skybridge 0.0.0-dev.e7d5814 → 0.0.0-dev.e8131c6

package/dist/server/auth/discovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.test.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,0BAA0B;AAC1B,KAAK,UAAU,KAAK,CAAC,KAAkD;IACrE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,CAAC;SAC5C,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;SACjE,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE;gBAC1C,wBAAwB,EAAE,SAAS;aACpC,CAAC;YACF,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE;gBAC1C,qBAAqB,EAAE,SAAS;aACjC,CAAC;YACF,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,mCAAmC,EAAE,GAAG,CAAC,mBAAmB,CAAC;SAC9D,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { discoverAuthorizationServer } from \"./discovery.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves JSON bodies built from the live origin at their well-known paths;\n// returns the origin URL.\nasync function serve(build: (origin: string) => Record<string, unknown>) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    const body = build(origin)[req.url ?? \"\"];\n    if (body === undefined) {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(body));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"discoverAuthorizationServer\", () => {\n  it(\"fetches and validates openid-configuration\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n    expect(meta.jwks_uri).toBe(`${base}/jwks`);\n  });\n\n  it(\"accepts a canonically slash-terminated issuer\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, { issuer: `${o}/` }),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"falls back to oauth-authorization-server when oidc is 404\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"throws when no well-known doc is reachable\", async () => {\n    const base = await serve(() => ({}));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n\n  it(\"falls through to oauth-authorization-server when oidc doc is schema-invalid\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, {\n        response_types_supported: undefined,\n      }),\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"prefers the doc advertising DCR when oidc omits registration_endpoint\", async () => {\n    // Clerk-shaped: valid openid-configuration without a registration_endpoint,\n    // DCR exposed only at oauth-authorization-server.\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, {\n        registration_endpoint: undefined,\n      }),\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"rejects a doc whose issuer does not match the fetch origin\", async () => {\n    const base = await serve(() => ({\n      \"/.well-known/openid-configuration\": doc(\"https://evil.test\"),\n    }));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n});\n"]}

package/dist/server/auth/index.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { JwksVerifyConfig } from "./verify.js";
+/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
+export type OAuthConfig = {
+    /**
+     * Public URL of this server; sets `resourceServerUrl` and the
+     * `resource_metadata` URL. When omitted, it is inferred per request from
+     * `x-forwarded-host`/`origin`/`host` headers.
+     */
+    baseUrl?: string;
+    /** AS metadata served at `/.well-known/oauth-authorization-server`. */
+    oauthMetadata: OAuthMetadata;
+    verify: JwksVerifyConfig;
+    /** Scopes advertised in protected-resource metadata. */
+    scopesSupported?: string[];
+    /** Server-wide required-scope floor. */
+    requiredScopes?: string[];
+};

package/dist/server/auth/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /**\n   * Public URL of this server; sets `resourceServerUrl` and the\n   * `resource_metadata` URL. When omitted, it is inferred per request from\n   * `x-forwarded-host`/`origin`/`host` headers.\n   */\n  baseUrl?: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n};\n"]}

package/dist/server/auth/providers/auth0.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for Auth0. `domain` is the tenant domain (e.g.
+ * `acme.us.auth0.com`) or a custom domain. Requires Dynamic Client
+ * Registration enabled on the tenant (`enable_dynamic_client_registration`).
+ * `audience` is the registered API Identifier — Auth0 only issues a verifiable
+ * JWT (rather than an opaque token) when the request targets that audience.
+ */
+export declare function auth0Provider(opts: {
+    domain: string;
+    audience: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig>;

