mcp-trellis 1.0.0 → 2.2.0

package/dist/oauth/crypto/hkdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hkdf.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/hkdf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,wFAAwF;AACxF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,eAAe,GAAG,gBAAgB,CAAC;IAC9C,KAAK,EAAE,QAAQ,CAAC;CACjB,CAAC;AAgCF,eAAO,MAAM,OAAO,GAAU,QAAQ,MAAM,EAAE,SAAS,cAAc,KAAG,OAAO,CAAC,SAAS,CAGxF,CAAC"}

package/dist/oauth/crypto/hkdf.js

@@ -0,0 +1,30 @@
+/**
+ * Purpose-bound keys derived from `codeSecret` with HKDF-SHA256, cached so
+ * rotation (`unsealAny`, `verifyClientSecretAny`) doesn't re-run
+ * `importKey` + `deriveKey` for every entry on every request.
+ */
+import { bytesToBase64Url } from "./base64url.js";
+import { createBoundedCache, settleCached } from "./keycache.js";
+const deriveKey = async (secret, purpose) => {
+    const encoder = new TextEncoder();
+    const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, [
+        "deriveKey",
+    ]);
+    return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: encoder.encode(purpose.info) }, material, purpose.algorithm, false, [purpose.usage]);
+};
+/**
+ * SHA-256 fingerprint of `secret` for the cache key — not a KDF. Keeps the
+ * plaintext secret out of Map key space (material still lives inside the
+ * derived CryptoKey).
+ */
+const secretFingerprint = async (secret) => {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`mcp-trellis:cache-key:${secret}`));
+    return bytesToBase64Url(digest);
+};
+const KEY_CACHE_LIMIT = 64;
+const keyCache = createBoundedCache(KEY_CACHE_LIMIT);
+export const hkdfKey = async (secret, purpose) => {
+    const cacheKey = `${purpose.info}:${purpose.usage}:${await secretFingerprint(secret)}`;
+    return settleCached(keyCache, cacheKey, () => deriveKey(secret, purpose));
+};
+//# sourceMappingURL=hkdf.js.map

package/dist/oauth/crypto/hkdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hkdf.js","sourceRoot":"","sources":["../../../src/oauth/crypto/hkdf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AASjE,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,OAAuB,EAAsB,EAAE;IACtF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3F,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAC9F,QAAQ,EACR,OAAO,CAAC,SAAS,EACjB,KAAK,EACL,CAAC,OAAO,CAAC,KAAK,CAAC,CAChB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAC5D,CAAC;IACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,QAAQ,GAAG,kBAAkB,CAAqB,eAAe,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,OAAuB,EAAsB,EAAE;IAC3F,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;IACvF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC"}

package/dist/oauth/crypto/keycache.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A small bounded cache, used by `hkdf.ts` for derived `CryptoKey`s.
+ *
+ * Insertion-order eviction, not true LRU — simpler, and the expected key
+ * count (a handful of rotation entries, rarely changing at runtime) stays
+ * well under the cap in ordinary use, so eviction order rarely matters in
+ * practice. The cap itself exists for the discouraged-but-possible case of
+ * a function-form `codeSecret` returning a different value on every call,
+ * which would otherwise grow this cache without bound.
+ */
+export type BoundedCache<V> = {
+    get: (key: string) => V | undefined;
+    set: (key: string, value: V) => void;
+    delete: (key: string) => void;
+};
+export declare const createBoundedCache: <V>(limit: number) => BoundedCache<V>;
+/** Cache a promise; drop the entry if it rejects so the slot is not poisoned. */
+export declare const settleCached: <T>(cache: BoundedCache<Promise<T>>, key: string, create: () => Promise<T>) => Promise<T>;
+//# sourceMappingURL=keycache.d.ts.map

