthorizeClient = async (options, clientId, secrets) => {
+    const registered = (await options.ports.clientStore?.get(clientId)) ?? null;
+    const assertion = registered ? null : await unsealClientAssertion(options, clientId, secrets);
+    const isCimdId = options.cimd === true && isCimdClientId(clientId);
+    const cimdDoc = !registered && !assertion && isCimdId
+        ? await resolveCimdClient(clientId, cimdFetchOpts(options))
+        : null;
+    if (!registered && !assertion && !cimdDoc) {
+        const unknown = unknownClientError(options, isCimdId);
+        if (unknown)
+            return unknown;
+    }
+    return {
+        registered,
+        boundRedirectUris: registered?.redirectUris ?? assertion?.redirectUris ?? cimdDoc?.redirect_uris ?? null,
+    };
+};
+/** This server's own `/register` assertion for `clientId`, auditing a legacy-key unseal. */
+const unsealClientAssertion = async (options, clientId, secrets) => {
+    const unsealed = await unsealAny(secrets, "client", clientId);
+    await auditLegacyKeyUsage(options, {
+        clientId,
+        keyIndex: unsealed?.keyIndex,
+        source: "client assertion unsealed",
+    });
+    return unsealed?.value ?? null;
+};
+/** The rejection for a `client_id` nothing resolved, or null when the config admits it. */
+const unknownClientError = (options, isCimdId) => {
+    const unregistered = unregisteredClientError(options, {
+        code: OAUTH_ERRORS.unauthorizedClient,
+        status: 400,
+    });
+    if (unregistered)
+        return unregistered;
+    if (isCimdId) {
+        return oauthError(OAUTH_ERRORS.unauthorizedClient, 400, "CIMD client_id could not be resolved");
+    }
+    if (!registeredClientsRequired(options))
+        return null;
+    return oauthError(OAUTH_ERRORS.unauthorizedClient, 400, "client_id must come from clientStore or this server's own /register");
+};
+/**
+ * Pre-trust tier: `redirect_uri` is not yet verified as belonging to a
+ * legitimate party, so these two stay direct JSON responses. Redirecting
+ * here is exactly the open-redirect risk RFC 6749 §4.1.2.1 exists to
+ * avoid — the URI itself is what's in question. An oversized `state` is
+ * included in this tier too, for a narrower reason: reflecting it back
+ * into the error redirect it would otherwise trigger recreates the
+ * header-size DoS the cap exists to prevent, on the one input the cap
+ * can't safely echo.
+ */
+const firstPreTrustError = (callback, boundRedirectUris, options) => {
+    if (!redirectAllowed(callback.redirectUri, boundRedirectUris, options.redirect)) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "invalid redirect_uri");
+    }
+    if (callback.state.length > MAX_STATE_LENGTH) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, `state must be at most ${MAX_STATE_LENGTH} characters`);
+    }
+    return null;
+};
+/**
+ * Post-trust tier: `redirect_uri` is now trusted, so every remaining error
+ * goes back to the client's own callback per RFC 6749 §4.1.2.1 instead of a
+ * bare JSON body the connector never parses.
+ */
+const firstPostTrustError = ({ url, callback, expectedResource }, options) => {
+    const redirectError = (code, description) => errorRedirect(callback, code, description);
+    const responseType = url.searchParams.get("response_type") ?? "";
+    if (responseType !== "code") {
+        return redirectError(OAUTH_ERRORS.unsupportedResponseType, "response_type must be code");
+    }
+    const codeChallenge = url.searchParams.get("code_challenge") ?? "";
+    // RFC 7636 defaults an absent method to `plain`; this AS only supports
+    // S256, so an absent method is read as S256 for client compatibility —
+    // a plain-style challenge then fails the shape check below anyway.
+    const challengeMethod = url.searchParams.get("code_challenge_method") ?? "S256";
+    if (!codeChallenge || challengeMethod !== "S256") {
+        return redirectError(OAUTH_ERRORS.invalidRequest, "PKCE S256 code_challenge required");
+    }
+    if (!S256_CHALLENGE.test(codeChallenge)) {
+        return redirectError(OAUTH_ERRORS.invalidRequest, "code_challenge must be a base64url SHA-256 digest (43 characters)");
+    }
+    const resourceIssue = resourceErrorInfo(url.searchParams.get("resource") ?? "", expectedResource);
+    if (resourceIssue)
+        return redirectError(resourceIssue.code, resourceIssue.description);
+    const advertised = advertisedScopes(options);
+    const granted = requestedScopes(url.searchParams.get("scope") ?? "", defaultScopes(options));
+    const scopeIssue = scopeErrorInfo(granted, advertised);
+    if (scopeIssue)
+        return redirectError(scopeIssue.code, scopeIssue.description);
+    return { codeChallenge, granted };
+};
+/** Pre-approved clients skip straight to a code; everyone else gets a consent ticket. */
+const issueAuthorizeOutcome = async (options, secrets, { context, clientId, registered, user, codeChallenge, granted }) => {
+    const { callback, expectedResource } = context;
+    const grant = {
+        clientId,
+        redirectUri: callback.redirectUri,
+        codeChallenge,
+        userId: user.id,
+        resource: expectedResource,
+        scope: formatScope(granted),
+    };
+    if (isPreApproved(options, clientId, registered)) {
+        return codeRedirect(callback, await issueAuthCode(secrets[0], grant));
+    }
+    const ticket = await issueConsentTicket(secrets[0], { ...grant, state: callback.state });
+    return renderConsent(options, {
+        clientId,
+        registeredClient: registered,
+        redirectUri: callback.redirectUri,
+        scope: granted,
+        resource: expectedResource,
+        user,
+        ticket,
+        oauthPath: options.oauthPath,
+    });
+};
+export const handleAuthorize = async (request, options) => {
+    const methodError = requireHttpMethod(request, GET_ONLY);
+    if (methodError)
+        return methodError;
+    const url = new URL(request.url);
+    const expectedResource = canonicalResource(url.origin, options.resourcePath);
+    const clientId = url.searchParams.get("client_id") ?? "";
+    if (!clientId) {
+        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
+    }
+    const secrets = await resolveSecrets(options.ports, request);
+    const clientResolution = await resolveAuthorizeClient(options, clientId, secrets);
+    if (clientResolution instanceof Response)
+        return clientResolution;
+    const { registered, boundRedirectUris } = clientResolution;
+    const callback = {
+        redirectUri: url.searchParams.get("redirect_uri") ?? "",
+        state: url.searchParams.get("state") ?? "",
+        issuer: url.origin,
+    };
+    const preTrustError = firstPreTrustError(callback, boundRedirectUris, options);
+    if (preTrustError)
+        return preTrustError;
+    const context = { url, callback, expectedResource };
+    const validated = firstPostTrustError(context, options);
+    if (validated instanceof Response)
+        return validated;
+    const user = await options.ports.resolveUser(request);
+    if (!user)
+        return redirectToLogin(request, url, options);
+    return issueAuthorizeOutcome(options, secrets, {
+        ...validated,
+        context,
+        clientId,
+        registered,
+        user,
+    });
+};
+//# sourceMappingURL=authorize.js.map