package/dist/server/auth/providers/auth0.js

@@ -0,0 +1,31 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for Auth0. `domain` is the tenant domain (e.g.
+ * `acme.us.auth0.com`) or a custom domain. Requires Dynamic Client
+ * Registration enabled on the tenant (`enable_dynamic_client_registration`).
+ * `audience` is the registered API Identifier — Auth0 only issues a verifiable
+ * JWT (rather than an opaque token) when the request targets that audience.
+ */
+export async function auth0Provider(opts) {
+    const { domain, audience, ...rest } = opts;
+    const config = await customProvider({
+        issuer: toIssuerUrl(domain),
+        audience,
+        ...rest,
+    });
+    // Auth0 only mints a verifiable JWT when /authorize targets a registered API.
+    // Bake the audience into the authorization endpoint so it no longer depends on
+    // the client's RFC 8707 `resource` matching the API Identifier byte-for-byte
+    // (ChatGPT's trailing-slash canonicalization breaks that → `Service not found`).
+    const authUrl = new URL(config.oauthMetadata.authorization_endpoint);
+    authUrl.searchParams.set("audience", audience);
+    return {
+        ...config,
+        oauthMetadata: {
+            ...config.oauthMetadata,
+            authorization_endpoint: authUrl.href,
+        },
+    };
+}
+//# sourceMappingURL=auth0.js.map

package/dist/server/auth/providers/auth0.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,QAAQ;QACR,GAAG,IAAI;KACR,CAAC,CAAC;IACH,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,iFAAiF;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACrE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE;YACb,GAAG,MAAM,CAAC,aAAa;YACvB,sBAAsB,EAAE,OAAO,CAAC,IAAI;SACrC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for Auth0. `domain` is the tenant domain (e.g.\n * `acme.us.auth0.com`) or a custom domain. Requires Dynamic Client\n * Registration enabled on the tenant (`enable_dynamic_client_registration`).\n * `audience` is the registered API Identifier — Auth0 only issues a verifiable\n * JWT (rather than an opaque token) when the request targets that audience.\n */\nexport async function auth0Provider(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): Promise<OAuthConfig> {\n  const { domain, audience, ...rest } = opts;\n  const config = await customProvider({\n    issuer: toIssuerUrl(domain),\n    audience,\n    ...rest,\n  });\n  // Auth0 only mints a verifiable JWT when /authorize targets a registered API.\n  // Bake the audience into the authorization endpoint so it no longer depends on\n  // the client's RFC 8707 `resource` matching the API Identifier byte-for-byte\n  // (ChatGPT's trailing-slash canonicalization breaks that → `Service not found`).\n  const authUrl = new URL(config.oauthMetadata.authorization_endpoint);\n  authUrl.searchParams.set(\"audience\", audience);\n  return {\n    ...config,\n    oauthMetadata: {\n      ...config.oauthMetadata,\n      authorization_endpoint: authUrl.href,\n    },\n  };\n}\n"]}

package/dist/server/auth/providers/auth0.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/auth0.test.js

@@ -0,0 +1,32 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { auth0Provider } from "./auth0.js";
+afterEach(() => vi.restoreAllMocks());
+function doc(issuer) {
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/oauth/token`,
+        registration_endpoint: `${issuer}/oidc/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "profile", "email"],
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+describe("auth0Provider", () => {
+    it("bakes the audience into the authorization endpoint (Auth0 needs it to mint a JWT)", async () => {
+        const issuer = "https://acme.us.auth0.com";
+        vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(doc(issuer)), {
+            headers: { "content-type": "application/json" },
+        }));
+        const config = await auth0Provider({
+            domain: "acme.us.auth0.com",
+            audience: "https://api.example.com/",
+        });
+        const url = new URL(config.oauthMetadata.authorization_endpoint);
+        expect(url.origin + url.pathname).toBe(`${issuer}/authorize`);
+        expect(url.searchParams.get("audience")).toBe("https://api.example.com/");
+        expect(config.verify.audience).toBe("https://api.example.com/");
+    });
+});
+//# sourceMappingURL=auth0.test.js.map