package/dist/oauth/crypto/keycache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycache.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/keycache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;IAC5B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,SAAS,CAAC;IACpC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;IACrC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,CAAC,EAAE,OAAO,MAAM,KAAG,YAAY,CAAC,CAAC,CAenE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,YAAY,GAAU,CAAC,EAClC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAC/B,KAAK,MAAM,EACX,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KACvB,OAAO,CAAC,CAAC,CAWX,CAAC"}

package/dist/oauth/crypto/keycache.js

@@ -0,0 +1,44 @@
+/**
+ * A small bounded cache, used by `hkdf.ts` for derived `CryptoKey`s.
+ *
+ * Insertion-order eviction, not true LRU — simpler, and the expected key
+ * count (a handful of rotation entries, rarely changing at runtime) stays
+ * well under the cap in ordinary use, so eviction order rarely matters in
+ * practice. The cap itself exists for the discouraged-but-possible case of
+ * a function-form `codeSecret` returning a different value on every call,
+ * which would otherwise grow this cache without bound.
+ */
+export const createBoundedCache = (limit) => {
+    const map = new Map();
+    return {
+        get: (key) => map.get(key),
+        set: (key, value) => {
+            if (!map.has(key) && map.size >= limit) {
+                const oldest = map.keys().next().value;
+                if (oldest !== undefined)
+                    map.delete(oldest);
+            }
+            map.set(key, value);
+        },
+        delete: (key) => {
+            map.delete(key);
+        },
+    };
+};
+/** Cache a promise; drop the entry if it rejects so the slot is not poisoned. */
+export const settleCached = async (cache, key, create) => {
+    const cached = cache.get(key);
+    if (cached)
+        return cached;
+    const pending = create();
+    cache.set(key, pending);
+    try {
+        return await pending;
+    }
+    catch (caught) {
+        if (cache.get(key) === pending)
+            cache.delete(key);
+        throw caught;
+    }
+};
+//# sourceMappingURL=keycache.js.map

package/dist/oauth/crypto/keycache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycache.js","sourceRoot":"","sources":["../../../src/oauth/crypto/keycache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAI,KAAa,EAAmB,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAClB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACvC,IAAI,MAAM,KAAK,SAAS;oBAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,KAA+B,EAC/B,GAAW,EACX,MAAwB,EACZ,EAAE;IACd,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC;IACf,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/crypto/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/pkce.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAGnE,CAAC;AAEF,eAAO,MAAM,cAAc,GAAU,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAIzF,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,MAGjD,CAAC"}

package/dist/oauth/{pkce.js → crypto/pkce.js}

@@ -1,4 +1,4 @@
-import { timingSafeEqual } from "../auth/bearer.js";
+import { timingSafeEqual } from "../../auth/bearer.js";
 import { bytesToBase64Url } from "./base64url.js";
 export const sha256Base64Url = async (input) => {
     const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));

package/dist/oauth/crypto/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/oauth/crypto/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,SAAiB,EAAoB,EAAE;IAC5F,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC,CAAC"}

package/dist/oauth/{sealed.d.ts → crypto/sealed.d.ts}

@@ -1,7 +1,6 @@
 /**
- * AES-GCM sealing for short-lived, self-describing tokens derived from the
- * same `codeSecret` as auth codes (HMAC today, AES-GCM from Phase 2 —
- * see `codes.ts`).
+ * AES-GCM sealing for short-lived, self-describing tokens (auth codes,
+ * consent tickets, DCR client assertions), all keyed from `codeSecret`.
  *
  * Domain separation is mandatory, not a nice-to-have: a consent ticket must
  * never unseal as a client-id assertion, and neither must ever unseal as an
@@ -14,4 +13,14 @@ export type SealedType = "consent" | "client" | "code";
 export declare const seal: <T>(secret: string, type: SealedType, payload: T) => Promise<string>;
 /** Unseals a string sealed with the same `secret` and `type`; `null` on any mismatch or tamper. */
 export declare const unseal: <T>(secret: string, type: SealedType, sealed: string) => Promise<T | null>;
+/**
+ * Rotation-aware unseal: tries each `secrets` entry in order, returning the
+ * index of the one that actually worked so a caller can audit "sealed under
+ * a non-primary key" without a second decrypt pass. `secrets` is expected
+ * non-empty (callers resolve it via `resolveSecrets`, which enforces that).
+ */
+export declare const unsealAny: <T>(secrets: readonly string[], type: SealedType, sealed: string) => Promise<{
+    value: T;
+    keyIndex: number;
+} | null>;
 //# sourceMappingURL=sealed.d.ts.map

