mcp-trellis 1.0.0 → 2.2.0

package/dist/adapters/node.js

@@ -1,121 +1,65 @@
 /**
  * Node HTTP `(req, res)` adapter — Express, Cloud Functions, `http.createServer`, etc.
  * Bridges duck-typed Node request/response objects to Web `Request`/`Response`.
+ * Request-side plumbing (origin resolution, `toWebRequest`, body reading)
+ * lives in `node-request.ts` and is re-exported below unchanged.
  */
-import { BodyTooLargeError, DEFAULT_MCP_BODY_LIMIT, DEFAULT_OAUTH_BODY_LIMIT, isNodeReadable, readBoundedNodeBody, } from "../body.js";
-import { INTERNAL_ERROR } from "../http.js";
-import { JSONRPC_PAYLOAD_TOO_LARGE, rpcError } from "../jsonrpc.js";
-import { isAllowedOrigin } from "./origins.js";
-export { isAllowedOrigin };
-const headerValue = (value) => Array.isArray(value) ? value[0] : value;
-const lastForwarded = (value) => value?.split(",").pop()?.trim();
-/** Derive origin from Host, or from forwarded headers when trustProxy. */
-export const resolveOrigin = (req, options = {}) => {
-    const trustProxy = options.trustProxy === true;
-    const proto = trustProxy
-        ? lastForwarded(headerValue(req.headers["x-forwarded-proto"])) || "https"
-        : "https";
-    const host = trustProxy
-        ? lastForwarded(headerValue(req.headers["x-forwarded-host"])) || headerValue(req.headers.host)
-        : headerValue(req.headers.host);
-    if (!host) {
-        throw new Error("Cannot resolve origin: pass options.origin or set Host" +
-            (trustProxy ? " / X-Forwarded-Host" : ""));
-    }
-    return `${proto}://${host}`;
-};
-const toBodyInit = (body) => {
-    if (body === undefined || body === null)
-        return undefined;
-    if (typeof body === "string")
-        return body;
-    if (body instanceof Uint8Array) {
-        return body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
-    }
-    return JSON.stringify(body);
-};
-export const toWebRequest = (req, options) => {
-    // Never trust an absolute-form request target — rebase onto the validated origin.
-    const target = new URL(req.url ?? "/", options.origin);
-    const url = `${options.origin}${target.pathname}${target.search}`;
-    const headers = new Headers(Object.entries(req.headers)
-        .map(([key, value]) => {
-        const resolved = headerValue(value);
-        return resolved === undefined ? null : [key, resolved];
-    })
-        .filter((entry) => entry !== null));
-    const method = (req.method ?? "GET").toUpperCase();
-    if (method === "GET" || method === "HEAD") {
-        return new Request(url, { method, headers });
-    }
-    const body = options.body !== undefined ? options.body : req.body;
-    const bodyInit = toBodyInit(body);
-    return new Request(url, {
-        method,
-        headers,
-        ...(bodyInit !== undefined ? { body: bodyInit } : {}),
-    });
-};
-const isAsyncIterable = (value) => typeof value?.[Symbol.asyncIterator] ===
-    "function";
-const requestPath = (req) => (req.url ?? "/").split("?")[0] ?? "/";
-/** OAuth routes under `…/oauth/…` get the 64 KiB cap; everything else gets 1 MiB. */
-export const bodyLimitForPath = (path) => /\/oauth(?:\/|$)/.test(path) ? DEFAULT_OAUTH_BODY_LIMIT : DEFAULT_MCP_BODY_LIMIT;
-const enforcePresetBodySize = (body, maxBytes) => {
-    if (typeof body === "string" && new TextEncoder().encode(body).byteLength > maxBytes) {
-        throw new BodyTooLargeError(maxBytes);
-    }
-    if (body instanceof Uint8Array && body.byteLength > maxBytes) {
-        throw new BodyTooLargeError(maxBytes);
-    }
-};
+import { BodyTooLargeError } from "../http/body.js";
+import { INTERNAL_ERROR } from "../http/http.js";
+import { isAllowedOrigin } from "../http/origins.js";
+import { JSONRPC_PAYLOAD_TOO_LARGE, rpcError } from "../mcp/jsonrpc.js";
+import { bodyLimitForPath, InvalidOriginError, isOAuthPath, readNodeBody, requestPath, resolveOrigin, toWebRequest, } from "./node-request.js";
+export { isAllowedOrigin, isAllowedRequestOrigin, } from "../http/origins.js";
+export { bodyLimitForPath, InvalidOriginError, readNodeBody, resolveOrigin, toWebRequest, } from "./node-request.js";
 /**
- * Prefer `req.body`; else drain the stream (raw `http.createServer`), capped
- * at `maxBytes`. Throws `BodyTooLargeError` past the cap without destroying
- * the socket — `asNodeHandler` writes 413 first, then destroys after flush.
+ * Unlike every other header, `Set-Cookie` cannot be folded into one
+ * comma-joined value — a cookie's own `Expires` attribute contains a comma.
+ * The Fetch `Headers` object accordingly keeps duplicates apart internally
+ * and exposes them via `getSetCookie()`, but `forEach`/`entries()` still
+ * yields one `"set-cookie"` pair per cookie — calling `res.setHeader` once
+ * per pair (as for any other header) makes each call overwrite the last,
+ * silently dropping every cookie but the final one.
  */
-export const readNodeBody = async (req, maxBytes = DEFAULT_MCP_BODY_LIMIT) => {
-    if (req.body !== undefined && req.body !== null) {
-        enforcePresetBodySize(req.body, maxBytes);