package/dist/server/auth/providers/auth0.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/auth0.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,gBAAgB;QAChD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,MAAM,GAAG,2BAA2B,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,0BAA0B;SACrC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { auth0Provider } from \"./auth0.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction doc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/oauth/token`,\n    registration_endpoint: `${issuer}/oidc/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"profile\", \"email\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\ndescribe(\"auth0Provider\", () => {\n  it(\"bakes the audience into the authorization endpoint (Auth0 needs it to mint a JWT)\", async () => {\n    const issuer = \"https://acme.us.auth0.com\";\n    vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n      new Response(JSON.stringify(doc(issuer)), {\n        headers: { \"content-type\": \"application/json\" },\n      }),\n    );\n\n    const config = await auth0Provider({\n      domain: \"acme.us.auth0.com\",\n      audience: \"https://api.example.com/\",\n    });\n\n    const url = new URL(config.oauthMetadata.authorization_endpoint);\n    expect(url.origin + url.pathname).toBe(`${issuer}/authorize`);\n    expect(url.searchParams.get(\"audience\")).toBe(\"https://api.example.com/\");\n    expect(config.verify.audience).toBe(\"https://api.example.com/\");\n  });\n});\n"]}

package/dist/server/auth/providers/clerk.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.
+ * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic
+ * Client Registration enabled on the instance, and the OAuth application set to
+ * issue JWT access tokens (opaque tokens can't be JWKS-verified).
+ *
+ * Clerk access tokens carry no `aud` claim, so there is no `audience` option —
+ * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).
+ */
+export declare function clerkProvider(opts: {
+    domain: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig>;

package/dist/server/auth/providers/clerk.js

@@ -0,0 +1,16 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.
+ * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic
+ * Client Registration enabled on the instance, and the OAuth application set to
+ * issue JWT access tokens (opaque tokens can't be JWKS-verified).
+ *
+ * Clerk access tokens carry no `aud` claim, so there is no `audience` option —
+ * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).
+ */
+export function clerkProvider(opts) {
+    const { domain, ...rest } = opts;
+    return customProvider({ issuer: toIssuerUrl(domain), ...rest });
+}
+//# sourceMappingURL=clerk.js.map

package/dist/server/auth/providers/clerk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/clerk.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA6E;IAE7E,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.\n * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic\n * Client Registration enabled on the instance, and the OAuth application set to\n * issue JWT access tokens (opaque tokens can't be JWKS-verified).\n *\n * Clerk access tokens carry no `aud` claim, so there is no `audience` option —\n * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).\n */\nexport function clerkProvider(\n  opts: { domain: string } & Omit<CustomProviderOptions, \"issuer\" | \"audience\">,\n): Promise<OAuthConfig> {\n  const { domain, ...rest } = opts;\n  return customProvider({ issuer: toIssuerUrl(domain), ...rest });\n}\n"]}

package/dist/server/auth/providers/clerk.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/clerk.test.js

@@ -0,0 +1,28 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { clerkProvider } from "./clerk.js";
+afterEach(() => vi.restoreAllMocks());
+function doc(issuer) {
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/oauth/authorize`,
+        token_endpoint: `${issuer}/oauth/token`,
+        registration_endpoint: `${issuer}/oauth/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["profile", "email"],
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+describe("clerkProvider", () => {
+    it("verifies issuer + JWKS with no audience (Clerk tokens carry no aud)", async () => {
+        const issuer = "https://acme.clerk.accounts.dev";
+        const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(doc(issuer)), {
+            headers: { "content-type": "application/json" },
+        }));
+        const config = await clerkProvider({ domain: "acme.clerk.accounts.dev" });
+        expect(fetchSpy).toHaveBeenCalledWith(`${issuer}/.well-known/openid-configuration`, expect.anything());
+        expect(config.verify.issuer).toBe(issuer);
+        expect(config.verify.audience).toBeUndefined();
+    });
+});
+//# sourceMappingURL=clerk.test.js.map