package/dist/oauth/crypto/sealed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/sealed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAevD,uDAAuD;AACvD,eAAO,MAAM,IAAI,GAAU,CAAC,EAAE,QAAQ,MAAM,EAAE,MAAM,UAAU,EAAE,SAAS,CAAC,KAAG,OAAO,CAAC,MAAM,CAW1F,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,MAAM,GAAU,CAAC,EAC5B,QAAQ,MAAM,EACd,MAAM,UAAU,EAChB,QAAQ,MAAM,KACb,OAAO,CAAC,CAAC,GAAG,IAAI,CAsBlB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAU,CAAC,EAC/B,SAAS,SAAS,MAAM,EAAE,EAC1B,MAAM,UAAU,EAChB,QAAQ,MAAM,KACb,OAAO,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM/C,CAAC"}

package/dist/oauth/{sealed.js → crypto/sealed.js}

@@ -1,7 +1,6 @@
 /**
- * AES-GCM sealing for short-lived, self-describing tokens derived from the
- * same `codeSecret` as auth codes (HMAC today, AES-GCM from Phase 2 —
- * see `codes.ts`).
+ * AES-GCM sealing for short-lived, self-describing tokens (auth codes,
+ * consent tickets, DCR client assertions), all keyed from `codeSecret`.
  *
  * Domain separation is mandatory, not a nice-to-have: a consent ticket must
  * never unseal as a client-id assertion, and neither must ever unseal as an
@@ -10,20 +9,15 @@
  * two independent reasons decryption fails across types, not one.
  */
 import { bytesToBase64Url, fromBase64Url } from "./base64url.js";
+import { hkdfKey } from "./hkdf.js";
 const HKDF_INFO_PREFIX = "mcp-trellis:sealed:";
 const IV_BYTES = 12;
-const deriveKey = async (secret, type, usage) => {
-    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: new Uint8Array(0),
-        info: new TextEncoder().encode(`${HKDF_INFO_PREFIX}${type}`),
-    }, material, { name: "AES-GCM", length: 256 }, false, [usage]);
-};
+const AES_GCM_256 = { name: "AES-GCM", length: 256 };
+/** Same key material for "encrypt" and "decrypt" — WebCrypto just restricts the derived key's own `usages`. */
+const sealingKey = (secret, type, usage) => hkdfKey(secret, { info: `${HKDF_INFO_PREFIX}${type}`, algorithm: AES_GCM_256, usage });
 /** Seals `payload` as an opaque, type-bound string. */
 export const seal = async (secret, type, payload) => {
-    const key = await deriveKey(secret, type, "encrypt");
+    const key = await sealingKey(secret, type, "encrypt");
     const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
     const additionalData = new TextEncoder().encode(type);
     const plaintext = new TextEncoder().encode(JSON.stringify(payload));
@@ -41,7 +35,7 @@ export const unseal = async (secret, type, sealed) => {
     if (!ivPart || !ciphertextPart)
         return null;
     try {
-        const key = await deriveKey(secret, type, "decrypt");
+        const key = await sealingKey(secret, type, "decrypt");
         const iv = fromBase64Url(ivPart);
         if (iv.byteLength !== IV_BYTES)
             return null;
@@ -54,4 +48,18 @@ export const unseal = async (secret, type, sealed) => {
         return null;
     }
 };
+/**
+ * Rotation-aware unseal: tries each `secrets` entry in order, returning the
+ * index of the one that actually worked so a caller can audit "sealed under
+ * a non-primary key" without a second decrypt pass. `secrets` is expected
+ * non-empty (callers resolve it via `resolveSecrets`, which enforces that).
+ */
+export const unsealAny = async (secrets, type, sealed) => {
+    for (const [keyIndex, secret] of secrets.entries()) {
+        const value = await unseal(secret, type, sealed);
+        if (value !== null)
+            return { value, keyIndex };
+    }
+    return null;
+};
 //# sourceMappingURL=sealed.js.map

