mcp-trellis 1.0.0 → 2.2.0

package/dist/dispatch.js

@@ -1,119 +0,0 @@
-import { rejectQueryToken } from "./auth/bearer.js";
-import { BodyTooLargeError, DEFAULT_MCP_BODY_LIMIT, readBoundedText } from "./body.js";
-import { emptyResponse, INTERNAL_ERROR, jsonResponse, methodNotAllowed, optionsResponse, } from "./http.js";
-import { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_PARSE_ERROR, JSONRPC_PAYLOAD_TOO_LARGE, rpcError, } from "./jsonrpc.js";
-import { DEFAULT_PUBLIC_METHODS, dispatchRpc, isNotification, resolveWww, safeAudit, unauthorized, } from "./methods.js";
-import { PROTOCOL_VERSIONS } from "./protocol.js";
-const parseBody = async (request) => {
-    let text;
-    try {
-        text = await readBoundedText(request, DEFAULT_MCP_BODY_LIMIT);
-    }
-    catch (exc) {
-        if (exc instanceof BodyTooLargeError) {
-            return jsonResponse(rpcError(null, JSONRPC_PAYLOAD_TOO_LARGE, "Payload too large"), 413);
-        }
-        return jsonResponse(rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), 400);
-    }
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return jsonResponse(rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), 400);
-    }
-};
-/** Transport-level denial: no JSON-RPC method has been parsed yet. */
-const auditDenial = (options, error, startedAt) => safeAudit(options, { method: "", ok: false, error, durationMs: Date.now() - startedAt });
-const guardPost = async (request, options, startedAt) => {
-    if (rejectQueryToken(new URL(request.url))) {
-        await auditDenial(options, "query_string_token", startedAt);
-        return unauthorized(resolveWww(options, request), "Token in query string is rejected. Use Authorization Bearer.");
-    }
-    return null;
-};
-const handleGet = async (request, options, startedAt) => {
-    if (rejectQueryToken(new URL(request.url))) {
-        await auditDenial(options, "query_string_token", startedAt);
-        return jsonResponse({
-            error: "Pass token via Authorization: Bearer header, not query string",
-        }, 400);
-    }
-    if (!request.headers.get("authorization")) {
-        await auditDenial(options, "unauthorized", startedAt);
-        return unauthorized(resolveWww(options, request));
-    }
-    return methodNotAllowed("Use POST for MCP");
-};
-/**
- * RFC-shaped JSON-RPC id extraction for an error response before
- * `dispatchRpc`'s own normalization runs — `undefined` (omitted, as on a
- * notification) becomes `null`; anything else is echoed as-is, matching
- * `dispatchRpc`'s rule so a client sees the same id either way.
- */
-const errorId = (msg) => (msg.id === undefined ? null : msg.id);
-/**
- * The 2025-06-18 spec requires `MCP-Protocol-Version` on every request past
- * `initialize` (which is what negotiates it in the first place — the
- * client can't have the header yet). Unknown/unsupported → 400. Missing →
- * assume `2025-03-26` per the spec's own backwards-compatibility rule for
- * the header specifically (not the same default `initialize` falls back
- * to — see `protocol.ts`).
- */
-const protocolVersionHeaderError = (request, msg) => {
-    if (msg.method === "initialize")
-        return null;
-    const header = request.headers.get("MCP-Protocol-Version");
-    if (!header || PROTOCOL_VERSIONS.has(header))
-        return null;
-    return jsonResponse(rpcError(errorId(msg), JSONRPC_INVALID_REQUEST, `Unsupported MCP-Protocol-Version: ${header}`), 400);
-};
-const handlePost = async (request, options, publicMethods, startedAt) => {
-    const denied = await guardPost(request, options, startedAt);
-    if (denied)
-        return denied;
-    const parsed = await parseBody(request);
-    if (parsed instanceof Response)
-        return parsed;
-    if (Array.isArray(parsed)) {
-        return jsonResponse(rpcError(null, JSONRPC_INVALID_REQUEST, "Batch requests not supported"), 400);
-    }
-    if (!parsed || typeof parsed !== "object") {
-        return jsonResponse(rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), 400);
-    }
-    const msg = parsed;
-    if (msg.jsonrpc !== "2.0") {
-        return jsonResponse(rpcError(errorId(msg), JSONRPC_INVALID_REQUEST, 'jsonrpc must be "2.0"'), 400);
-    }
-    const versionError = protocolVersionHeaderError(request, msg);
-    if (versionError)
-        return versionError;
-    if (isNotification(msg))
-        return emptyResponse(202);
-    return dispatchRpc({ req: request, body: msg, options, publicMethods, startedAt });
-};
-export const createMcpHandler = (options) => {
-    const publicMethods = options.publicMethods ?? DEFAULT_PUBLIC_METHODS;
-    const HTTP_METHODS = {
-        OPTIONS: () => optionsResponse(),
-        GET: (request, startedAt) => handleGet(request, options, startedAt),
-        POST: (request, startedAt) => handlePost(request, options, publicMethods, startedAt),
-    };
-    return {
-        fetch: async (request) => {
-            const startedAt = Date.now();
-            try {
-                const handler = HTTP_METHODS[request.method];
-                return await (handler ? handler(request, startedAt) : methodNotAllowed());
-            }
-            catch (exc) {
-                // A host port (authenticate/context/audit) threw. `fetch` must never
-                // reject — the caller gets an honest 500, not an unhandled rejection
-                // whose shape depends on which runtime is hosting this.
-                const error = exc instanceof Error && exc.message ? exc.message : INTERNAL_ERROR;
-                await auditDenial(options, error, startedAt);
-                return jsonResponse(rpcError(null, JSONRPC_INTERNAL_ERROR, "Internal error"), 500);
-            }
-        },
-    };
-};
-//# sourceMappingURL=dispatch.js.map