package/dist/server/auth/providers/clerk.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/clerk.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,iCAAiC,CAAC;QACjD,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,MAAM,mCAAmC,EAC5C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { clerkProvider } from \"./clerk.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction doc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/oauth/authorize`,\n    token_endpoint: `${issuer}/oauth/token`,\n    registration_endpoint: `${issuer}/oauth/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"profile\", \"email\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\ndescribe(\"clerkProvider\", () => {\n  it(\"verifies issuer + JWKS with no audience (Clerk tokens carry no aud)\", async () => {\n    const issuer = \"https://acme.clerk.accounts.dev\";\n    const fetchSpy = vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n      new Response(JSON.stringify(doc(issuer)), {\n        headers: { \"content-type\": \"application/json\" },\n      }),\n    );\n\n    const config = await clerkProvider({ domain: \"acme.clerk.accounts.dev\" });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${issuer}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(config.verify.issuer).toBe(issuer);\n    expect(config.verify.audience).toBeUndefined();\n  });\n});\n"]}

package/dist/server/auth/providers/custom.d.ts

@@ -0,0 +1,17 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthConfig } from "../index.js";
+/** Options accepted by {@link customProvider} and the branded providers. */
+export type CustomProviderOptions = {
+    issuer: string;
+    /** Expected token `aud`. Omit to skip audience verification — only for IdPs
+     * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does
+     * bind an audience re-require it in their own options. */
+    audience?: string;
+    /** Omit to let the server infer the resource origin from request headers. */
+    baseUrl?: string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    metadataOverrides?: Omit<Partial<OAuthMetadata>, "issuer">;
+};
+/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */
+export declare function customProvider(opts: CustomProviderOptions): Promise<OAuthConfig>;

package/dist/server/auth/providers/custom.js

@@ -0,0 +1,28 @@
+import { discoverAuthorizationServer, } from "../discovery.js";
+/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */
+export async function customProvider(opts) {
+    const discovered = await discoverAuthorizationServer(opts.issuer);
+    // The IdP's own discovery must advertise DCR and a JWKS; overrides can't fake it.
+    if (!discovered.registration_endpoint) {
+        throw new Error(`${opts.issuer} is not DCR-compatible (no registration_endpoint); customProvider only supports DCR IdPs.`);
+    }
+    if (!discovered.jwks_uri) {
+        throw new Error(`${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`);
+    }
+    // Overrides adjust only advertised metadata (e.g. proxied endpoints). The
+    // trust anchor (issuer, jwks_uri) always comes from validated discovery.
+    const { issuer: _issuer, jwks_uri: _jwks, ...overrides } = opts.metadataOverrides ?? {};
+    const oauthMetadata = { ...discovered, ...overrides };
+    return {
+        baseUrl: opts.baseUrl,
+        oauthMetadata,
+        verify: {
+            issuer: discovered.issuer,
+            audience: opts.audience,
+            jwksUri: discovered.jwks_uri,
+        },
+        scopesSupported: opts.scopes ?? oauthMetadata.scopes_supported,
+        requiredScopes: opts.requiredScopes,
+    };
+}
+//# sourceMappingURL=custom.js.map

package/dist/server/auth/providers/custom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAiBzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,kFAAkF;IAClF,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,2FAA2F,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,MAAM,aAAa,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IAE1E,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B;QACD,eAAe,EAAE,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,gBAAgB;QAC9D,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */\nexport async function customProvider(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // The IdP's own discovery must advertise DCR and a JWKS; overrides can't fake it.\n  if (!discovered.registration_endpoint) {\n    throw new Error(\n      `${opts.issuer} is not DCR-compatible (no registration_endpoint); customProvider only supports DCR IdPs.`,\n    );\n  }\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata (e.g. proxied endpoints). The\n  // trust anchor (issuer, jwks_uri) always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  const oauthMetadata: DiscoveredMetadata = { ...discovered, ...overrides };\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: discovered.issuer,\n      audience: opts.audience,\n      jwksUri: discovered.jwks_uri,\n    },\n    scopesSupported: opts.scopes ?? oauthMetadata.scopes_supported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}

package/dist/server/auth/providers/custom.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/custom.test.js