package/dist/oauth/crypto/sealed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.js","sourceRoot":"","sources":["../../../src/oauth/crypto/sealed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,MAAM,WAAW,GAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAEtE,+GAA+G;AAC/G,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,IAAgB,EAChB,KAA4B,EACR,EAAE,CACtB,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,gBAAgB,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AAEzF,uDAAuD;AACvD,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAK,MAAc,EAAE,IAAgB,EAAE,OAAU,EAAmB,EAAE;IAC7F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EACvC,GAAG,EACH,SAAS,CACV,CAAC;IACF,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;AACnE,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,MAAc,EACd,IAAgB,EAChB,MAAc,EACK,EAAE;IACrB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EACvC,GAAG,EACH,UAAU,CACX,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAA0B,EAC1B,IAAgB,EAChB,MAAc,EACkC,EAAE;IAClD,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAI,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/oauth/{secrethash.d.ts → crypto/secrethash.d.ts}

@@ -41,4 +41,18 @@ export declare const hashClientSecret: (secret: string, codeSecretValue: string)
  * the same check outside the token endpoint (e.g. a client-management API).
  */
 export declare const verifyClientSecret: (presented: string, stored: string, codeSecretValue: string) => Promise<boolean>;
+/**
+ * Rotation-aware `verifyClientSecret`: a hash stored under an older
+ * `codeSecret` must keep verifying until it's re-hashed under the current
+ * one. Always tries every entry in `codeSecretValues` — even after an
+ * earlier one matches — for the *unknown-client* dummy-compare call site in
+ * `clientauth.ts`, where `stored` is a fixed dummy hash that never matches
+ * any real key: looping the same number of times whether or not a key list
+ * is configured for rotation keeps that call's cost from leaking how many
+ * keys are configured.
+ */
+export declare const verifyClientSecretAny: (presented: string, stored: string, codeSecretValues: readonly string[]) => Promise<{
+    ok: boolean;
+    keyIndex: number | null;
+}>;
 //# sourceMappingURL=secrethash.d.ts.map

package/dist/oauth/crypto/secrethash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrethash.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/secrethash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAWH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,iBAAiB,MAAM,KACtB,OAAO,CAAC,MAAM,CAQhB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,QAAQ,MAAM,EACd,iBAAiB,MAAM,KACtB,OAAO,CAAC,OAAO,CAIjB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAChC,WAAW,MAAM,EACjB,QAAQ,MAAM,EACd,kBAAkB,SAAS,MAAM,EAAE,KAClC,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAQlD,CAAC"}