-        return req.body;
-    }
-    const opts = { contentLength: headerValue(req.headers["content-length"]) };
-    if (isNodeReadable(req)) {
-        const bytes = await readBoundedNodeBody(req, maxBytes, opts);
-        return bytes.byteLength > 0 ? bytes : undefined;
-    }
-    if (!isAsyncIterable(req))
-        return undefined;
-    const bytes = await readBoundedNodeBody(req, maxBytes, opts);
-    return bytes.byteLength > 0 ? bytes : undefined;
-};
 export const sendWebResponse = async (res, response) => {
     res.statusCode = response.status;
     response.headers.forEach((value, key) => {
+        if (key.toLowerCase() === "set-cookie")
+            return;
         res.setHeader(key, value);
     });
+    const cookies = response.headers.getSetCookie();
+    if (cookies.length > 0)
+        res.setHeader("set-cookie", cookies);
     res.end(new Uint8Array(await response.arrayBuffer()));
 };
-/** Always answer — an unhandled rejection on `http.createServer` hangs the client. */
-const sendJsonError = (res, status, body, after) => {
-    res.statusCode = status;
+/**
+ * Always answer — an unhandled rejection on `http.createServer` hangs the
+ * client. `onFlushed` also closes the connection once the body is written.
+ */
+const sendJsonError = (res, error, onFlushed) => {
+    res.statusCode = error.status;
     res.setHeader("Content-Type", "application/json");
-    if (after)
+    if (onFlushed)
         res.setHeader("Connection", "close");
-    res.end(body, after);
+    res.end(error.body, onFlushed);
 };
-const payloadTooLargeBody = (path) => /\/oauth(?:\/|$)/.test(path)
+const ORIGIN_NOT_ALLOWED = { status: 400, body: JSON.stringify({ error: "origin not allowed" }) };
+const payloadTooLargeBody = (path) => isOAuthPath(path)
     ? JSON.stringify({ error: "request body too large" })
     : JSON.stringify(rpcError(null, JSONRPC_PAYLOAD_TOO_LARGE, "Payload too large"));
-/** One-liner: Node `(req, res)` → MCP / OAuth Web handler. */
-export const asNodeHandler = (mcp, options) => {
+/**
+ * Validates that `options` resolves to an origin `asNodeHandler` can trust —
+ * either an explicit `options.origin` already covered by `allowedOrigins`,
+ * or (Host-derived) an `allowedOrigins` that isn't empty. A forgettable Host
+ * spoof would otherwise leak straight into the AS issuer / PRM /
+ * WWW-Authenticate values every request produces.
+ */
+const assertNodeHandlerOptions = (options) => {
     const hostDerived = !options?.origin;
     if (hostDerived && options?.trustProxy !== true) {
         throw new Error("asNodeHandler requires options.origin or options.trustProxy: true");
     }
-    // Forgettable Host spoof → AS issuer / PRM / WWW-Authenticate. Require an
-    // explicit allowlist whenever origin comes from the request.
-    if (hostDerived && !options.allowedOrigins?.length) {
+    if (hostDerived && !options?.allowedOrigins?.length) {
         throw new Error('asNodeHandler with Host-derived origin requires options.allowedOrigins (use ["*"] to admit any Host)');
     }
     if (options?.origin &&
@@ -123,26 +67,36 @@ export const asNodeHandler = (mcp, options) => {
         !isAllowedOrigin(options.origin, options)) {
         throw new Error("asNodeHandler: options.origin is not in options.allowedOrigins");
     }
+};
+/** One-liner: Node `(req, res)` → MCP / OAuth Web handler. */
+export const asNodeHandler = (mcp, options) => {
+    assertNodeHandlerOptions(options);
     return async (req, res) => {
         const path = requestPath(req);
         try {
             const origin = options?.origin ?? resolveOrigin(req, { trustProxy: true });
             if (!isAllowedOrigin(origin, options)) {
-                sendJsonError(res, 400, JSON.stringify({ error: "origin not allowed" }));
+                sendJsonError(res, ORIGIN_NOT_ALLOWED);
                 return;
             }
             const body = await readNodeBody(req, bodyLimitForPath(path));
             const request = toWebRequest(req, { origin, body });
             await sendWebResponse(res, await mcp.fetch(request));
         }
-        catch (exc) {
-            if (exc instanceof BodyTooLargeError) {
-                sendJsonError(res, 413, payloadTooLargeBody(path), () => {
+        catch (caught) {
+            if (caught instanceof BodyTooLargeError) {
+                sendJsonError(res, { status: 413, body: payloadTooLargeBody(path) }, () => {
                     req.destroy?.();
                 });
                 return;
             }
-            sendJsonError(res, 500, JSON.stringify({ error: INTERNAL_ERROR }));
+            if (caught instanceof InvalidOriginError) {
+                // Bad client input (a malformed or missing Host / X-Forwarded-*),
+                // not a server fault — 400, not the generic 500 below.
+                sendJsonError(res, ORIGIN_NOT_ALLOWED);
+                return;
+            }
+            sendJsonError(res, { status: 500, body: JSON.stringify({ error: INTERNAL_ERROR }) });
         }
     };
 };