@@ -0,0 +1,91 @@
+// @vitest-environment node
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { customProvider } from "./custom.js";
+let server;
+afterEach(() => server?.close());
+function doc(origin, extra = {}) {
+    return {
+        issuer: origin,
+        authorization_endpoint: `${origin}/authorize`,
+        token_endpoint: `${origin}/token`,
+        registration_endpoint: `${origin}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "email", "profile"],
+        jwks_uri: `${origin}/jwks`,
+        ...extra,
+    };
+}
+// Serves the discovery doc (built from the live origin) at the OIDC well-known path.
+async function serveDiscovery(extra = {}) {
+    let origin = "";
+    const srv = http.createServer((req, res) => {
+        if (req.url !== "/.well-known/openid-configuration") {
+            res.writeHead(404).end();
+            return;
+        }
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify(doc(origin, extra)));
+    });
+    await new Promise((resolve) => srv.listen(0, resolve));
+    server = srv;
+    origin = `http://localhost:${srv.address().port}`;
+    return origin;
+}
+describe("customProvider", () => {
+    it("builds an OAuthConfig from discovery", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "my-api",
+            baseUrl: "https://app.example.test",
+            scopes: ["openid"],
+        });
+        expect(config.baseUrl).toBe("https://app.example.test");
+        expect(config.verify).toEqual({
+            issuer: base,
+            audience: "my-api",
+            jwksUri: `${base}/jwks`,
+        });
+        expect(config.scopesSupported).toEqual(["openid"]);
+        expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("ignores a runtime issuer override (keeps the discovered trust anchor)", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            metadataOverrides: { issuer: "https://evil.test" },
+        });
+        expect(config.verify.issuer).toBe(base);
+        expect(config.oauthMetadata.issuer).toBe(base);
+    });
+    it("ignores a runtime jwks_uri override (keeps the discovered signing keys)", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            metadataOverrides: { jwks_uri: "https://evil.test/keys" },
+        });
+        expect(config.verify.jwksUri).toBe(`${base}/jwks`);
+    });
+    it("rejects a non-DCR IdP even if an override supplies registration_endpoint", async () => {
+        const base = await serveDiscovery({ registration_endpoint: undefined });
+        await expect(customProvider({
+            issuer: base,
+            audience: "a",
+            metadataOverrides: { registration_endpoint: `${base}/register` },
+        })).rejects.toThrow(/not DCR-compatible/);
+    });
+    it("applies metadataOverrides over discovered values", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            baseUrl: "https://app.example.test",
+            metadataOverrides: { token_endpoint: "https://override/token" },
+        });
+        expect(config.oauthMetadata.token_endpoint).toBe("https://override/token");
+    });
+});
+//# sourceMappingURL=custom.test.js.map

package/dist/server/auth/providers/custom.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAW;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAW;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,CACV,cAAc,CAAC;YACb,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,qBAAqB,EAAE,GAAG,IAAI,WAAW,EAAE;SACjE,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(config.verify).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"ignores a runtime issuer override (keeps the discovered trust anchor)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { issuer: \"https://evil.test\" } as never,\n    });\n    expect(config.verify.issuer).toBe(base);\n    expect(config.oauthMetadata.issuer).toBe(base);\n  });\n\n  it(\"ignores a runtime jwks_uri override (keeps the discovered signing keys)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { jwks_uri: \"https://evil.test/keys\" } as never,\n    });\n    expect(config.verify.jwksUri).toBe(`${base}/jwks`);\n  });\n\n  it(\"rejects a non-DCR IdP even if an override supplies registration_endpoint\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    await expect(\n      customProvider({\n        issuer: base,\n        audience: \"a\",\n        metadataOverrides: { registration_endpoint: `${base}/register` },\n      }),\n    ).rejects.toThrow(/not DCR-compatible/);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}

package/dist/server/auth/providers/descope.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery
+ * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.
+ * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your
+ * custom domain). Requires DCR enabled on the MCP Server. The token `audience`
+ * defaults to the **Project ID** derived from the URL — Descope binds `aud` to
+ * [DCR client id, project id], not the server URL; pass `audience` to override.
+ */
+export declare function descopeProvider(opts: {
+    url: string;
+} & Omit<CustomProviderOptions, "issuer">): Promise<OAuthConfig>;

