skybridge 0.0.0-dev.ecf87cf → 0.0.0-dev.ed29eee

package/dist/server/auth/setup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.test.js","sourceRoot":"","sources":["../../../src/server/auth/setup.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,IAAI,SAAkC,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,SAAS,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAc,EAAE,KAAK,GAAG,cAAc;IACvD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,KAAK;QACL,GAAG,EAAE,QAAQ;KACd,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EACE,OAAO,GAAG,0BAA0B,EACpC,YAAY,GAAG,KAAK,MACmC,EAAE;IAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YACxC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC7D,CAAC,CAAC;oBACE,QAAQ,EAAE,kBAAkB,CAAC;wBAC3B,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,QAAQ;wBAClB,OAAO;qBACR,CAAC;iBACH,CAAC;YACN,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,cAAc,EAAE,CAAC,QAAQ,CAAC;SAC3B;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE;QACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAED,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAA6D,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE;gBACP,kBAAkB,EAAE,gCAAgC;gBACpD,mBAAmB,EAAE,aAAa;aACnC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,oBAAoB;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CACjD,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,OAAO,EAAE,0BAA0B;YACnC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,QAAQ,EAAE,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,QAAQ;gBAClB,OAAO;aACR,CAAC;SACH;KACF,CACF;SACE,YAAY,CACX;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,SAAS;QACtB,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;KAChC,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH;SACA,YAAY,CACX;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,EAAE;KACT,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEH,MAAM,CAAC,YAA6C,CACnD,eAAe,EACf;QACE,WAAW,EAAE,4CAA4C;QACzD,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAc,EAAE,KAA2C,EAAE,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,OAAO,CAClB,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAC1D,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE;SACd,CAAC,CAA+C,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG;YACd,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;SAC9C,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;iBACxC;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAE/D,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB;oBACE,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;iBAClD;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE;aACjD,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;aAClD,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CACjD,uBAAuB,CACxB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,YAAY,EAAE,gBAAgB;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;aAClD,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,YAAY,EAAE,gBAAgB;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB;oBACE,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;iBAClD;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,gBAAgB,CAAC,OAAe;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,OAAO,EAAE,0BAA0B;YACnC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,QAAQ,EAAE,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,QAAQ;gBAClB,OAAO;aACR,CAAC;SACH;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;KAC/B,EACD,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CACpD,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;aAC5C,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,OAAO,CAClB,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE;YACxD,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE;SAC/D,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,EAAE;SACd,CAAC,CAAkE,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,GAAG,EAAE,CACV,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EACxC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,GAAG,EAAE,CACV,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAC9D,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,GAAG,EAAE,CACV,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAC/D,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,GAAG,EAAE,CAER,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAG5C,CACC;YACE,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,EAAE;YACf,IAAI,EAAE,EAAE;YACR,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SACtC,EACD,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE;YACpD,KAAK,EAAE;gBACL,OAAO,EAAE,WAAW;gBACpB,aAAa,EAAE,aAAa;gBAC5B,QAAQ,EAAE,kBAAkB,CAAC;oBAC3B,MAAM,EAAE,MAAM;oBACd,QAAQ,EAAE,QAAQ;iBACnB,CAAC;aACH;SACF,CAAC,CACL,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { RequestHandler } from \"express\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { McpServer } from \"../server.