mcp-use 2.0.0-beta.9 → 2.0.0

package/dist/oauth/clerk.d.ts

@@ -1,26 +1,53 @@
+/**
+ * Verify Clerk access tokens for an mcp-use resource server.
+ *
+ * @packageDocumentation
+ */
 import { type OAuthProvider, type OAuthResourceOptions } from "./provider.js";
 /** Verified Clerk user and organization claims exposed to authenticated MCP callbacks. */
 export interface ClerkOAuthUser {
+    /** Clerk subject identifier. */
     id: string;
+    /** Primary email address, when included in the access token. */
     email?: string;
+    /** Display name, when included in the access token. */
     name?: string;
+    /** Clerk username, when included in the access token. */
     username?: string;
+    /** Profile image URL, when included in the access token. */
     picture?: string;
+    /** Whether Clerk has verified {@link ClerkOAuthUser.email}. */
     emailVerified?: boolean;
+    /** Active Clerk organization identifier. */
     organizationId?: string;
+    /** Role in the active Clerk organization. */
     organizationRole?: string;
+    /** Slug of the active Clerk organization. */
     organizationSlug?: string;
+    /** Active organization role as a normalized list. */
     roles: string[];
 }
 /** Configures Clerk JWT verification and protected-resource metadata. */
 export interface ClerkOAuthProviderOptions extends OAuthResourceOptions {
+    /** Clerk Frontend API URL used as the token issuer. */
     frontendApiUrl: URL | string;
+    /** Expected Clerk access-token audience, when the application emits one. */
+    audience?: string;
 }
 /**
  * Creates a provider that verifies Clerk access tokens and maps their claims.
  *
- * @param options - Clerk frontend API URL and resource-server settings.
- * @returns A provider that rejects tokens not issued for the resolved MCP resource.
+ * @param options - Clerk frontend API URL, optional token audience, and resource-server settings.
+ * @returns A provider that verifies Clerk-issued access tokens and explicit resource claims.
+ * @throws A `TypeError` if `frontendApiUrl` is invalid or `audience` is empty.
+ *
+ * @example
+ * ```ts
+ * import { oauthClerkProvider } from "mcp-use/oauth/clerk";
+ *
+ * const oauth = oauthClerkProvider({
+ *   frontendApiUrl: "https://example.clerk.accounts.dev",
+ * });
+ * ```
  */
 export declare function oauthClerkProvider(options: ClerkOAuthProviderOptions): OAuthProvider<ClerkOAuthUser>;
-//# sourceMappingURL=clerk.d.ts.map