package/dist/dispatch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EAGzB,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,cAAc,EAEd,UAAU,EACV,SAAS,EACT,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAclD,MAAM,SAAS,GAAG,KAAK,EAAE,OAAgB,EAA+B,EAAE;IACxE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,GAAG,CAClB,OAAgC,EAChC,KAAa,EACb,SAAiB,EACF,EAAE,CACjB,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAE3F,MAAM,SAAS,GAAG,KAAK,EACrB,OAAgB,EAChB,OAAgC,EAChC,SAAiB,EACS,EAAE;IAC5B,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,YAAY,CACjB,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,EACrB,OAAgB,EAChB,OAAgC,EAChC,SAAiB,EACE,EAAE;IACrB,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,YAAY,CACjB;YACE,KAAK,EAAE,+DAA+D;SACvE,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAa,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,CAAC,OAAgB,EAAE,GAAmB,EAAmB,EAAE;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,YAAY,CACjB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,uBAAuB,EAAE,qCAAqC,MAAM,EAAE,CAAC,EAC9F,GAAG,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EACtB,OAAgB,EAChB,OAAgC,EAChC,aAA0B,EAC1B,SAAiB,EACE,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE,8BAA8B,CAAC,EACvE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,GAAG,GAAG,MAAwB,CAAC;IACrC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,YAAY,CACjB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,EACxE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAO,OAAgC,EAAc,EAAE;IACrF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAEtE,MAAM,YAAY,GAAiC;QACjD,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;QAChC,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QACnE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC;KACrF,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;gBACjF,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC7C,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/http.d.ts