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"../viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nlet appServer: http.Server | undefined;\nafterEach(() => {\n  jwksServer?.close();\n  appServer?.close();\n});\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction signToken(key: CryptoKey, scope = \"openid email\") {\n  return new jose.SignJWT({\n    client_id: \"client-1\",\n    scope,\n    sub: \"user-1\",\n  })\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(ISSUER)\n    .setAudience(AUDIENCE)\n    .setExpirationTime(\"1h\")\n    .sign(key);\n}\n\nasync function bootServer(\n  jwksUri: string,\n  {\n    baseUrl = \"https://app.example.test\",\n    legacyVerify = false,\n  }: { baseUrl?: string | null; legacyVerify?: boolean } = {},\n) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        ...(baseUrl === null ? {} : { baseUrl }),\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        ...(legacyVerify\n          ? { verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri } }\n          : {\n              verifier: createJwksVerifier({\n                issuer: ISSUER,\n                audience: AUDIENCE,\n                jwksUri,\n              }),\n            }),\n        scopesSupported: [\"openid\", \"email\"],\n        requiredScopes: [\"openid\"],\n      },\n    },\n  ).registerTool(\n    {\n      name: \"whoami\",\n      description: \"Returns the caller identity.\",\n      inputSchema: {},\n    },\n    (_args, extra) => ({\n      structuredContent: { clientId: extra.authInfo?.clientId ?? null },\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"setupOAuth wiring\", () => {\n  it(\"serves protected-resource metadata\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`);\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as {\n      resource: string;\n      authorization_servers: string[];\n      scopes_supported: string[];\n    };\n    expect(body.resource).toBe(\"https://app.example.test/\");\n    expect(body.authorization_servers).toContain(ISSUER);\n    expect(body.scopes_supported).toEqual([\"openid\", \"email\"]);\n  });\n\n  it(\"rejects /mcp without a token (401 + WWW-Authenticate)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"threads authInfo into the tool handler for a valid token\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as {\n      content: { type: string; text: string }[];\n    };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n  it(\"builds the verifier from the legacy verify config\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { legacyVerify: true });\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as { content: { type: string; text: string }[] };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"baseUrl inferred from headers\", () => {\n  it(\"derives the resource origin from x-forwarded-host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { \"x-forwarded-host\": \"infer.example.test\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://infer.example.test/\");\n  });\n\n  it(\"uses the first hop of a forwarded-host chain\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: {\n        \"x-forwarded-host\": \"public.example, internal.local\",\n        \"x-forwarded-proto\": \"https, http\",\n      },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://public.example/\");\n  });\n\n  it(\"ignores the client Origin header, using Host instead\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { origin: \"https://chatgpt.com\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toMatch(/^http:\\/\\/(localhost|127\\.0\\.0\\.1):/);\n  });\n\n  it(\"points the 401 WWW-Authenticate at the inferred host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"x-forwarded-host\": \"infer.example.test\",\n      },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(\n      /resource_metadata=\"https:\\/\\/infer\\.example\\.test\\//,\n    );\n  });\n});\n\nasync function bootMixedServer(jwksUri: string) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"mixed-auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        baseUrl: \"https://app.example.test\",\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verifier: createJwksVerifier({\n          issuer: ISSUER,\n          audience: AUDIENCE,\n          jwksUri,\n        }),\n      },\n    },\n  )\n    .registerTool(\n      {\n        name: \"public-whoami\",\n        description: \"Public.\",\n        inputSchema: {},\n        auth: { allowsAnonymous: true },\n      },\n      (_args, extra) => ({\n        content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n      }),\n    )\n    .registerTool(\n      {\n        name: \"private-whoami\",\n        description: \"Private.\",\n        inputSchema: {},\n        auth: {},\n      },\n      (_args, extra) => ({\n        content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n      }),\n    );\n\n  (server.registerTool as (...a: unknown[]) => unknown)(\n    \"legacy-whoami\",\n    {\n      description: \"Registered via the legacy string overload.