package/dist/server/auth/providers/descope.js

@@ -0,0 +1,31 @@
+import { customProvider } from "./custom.js";
+/**
+ * Derives the Descope Project ID from an MCP Server URL
+ * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the
+ * project id, so it doubles as the audience.
+ */
+function projectIdFromUrl(url) {
+    const projectId = url.match(/\/agentic\/([^/]+)\/[^/]+/)?.[1];
+    if (!projectId) {
+        throw new Error(`Could not derive the Descope project id from "${url}"; pass an explicit \`audience\`.`);
+    }
+    return projectId;
+}
+/**
+ * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery
+ * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.
+ * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your
+ * custom domain). Requires DCR enabled on the MCP Server. The token `audience`
+ * defaults to the **Project ID** derived from the URL — Descope binds `aud` to
+ * [DCR client id, project id], not the server URL; pass `audience` to override.
+ */
+export function descopeProvider(opts) {
+    const { url, audience, ...rest } = opts;
+    const issuer = url.replace(/\/\.well-known\/[^?#]*$/, "").replace(/\/$/, "");
+    return customProvider({
+        issuer,
+        audience: audience ?? projectIdFromUrl(issuer),
+        ...rest,
+    });
+}
+//# sourceMappingURL=descope.js.map

package/dist/server/auth/providers/descope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzE;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAC9C,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. The token `audience`\n * defaults to the **Project ID** derived from the URL — Descope binds `aud` to\n * [DCR client id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig> {\n  const { url, audience, ...rest } = opts;\n  const issuer = url.replace(/\\/\\.well-known\\/[^?#]*$/, \"\").replace(/\\/$/, \"\");\n  return customProvider({\n    issuer,\n    audience: audience ?? projectIdFromUrl(issuer),\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/descope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/descope.test.js

@@ -0,0 +1,37 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { descopeProvider } from "./descope.js";
+afterEach(() => vi.restoreAllMocks());
+function discoveryDoc(issuer) {
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/token`,
+        registration_endpoint: `${issuer}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid"],
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+function mockDiscovery(issuer) {
+    return vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(discoveryDoc(issuer)), {
+        headers: { "content-type": "application/json" },
+    }));
+}
+describe("descopeProvider", () => {
+    it("derives issuer and audience (project id) from the MCP Server URL", async () => {
+        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
+        const fetchSpy = mockDiscovery(issuer);
+        const config = await descopeProvider({ url: issuer });
+        expect(fetchSpy).toHaveBeenCalledWith(`${issuer}/.well-known/openid-configuration`, expect.anything());
+        expect(config.verify.issuer).toBe(issuer);
+        expect(config.verify.audience).toBe("P123");
+    });
+    it("lets an explicit audience override the derived project id", async () => {
+        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
+        mockDiscovery(issuer);
+        const config = await descopeProvider({ url: issuer, audience: "custom" });
+        expect(config.verify.audience).toBe("custom");
+    });
+});
+//# sourceMappingURL=descope.test.js.map

package/dist/server/auth/providers/descope.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE;QACjD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,MAAM,mCAAmC,EAC5C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,aAAa,CAAC,MAAM,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(issuer: string) {\n  return vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n    new Response(JSON.stringify(discoveryDoc(issuer)), {\n      headers: { \"content-type\": \"application/json\" },\n    }),\n  );\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"derives issuer and audience (project id) from the MCP Server URL\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    const fetchSpy = mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${issuer}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(config.verify.issuer).toBe(issuer);\n    expect(config.verify.audience).toBe(\"P123\");\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer, audience: \"custom\" });\n\n    expect(config.verify.audience).toBe(\"custom\");\n  });\n});\n"]}

package/dist/server/auth/providers/shared.d.ts

@@ -0,0 +1,2 @@
+/** Normalises a bare host to an https issuer URL and strips a trailing slash. */
+export declare function toIssuerUrl(domain: string): string;