@@ -1,17 +0,0 @@
-/** JSON `error` body / audit reason when a host port throws. */
-export declare const INTERNAL_ERROR = "internal_error";
-export declare const corsHeaders: (extra?: Record<string, string>) => Record<string, string>;
-export type JsonResponseOptions = {
-    /** Include permissive CORS headers. Default true (MCP). OAuth token set false. */
-    cors?: boolean;
-};
-export declare const jsonResponse: (data: unknown, status?: number, extraHeaders?: Record<string, string>, options?: JsonResponseOptions) => Response;
-export declare const emptyResponse: (status: number) => Response;
-export declare const optionsResponse: (options?: JsonResponseOptions) => Response;
-export declare const methodNotAllowed: (message?: string, options?: JsonResponseOptions) => Response;
-/**
- * OPTIONS → 204; allowed verb → null (continue); otherwise → 405.
- * Shared by OAuth handlers that all need the same method gate.
- */
-export declare const requireHttpMethod: (request: Request, allowed: ReadonlySet<string>, options?: JsonResponseOptions) => Response | null;
-//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAKhF,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,YAAY,GACvB,MAAM,OAAO,EACb,eAAY,EACZ,eAAe,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,UAAU,mBAAmB,KAC5B,QAWF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,QACS,CAAC;AAEzD,eAAO,MAAM,eAAe,GAAI,UAAU,mBAAmB,KAAG,QAI5D,CAAC;AAEL,eAAO,MAAM,gBAAgB,GAC3B,gBAA8B,EAC9B,UAAU,mBAAmB,KAC5B,QAAqE,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,SAAS,WAAW,CAAC,MAAM,CAAC,EAC5B,UAAU,mBAAmB,KAC5B,QAAQ,GAAG,IAIb,CAAC"}

package/dist/http.js

@@ -1,38 +0,0 @@
-/** JSON `error` body / audit reason when a host port throws. */
-export const INTERNAL_ERROR = "internal_error";
-export const corsHeaders = (extra) => ({
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
-    ...extra,
-});
-export const jsonResponse = (data, status = 200, extraHeaders, options) => {
-    const cors = options?.cors !== false;
-    return new Response(JSON.stringify(data), {
-        status,
-        headers: {
-            "Content-Type": "application/json",
-            "Cache-Control": "no-store",
-            ...(cors ? corsHeaders() : {}),
-            ...extraHeaders,
-        },
-    });
-};
-export const emptyResponse = (status) => new Response(null, { status, headers: corsHeaders() });
-export const optionsResponse = (options) => new Response(null, {
-    status: 204,
-    headers: options?.cors === false ? { "Cache-Control": "no-store" } : corsHeaders(),
-});
-export const methodNotAllowed = (message = "Method not allowed", options) => jsonResponse({ error: message }, 405, undefined, options);
-/**
- * OPTIONS → 204; allowed verb → null (continue); otherwise → 405.
- * Shared by OAuth handlers that all need the same method gate.
- */
-export const requireHttpMethod = (request, allowed, options) => {
-    if (request.method === "OPTIONS")
-        return optionsResponse(options);
-    if (allowed.has(request.method))
-        return null;
-    return jsonResponse({ detail: "method not allowed" }, 405, undefined, options);
-};
-//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAA8B,EAA0B,EAAE,CAAC,CAAC;IACtF,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;IACnF,GAAG,KAAK;CACT,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,IAAa,EACb,MAAM,GAAG,GAAG,EACZ,YAAqC,EACrC,OAA6B,EACnB,EAAE;IACZ,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,YAAY;SAChB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAY,EAAE,CACxD,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA6B,EAAY,EAAE,CACzE,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;CACnF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAO,GAAG,oBAAoB,EAC9B,OAA6B,EACnB,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAAgB,EAChB,OAA4B,EAC5B,OAA6B,EACZ,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACjF,CAAC,CAAC"}

package/dist/jsonrpc.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAE9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAC1C,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAC/C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAC3C,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAEhD,eAAO,MAAM,SAAS,GAAI,IAAI,SAAS,EAAE,QAAQ,OAAO,KAAG,cAIzD,CAAC;AAEH,eAAO,MAAM,QAAQ,GAAI,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,cAItE,CAAC"}