\",\n      inputSchema: {},\n    },\n    (_args: unknown, extra: { authInfo?: { clientId?: string } }) => ({\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"mixed-auth door\", () => {\n  it(\"lets an anonymous caller initialize and run a noauth tool\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    await client.connect(\n      new StreamableHTTPClientTransport(new URL(`${base}/mcp`)),\n    );\n\n    const result = (await client.callTool({\n      name: \"public-whoami\",\n      arguments: {},\n    })) as unknown as { content: { text: string }[] };\n    expect(result.content[0]?.text).toBe(\"anon\");\n\n    await client.close();\n  });\n\n  it(\"exposes securitySchemes at the top level of tools/list (not only _meta)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n    const headers = {\n      \"Content-Type\": \"application/json\",\n      Accept: \"application/json, text/event-stream\",\n    };\n    await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"initialize\",\n        params: {\n          protocolVersion: \"2025-06-18\",\n          capabilities: {},\n          clientInfo: { name: \"c\", version: \"0\" },\n        },\n      }),\n    });\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ jsonrpc: \"2.0\", id: 2, method: \"tools/list\" }),\n    });\n    const text = await res.text();\n    const json = JSON.parse((text.match(/\\{[\\s\\S]*\\}/) ?? [\"{}\"])[0]) as {\n      result: { tools: Array<{ name: string; securitySchemes?: unknown }> };\n    };\n    const whoami = json.result.tools.find((t) => t.name === \"private-whoami\");\n    expect(whoami?.securitySchemes).toEqual([{ type: \"oauth2\" }]);\n  });\n\n  it(\"denies a protected tool inside an anonymous JSON-RPC batch\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify([\n        {\n          jsonrpc: \"2.0\",\n          id: 1,\n          method: \"tools/call\",\n          params: { name: \"private-whoami\", arguments: {} },\n        },\n      ]),\n    });\n    expect(res.status).toBe(401);\n    const wwwAuthenticate = res.headers.get(\"www-authenticate\") ?? \"\";\n    expect(wwwAuthenticate).toMatch(/^Bearer /);\n    expect(wwwAuthenticate).toContain(\"resource_metadata=\");\n    const text = await res.text();\n    expect(text).not.toContain(\"client-1\");\n  });\n\n  it(\"gates a tool registered via the legacy string overload (secure default)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"tools/call\",\n        params: { name: \"legacy-whoami\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(401);\n  });\n\n  it(\"returns 401 + WWW-Authenticate for a protected tool while anonymous\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"tools/call\",\n        params: { name: \"private-whoami\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(\n      /error=\"invalid_token\"/,\n    );\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"returns an in-band mcp/www_authenticate array to ChatGPT (not a transport 401)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n        \"User-Agent\": \"openai-mcp/1.0\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 7,\n        method: \"tools/call\",\n        params: { name: \"private-whoami\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(200);\n    expect(res.headers.get(\"www-authenticate\")).toBeNull();\n    const body = (await res.json()) as {\n      id: number;\n      result: {\n        isError: boolean;\n        _meta: { \"mcp/www_authenticate\": string[] };\n      };\n    };\n    expect(body.id).toBe(7);\n    expect(body.result.isError).toBe(true);\n    const challenge = body.result._meta[\"mcp/www_authenticate\"];\n    expect(Array.isArray(challenge)).toBe(true);\n    expect(challenge[0]).toMatch(/error=\"invalid_token\"/);\n    expect(challenge[0]).toMatch(/resource_metadata=/);\n  });\n\n  it(\"fails closed on a ChatGPT batch (transport 401, no in-band challenge)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n        \"User-Agent\": \"openai-mcp/1.0\",\n      },\n      body: JSON.stringify([\n        {\n          jsonrpc: \"2.0\",\n          id: 1,\n          method: \"tools/call\",\n          params: { name: \"private-whoami\", arguments: {} },\n        },\n      ]),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/^Bearer /);\n    const text = await res.text();\n    expect(text).not.toContain(\"client-1\");\n  });\n});\n\nasync function bootScopedServer(jwksUri: string) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"scoped-auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        baseUrl: \"https://app.example.test\",\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verifier: createJwksVerifier({\n          issuer: ISSUER,\n          audience: AUDIENCE,\n          jwksUri,\n        }),\n      },\n    },\n  ).registerTool(\n    {\n      name: \"checkout\",\n      description: \"Needs the checkout scope.