package/dist/adapters/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,eAAe,EAA+B,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAE,eAAe,EAA+B,CAAC;AAwCxD,MAAM,WAAW,GAAG,CAAC,KAAoC,EAAsB,EAAE,CAC/E,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAE1C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACtE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAE,UAAgC,EAAE,EAAU,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,OAAO;QACzE,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9F,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAa,EAAwB,EAAE;IACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAgB,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,OAA4B,EAAW,EAAE;IAC1F,kFAAkF;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAA2B,EAAE;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAChE,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM;QACN,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAmC,EAAE,CAC1E,OAAQ,KAAqD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;IACrF,UAAU,CAAC;AAEb,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AAE5F,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE,CACvD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAEnF,MAAM,qBAAqB,GAAG,CAAC,IAAa,EAAE,QAAgB,EAAQ,EAAE;IACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QACrF,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,YAAY,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAoB,EACpB,WAAmB,sBAAsB,EACvB,EAAE;IACpB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAChD,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,GAAyC,EACzC,QAAQ,EACR,IAAI,CACL,CAAC;IACF,OAAO,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,GAAqB,EAAE,QAAkB,EAAiB,EAAE;IAChG,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,aAAa,GAAG,CACpB,GAAqB,EACrB,MAAc,EACd,IAAY,EACZ,KAAkB,EACZ,EAAE;IACR,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,IAAI,KAAK;QAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE,CACnD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;IAC1B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAErF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuD,EACvD,OAA8B,EAC9B,EAAE;IACF,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,WAAW,IAAI,OAAO,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,WAAW,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IACE,OAAO,EAAE,MAAM;QACf,OAAO,CAAC,cAAc,EAAE,MAAM;QAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAiB,EAAE;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE;oBACtD,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EAEX,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAGlB,YAAY,EACZ,aAAa,EAEb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAkB3B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,GAAqB,EAAE,QAAkB,EAAiB,EAAE;IAChG,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,YAAY;YAAE,OAAO;QAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,GAAqB,EACrB,KAAuC,EACvC,SAAsB,EAChB,EAAE;IACR,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,IAAI,SAAS;QAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACjC,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;AAElG,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE,CACnD,WAAW,CAAC,IAAI,CAAC;IACf,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC,OAAyC,EAAQ,EAAE;IACnF,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,WAAW,IAAI,OAAO,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IACE,OAAO,EAAE,MAAM;QACf,OAAO,CAAC,cAAc,EAAE,MAAM;QAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuD,EACvD,OAA8B,EAC9B,EAAE;IACF,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAiB,EAAE;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;gBACxC,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;oBACxE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,MAAM,YAAY,kBAAkB,EAAE,CAAC;gBACzC,kEAAkE;gBAClE,uDAAuD;gBACvD,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/advanced.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `mcp-trellis/advanced` — low-level building blocks for hosts assembling
+ * their own MCP transport or OAuth flow. Less stable than the root and
+ * `mcp-trellis/oauth` entry points: these follow the internals more closely
+ * and may change in a minor release when the protocol work requires it.
+ */
+export { matchesAny, timingSafeEqual } from "./auth/bearer.js";
+export { corsHeaders, emptyResponse, methodNotAllowed, optionsResponse } from "./http/http.js";
+export { ASSUMED_HEADER_PROTOCOL_VERSION, pickProtocolVersion } from "./mcp/protocol.js";
+export { IGNORED_SCHEMA_KEYWORDS, JSON_SCHEMA_TYPES, missingObjectType, SUPPORTED_SCHEMA_KEYWORDS, unsupportedKeywords, validateAgainstSchema, } from "./mcp/validate.js";
+export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./oauth/config.js";
+export { type ClientAuth, firstClientAuthError, readClientAuth, } from "./oauth/crypto/clientauth.js";
+export { type AuthCodeRecord, type CodeStore, consumeAuthCode, issueAuthCode, newClientId, } from "./oauth/crypto/codes.js";
+export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./oauth/crypto/pkce.js";
+export { buildErrorRedirectUrl } from "./oauth/endpoints/callback.js";
+export { firstResourceError, normalizeConfiguredPath, resourceErrorInfo, } from "./oauth/policy/resource.js";
+export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./oauth/policy/scope.js";
+//# sourceMappingURL=advanced.d.ts.map