package/dist/jsonrpc.js

@@ -1,18 +0,0 @@
-export const JSONRPC_PARSE_ERROR = -32700;
-export const JSONRPC_INVALID_REQUEST = -32600;
-export const JSONRPC_METHOD_NOT_FOUND = -32601;
-export const JSONRPC_INVALID_PARAMS = -32602;
-export const JSONRPC_INTERNAL_ERROR = -32603;
-export const JSONRPC_UNAUTHORIZED = -32001;
-export const JSONRPC_PAYLOAD_TOO_LARGE = -32002;
-export const rpcResult = (id, result) => ({
-    jsonrpc: "2.0",
-    id,
-    result,
-});
-export const rpcError = (id, code, message) => ({
-    jsonrpc: "2.0",
-    id,
-    error: { code, message },
-});
-//# sourceMappingURL=jsonrpc.js.map

package/dist/jsonrpc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,CAAC;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,MAAe,EAAkB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAa,EAAE,IAAY,EAAE,OAAe,EAAkB,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC"}

package/dist/methods.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,kBAAkB,CAAC;AAEtF,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC9C,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAAG;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,IAAI,IAAI;IAC3B,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzF,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,IAAI,IAAI;IACpC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,sBAAsB,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,sBAAsB,CAAC,CAAC;IACrF,2EAA2E;IAC3E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAIF,eAAO,MAAM,sBAAsB,aAKjC,CAAC;AAQH,eAAO,MAAM,cAAc,GAAI,MAAM,cAAc,KAAG,OACQ,CAAC;AAE/D,eAAO,MAAM,UAAU,GAAI,IAAI,EAC7B,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,KAAK,OAAO,KACX,sBAG0B,CAAC;AAE9B;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,sBAAsB,EAC3B,gBAAwB,EACxB,KAAI,SAAgB,KACnB,QAGC,CAAC;AAEL;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAU,IAAI,EAClC,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,OAAO,UAAU,KAChB,OAAO,CAAC,IAAI,CAcd,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,WAAW,SAAS,EAAE,OAAO,MAAM,GAAG,SAAS,KAAG,OAG1E,CAAC;AAiEF,eAAO,MAAM,WAAW,GAAU,IAAI,EAAE,OAAO;IAC7C,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,QAAQ,CAgCnB,CAAC"}