\",\n      inputSchema: {},\n      auth: { scopes: [\"checkout\"] },\n    },\n    () => ({ content: [{ type: \"text\", text: \"ok\" }] }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"per-tool scope enforcement in fully-authenticated mode\", () => {\n  it(\"returns 403 for a valid token missing the tool's scope\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootScopedServer(jwksUri);\n    const token = await signToken(privateKey, \"openid\");\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n        Authorization: `Bearer ${token}`,\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"tools/call\",\n        params: { name: \"checkout\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(403);\n    const header = res.headers.get(\"www-authenticate\");\n    expect(header).toMatch(/error=\"insufficient_scope\"/);\n    expect(header).toMatch(/scope=\"checkout\"/);\n  });\n\n  it(\"allows a token carrying the tool's scope\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootScopedServer(jwksUri);\n    const token = await signToken(privateKey, \"openid checkout\");\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    await client.connect(\n      new StreamableHTTPClientTransport(new URL(`${base}/mcp`), {\n        requestInit: { headers: { Authorization: `Bearer ${token}` } },\n      }),\n    );\n\n    const result = (await client.callTool({\n      name: \"checkout\",\n      arguments: {},\n    })) as unknown as { isError?: boolean; content: { text: string }[] };\n    expect(result.content[0]?.text).toBe(\"ok\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"auth shorthand validation\", () => {\n  it(\"throws when `auth` requires sign-in but no oauth provider is configured\", () => {\n    expect(() =>\n      new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n        { name: \"x\", inputSchema: {}, auth: {} },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).toThrow(/no `oauth` provider/);\n  });\n\n  it(\"throws when `auth` sets scopes but no oauth provider is configured\", () => {\n    expect(() =>\n      new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n        { name: \"x\", inputSchema: {}, auth: { scopes: [\"checkout\"] } },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).toThrow(/no `oauth` provider/);\n  });\n\n  it(\"allows `auth: { allowsAnonymous: true }` without an oauth provider\", () => {\n    expect(() =>\n      new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n        { name: \"x\", inputSchema: {}, auth: { allowsAnonymous: true } },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).not.toThrow();\n  });\n\n  it(\"prefers `securitySchemes` over `auth` when both are set (untyped path)\", () => {\n    expect(() =>\n      (\n        new McpServer({ name: \"t\", version: \"0\" }).registerTool as (\n          ...a: unknown[]\n        ) => unknown\n      )(\n        {\n          name: \"x\",\n          inputSchema: {},\n          auth: {},\n          securitySchemes: [{ type: \"oauth2\" }],\n        },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).not.toThrow();\n  });\n});\n\ndescribe(\"oauth config validation\", () => {\n  const validMetadata = {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    response_types_supported: [\"code\"],\n  };\n\n  it(\"throws on a non-absolute baseUrl\", () => {\n    expect(\n      () =>\n        new McpServer({ name: \"t\", version: \"0\" }, undefined, {\n          oauth: {\n            baseUrl: \"not-a-url\",\n            oauthMetadata: validMetadata,\n            verifier: createJwksVerifier({\n              issuer: ISSUER,\n              audience: AUDIENCE,\n            }),\n          },\n        }),\n    ).toThrow(/baseUrl must be a valid absolute URL/);\n  });\n});\n"]}

package/dist/server/auth/verify.d.ts

@@ -0,0 +1,46 @@
+import type { ExtraClaims, TokenVerifier } from "../auth.js";
+export type JwksVerifyConfig = {
+    /** Expected `iss` claim. */
+    issuer: string;
+    /** Expected `aud` claim. Omit to skip audience verification — for IdPs that
+     * don't bind an audience to their access tokens (e.g. Clerk). */
+    audience?: string;
+    /** Defaults to `${issuer}/.well-known/jwks.json`. */
+    jwksUri?: string;
+};
+/**
+ * Claims a JWKS-verified token always carries into `extra`, whatever the IdP:
+ * `subject` (the renamed `sub`) plus the registered claims that survive the
+ * mapping. `client_id`, `scope` and `exp` do not appear here, since they become
+ * `AuthInfo` fields instead. Intersected into every claim shape a JWKS verifier
+ * resolves.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1
+ */
+export type RegisteredClaims = {
+    /** The token's `sub`, renamed on the way into `extra`. */
+    subject?: string;
+    /** Issuer of the token. */
+    iss?: string;
+    /** Audience the token was minted for. */
+    aud?: string | string[];
+    /** Issued-at, in unix seconds. */
+    iat?: number;
+    /** Not-valid-before, in unix seconds. */
+    nbf?: number;
+    /** Unique token id. */
+    jti?: string;
+};
+/**
+ * Builds a {@link TokenVerifier} that validates JWTs against a remote JWKS.
+ *
+ * `extra` receives the token's claims with `sub` renamed to `subject`, minus
+ * `client_id`, `scope` and `exp`, which map onto `AuthInfo` fields instead. Pass
+ * `TExtra` to declare what your IdP puts there; the branded providers do this
+ * for you. {@link RegisteredClaims} is always included, since those claims
+ * survive the mapping.