package/dist/advanced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanced.d.ts","sourceRoot":"","sources":["../src/advanced.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC"}

package/dist/advanced.js

@@ -0,0 +1,18 @@
+/**
+ * `mcp-trellis/advanced` — low-level building blocks for hosts assembling
+ * their own MCP transport or OAuth flow. Less stable than the root and
+ * `mcp-trellis/oauth` entry points: these follow the internals more closely
+ * and may change in a minor release when the protocol work requires it.
+ */
+export { matchesAny, timingSafeEqual } from "./auth/bearer.js";
+export { corsHeaders, emptyResponse, methodNotAllowed, optionsResponse } from "./http/http.js";
+export { ASSUMED_HEADER_PROTOCOL_VERSION, pickProtocolVersion } from "./mcp/protocol.js";
+export { IGNORED_SCHEMA_KEYWORDS, JSON_SCHEMA_TYPES, missingObjectType, SUPPORTED_SCHEMA_KEYWORDS, unsupportedKeywords, validateAgainstSchema, } from "./mcp/validate.js";
+export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./oauth/config.js";
+export { firstClientAuthError, readClientAuth, } from "./oauth/crypto/clientauth.js";
+export { consumeAuthCode, issueAuthCode, newClientId, } from "./oauth/crypto/codes.js";
+export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./oauth/crypto/pkce.js";
+export { buildErrorRedirectUrl } from "./oauth/endpoints/callback.js";
+export { firstResourceError, normalizeConfiguredPath, resourceErrorInfo, } from "./oauth/policy/resource.js";
+export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./oauth/policy/scope.js";
+//# sourceMappingURL=advanced.js.map

package/dist/advanced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanced.js","sourceRoot":"","sources":["../src/advanced.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,oBAAoB,EACpB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC"}