package/dist/oauth/clerk.js

@@ -1,70 +1 @@
-import {
-  booleanValue,
-  createJwtVerifier,
-  invalidToken,
-  normalizedProviderUrl,
-  normalizedStrings,
-  oauthCustomProvider,
-  payloadFromAuthInfo,
-  providerEndpoint,
-  requiredString,
-  stringValue
-} from "../chunk-DPL7OEXC.js";
-
-// src/oauth/clerk.ts
-function oauthClerkProvider(options) {
-  const issuer = normalizedProviderUrl(
-    options.frontendApiUrl,
-    "Clerk frontendApiUrl"
-  ).href.replace(/\/$/, "");
-  return oauthCustomProvider({
-    ...options,
-    createTokenVerifier: (resource) => createJwtVerifier({
-      issuer,
-      jwksUrl: new URL(providerEndpoint(issuer, ".well-known/jwks.json")),
-      resource
-    }),
-    oauthMetadata: metadata(issuer),
-    mapAuthInfo: (authInfo) => mapUser(authInfo)
-  });
-}
-function mapUser(authInfo) {
-  const payload = payloadFromAuthInfo(authInfo);
-  const id = requiredString(payload, "sub");
-  if (id === void 0) throw invalidToken("Missing Clerk subject");
-  const organizationRole = stringValue(payload, "org_role");
-  return {
-    user: {
-      id,
-      ...optional("email", stringValue(payload, "email")),
-      ...optional("name", stringValue(payload, "name")),
-      ...optional("username", stringValue(payload, "username")),
-      ...optional("picture", stringValue(payload, "picture")),
-      ...optional("emailVerified", booleanValue(payload, "email_verified")),
-      ...optional("organizationId", stringValue(payload, "org_id")),
-      ...optional("organizationRole", organizationRole),
-      ...optional("organizationSlug", stringValue(payload, "org_slug")),
-      roles: organizationRole === void 0 ? [] : [organizationRole]
-    },
-    payload,
-    permissions: normalizedStrings(payload["org_permissions"])
-  };
-}
-function metadata(issuer) {
-  return {
-    issuer,
-    authorization_endpoint: providerEndpoint(issuer, "oauth/authorize"),
-    token_endpoint: providerEndpoint(issuer, "oauth/token"),
-    registration_endpoint: providerEndpoint(issuer, "oauth/register"),
-    response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
-    code_challenge_methods_supported: ["S256"]
-  };
-}
-function optional(key, value) {
-  return value === void 0 ? {} : { [key]: value };
-}
-export {
-  oauthClerkProvider
-};
-//# sourceMappingURL=clerk.js.map
+import{booleanValue,createJwtVerifier,normalizedProviderUrl,normalizedStrings,payloadFromAuthInfo,providerEndpoint,requiredString,stringValue}from"../chunk-KGTOBJW2.js";import{invalidToken,oauthCustomProvider}from"../chunk-IS7FKXFR.js";function oauthClerkProvider(options){if(options.audience!==void 0&&(typeof options.audience!="string"||options.audience.trim().length===0))throw new TypeError("Clerk audience must be non-empty");let issuer=normalizedProviderUrl(options.frontendApiUrl,"Clerk frontendApiUrl").href.replace(/\/$/,"");return oauthCustomProvider({...options,createTokenVerifier:resource=>createJwtVerifier({issuer,jwksUrl:new URL(providerEndpoint(issuer,".well-known/jwks.json")),resource,...options.audience!==void 0?{audience:options.audience}:{issuerBoundAccessTokens:!0}}),oauthMetadata:metadata(issuer),mapAuthInfo:authInfo=>mapUser(authInfo)})}function mapUser(authInfo){let payload=payloadFromAuthInfo(authInfo),id=requiredString(payload,"sub");if(id===void 0)throw invalidToken("Missing Clerk subject");let organizationRole=stringValue(payload,"org_role");return{user:{id,...optional("email",stringValue(payload,"email")),...optional("name",stringValue(payload,"name")),...optional("username",stringValue(payload,"username")),...optional("picture",stringValue(payload,"picture")),...optional("emailVerified",booleanValue(payload,"email_verified")),...optional("organizationId",stringValue(payload,"org_id")),...optional("organizationRole",organizationRole),...optional("organizationSlug",stringValue(payload,"org_slug")),roles:organizationRole===void 0?[]:[organizationRole]},payload,permissions:normalizedStrings(payload.org_permissions)}}function metadata(issuer){return{issuer,authorization_endpoint:providerEndpoint(issuer,"oauth/authorize"),token_endpoint:providerEndpoint(issuer,"oauth/token"),registration_endpoint:providerEndpoint(issuer,"oauth/register"),response_types_supported:["code"],grant_types_supported:["authorization_code","refresh_token"],code_challenge_methods_supported:["S256"]}}function optional(key,value){return value===void 0?{}:{[key]:value}}export{oauthClerkProvider};

package/dist/oauth/errors.d.ts

@@ -0,0 +1,3 @@
+import { OAuthError } from "@modelcontextprotocol/server";
+/** @internal Creates an OAuth invalid-token error with an optional cause. */
+export declare function invalidToken(message: string, cause?: unknown): OAuthError;

package/dist/oauth/guards.d.ts

@@ -6,4 +6,3 @@ export declare function isLocalhost(url: URL): boolean;
 export declare function parseAbsoluteUrl(value: string | URL, name: string): URL;
 /** @internal Validates that a URL uses HTTPS, or HTTP for localhost. */
 export declare function assertSecureHttpUrl(url: URL, name: string): void;
-//# sourceMappingURL=guards.d.ts.map

package/dist/oauth/index.d.ts

@@ -7,4 +7,3 @@ export { OAuthError, OAuthErrorCode, bearerAuthChallengeResponse, getOAuthProtec
 export type { AuthInfo as OAuthAuthInfo, AuthMetadataOptions, BearerAuthOptions, OAuthMetadata, OAuthProtectedResourceMetadata, OAuthTokenVerifier, } from "@modelcontextprotocol/server";
 export { bearerAuth, oauthMetadata } from "./adapters.js";
 export { oauthCustomProvider, type CustomOAuthProviderOptions, type OAuthExtra, type OAuthProvider, type OAuthResourceOptions, } from "./provider.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.js