package/dist/methods.js

@@ -1,130 +0,0 @@
-import { wwwAuthenticateHeader } from "./auth/bearer.js";
-import { emptyResponse, jsonResponse } from "./http.js";
-import { JSONRPC_METHOD_NOT_FOUND, JSONRPC_UNAUTHORIZED, rpcError, rpcResult, } from "./jsonrpc.js";
-import { pickProtocolVersion } from "./protocol.js";
-const DEFAULT_AUDIT_TIMEOUT_MS = 1000;
-export const DEFAULT_PUBLIC_METHODS = new Set([
-    "initialize",
-    "ping",
-    "notifications/initialized",
-    "initialized",
-]);
-const NOTIFICATION_PREDICATES = [
-    (body) => typeof body.method === "string" && body.method.startsWith("notifications/"),
-    (body) => body.method === "initialized",
-    (body) => body.id === undefined && body.method === undefined && "result" in body,
-];
-export const isNotification = (body) => NOTIFICATION_PREDICATES.some((predicate) => predicate(body));
-export const resolveWww = (options, req) => typeof options.wwwAuthenticate === "function"
-    ? options.wwwAuthenticate(req)
-    : options.wwwAuthenticate;
-/**
- * `id` defaults to `null` for the transport-level call sites in
- * `dispatch.ts` — a body hasn't been parsed yet there, so there's no real
- * id to echo. Call sites past that point (inside `dispatchRpc` and the
- * method handlers) have one and must pass it, or a client correlating
- * responses by id sees `null` on every 401 regardless of what it sent.
- */
-export const unauthorized = (www, message = "Unauthorized", id = null) => jsonResponse(rpcError(id, JSONRPC_UNAUTHORIZED, message), 401, {
-    "WWW-Authenticate": wwwAuthenticateHeader(www),
-});
-/**
- * Invoke the audit metrics hook, swallowing any failure and racing it
- * against `auditTimeoutMs` so a hanging sink can't stall the response
- * either — "can't fail a request" was already true; this adds "can't
- * delay one" past a bound. The audit call keeps running in the background
- * if the timer wins; its own `catch` below means it can never surface as
- * an unhandled rejection whenever it does finish.
- */
-export const safeAudit = async (options, entry) => {
-    const audit = options.ports.audit;
-    if (!audit)
-        return;
-    const settled = (async () => {
-        try {
-            await audit(entry);
-        }
-        catch {
-            // Intentionally ignored.
-        }
-    })();
-    const timeoutMs = options.auditTimeoutMs ?? DEFAULT_AUDIT_TIMEOUT_MS;
-    await Promise.race([settled, new Promise((resolve) => setTimeout(resolve, timeoutMs))]);
-};
-export const hasScope = (principal, scope) => {
-    if (!scope)
-        return true;
-    return principal.scopes.includes(scope) || principal.scopes.includes("*");
-};
-const METHODS = {
-    initialize: async ({ id, body, options }) => jsonResponse(rpcResult(id, {
-        protocolVersion: pickProtocolVersion(body.params),
-        capabilities: { tools: {} },
-        serverInfo: options.serverInfo,
-        instructions: options.instructions ?? "",
-    })),
-    ping: async ({ id }) => jsonResponse(rpcResult(id, {})),
-    "tools/list": async ({ id, options }) => jsonResponse(rpcResult(id, { tools: options.registry.list() })),
-    "tools/call": async ({ req, body, id, principal, ctx, options, startedAt }) => {
-        const params = body.params ?? {};
-        const name = String(params.name ?? "");
-        const rawArgs = params.arguments;
-        const args = rawArgs !== null && typeof rawArgs === "object" && !Array.isArray(rawArgs)
-            ? rawArgs
-            : {};
-        const tool = options.registry.get(name);
-        if (tool?.scope && (!principal || !hasScope(principal, tool.scope))) {
-            await safeAudit(options, {
-                method: "tools/call",
-                tool: name,
-                principalId: principal?.id,
-                ok: false,
-                error: "missing_scope",
-                durationMs: Date.now() - startedAt,
-            });
-            return unauthorized(resolveWww(options, req), `Missing scope: ${tool.scope}`, id);
-        }
-        const started = Date.now();
-        const result = await options.registry.call(name, ctx, args);
-        await safeAudit(options, {
-            method: "tools/call",
-            tool: name,
-            principalId: principal?.id,
-            ok: !result.isError,
-            error: result.isError ? result.content[0]?.text : undefined,
-            durationMs: Date.now() - started,
-        });
-        return jsonResponse(rpcResult(id, result));
-    },
-};
-export const dispatchRpc = async (input) => {
-    const { req, body, options, publicMethods, startedAt } = input;
-    const method = body.method ?? "";
-    // Notifications omit `id`; explicit null is a valid request id (JSON-RPC).
-    const id = body.id === undefined ? null : body.id;
-    const toolName = method === "tools/call" ? String(body.params?.name ?? "") : undefined;
-    const isPublic = publicMethods.has(method) || method.startsWith("notifications/");
-    let principal = null;
-    if (!isPublic) {
-        principal = await options.ports.authenticate(req, method, toolName);
-        if (!principal) {
-            await safeAudit(options, {
-                method,
-                tool: toolName,
-                ok: false,
-                error: "unauthorized",
-                durationMs: Date.now() - startedAt,
-            });
-            return unauthorized(resolveWww(options, req), undefined, id);
-        }
-    }
-    const handler = METHODS[method];
-    if (!handler) {
-        if (body.id === undefined)
-            return emptyResponse(202);
-        return jsonResponse(rpcError(body.id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${method}`));
-    }
-    const ctx = await options.ports.context(req, principal);
-    return handler({ req, body, id, principal, ctx, options, startedAt });
-};
-//# sourceMappingURL=methods.js.map