package/dist/app-options.d.ts

@@ -0,0 +1,132 @@
+import type { ClientName } from "./clients.js";
+import type { AuditEntry, Principal, ServerInfo } from "./mcp/methods.js";
+import type { ToolDef } from "./mcp/registry.js";
+import type { CimdCache } from "./oauth/cimd/types.js";
+import type { CodeStore } from "./oauth/crypto/codes.js";
+import type { ClientStore, ConsentOptions, MintAccessTokenInput, MintedToken, OAuthAuditEntry, OAuthUser, RefreshAccessTokenInput, RevokeTokenInput } from "./oauth/types.js";
+/** One sink for both MCP tool-call and OAuth AS audit events. */
+export type UnifiedAuditEntry = ({
+    source: "mcp";
+} & AuditEntry) | ({
+    source: "oauth";
+} & OAuthAuditEntry);
+/** What your token verification returns. The library checks the audience. */
+export type VerifiedToken = {
+    userId: string;
+    scopes: string[];
+    /** RFC 8707 audience the token was minted for. */
+    audience: string;
+    /** Optional host claims passed through to `context` via `Principal`. */
+    claims?: Record<string, unknown>;
+};
+export type McpAppAuth = {
+    /**
+     * Secret(s) that seal auth codes, consent tickets, and self-issued DCR
+     * client assertions, and key `ClientStore.secretHash`. Pass a string, or
+     * an array for key rotation — the first
+     * entry seals new material, every entry is tried when unsealing/verifying.
+     * See `OAuthPorts.codeSecret` for the full rotation contract.
+     */
+    codeSecret: string | string[] | ((req: Request) => string | string[] | Promise<string | string[]>);
+    /** Resolve the logged-in user, or null → redirect to `loginUrl`. */
+    resolveUser: (req: Request) => Promise<OAuthUser | null>;
+    /** Where to send unauthenticated authorize requests. */
+    loginUrl: (req: Request, nextPath: string) => string;
+    /** Mint an access token; embed `resource` as the audience. */
+    mintAccessToken: (input: MintAccessTokenInput) => Promise<MintedToken>;
+    /**
+     * Decode and validate a bearer token. Return its `audience` —
+     * `createMcpApp` rejects tokens minted for a different resource itself,
+     * so this check cannot be forgotten.
+     */
+    verifyToken: (token: string, req: Request) => Promise<VerifiedToken | null>;
+    refreshAccessToken?: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
+    /** RFC 7009 — presence mounts `/revoke` and advertises it. */
+    revokeToken?: (input: RevokeTokenInput) => Promise<void>;
+    codeStore?: CodeStore;
+    /** Required when any configured client is pre-registered (e.g. Gemini). */
+    clientStore?: ClientStore;
+    /**
+     * Opt-in OAuth-side metrics hook — see the tool-call `audit` below for
+     * the general shape. This one sees the real reason behind a collapsed
+     * `invalid_client` or a rejected `codeSecret`, which the caller never
+     * does. Omit for silence.
+     */
+    audit?: (entry: OAuthAuditEntry) => void | Promise<void>;
+};
+export type McpAppOptions<TCtx> = {
+    serverInfo: ServerInfo;
+    tools: ToolDef<TCtx>[];
+    auth: McpAppAuth;
+    /** Connector clients to serve. Default: `["claude"]`. */