package/dist/oauth/endpoints/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAiC,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQlF,OAAO,EAAiB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhF,oFAAoF;AACpF,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,iBAAkC,EAClC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAQ,EAAE,OAA2B,EAAY,EAAE;IAC5F,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC;AAOF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACF,EAAE;IACvC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,OAAO,GACX,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,QAAQ;QACnC,CAAC,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,UAAU;QACV,iBAAiB,EACf,UAAU,EAAE,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;KACxF,CAAC;AACJ,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACN,EAAE;IACnC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,MAAM,EAAE,2BAA2B;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;AACjC,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,CAAC,OAA2B,EAAE,QAAiB,EAAmB,EAAE;IAC7F,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;QACrC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CACzB,QAAkB,EAClB,iBAAkC,EAClC,OAA2B,EACV,EAAE;IACnB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,yBAAyB,gBAAgB,aAAa,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAcF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAC1B,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAoB,EACrD,OAA2B,EACW,EAAE;IACxC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAY,EAAE,CACpE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,YAAY,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,aAAa,CAClB,YAAY,CAAC,cAAc,EAC3B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClG,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEvF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC;AAUF,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAAmC,EACnC,OAAuC,EACvC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAyB,EACnE,EAAE;IACrB,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;KAC5B,CAAC;IAEF,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,aAAa,CAAC,OAAO,EAAE;QAC5B,QAAQ;QACR,gBAAgB,EAAE,UAAU;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,gBAAgB;QAC1B,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClF,IAAI,gBAAgB,YAAY,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC;IAE3D,MAAM,QAAQ,GAAa;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACvD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC/E,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,SAAS,YAAY,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzD,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QAC7C,GAAG,SAAS;QACZ,OAAO;QACP,QAAQ;QACR,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/endpoints/callback.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Responses that send the user agent back to the client's own, already
+ * validated `redirect_uri` — the code on success, the error otherwise
+ * (RFC 6749 §4.1.2 / §4.1.2.1), with `iss` per RFC 9207.
+ */
+/** The validated client callback one authorize/consent round trip returns to. */
+export type Callback = {
+    redirectUri: string;
+    state: string;
+    issuer: string;
+};
+export declare const secureRedirect: (location: string) => Response;
+export declare const codeRedirect: (callback: Callback, code: string) => Response;
+export declare const errorRedirect: (callback: Callback, error: string, description?: string) => Response;
+/**
+ * URL form of `errorRedirect`, for hosts composing their own authorize flow
+ * (`mcp-trellis/advanced`). `issuer`, when set, adds `iss` (RFC 9207).
+ */
+export declare const buildErrorRedirectUrl: (redirectUri: string, error: string, description: string, state: string, issuer?: string) => string;
+//# sourceMappingURL=callback.d.ts.map