package/dist/methods.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"methods.js","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EAGpB,QAAQ,EACR,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AA2DpD,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,MAAM;IACN,2BAA2B;IAC3B,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAA6C;IACxE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACrF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,aAAa;IACvC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,IAAI,IAAI;CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAoB,EAAW,EAAE,CAC9D,uBAAuB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,OAAgC,EAChC,GAAY,EACY,EAAE,CAC1B,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU;IAC3C,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAA2B,EAC3B,OAAO,GAAG,cAAc,EACxB,KAAgB,IAAI,EACV,EAAE,CACZ,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE;IAC7D,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,CAAC;CAC/C,CAAC,CAAC;AAEL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAgC,EAChC,KAAiB,EACF,EAAE;IACjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IACrE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,SAAoB,EAAE,KAAyB,EAAW,EAAE;IACnF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC,CAAC;AAaF,MAAM,OAAO,GAAG;IACd,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,YAAY,CACV,SAAS,CAAC,EAAE,EAAE;QACZ,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QACjD,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;KACzC,CAAC,CACH;IAEH,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAEvD,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CACtC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEjE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,MAAM,IAAI,GACR,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxE,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,SAAS,EAAE,EAAE;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,CAAC,OAAO,EAAE;YACvB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,SAAS,EAAE,EAAE;YAC1B,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;YACnB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;YAC3D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACmD,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAQ,KAOvC,EAAqB,EAAE;IACtB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,2EAA2E;IAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAClF,IAAI,SAAS,GAAqB,IAAI,CAAC;IAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,cAAc;gBACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAI,OAAsD,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QACrD,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC"}

package/dist/oauth/authorize.d.ts

@@ -1,3 +0,0 @@
-import { type OAuthRouterOptions } from "./types.js";
-export declare const handleAuthorize: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
-//# sourceMappingURL=authorize.d.ts.map

package/dist/oauth/authorize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAeA,OAAO,EAIL,KAAK,kBAAkB,EAKxB,MAAM,YAAY,CAAC;AA6CpB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CAqHlB,CAAC"}