package/dist/oauth/{secrethash.js → crypto/secrethash.js}

@@ -27,19 +27,12 @@
  * are human-chosen, don't use this — do a real password hash inside your
  * own `verifySecret` instead.
  */
-import { timingSafeEqual } from "../auth/bearer.js";
+import { timingSafeEqual } from "../../auth/bearer.js";
 import { bytesToBase64Url } from "./base64url.js";
+import { hkdfKey } from "./hkdf.js";
 const HASH_PREFIX = "hmac-sha256$";
 const HKDF_INFO = "mcp-trellis:client-secret-hash";
-const deriveHmacKey = async (codeSecretValue) => {
-    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(codeSecretValue), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: new Uint8Array(0),
-        info: new TextEncoder().encode(HKDF_INFO),
-    }, material, { name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign"]);
-};
+const HMAC_SHA256 = { name: "HMAC", hash: "SHA-256", length: 256 };
 /**
  * Hash a client secret for storage in your `ClientStore.secretHash` lookup.
  * Call this once, at registration time, with the same `codeSecret` value
@@ -47,7 +40,11 @@ const deriveHmacKey = async (codeSecretValue) => {
  * the result, never the plaintext secret.
  */
 export const hashClientSecret = async (secret, codeSecretValue) => {
-    const key = await deriveHmacKey(codeSecretValue);
+    const key = await hkdfKey(codeSecretValue, {
+        info: HKDF_INFO,
+        algorithm: HMAC_SHA256,
+        usage: "sign",
+    });
     const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(secret));
     return `${HASH_PREFIX}${bytesToBase64Url(sig)}`;
 };
@@ -63,4 +60,23 @@ export const verifyClientSecret = async (presented, stored, codeSecretValue) =>
     const recomputed = await hashClientSecret(presented, codeSecretValue);
     return timingSafeEqual(recomputed, stored);
 };
+/**
+ * Rotation-aware `verifyClientSecret`: a hash stored under an older
+ * `codeSecret` must keep verifying until it's re-hashed under the current
+ * one. Always tries every entry in `codeSecretValues` — even after an
+ * earlier one matches — for the *unknown-client* dummy-compare call site in
+ * `clientauth.ts`, where `stored` is a fixed dummy hash that never matches
+ * any real key: looping the same number of times whether or not a key list
+ * is configured for rotation keeps that call's cost from leaking how many
+ * keys are configured.
+ */
+export const verifyClientSecretAny = async (presented, stored, codeSecretValues) => {
+    let matchedIndex = null;
+    for (const [keyIndex, codeSecretValue] of codeSecretValues.entries()) {
+        if (await verifyClientSecret(presented, stored, codeSecretValue)) {
+            matchedIndex ??= keyIndex;
+        }
+    }
+    return { ok: matchedIndex !== null, keyIndex: matchedIndex };
+};
 //# sourceMappingURL=secrethash.js.map

package/dist/oauth/crypto/secrethash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrethash.js","sourceRoot":"","sources":["../../../src/oauth/crypto/secrethash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,SAAS,GAAG,gCAAgC,CAAC;AAEnD,MAAM,WAAW,GAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAc,EACd,eAAuB,EACN,EAAE;IACnB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE;QACzC,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,WAAW;QACtB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,MAAc,EACd,eAAuB,EACL,EAAE;IACpB,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACtE,OAAO,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,SAAiB,EACjB,MAAc,EACd,gBAAmC,EACgB,EAAE;IACrD,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACrE,IAAI,MAAM,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YACjE,YAAY,KAAK,QAAQ,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,YAAY,KAAK,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC/D,CAAC,CAAC"}

package/dist/oauth/deprecated.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `mcp-trellis/oauth` aliases for symbols that moved to
+ * `mcp-trellis/advanced`. Declared as consts so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+import * as advanced from "../advanced.js";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const readClientAuth: (request: Request, body: Record<string, string>) => advanced.ClientAuth | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const firstClientAuthError: (auth: advanced.ClientAuth, options: import("./types.js").OAuthRouterOptions, request: Request) => Promise<Response | null>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const firstResourceError: (requested: string, expected: string) => Response | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const resourceErrorInfo: (requested: string, expected: string) => import("./types.js").OAuthErrorInfo | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const normalizeConfiguredPath: (path: string) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const firstScopeError: (requested: string[], advertised: string[]) => Response | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const scopeErrorInfo: (requested: string[], advertised: string[]) => import("./types.js").OAuthErrorInfo | null;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const parseScope: (raw: string) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const requestedScopes: (raw: string, fallback: string[]) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const formatScope: (scopes: string[]) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const issueAuthCode: (secret: string, record: Omit<advanced.AuthCodeRecord, "exp">, nowMs?: number) => Promise<string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const consumeAuthCode: (secret: string | readonly string[], code: string, options?: {
+    codeStore?: advanced.CodeStore | undefined;
+    nowMs?: number | undefined;
+}) => Promise<advanced.AuthCodeRecord | null>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const newClientId: () => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const randomBase64Url: (byteLen: number) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const sha256Base64Url: (input: string) => Promise<string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const verifyPkceS256: (verifier: string, challenge: string) => Promise<boolean>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const buildErrorRedirectUrl: (redirectUri: string, error: string, description: string, state: string, issuer?: string) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const advertisedScopes: (options: import("./types.js").OAuthRouterOptions) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const defaultScopes: (options: import("./types.js").OAuthRouterOptions) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const registeredClientsRequired: (options: import("./types.js").OAuthRouterOptions) => boolean;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const unregisteredClientsAllowed: (options: import("./types.js").OAuthRouterOptions) => boolean;
+//# sourceMappingURL=deprecated.d.ts.map