+    clients?: ClientName[];
+    instructions?: string;
+    /** MCP endpoint path. Default `"/mcp"`. */
+    resourcePath?: string;
+    /** OAuth prefix. Default `` `${resourcePath}/oauth` ``. */
+    oauthPath?: string;
+    /** Scopes this server grants. Default `["mcp"]`. */
+    scopes?: string[];
+    /** Required when `scopes` has more than one entry — see `OAuthRouterOptions.defaultScopes`. */
+    defaultScopes?: string[];
+    realm?: string;
+    /** Extra exact-match redirect URIs beyond the client profiles. */
+    extraRedirectUris?: string[];
+    /** Allow loopback redirects (native clients). Default true. */
+    allowLoopback?: boolean;
+    /**
+     * Consent policy — policy, not a credential, so it sits alongside
+     * `allowLoopback` rather than under `auth`. Omit for the built-in
+     * hardened interstitial.
+     */
+    consent?: ConsentOptions;
+    /**
+     * Require every `client_id` to come from `clientStore` or this server's
+     * own `/register` (sealed assertion). Default **true** since 1.0.
+     * Set false only to accept invented public ids (pre-CIMD).
+     */
+    requireRegisteredClients?: boolean;
+    /**
+     * Validate tools/call args against each tool's `inputSchema`. Default
+     * **true** since 2.0. Set false only to skip schema checks intentionally.
+     */
+    validateArgs?: boolean;
+    /**
+     * See `OAuthRouterOptions.allowInMemoryCodeStore`. Default false.
+     */
+    allowInMemoryCodeStore?: boolean;
+    /**
+     * Opt into CIMD (HTTPS URL `client_id`s). Default **false** — see
+     * `OAuthRouterOptions.cimd`.
+     */
+    cimd?: boolean;
+    /**
+     * CIMD document cache. Strongly recommended with `cimd: true` — see
+     * `OAuthRouterOptions.cimdCache`.
+     */
+    cimdCache?: CimdCache;
+    /** Optional DNS lookup for CIMD SSRF checks. */
+    cimdLookup?: (hostname: string) => Promise<string[]>;
+    onToolError?: (error: unknown) => string;
+    /**
+     * Per-call context for tools, built only when a `tools/call` is about to
+     * run (see `McpPorts.context`). Defaults to an empty object.
+     */
+    context?: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
+    /**
+     * Unified metrics hook for MCP and OAuth events (`source: "mcp" | "oauth"`).
+     * Omit for silence. `auth.audit` overrides OAuth delivery when both are set.
+     * See `consoleAudit` or `examples/audit-store.ts`.
+     */
+    audit?: (entry: UnifiedAuditEntry) => void | Promise<void>;
+    /** Max time to wait for `audit` above before responding anyway. Default 1000ms. Also applied to `auth.audit`. */
+    auditTimeoutMs?: number;
+    /**
+     * Browser `Origin` allowlist for `/mcp` — see `McpHandlerOptions.allowedRequestOrigins`.
+     * Omitted → reject any request that sends `Origin`. Native clients omit the header.
+     */
+    allowedRequestOrigins?: string[];
+    /** Filter `tools/list` by scope. See `McpHandlerOptions.hideToolsOutsideScope`. Default false. */
+    hideToolsOutsideScope?: boolean;
+};
+//# sourceMappingURL=app-options.d.ts.map