package/dist/oauth/authorize.js

@@ -1,141 +0,0 @@
-import { requireHttpMethod } from "../http.js";
-import { issueAuthCode } from "./codes.js";
-import { buildCodeRedirectUrl, buildErrorRedirectUrl, isPreApproved, issueConsentTicket, renderConsent, secureRedirect, } from "./consent.js";
-import { OAUTH_ERRORS } from "./constants.js";
-import { isAllowedRedirectUri } from "./redirect.js";
-import { canonicalResource, resourceErrorInfo } from "./resource.js";
-import { formatScope, requestedScopes, scopeErrorInfo } from "./scope.js";
-import { unseal } from "./sealed.js";
-import { advertisedScopes, defaultScopes, oauthError, registeredClientsRequired, resolveSecret, unregisteredClientError, } from "./types.js";
-const GET_ONLY = new Set(["GET"]);
-/** Reflected into `Location` on denial — an unbounded `state` is a header-size DoS knob. */
-const MAX_STATE_LENGTH = 2048;
-/**
- * A client bound to a known redirect-URI list — either pre-registered via
- * `clientStore`, or a sealed assertion this server itself issued via
- * `/register` (see `sealed.ts`). Unbound clients fall back to the global
- * allowlist, unless `requireRegisteredClients` forbids that entirely.
- */
-const redirectAllowed = (redirectUri, boundRedirectUris, allowlist) => {
-    if (!redirectUri)
-        return false;
-    if (boundRedirectUris)
-        return boundRedirectUris.includes(redirectUri);
-    return isAllowedRedirectUri(redirectUri, allowlist);
-};
-const redirectToLogin = (request, url, options) => {
-    const next = `${url.pathname}${url.search}`;
-    const login = options.ports.loginUrl(request, next);
-    let loginTarget;
-    try {
-        loginTarget = new URL(login, url.origin);
-    }
-    catch {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
-    }
-    if (loginTarget.protocol !== "http:" && loginTarget.protocol !== "https:") {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 500, "loginUrl must be absolute or same-origin relative");
-    }
-    return secureRedirect(loginTarget.toString());
-};
-export const handleAuthorize = async (request, options) => {
-    const methodError = requireHttpMethod(request, GET_ONLY);
-    if (methodError)
-        return methodError;
-    const url = new URL(request.url);
-    const expectedResource = canonicalResource(url.origin, options.resourcePath);
-    const clientId = url.searchParams.get("client_id") ?? "";
-    if (!clientId) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "client_id required");
-    }
-    const registered = (await options.ports.clientStore?.get(clientId)) ?? null;
-    const secret = await resolveSecret(options.ports, request);
-    // Additive: a `client_id` this server itself sealed via `/register` is
-    // bound to its own redirect_uris exactly like a pre-registered client,
-    // without ever being written to storage. Non-sealed ids unseal to null
-    // and keep today's behavior.
-    const assertion = registered ? null : await unseal(secret, "client", clientId);
-    if (!registered && !assertion) {
-        const unregistered = unregisteredClientError(options, {
-            code: OAUTH_ERRORS.unauthorizedClient,
-            status: 400,
-        });
-        if (unregistered)
-            return unregistered;
-        if (registeredClientsRequired(options)) {
-            return oauthError(OAUTH_ERRORS.unauthorizedClient, 400, "client_id must come from clientStore or this server's own /register");
-        }
-    }
-    const boundRedirectUris = registered?.redirectUris ?? assertion?.redirectUris ?? null;
-    const redirectUri = url.searchParams.get("redirect_uri") ?? "";
-    const state = url.searchParams.get("state") ?? "";
-    // --- Pre-trust tier: redirect_uri is not yet verified as belonging to a
-    // legitimate party, so these two stay direct JSON responses. Redirecting
-    // here is exactly the open-redirect risk RFC 6749 §4.1.2.1 exists to
-    // avoid — the URI itself is what's in question. An oversized `state` is
-    // included in this tier too, for a narrower reason: reflecting it back
-    // into the error redirect it would otherwise trigger recreates the
-    // header-size DoS the cap exists to prevent, on the one input the cap
-    // can't safely echo.
-    if (!redirectAllowed(redirectUri, boundRedirectUris, options.redirect)) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "invalid redirect_uri");
-    }
-    if (state.length > MAX_STATE_LENGTH) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, `state must be at most ${MAX_STATE_LENGTH} characters`);
-    }
-    // --- Post-trust tier: redirect_uri is now trusted, so every remaining
-    // error goes back to the client's own callback per RFC 6749 §4.1.2.1
-    // instead of a bare JSON body the connector never parses.
-    const redirectError = (code, description) => secureRedirect(buildErrorRedirectUrl(redirectUri, code, description, state));
-    const responseType = url.searchParams.get("response_type") ?? "";
-    if (responseType !== "code") {
-        return redirectError(OAUTH_ERRORS.unsupportedResponseType, "response_type must be code");
-    }
-    const codeChallenge = url.searchParams.get("code_challenge") ?? "";
-    const challengeMethod = url.searchParams.get("code_challenge_method") ?? "S256";
-    if (!codeChallenge || challengeMethod !== "S256") {
-        return redirectError(OAUTH_ERRORS.invalidRequest, "PKCE S256 code_challenge required");
-    }
-    const resourceIssue = resourceErrorInfo(url.searchParams.get("resource") ?? "", expectedResource);
-    if (resourceIssue)
-        return redirectError(resourceIssue.code, resourceIssue.description);
-    const advertised = advertisedScopes(options);
-    const granted = requestedScopes(url.searchParams.get("scope") ?? "", defaultScopes(options));
-    const scopeIssue = scopeErrorInfo(granted, advertised);
-    if (scopeIssue)
-        return redirectError(scopeIssue.code, scopeIssue.description);
-    const user = await options.ports.resolveUser(request);
-    if (!user)
-        return redirectToLogin(request, url, options);
-    if (isPreApproved(options, clientId, registered)) {
-        const code = await issueAuthCode(secret, {
-            clientId,
-            redirectUri,
-            codeChallenge,
-            userId: user.id,
-            resource: expectedResource,
-            scope: formatScope(granted),
-        });
-        return secureRedirect(buildCodeRedirectUrl(redirectUri, code, state));
-    }
-    const ticket = await issueConsentTicket(secret, {
-        clientId,
-        redirectUri,
-        codeChallenge,
-        userId: user.id,
-        resource: expectedResource,
-        scope: formatScope(granted),
-        state,
-    });
-    return renderConsent(options, {
-        clientId,
-        registeredClient: registered,
-        redirectUri,
-        scope: granted,
-        resource: expectedResource,
-        user,
-        ticket,
-        oauthPath: options.oauthPath ?? "/mcp/oauth",
-    });
-};
-//# sourceMappingURL=authorize.js.map