@@ -1,28 +1 @@
-import {
-  OAuthError,
-  OAuthErrorCode,
-  bearerAuth,
-  bearerAuthChallengeResponse,
-  getOAuthProtectedResourceMetadataUrl,
-  oauthMetadata,
-  oauthMetadataResponse,
-  requireBearerAuth,
-  verifyBearerToken
-} from "../chunk-Z326HADF.js";
-import "../chunk-QUUANIE4.js";
-import {
-  oauthCustomProvider
-} from "../chunk-DPL7OEXC.js";
-export {
-  OAuthError,
-  OAuthErrorCode,
-  bearerAuth,
-  bearerAuthChallengeResponse,
-  getOAuthProtectedResourceMetadataUrl,
-  oauthCustomProvider,
-  oauthMetadata,
-  oauthMetadataResponse,
-  requireBearerAuth,
-  verifyBearerToken
-};
-//# sourceMappingURL=index.js.map
+import{OAuthError,OAuthErrorCode,bearerAuth,bearerAuthChallengeResponse,getOAuthProtectedResourceMetadataUrl,oauthMetadata,oauthMetadataResponse,requireBearerAuth,verifyBearerToken}from"../chunk-MIZQEWZS.js";import{oauthCustomProvider}from"../chunk-IS7FKXFR.js";export{OAuthError,OAuthErrorCode,bearerAuth,bearerAuthChallengeResponse,getOAuthProtectedResourceMetadataUrl,oauthCustomProvider,oauthMetadata,oauthMetadataResponse,requireBearerAuth,verifyBearerToken};

package/dist/oauth/internal.d.ts

@@ -21,4 +21,3 @@ export declare function getOAuthProviderOptions<TUser>(provider: OAuthProvider<T
     resourceName?: string;
     serviceDocumentationUrl?: URL;
 };
-//# sourceMappingURL=internal.d.ts.map

package/dist/oauth/jwt.d.ts

@@ -1,4 +1,5 @@
-import { OAuthError, type AuthInfo, type OAuthTokenVerifier } from "@modelcontextprotocol/server";
+import { type AuthInfo, type OAuthTokenVerifier } from "@modelcontextprotocol/server";
+export { invalidToken } from "./errors.js";
 /** @internal Record of claims extracted from a verified JWT. */
 export type VerifiedPayload = Record<string, unknown>;
 /** @internal Configures issuer, keys, and claims enforced by a JWT verifier. */
@@ -6,6 +7,14 @@ export interface JwtVerifierOptions {
     issuer: string;
     jwksUrl: URL;
     resource: URL;
+    /** Provider-specific JWT audience, when it differs from the MCP resource. */
+    audience?: string | string[];
+    /**
+     * Treat successful issuer validation as the provider's resource binding.
+     * Use only for providers whose access-token model is scoped by issuer rather
+     * than an aud/resource claim.
+     */
+    issuerBoundAccessTokens?: boolean;
     algorithms?: readonly string[];
     key?: Uint8Array;
 }
@@ -31,6 +40,3 @@ export declare function recordValue(claims: VerifiedPayload, name: string): Reco
 export declare function normalizedStrings(value: unknown): string[];
 /** @internal Returns a future numeric claim or raises an invalid-token error. */
 export declare function requiredFutureNumber(claims: VerifiedPayload, name: string): number;
-/** @internal Creates an OAuth invalid-token error with an optional cause. */
-export declare function invalidToken(message: string, cause?: unknown): OAuthError;
-//# sourceMappingURL=jwt.d.ts.map