+ *
+ * @typeParam TExtra - Claims the verified token carries in `extra`. An
+ * assertion, not a runtime check: nothing rejects a token whose claims differ.
+ */
+export declare function createJwksVerifier<TExtra extends ExtraClaims = ExtraClaims>(config: JwksVerifyConfig): TokenVerifier<TExtra & RegisteredClaims>;

package/dist/server/auth/verify.js

@@ -0,0 +1,62 @@
+import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import * as jose from "jose";
+/**
+ * Builds a {@link TokenVerifier} that validates JWTs against a remote JWKS.
+ *
+ * `extra` receives the token's claims with `sub` renamed to `subject`, minus
+ * `client_id`, `scope` and `exp`, which map onto `AuthInfo` fields instead. Pass
+ * `TExtra` to declare what your IdP puts there; the branded providers do this
+ * for you. {@link RegisteredClaims} is always included, since those claims
+ * survive the mapping.
+ *
+ * @typeParam TExtra - Claims the verified token carries in `extra`. An
+ * assertion, not a runtime check: nothing rejects a token whose claims differ.
+ */
+export function createJwksVerifier(config) {
+    if (!config.issuer) {
+        throw new Error("createJwksVerifier requires an `issuer`");
+    }
+    const jwksUri = config.jwksUri ??
+        `${config.issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+    const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+    return {
+        async verifyAccessToken(token) {
+            let payload;
+            try {
+                ({ payload } = await jose.jwtVerify(token, jwks, {
+                    issuer: config.issuer,
+                    // jose skips the aud check when `audience` is undefined.
+                    ...(config.audience !== undefined && { audience: config.audience }),
+                }));
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                // This reaches the `error_description` of a `WWW-Authenticate`
+                // challenge, whose value must not include characters outside
+                // %x20-21 / %x23-5B / %x5D-7E (OAuth 2.1 §5.3.1, RFC 6750 §3). jose
+                // quotes claim names in its messages, and a quote would end the
+                // parameter early, dropping the `resource_metadata` that follows it.
+                // Each run becomes a space rather than being dropped, so removing one
+                // never runs two words together.
+                const safe = message
+                    .replace(/[^\x20-\x21\x23-\x5B\x5D-\x7E]+/g, " ")
+                    .trim();
+                throw new InvalidTokenError(`Token verification failed: ${safe}`);
+            }
+            const { client_id, scope, exp, sub, ...rest } = payload;
+            const scopes = Array.isArray(scope)
+                ? scope.map(String)
+                : typeof scope === "string"
+                    ? scope.split(/\s+/).filter(Boolean)
+                    : [];
+            return {
+                token,
+                clientId: client_id ?? "",
+                scopes,
+                expiresAt: exp,
+                extra: { subject: sub, ...rest },
+            };
+        },
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/server/auth/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/server/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAqC7B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvD,OAAO;QACL,KAAK,CAAC,iBAAiB,CACrB,KAAa;YAEb,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,yDAAyD;oBACzD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;iBACpE,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,oEAAoE;gBACpE,gEAAgE;gBAChE,qEAAqE;gBACrE,sEAAsE;gBACtE,iCAAiC;gBACjC,MAAM,IAAI,GAAG,OAAO;qBACjB,OAAO,CAAC,kCAAkC,EAAE,GAAG,CAAC;qBAChD,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAQ/C,CAAC;YAEF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnB,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,EAAE,CAAC;YAET,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,SAAS,IAAI,EAAE;gBACzB,MAAM;gBACN,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EACZ;aACnB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nimport * as jose from \"jose\";\nimport type { AuthInfo, ExtraClaims, TokenVerifier } from \"../auth.js\";\n\nexport type JwksVerifyConfig = {\n  /** Expected `iss` claim. */\n  issuer: string;\n  /** Expected `aud` claim. Omit to skip audience verification — for IdPs that\n   * don't bind an audience to their access tokens (e.g. Clerk). */\n  audience?: string;\n  /** Defaults to `${issuer}/.well-known/jwks.json`. */\n  jwksUri?: string;\n};\n\n/**\n * Claims a JWKS-verified token always carries into `extra`, whatever the IdP:\n * `subject` (the renamed `sub`) plus the registered claims that survive the\n * mapping. `client_id`, `scope` and `exp` do not appear here, since they become\n * `AuthInfo` fields instead. Intersected into every claim shape a JWKS verifier\n * resolves.