package/dist/oauth/endpoints/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/callback.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,iFAAiF;AACjF,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,QAQ9C,CAAC;AAeL,eAAO,MAAM,YAAY,GAAI,UAAU,QAAQ,EAAE,MAAM,MAAM,KAAG,QACf,CAAC;AAElD,eAAO,MAAM,aAAa,GAAI,UAAU,QAAQ,EAAE,OAAO,MAAM,EAAE,oBAAgB,KAAG,QACF,CAAC;AAEnF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAChC,aAAa,MAAM,EACnB,OAAO,MAAM,EACb,aAAa,MAAM,EACnB,OAAO,MAAM,EACb,SAAS,MAAM,KACd,MAAgG,CAAC"}

package/dist/oauth/endpoints/callback.js

@@ -0,0 +1,31 @@
+/**
+ * Responses that send the user agent back to the client's own, already
+ * validated `redirect_uri` — the code on success, the error otherwise
+ * (RFC 6749 §4.1.2 / §4.1.2.1), with `iss` per RFC 9207.
+ */
+export const secureRedirect = (location) => new Response(null, {
+    status: 302,
+    headers: {
+        Location: location,
+        "Referrer-Policy": "no-referrer",
+        "Cache-Control": "no-store",
+    },
+});
+/** Empty values are omitted, and `state` / `iss` always come last. */
+const callbackUrl = (callback, params) => {
+    const target = new URL(callback.redirectUri);
+    const entries = [...Object.entries(params), ["state", callback.state], ["iss", callback.issuer]];
+    for (const [key, value] of entries) {
+        if (key && value)
+            target.searchParams.set(key, value);
+    }
+    return target.toString();
+};
+export const codeRedirect = (callback, code) => secureRedirect(callbackUrl(callback, { code }));
+export const errorRedirect = (callback, error, description = "") => secureRedirect(callbackUrl(callback, { error, error_description: description }));
+/**
+ * URL form of `errorRedirect`, for hosts composing their own authorize flow
+ * (`mcp-trellis/advanced`). `issuer`, when set, adds `iss` (RFC 9207).
+ */
+export const buildErrorRedirectUrl = (redirectUri, error, description, state, issuer) => callbackUrl({ redirectUri, state, issuer }, { error, error_description: description });
+//# sourceMappingURL=callback.js.map

package/dist/oauth/endpoints/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/callback.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAY,EAAE,CAC3D,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ;QAClB,iBAAiB,EAAE,aAAa;QAChC,eAAe,EAAE,UAAU;KAC5B;CACF,CAAC,CAAC;AAEL,sEAAsE;AACtE,MAAM,WAAW,GAAG,CAClB,QAA6E,EAC7E,MAA8B,EACtB,EAAE;IACV,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,IAAI,KAAK;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAkB,EAAE,IAAY,EAAY,EAAE,CACzE,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAE,KAAa,EAAE,WAAW,GAAG,EAAE,EAAY,EAAE,CAC7F,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAEnF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,WAAmB,EACnB,KAAa,EACb,WAAmB,EACnB,KAAa,EACb,MAAe,EACP,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC"}

package/dist/oauth/endpoints/consent-page.d.ts

@@ -0,0 +1,5 @@
+/** The built-in consent interstitial, used when the host supplies no `consent.render`. */
+import type { ConsentRequest } from "../types.js";
+/** Built-in hardened interstitial — used whenever the host doesn't supply `consent.render`. */
+export declare const renderBuiltInConsent: (input: ConsentRequest) => Response;
+//# sourceMappingURL=consent-page.d.ts.map

package/dist/oauth/endpoints/consent-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-page.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent-page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA+BlD,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,GAAI,OAAO,cAAc,KAAG,QAmC5D,CAAC"}