package/dist/oauth/keycloak.d.ts

@@ -1,20 +1,37 @@
+/**
+ * Verify Keycloak access tokens for an mcp-use resource server.
+ *
+ * @packageDocumentation
+ */
 import { type OAuthProvider, type OAuthResourceOptions } from "./provider.js";
 /** Verified Keycloak user and role claims exposed to authenticated MCP callbacks. */
 export interface KeycloakOAuthUser {
+    /** Keycloak subject identifier. */
     id: string;
+    /** Primary email address, when included in the access token. */
     email?: string;
+    /** Display name, when included in the access token. */
     name?: string;
+    /** Preferred username, when included in the access token. */
     preferredUsername?: string;
+    /** Given name, when included in the access token. */
     givenName?: string;
+    /** Family name, when included in the access token. */
     familyName?: string;
+    /** Whether Keycloak has verified {@link KeycloakOAuthUser.email}. */
     emailVerified?: boolean;
+    /** Realm roles from `realm_access.roles`. */
     roles: string[];
+    /** Unmodified `realm_access` claim, when present. */
     realmAccess?: Record<string, unknown>;
+    /** Unmodified `resource_access` claim, when present. */
     resourceAccess?: Record<string, unknown>;
 }
 /** Configures Keycloak JWT verification and protected-resource metadata. */
 export interface KeycloakOAuthProviderOptions extends OAuthResourceOptions {
+    /** Base URL of the Keycloak server. */
     serverUrl: URL | string;
+    /** Keycloak realm that issues accepted access tokens. */
     realm: string;
 }
 /**
@@ -22,6 +39,16 @@ export interface KeycloakOAuthProviderOptions extends OAuthResourceOptions {
  *
  * @param options - Keycloak server URL, realm, and resource-server settings.
  * @returns A provider that rejects tokens not issued for the resolved MCP resource.
+ * @throws A `TypeError` if `serverUrl` or `realm` is invalid.
+ *
+ * @example
+ * ```ts
+ * import { oauthKeycloakProvider } from "mcp-use/oauth/keycloak";
+ *
+ * const oauth = oauthKeycloakProvider({
+ *   serverUrl: "https://keycloak.example.com",
+ *   realm: "production",
+ * });
+ * ```
  */
 export declare function oauthKeycloakProvider(options: KeycloakOAuthProviderOptions): OAuthProvider<KeycloakOAuthUser>;
-//# sourceMappingURL=keycloak.d.ts.map