\n *\n * @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1\n */\nexport type RegisteredClaims = {\n  /** The token's `sub`, renamed on the way into `extra`. */\n  subject?: string;\n  /** Issuer of the token. */\n  iss?: string;\n  /** Audience the token was minted for. */\n  aud?: string | string[];\n  /** Issued-at, in unix seconds. */\n  iat?: number;\n  /** Not-valid-before, in unix seconds. */\n  nbf?: number;\n  /** Unique token id. */\n  jti?: string;\n};\n\n/**\n * Builds a {@link TokenVerifier} that validates JWTs against a remote JWKS.\n *\n * `extra` receives the token's claims with `sub` renamed to `subject`, minus\n * `client_id`, `scope` and `exp`, which map onto `AuthInfo` fields instead. Pass\n * `TExtra` to declare what your IdP puts there; the branded providers do this\n * for you. {@link RegisteredClaims} is always included, since those claims\n * survive the mapping.\n *\n * @typeParam TExtra - Claims the verified token carries in `extra`. An\n * assertion, not a runtime check: nothing rejects a token whose claims differ.\n */\nexport function createJwksVerifier<TExtra extends ExtraClaims = ExtraClaims>(\n  config: JwksVerifyConfig,\n): TokenVerifier<TExtra & RegisteredClaims> {\n  if (!config.issuer) {\n    throw new Error(\"createJwksVerifier requires an `issuer`\");\n  }\n  const jwksUri =\n    config.jwksUri ??\n    `${config.issuer.replace(/\\/$/, \"\")}/.well-known/jwks.json`;\n  const jwks = jose.createRemoteJWKSet(new URL(jwksUri));\n\n  return {\n    async verifyAccessToken(\n      token: string,\n    ): Promise<AuthInfo<TExtra & RegisteredClaims>> {\n      let payload: jose.JWTPayload;\n      try {\n        ({ payload } = await jose.jwtVerify(token, jwks, {\n          issuer: config.issuer,\n          // jose skips the aud check when `audience` is undefined.\n          ...(config.audience !== undefined && { audience: config.audience }),\n        }));\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        // This reaches the `error_description` of a `WWW-Authenticate`\n        // challenge, whose value must not include characters outside\n        // %x20-21 / %x23-5B / %x5D-7E (OAuth 2.1 §5.3.1, RFC 6750 §3). jose\n        // quotes claim names in its messages, and a quote would end the\n        // parameter early, dropping the `resource_metadata` that follows it.\n        // Each run becomes a space rather than being dropped, so removing one\n        // never runs two words together.\n        const safe = message\n          .replace(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]+/g, \" \")\n          .trim();\n        throw new InvalidTokenError(`Token verification failed: ${safe}`);\n      }\n\n      const { client_id, scope, exp, sub, ...rest } = payload as Record<\n        string,\n        unknown\n      > & {\n        client_id?: string;\n        scope?: string | string[];\n        exp?: number;\n        sub?: string;\n      };\n\n      const scopes = Array.isArray(scope)\n        ? scope.map(String)\n        : typeof scope === \"string\"\n          ? scope.split(/\\s+/).filter(Boolean)\n          : [];\n\n      return {\n        token,\n        clientId: client_id ?? \"\",\n        scopes,\n        expiresAt: exp,\n        extra: { subject: sub, ...rest } as unknown as TExtra &\n          RegisteredClaims,\n      };\n    },\n  };\n}\n"]}

package/dist/server/auth/verify.test.js

@@ -0,0 +1,149 @@
+// @vitest-environment node
+import http from "node:http";
+import * as jose from "jose";
+import { afterEach, describe, expect, it } from "vitest";
+import { createJwksVerifier } from "./verify.js";
+const ISSUER = "https://issuer.test";
+const AUDIENCE = "api://default";
+let jwksServer;