package/dist/oauth/authorize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAiC,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,gBAAgB,EAEhB,aAAa,EAEb,UAAU,EACV,yBAAyB,EACzB,aAAa,EACb,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAClC,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,iBAAkC,EAClC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAQ,EAAE,OAA2B,EAAY,EAAE;IAC5F,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAkB,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEhG,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;YACrC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,UAAU,EAAE,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC;IACtF,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAElD,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,qBAAqB;IACrB,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,yBAAyB,gBAAgB,aAAa,CACvD,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAY,EAAE,CACpE,cAAc,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IAE/E,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,YAAY,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClG,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEvF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzD,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;YACvC,QAAQ;YACR,WAAW;YACX,aAAa;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,gBAAgB;YAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE;QAC9C,QAAQ;QACR,WAAW;QACX,aAAa;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;QAC3B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,OAAO,EAAE;QAC5B,QAAQ;QACR,gBAAgB,EAAE,UAAU;QAC5B,WAAW;QACX,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,gBAAgB;QAC1B,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,YAAY;KAC7C,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/base64url.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/oauth/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,eAAO,MAAM,gBAAgB,GAAI,OAAO,WAAW,GAAG,UAAU,KAAG,MAIlE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,MACG,CAAC;AAEnD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,UAAU,CAAC,WAAW,CAKlE,CAAC"}

package/dist/oauth/base64url.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/oauth/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAA+B,EAAU,EAAE;IAC1E,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CACtD,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAA2B,EAAE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC"}

package/dist/oauth/clientauth.d.ts

@@ -1,24 +0,0 @@
-/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
-import { type TokenEndpointAuthMethod } from "./constants.js";
-import { type OAuthRouterOptions } from "./types.js";
-export type ClientAuth = {
-    clientId: string;
-    secret: string | null;
-    method: TokenEndpointAuthMethod;
-};
-/** Credentials from the Authorization header, else from the body. */
-export declare const readClientAuth: (request: Request, body: Record<string, string>) => ClientAuth | null;
-/**
- * Enforce the registered auth method for known clients.
- *
- * An unknown client_id is treated as public — PKCE is its only proof —
- * unless `allowUnregisteredClients` is false, in which case it is rejected
- * rather than silently falling back to "no auth required". On that
- * locked-down path, a dummy secret comparison runs even for a client_id
- * this server has never heard of, so the crypto-verification cost can't be
- * used to distinguish "unknown" from "known, wrong secret" by timing. This
- * only runs on the non-default, already-more-expensive path — public
- * clients (the common case) never pay it.
- */
-export declare const firstClientAuthError: (auth: ClientAuth, options: OAuthRouterOptions, request: Request) => Promise<Response | null>;
-//# sourceMappingURL=clientauth.d.ts.map

package/dist/oauth/clientauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../src/oauth/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAqBF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAaf,CAAC;AAuCF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,EAC3B,SAAS,OAAO,KACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAkDzB,CAAC"}