package/dist/oauth/keycloak.js

@@ -1,94 +1 @@
-import {
-  booleanValue,
-  createJwtVerifier,
-  invalidToken,
-  isRecord,
-  normalizedProviderUrl,
-  normalizedStrings,
-  oauthCustomProvider,
-  payloadFromAuthInfo,
-  providerEndpoint,
-  recordValue,
-  requiredString,
-  stringValue
-} from "../chunk-DPL7OEXC.js";
-
-// src/oauth/keycloak.ts
-function oauthKeycloakProvider(options) {
-  if (typeof options.realm !== "string" || options.realm.trim().length === 0 || /[/?#]/.test(options.realm)) {
-    throw new TypeError("Keycloak realm is invalid");
-  }
-  const serverUrl = normalizedProviderUrl(
-    options.serverUrl,
-    "Keycloak serverUrl"
-  );
-  const issuer = providerEndpoint(
-    serverUrl,
-    `realms/${encodeURIComponent(options.realm)}`
-  ).replace(/\/$/, "");
-  return oauthCustomProvider({
-    ...options,
-    createTokenVerifier: (resource) => createJwtVerifier({
-      issuer,
-      jwksUrl: new URL(
-        providerEndpoint(issuer, "protocol/openid-connect/certs")
-      ),
-      resource
-    }),
-    oauthMetadata: {
-      issuer,
-      authorization_endpoint: providerEndpoint(
-        issuer,
-        "protocol/openid-connect/auth"
-      ),
-      token_endpoint: providerEndpoint(issuer, "protocol/openid-connect/token"),
-      registration_endpoint: providerEndpoint(
-        issuer,
-        "clients-registrations/openid-connect"
-      ),
-      response_types_supported: ["code"],
-      grant_types_supported: ["authorization_code", "refresh_token"],
-      code_challenge_methods_supported: ["S256"]
-    },
-    mapAuthInfo: mapUser
-  });
-}
-function mapUser(authInfo) {
-  const payload = payloadFromAuthInfo(authInfo);
-  const id = requiredString(payload, "sub");
-  if (id === void 0) throw invalidToken("Missing Keycloak subject");
-  const realmAccess = recordValue(payload, "realm_access");
-  const resourceAccess = recordValue(payload, "resource_access");
-  return {
-    user: {
-      id,
-      ...optional("email", stringValue(payload, "email")),
-      ...optional("name", stringValue(payload, "name")),
-      ...optional(
-        "preferredUsername",
-        stringValue(payload, "preferred_username")
-      ),
-      ...optional("givenName", stringValue(payload, "given_name")),
-      ...optional("familyName", stringValue(payload, "family_name")),
-      ...optional("emailVerified", booleanValue(payload, "email_verified")),
-      roles: realmAccess === void 0 ? [] : normalizedStrings(realmAccess["roles"]),
-      ...realmAccess !== void 0 && { realmAccess },
-      ...resourceAccess !== void 0 && { resourceAccess }
-    },
-    payload,
-    permissions: resourcePermissions(resourceAccess)
-  };
-}
-function optional(key, value) {
-  return value === void 0 ? {} : { [key]: value };
-}
-function resourcePermissions(resourceAccess) {
-  if (resourceAccess === void 0) return [];
-  return Object.entries(resourceAccess).flatMap(
-    ([resource, value]) => isRecord(value) ? normalizedStrings(value["roles"]).map((role) => `${resource}:${role}`) : []
-  );
-}
-export {
-  oauthKeycloakProvider
-};
-//# sourceMappingURL=keycloak.js.map
+import{booleanValue,createJwtVerifier,normalizedProviderUrl,normalizedStrings,payloadFromAuthInfo,providerEndpoint,recordValue,requiredString,stringValue}from"../chunk-KGTOBJW2.js";import{invalidToken,isRecord,oauthCustomProvider}from"../chunk-IS7FKXFR.js";function oauthKeycloakProvider(options){if(typeof options.realm!="string"||options.realm.trim().length===0||/[/?#]/.test(options.realm))throw new TypeError("Keycloak realm is invalid");let serverUrl=normalizedProviderUrl(options.serverUrl,"Keycloak serverUrl"),issuer=providerEndpoint(serverUrl,`realms/${encodeURIComponent(options.realm)}`).replace(/\/$/,"");return oauthCustomProvider({...options,createTokenVerifier:resource=>createJwtVerifier({issuer,jwksUrl:new URL(providerEndpoint(issuer,"protocol/openid-connect/certs")),resource}),oauthMetadata:{issuer,authorization_endpoint:providerEndpoint(issuer,"protocol/openid-connect/auth"),token_endpoint:providerEndpoint(issuer,"protocol/openid-connect/token"),registration_endpoint:providerEndpoint(issuer,"clients-registrations/openid-connect"),response_types_supported:["code"],grant_types_supported:["authorization_code","refresh_token"],code_challenge_methods_supported:["S256"]},mapAuthInfo:mapUser})}function mapUser(authInfo){let payload=payloadFromAuthInfo(authInfo),id=requiredString(payload,"sub");if(id===void 0)throw invalidToken("Missing Keycloak subject");let realmAccess=recordValue(payload,"realm_access"),resourceAccess=recordValue(payload,"resource_access");return{user:{id,...optional("email",stringValue(payload,"email")),...optional("name",stringValue(payload,"name")),...optional("preferredUsername",stringValue(payload,"preferred_username")),...optional("givenName",stringValue(payload,"given_name")),...optional("familyName",stringValue(payload,"family_name")),...optional("emailVerified",booleanValue(payload,"email_verified")),roles:realmAccess===void 0?[]:normalizedStrings(realmAccess.roles),...realmAccess!==void 0&&{realmAccess},...resourceAccess!==void 0&&{resourceAccess}},payload,permissions:resourcePermissions(resourceAccess)}}function optional(key,value){return value===void 0?{}:{[key]:value}}function resourcePermissions(resourceAccess){return resourceAccess===void 0?[]:Object.entries(resourceAccess).flatMap(([resource,value])=>isRecord(value)?normalizedStrings(value.roles).map(role=>`${resource}:${role}`):[])}export{oauthKeycloakProvider};

package/dist/oauth/provider.d.ts

@@ -30,7 +30,7 @@ export interface CustomOAuthProviderOptions<TUser> extends OAuthResourceOptions
     /** Maps verified SDK auth information into mcp-use callback identity data. */
     mapAuthInfo: (authInfo: OAuthAuthInfo) => OAuthExtra<TUser>;
 }
-/** OAuth resource-server provider accepted by {@link MCPServer}. */
+/** OAuth resource-server provider accepted by the mcp-use server constructor. */
 export type OAuthProvider<TUser> = CustomOAuthProviderOptions<TUser>;
 /**
  * Creates an OAuth provider backed by an external authorization server.
@@ -38,6 +38,21 @@ export type OAuthProvider<TUser> = CustomOAuthProviderOptions<TUser>;
  * @typeParam TUser - Application user type exposed to authenticated callbacks.
  * @param options - Token verification, discovery metadata, and identity mapping.
  * @returns A provider for an OAuth-enabled MCP server.
+ * @throws A `TypeError` if provider metadata or resource settings are invalid.
+ *
+ * @example
+ * ```ts
+ * import { oauthCustomProvider } from "mcp-use/oauth";
+ *
+ * const oauth = oauthCustomProvider({
+ *   createTokenVerifier: (resource) => tokenVerifierFor(resource),
+ *   oauthMetadata,
+ *   mapAuthInfo: (authInfo) => ({
+ *     user: { id: authInfo.clientId },
+ *     payload: {},
+ *     permissions: [],
+ *   }),
+ * });
+ * ```
  */
 export declare function oauthCustomProvider<TUser>(options: CustomOAuthProviderOptions<TUser>): OAuthProvider<TUser>;
-//# sourceMappingURL=provider.d.ts.map