package/dist/app-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-options.d.ts","sourceRoot":"","sources":["../src/app-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAE1B,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GACzB,CAAC;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GAAG,UAAU,CAAC,GAChC,CAAC;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,eAAe,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,UAAU,EACN,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,oEAAoE;IACpE,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,8DAA8D;IAC9D,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE;;;;OAIG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5E,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACrF,8DAA8D;IAC9D,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,IAAI,IAAI;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,gDAAgD;IAChD,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,iHAAiH;IACjH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,kGAAkG;IAClG,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC"}

package/dist/app-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=app-options.js.map

package/dist/app-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-options.js","sourceRoot":"","sources":["../src/app-options.ts"],"names":[],"mappings":""}

package/dist/app.d.ts

@@ -4,95 +4,8 @@
  * This layers over `createMcpHandler` and `createOAuthRouter`, which stay
  * exported for anyone who wants to compose the pieces themselves.
  */
-import { type ClientName } from "./clients.js";
-import type { AuditEntry, Principal, ServerInfo } from "./methods.js";
-import type { CodeStore } from "./oauth/codes.js";
-import type { ConsentOptions } from "./oauth/consent.js";
-import type { ClientStore, MintAccessTokenInput, MintedToken, OAuthAuditEntry, OAuthUser, RefreshAccessTokenInput, RevokeTokenInput } from "./oauth/types.js";
-import { type ToolDef } from "./registry.js";
-/** What your token verification returns. The library checks the audience. */
-export type VerifiedToken = {
-    userId: string;
-    scopes: string[];
-    /** RFC 8707 audience the token was minted for. */
-    audience: string;
-    /** Optional host claims passed through to `context` via `Principal`. */
-    claims?: Record<string, unknown>;
-};
-export type McpAppAuth = {
-    /** HMAC secret for signing auth codes. */
-    codeSecret: string | ((req: Request) => string | Promise<string>);
-    /** Resolve the logged-in user, or null → redirect to `loginUrl`. */
-    resolveUser: (req: Request) => Promise<OAuthUser | null>;
-    /** Where to send unauthenticated authorize requests. */
-    loginUrl: (req: Request, nextPath: string) => string;
-    /** Mint an access token; embed `resource` as the audience. */
-    mintAccessToken: (input: MintAccessTokenInput) => Promise<MintedToken>;
-    /**
-     * Decode and validate a bearer token. Return its `audience` —
-     * `createMcpApp` rejects tokens minted for a different resource itself,
-     * so this check cannot be forgotten.
-     */
-    verifyToken: (token: string, req: Request) => Promise<VerifiedToken | null>;
-    refreshAccessToken?: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
-    /** RFC 7009 — presence mounts `/revoke` and advertises it. */
-    revokeToken?: (input: RevokeTokenInput) => Promise<void>;
-    codeStore?: CodeStore;
-    /** Required when any configured client is pre-registered (e.g. Gemini). */
-    clientStore?: ClientStore;
-    /**
-     * Opt-in OAuth-side metrics hook — see the tool-call `audit` below for
-     * the general shape. This one sees the real reason behind a collapsed
-     * `invalid_client` or a rejected `codeSecret`, which the caller never
-     * does. Omit for silence.
-     */
-    audit?: (entry: OAuthAuditEntry) => void | Promise<void>;
-};
-export type McpAppOptions<TCtx> = {
-    serverInfo: ServerInfo;
-    tools: ToolDef<TCtx>[];
-    auth: McpAppAuth;
-    /** Connector clients to serve. Default: `["claude"]`. */
-    clients?: ClientName[];
-    instructions?: string;
-    /** MCP endpoint path. Default `"/mcp"`. */
-    resourcePath?: string;
-    /** OAuth prefix. Default `` `${resourcePath}/oauth` ``. */
-    oauthPath?: string;
-    /** Scopes this server grants. Default `["mcp"]`. */
-    scopes?: string[];
-    /** Required when `scopes` has more than one entry — see `OAuthRouterOptions.defaultScopes`. */
-    defaultScopes?: string[];
-    realm?: string;
-    /** Extra exact-match redirect URIs beyond the client profiles. */
-    extraRedirectUris?: string[];
-    /** Allow loopback redirects (native clients). Default true. */
-    allowLoopback?: boolean;
-    /**
-     * Consent policy — policy, not a credential, so it sits alongside
-     * `allowLoopback` rather than under `auth`. Omit for the built-in
-     * hardened interstitial.
-     */
-    consent?: ConsentOptions;
-    /**
-     * Require every `client_id` to come from `clientStore` or this server's
-     * own `/register` (sealed assertion). Default **true** since 1.0.
-     * Set false only to accept invented public ids (pre-CIMD).
-     */
-    requireRegisteredClients?: boolean;
-    validateArgs?: boolean;
-    onToolError?: (exc: unknown) => string;
-    /** Per-request context for tools. Defaults to an empty object. */
-    context?: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
-    /**
-     * Opt-in metrics hook — same as `McpPorts.audit`. Omit for silence. The
-     * library never stores or prints these itself. See `consoleAudit` or
-     * `examples/audit-store.ts`.
-     */
-    audit?: (entry: AuditEntry) => void | Promise<void>;
-    /** Max time to wait for `audit` above before responding anyway. Default 1000ms. */
-    auditTimeoutMs?: number;
-};
+import type { McpAppOptions } from "./app-options.js";
+export type { McpAppAuth, McpAppOptions, UnifiedAuditEntry, VerifiedToken, } from "./app-options.js";
 export type McpApp = {
     fetch: (request: Request) => Promise<Response>;
 };

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,KAAK,UAAU,EAIhB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAEjE,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,oEAAoE;IACpE,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,8DAA8D;IAC9D,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE;;;;OAIG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5E,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACrF,8DAA8D;IAC9D,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,IAAI,IAAI;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACvC,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,IAAI,EAAE,SAAS,aAAa,CAAC,IAAI,CAAC,KAAG,MAwGjE,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA0BtD,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAwLF,eAAO,MAAM,YAAY,GAAI,IAAI,EAAE,SAAS,aAAa,CAAC,IAAI,CAAC,KAAG,MA8CjE,CAAC"}