package/dist/server/auth/providers/shared.js

@@ -0,0 +1,6 @@
+/** Normalises a bare host to an https issuer URL and strips a trailing slash. */
+export function toIssuerUrl(domain) {
+    const withScheme = /^https?:\/\//.test(domain) ? domain : `https://${domain}`;
+    return withScheme.replace(/\/$/, "");
+}
+//# sourceMappingURL=shared.js.map

package/dist/server/auth/providers/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/shared.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;IAC9E,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC","sourcesContent":["/** Normalises a bare host to an https issuer URL and strips a trailing slash. */\nexport function toIssuerUrl(domain: string): string {\n  const withScheme = /^https?:\\/\\//.test(domain) ? domain : `https://${domain}`;\n  return withScheme.replace(/\\/$/, \"\");\n}\n"]}

package/dist/server/auth/providers/shared.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/shared.test.js

@@ -0,0 +1,10 @@
+import { describe, expect, it } from "vitest";
+import { toIssuerUrl } from "./shared.js";
+describe("toIssuerUrl", () => {
+    it("adds https to a bare host, preserves an explicit scheme, strips a trailing slash", () => {
+        expect(toIssuerUrl("acme.authkit.app")).toBe("https://acme.authkit.app");
+        expect(toIssuerUrl("https://acme.authkit.app/")).toBe("https://acme.authkit.app");
+        expect(toIssuerUrl("http://localhost:3000")).toBe("http://localhost:3000");
+    });
+});
+//# sourceMappingURL=shared.test.js.map

package/dist/server/auth/providers/shared.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/shared.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CACnD,0BAA0B,CAC3B,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { toIssuerUrl } from \"./shared.js\";\n\ndescribe(\"toIssuerUrl\", () => {\n  it(\"adds https to a bare host, preserves an explicit scheme, strips a trailing slash\", () => {\n    expect(toIssuerUrl(\"acme.authkit.app\")).toBe(\"https://acme.authkit.app\");\n    expect(toIssuerUrl(\"https://acme.authkit.app/\")).toBe(\n      \"https://acme.authkit.app\",\n    );\n    expect(toIssuerUrl(\"http://localhost:3000\")).toBe(\"http://localhost:3000\");\n  });\n});\n"]}

package/dist/server/auth/providers/stytch.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for Stytch Connected Apps. `domain` is the project domain,
+ * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires
+ * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID
+ * (the default token audience).
+ */
+export declare function stytchProvider(opts: {
+    domain: string;
+    audience: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig>;

package/dist/server/auth/providers/stytch.js

@@ -0,0 +1,13 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for Stytch Connected Apps. `domain` is the project domain,
+ * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires
+ * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID
+ * (the default token audience).
+ */
+export function stytchProvider(opts) {
+    const { domain, ...rest } = opts;
+    return customProvider({ issuer: toIssuerUrl(domain), ...rest });
+}
+//# sourceMappingURL=stytch.js.map

package/dist/server/auth/providers/stytch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stytch.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/stytch.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for Stytch Connected Apps. `domain` is the project domain,\n * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires\n * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID\n * (the default token audience).\n */\nexport function stytchProvider(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): Promise<OAuthConfig> {\n  const { domain, ...rest } = opts;\n  return customProvider({ issuer: toIssuerUrl(domain), ...rest });\n}\n"]}

package/dist/server/auth/providers/workos.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.
+ * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard
+ * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.
+ */
+export declare function workosProvider(opts: {
+    domain: string;
+    audience: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig>;

package/dist/server/auth/providers/workos.js

@@ -0,0 +1,12 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.
+ * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard
+ * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.
+ */
+export function workosProvider(opts) {
+    const { domain, ...rest } = opts;
+    return customProvider({ issuer: toIssuerUrl(domain), ...rest });
+}
+//# sourceMappingURL=workos.js.map

package/dist/server/auth/providers/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/workos.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.\n * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard\n * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.\n */\nexport function workosProvider(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): Promise<OAuthConfig> {\n  const { domain, ...rest } = opts;\n  return customProvider({ issuer: toIssuerUrl(domain), ...rest });\n}\n"]}