package/dist/oauth/supabase.d.ts

@@ -1,33 +1,69 @@
+/**
+ * Verify Supabase access tokens for an mcp-use resource server.
+ *
+ * @packageDocumentation
+ */
 import { type OAuthProvider, type OAuthResourceOptions } from "./provider.js";
 /** Verified Supabase user claims exposed to authenticated MCP callbacks. */
 export interface SupabaseOAuthUser {
+    /** Supabase user identifier. */
     id: string;
+    /** Primary email address, when included in the access token. */
     email?: string;
+    /** Display name from `user_metadata.name`. */
     name?: string;
+    /** Full name from `user_metadata.full_name`. */
     fullName?: string;
+    /** Username from `user_metadata.username`. */
     username?: string;
+    /** Profile image URL from `user_metadata.avatar_url`. */
     avatarUrl?: string;
+    /** Supabase Postgres role from the access token. */
     role?: string;
+    /** Authenticator assurance level for the session. */
     aal?: string;
+    /** Authentication methods used for the session. */
     amr: SupabaseAmr[];
+    /** Supabase session identifier. */
     sessionId?: string;
 }
 /** A verified Supabase authentication-method reference. */
 export interface SupabaseAmr {
+    /** Authentication method name, such as `password` or `totp`. */
     method: string;
+    /** Unix timestamp at which the authentication method was completed. */
     timestamp?: number;
 }
 /** Configures Supabase JWT verification and protected-resource metadata. */
 export interface SupabaseOAuthProviderOptions extends OAuthResourceOptions {
+    /** Supabase project identifier used to derive `supabaseUrl`. */
     projectId?: string;
+    /** Full Supabase project URL. Takes precedence over `projectId`. */
     supabaseUrl?: URL | string;
+    /** Legacy HS256 JWT secret. Omit to verify ES256 tokens against project JWKS. */
     jwtSecret?: string;
+    /**
+     * Expected access-token audience.
+     *
+     * @defaultValue `"authenticated"`
+     */
+    audience?: string;
 }
 /**
  * Creates a provider that verifies Supabase access tokens and maps their claims.
  *
- * @param options - Supabase project or URL, optional JWT secret, and resource-server settings.
+ * @param options - Supabase project or URL, optional JWT secret/audience, and resource-server settings.
  * @returns A provider that rejects tokens without a valid configured Supabase signature and issuer.
+ * @throws A `TypeError` if project settings are invalid, `audience` is empty,
+ * or `jwtSecret` is shorter than 32 bytes.
+ *
+ * @example
+ * ```ts
+ * import { oauthSupabaseProvider } from "mcp-use/oauth/supabase";
+ *
+ * const oauth = oauthSupabaseProvider({
+ *   projectId: "example-project",
+ * });
+ * ```
  */
 export declare function oauthSupabaseProvider(options: SupabaseOAuthProviderOptions): OAuthProvider<SupabaseOAuthUser>;
-//# sourceMappingURL=supabase.d.ts.map