+afterEach(() => jwksServer?.close());
+async function startJwks() {
+    const { publicKey, privateKey } = await jose.generateKeyPair("RS256");
+    const jwk = {
+        ...(await jose.exportJWK(publicKey)),
+        kid: "test-key",
+        alg: "RS256",
+        use: "sig",
+    };
+    const server = http.createServer((_req, res) => {
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ keys: [jwk] }));
+    });
+    await new Promise((resolve) => server.listen(0, resolve));
+    jwksServer = server;
+    const port = server.address().port;
+    return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
+}
+function sign(key, claims, opts = {}) {
+    return new jose.SignJWT(claims)
+        .setProtectedHeader({ alg: "RS256", kid: "test-key" })
+        .setIssuer(opts.issuer ?? ISSUER)
+        .setAudience(opts.audience ?? AUDIENCE)
+        .setExpirationTime(opts.expiresAt ?? "1h")
+        .sign(key);
+}
+it("rejects a config with no issuer", () => {
+    expect(() => createJwksVerifier({ issuer: "" })).toThrow(/requires an `issuer`/);
+});
+describe("createJwksVerifier", () => {
+    it("verifies a valid token and maps claims to AuthInfo", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            jwksUri,
+        });
+        const token = await sign(privateKey, {
+            client_id: "client-1",
+            scope: "openid email",
+            sub: "user-1",
+            email: "a@b.test",
+        });
+        const auth = await verifier.verifyAccessToken(token);
+        expect(auth.token).toBe(token);
+        expect(auth.clientId).toBe("client-1");
+        expect(auth.scopes).toEqual(["openid", "email"]);
+        expect(auth.extra?.subject).toBe("user-1");
+        expect(auth.extra?.email).toBe("a@b.test");
+    });
+    it("rejects a token with the wrong audience", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            jwksUri,
+        });
+        const token = await sign(privateKey, { client_id: "c" }, { audience: "api://other" });
+        await expect(verifier.verifyAccessToken(token)).rejects.toThrow(/Token verification failed/);
+    });
+    // jose quotes claim names — `"exp" claim timestamp check failed`, `unexpected
+    // "aud" claim value`. Those quotes would close `error_description="…"` early,
+    // dropping the `resource_metadata` that MCP clients start discovery from.
+    it.each([
+        [
+            "an expired token",
+            (key) => sign(key, {}, { expiresAt: "-1h" }),
+            // jose: `"exp" claim timestamp check failed`
+            "Token verification failed: exp  claim timestamp check failed",
+        ],
+        [
+            "a token issued for another resource",
+            (key) => sign(key, {}, { audience: "api://other" }),
+            // jose: `unexpected "aud" claim value`
+            "Token verification failed: unexpected  aud  claim value",
+        ],
+        [
+            "a token from another issuer",
+            (key) => sign(key, {}, { issuer: "https://other.test" }),
+            // jose: `unexpected "iss" claim value`
+            "Token verification failed: unexpected  iss  claim value",
+        ],
+        [
+            "a token carrying no aud claim",
+            (key) => new jose.SignJWT({})
+                .setProtectedHeader({ alg: "RS256", kid: "test-key" })
+                .setIssuer(ISSUER)
+                .setExpirationTime("1h")
+                .sign(key),
+            // jose: `missing required "aud" claim`
+            "Token verification failed: missing required  aud  claim",
+        ],
+    ])("keeps the message safe inside the challenge for %s", async (_, mint, expected) => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            jwksUri,
+        });
+        const error = await verifier
+            .verifyAccessToken(await mint(privateKey))
+            .then(() => undefined, (e) => e);
+        expect(error?.message).toBe(expected);
+        // OAuth 2.1 §5.3.1: %x20-21 / %x23-5B / %x5D-7E and nothing else.
+        expect(error?.message).not.toMatch(/[^\x20-\x21\x23-\x5B\x5D-\x7E]/);
+    });
+    it("skips the aud check when no audience is configured (e.g. Clerk)", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({ issuer: ISSUER, jwksUri });
+        // Clerk-shaped access token: no `aud` claim at all.