package/dist/oauth/deprecated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,sEAAsE;AACtE,eAAO,MAAM,cAAc,gFAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,6HAAgC,CAAC;AAClE,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,0DAA8B,CAAC;AAC9D,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,qFAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,0BAAmC,CAAC;AACxE,sEAAsE;AACtE,eAAO,MAAM,eAAe,gEAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,cAAc,2FAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,UAAU,2BAAsB,CAAC;AAC9C,sEAAsE;AACtE,eAAO,MAAM,eAAe,+CAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,WAAW,8BAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,aAAa,mGAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,eAAe;aAmBqzE,CAAC;SAA8B,CAAC;6CAnB1zE,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,WAAW,cAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,eAAe,6BAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,eAAe,oCAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,cAAc,2DAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,qGAAiC,CAAC;AACpE,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,gEAA4B,CAAC;AAC1D,sEAAsE;AACtE,eAAO,MAAM,aAAa,gEAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,+DAAqC,CAAC;AAC5E,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,+DAAsC,CAAC"}

package/dist/oauth/deprecated.js

@@ -0,0 +1,49 @@
+/**
+ * `mcp-trellis/oauth` aliases for symbols that moved to
+ * `mcp-trellis/advanced`. Declared as consts so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+import * as advanced from "../advanced.js";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const readClientAuth = advanced.readClientAuth;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const firstClientAuthError = advanced.firstClientAuthError;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const firstResourceError = advanced.firstResourceError;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const resourceErrorInfo = advanced.resourceErrorInfo;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const normalizeConfiguredPath = advanced.normalizeConfiguredPath;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const firstScopeError = advanced.firstScopeError;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const scopeErrorInfo = advanced.scopeErrorInfo;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const parseScope = advanced.parseScope;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const requestedScopes = advanced.requestedScopes;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const formatScope = advanced.formatScope;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const issueAuthCode = advanced.issueAuthCode;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const consumeAuthCode = advanced.consumeAuthCode;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const newClientId = advanced.newClientId;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const randomBase64Url = advanced.randomBase64Url;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const sha256Base64Url = advanced.sha256Base64Url;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const verifyPkceS256 = advanced.verifyPkceS256;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const buildErrorRedirectUrl = advanced.buildErrorRedirectUrl;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const advertisedScopes = advanced.advertisedScopes;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const defaultScopes = advanced.defaultScopes;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const registeredClientsRequired = advanced.registeredClientsRequired;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const unregisteredClientsAllowed = advanced.unregisteredClientsAllowed;
+//# sourceMappingURL=deprecated.js.map

package/dist/oauth/deprecated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC;AAClE,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;AAC9D,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;AACxE,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,0BAA0B,CAAC"}

package/dist/oauth/endpoints/authorize.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedOAuthRouterOptions } from "../types.js";
+export declare const handleAuthorize: (request: Request, options: ResolvedOAuthRouterOptions) => Promise<Response>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/oauth/endpoints/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAKV,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAiPrB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAuClB,CAAC"}