package/dist/oauth/supabase.js

@@ -1,101 +1 @@
-import {
-  createJwtVerifier,
-  invalidToken,
-  isRecord,
-  normalizedProviderUrl,
-  oauthCustomProvider,
-  payloadFromAuthInfo,
-  providerEndpoint,
-  recordValue,
-  requiredString,
-  stringValue
-} from "../chunk-DPL7OEXC.js";
-
-// src/oauth/supabase.ts
-function oauthSupabaseProvider(options) {
-  const supabaseUrl = resolveSupabaseUrl(options);
-  const issuer = providerEndpoint(supabaseUrl, "auth/v1").replace(/\/$/, "");
-  const secret = options.jwtSecret;
-  if (secret !== void 0 && new TextEncoder().encode(secret).length < 32) {
-    throw new TypeError("Supabase jwtSecret must be at least 32 bytes");
-  }
-  return oauthCustomProvider({
-    ...options,
-    createTokenVerifier: (resource) => createJwtVerifier({
-      issuer,
-      jwksUrl: new URL(
-        providerEndpoint(supabaseUrl, "auth/v1/.well-known/jwks.json")
-      ),
-      ...secret !== void 0 ? { key: new TextEncoder().encode(secret), algorithms: ["HS256"] } : { algorithms: ["ES256"] },
-      resource
-    }),
-    oauthMetadata: {
-      issuer,
-      authorization_endpoint: providerEndpoint(
-        supabaseUrl,
-        "auth/v1/oauth/authorize"
-      ),
-      token_endpoint: providerEndpoint(supabaseUrl, "auth/v1/oauth/token"),
-      registration_endpoint: providerEndpoint(
-        supabaseUrl,
-        "auth/v1/oauth/clients/register"
-      ),
-      response_types_supported: ["code"],
-      grant_types_supported: ["authorization_code", "refresh_token"],
-      code_challenge_methods_supported: ["S256"]
-    },
-    mapAuthInfo: mapUser
-  });
-}
-function mapUser(authInfo) {
-  const payload = payloadFromAuthInfo(authInfo);
-  const id = requiredString(payload, "sub") ?? requiredString(payload, "user_id");
-  if (id === void 0) throw invalidToken("Missing Supabase subject");
-  const userMetadata = recordValue(payload, "user_metadata") ?? {};
-  const aal = stringValue(payload, "aal");
-  return {
-    user: {
-      id,
-      ...optional("email", stringValue(payload, "email")),
-      ...optional("name", stringValue(userMetadata, "name")),
-      ...optional("fullName", stringValue(userMetadata, "full_name")),
-      ...optional("username", stringValue(userMetadata, "username")),
-      ...optional("avatarUrl", stringValue(userMetadata, "avatar_url")),
-      ...optional("role", stringValue(payload, "role")),
-      ...optional("aal", aal),
-      amr: supabaseAmr(payload["amr"]),
-      ...optional("sessionId", stringValue(payload, "session_id"))
-    },
-    payload,
-    permissions: aal === void 0 ? [] : [`aal:${aal}`]
-  };
-}
-function optional(key, value) {
-  return value === void 0 ? {} : { [key]: value };
-}
-function resolveSupabaseUrl(options) {
-  if (options.supabaseUrl !== void 0) {
-    return normalizedProviderUrl(options.supabaseUrl, "supabaseUrl");
-  }
-  if (options.projectId === void 0 || !/^[a-z0-9-]+$/i.test(options.projectId)) {
-    throw new TypeError("Supabase requires projectId or supabaseUrl");
-  }
-  return new URL(`https://${options.projectId}.supabase.co`);
-}
-function supabaseAmr(value) {
-  if (!Array.isArray(value)) return [];
-  return value.flatMap((item) => {
-    if (!isRecord(item)) return [];
-    const method = item["method"];
-    const timestamp = item["timestamp"];
-    if (typeof method !== "string" || method.length === 0) return [];
-    if (timestamp !== void 0 && (typeof timestamp !== "number" || !Number.isFinite(timestamp))) {
-      return [];
-    }
-    return [timestamp === void 0 ? { method } : { method, timestamp }];
-  });
-}
-export {
-  oauthSupabaseProvider
-};
-//# sourceMappingURL=supabase.js.map
+import{createJwtVerifier,normalizedProviderUrl,payloadFromAuthInfo,providerEndpoint,recordValue,requiredString,stringValue}from"../chunk-KGTOBJW2.js";import{invalidToken,isRecord,oauthCustomProvider}from"../chunk-IS7FKXFR.js";function oauthSupabaseProvider(options){let supabaseUrl=resolveSupabaseUrl(options),issuer=providerEndpoint(supabaseUrl,"auth/v1").replace(/\/$/,""),secret=options.jwtSecret,audience=options.audience??"authenticated";if(typeof audience!="string"||audience.trim().length===0)throw new TypeError("Supabase audience must be non-empty");if(secret!==void 0&&new TextEncoder().encode(secret).length<32)throw new TypeError("Supabase jwtSecret must be at least 32 bytes");return oauthCustomProvider({...options,createTokenVerifier:resource=>createJwtVerifier({issuer,jwksUrl:new URL(providerEndpoint(supabaseUrl,"auth/v1/.well-known/jwks.json")),...secret!==void 0?{key:new TextEncoder().encode(secret),algorithms:["HS256"]}:{algorithms:["ES256"]},resource,audience}),oauthMetadata:{issuer,authorization_endpoint:providerEndpoint(supabaseUrl,"auth/v1/oauth/authorize"),token_endpoint:providerEndpoint(supabaseUrl,"auth/v1/oauth/token"),registration_endpoint:providerEndpoint(supabaseUrl,"auth/v1/oauth/clients/register"),response_types_supported:["code"],grant_types_supported:["authorization_code","refresh_token"],code_challenge_methods_supported:["S256"]},mapAuthInfo:mapUser})}function mapUser(authInfo){let payload=payloadFromAuthInfo(authInfo),id=requiredString(payload,"sub")??requiredString(payload,"user_id");if(id===void 0)throw invalidToken("Missing Supabase subject");let userMetadata=recordValue(payload,"user_metadata")??{},aal=stringValue(payload,"aal");return{user:{id,...optional("email",stringValue(payload,"email")),...optional("name",stringValue(userMetadata,"name")),...optional("fullName",stringValue(userMetadata,"full_name")),...optional("username",stringValue(userMetadata,"username")),...optional("avatarUrl",stringValue(userMetadata,"avatar_url")),...optional("role",stringValue(payload,"role")),...optional("aal",aal),amr:supabaseAmr(payload.amr),...optional("sessionId",stringValue(payload,"session_id"))},payload,permissions:aal===void 0?[]:[`aal:${aal}`]}}function optional(key,value){return value===void 0?{}:{[key]:value}}function resolveSupabaseUrl(options){if(options.supabaseUrl!==void 0)return normalizedProviderUrl(options.supabaseUrl,"supabaseUrl");if(options.projectId===void 0||!/^[a-z0-9-]+$/i.test(options.projectId))throw new TypeError("Supabase requires projectId or supabaseUrl");return new URL(`https://${options.projectId}.supabase.co`)}function supabaseAmr(value){return Array.isArray(value)?value.flatMap(item=>{if(!isRecord(item))return[];let method=item.method,timestamp=item.timestamp;return typeof method!="string"||method.length===0?[]:timestamp!==void 0&&(typeof timestamp!="number"||!Number.isFinite(timestamp))?[]:[timestamp===void 0?{method}:{method,timestamp}]}):[]}export{oauthSupabaseProvider};

package/dist/oauth/workos.d.ts

@@ -1,20 +1,37 @@
+/**
+ * Verify WorkOS AuthKit access tokens for an mcp-use resource server.
+ *
+ * @packageDocumentation
+ */
 import { type OAuthProvider, type OAuthResourceOptions } from "./provider.js";
 /** Verified WorkOS user and organization claims exposed to authenticated MCP callbacks. */
 export interface WorkOSOAuthUser {
+    /** WorkOS subject identifier. */
     id: string;
+    /** Primary email address, when included in the access token. */
     email?: string;
+    /** Whether WorkOS has verified {@link WorkOSOAuthUser.email}. */
     emailVerified?: boolean;
+    /** Display name, when included in the access token. */
     name?: string;
+    /** Preferred username, when included in the access token. */
     preferredUsername?: string;
+    /** Given name, when included in the access token. */
     firstName?: string;
+    /** Family name, when included in the access token. */
     lastName?: string;
+    /** Profile image URL, when included in the access token. */
     picture?: string;
+    /** Roles from the access token's `roles` claim. */
     roles: string[];
+    /** Active WorkOS organization identifier. */
     organizationId?: string;
+    /** WorkOS session identifier. */
     sessionId?: string;
 }
 /** Configures WorkOS JWT verification and protected-resource metadata. */
 export interface WorkOSOAuthProviderOptions extends OAuthResourceOptions {
+    /** AuthKit subdomain, with or without the `https://` scheme. */
     subdomain: string;
 }
 /**
@@ -22,6 +39,15 @@ export interface WorkOSOAuthProviderOptions extends OAuthResourceOptions {
  *
  * @param options - WorkOS AuthKit origin and resource-server settings.
  * @returns A provider that rejects tokens not issued for the resolved MCP resource.
+ * @throws A `TypeError` if `subdomain` is empty or uses a non-HTTPS URL.
+ *
+ * @example
+ * ```ts
+ * import { oauthWorkOSProvider } from "mcp-use/oauth/workos";
+ *
+ * const oauth = oauthWorkOSProvider({
+ *   subdomain: "example.authkit.app",
+ * });
+ * ```
  */
 export declare function oauthWorkOSProvider(options: WorkOSOAuthProviderOptions): OAuthProvider<WorkOSOAuthUser>;
-//# sourceMappingURL=workos.d.ts.map