+        const token = await new jose.SignJWT({ client_id: "c", sub: "u" })
+            .setProtectedHeader({ alg: "RS256", kid: "test-key" })
+            .setIssuer(ISSUER)
+            .setExpirationTime("1h")
+            .sign(privateKey);
+        const auth = await verifier.verifyAccessToken(token);
+        expect(auth.clientId).toBe("c");
+        expect(auth.extra?.subject).toBe("u");
+    });
+    it("parses array scope claims and trims extra whitespace", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const verifier = createJwksVerifier({
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            jwksUri,
+        });
+        const arrayToken = await sign(privateKey, {
+            scope: ["openid", "email"],
+        });
+        expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([
+            "openid",
+            "email",
+        ]);
+        const messyToken = await sign(privateKey, { scope: " openid  email " });
+        expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([
+            "openid",
+            "email",
+        ]);
+    });
+});
+//# sourceMappingURL=verify.test.js.map

package/dist/server/auth/verify.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../../../src/server/auth/verify.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CACX,GAAc,EACd,MAA+B,EAC/B,OAAmE,EAAE;IAErE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;SAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;SACtC,iBAAiB,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;SACzC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CACtD,sBAAsB,CACvB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACnC,SAAS,EAAE,UAAU;YACrB,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,EAAE,EAClB,EAAE,QAAQ,EAAE,aAAa,EAAE,CAC5B,CAAC;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,EAAE,CAAC,IAAI,CAAC;QACN;YACE,kBAAkB;YAClB,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACvD,6CAA6C;YAC7C,8DAA8D;SAC/D;QACD;YACE,qCAAqC;YACrC,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;YAC9D,uCAAuC;YACvC,yDAAyD;SAC1D;QACD;YACE,6BAA6B;YAC7B,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACnE,uCAAuC;YACvC,yDAAyD;SAC1D;QACD;YACE,+BAA+B;YAC/B,CAAC,GAAc,EAAE,EAAE,CACjB,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;iBACjB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;iBACrD,SAAS,CAAC,MAAM,CAAC;iBACjB,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,GAAG,CAAC;YACd,uCAAuC;YACvC,yDAAyD;SAC1D;KACF,CAAC,CACA,oDAAoD,EACpD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,QAAQ;aACzB,iBAAiB,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;aACzC,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAChB,CAAC;QAEJ,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,kEAAkE;QAClE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,oDAAoD;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;aAC/D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;aACrD,SAAS,CAAC,MAAM,CAAC;aACjB,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACxC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACpE,QAAQ;YACR,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nafterEach(() => jwksServer?.close());\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction sign(\n  key: CryptoKey,\n  claims: Record<string, unknown>,\n  opts: { issuer?: string; audience?: string; expiresAt?: string } = {},\n) {\n  return new jose.SignJWT(claims)\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(opts.issuer ?? ISSUER)\n    .setAudience(opts.audience ?? AUDIENCE)\n    .setExpirationTime(opts.expiresAt ?? \"1h\")\n    .sign(key);\n}\n\nit(\"rejects a config with no issuer\", () => {\n  expect(() => createJwksVerifier({ issuer: \"\" })).toThrow(\n    /requires an `issuer`/,\n  );\n});\n\ndescribe(\"createJwksVerifier\", () => {\n  it(\"verifies a valid token and maps claims to AuthInfo\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(privateKey, {\n      client_id: \"client-1\",\n      scope: \"openid email\",\n      sub: \"user-1\",\n      email: \"a@b.test\",\n    });\n\n    const auth = await verifier.verifyAccessToken(token);\n\n    expect(auth.token).toBe(token);\n    expect(auth.clientId).toBe(\"client-1\");\n    expect(auth.scopes).toEqual([\"openid\", \"email\"]);\n    expect(auth.extra?.subject).toBe(\"user-1\");\n    expect(auth.extra?.email).toBe(\"a@b.test\");\n  });\n\n  it(\"rejects a token with the wrong audience\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n    const token = await sign(\n      privateKey,\n      { client_id: \"c\" },\n      { audience: \"api://other\" },\n    );\n\n    await expect(verifier.verifyAccessToken(token)).rejects.toThrow(\n      /Token verification failed/,\n    );\n  });\n\n  // jose quotes claim names — `\"exp\" claim timestamp check failed`, `unexpected\n  // \"aud\" claim value`. Those quotes would close `error_description=\"…\"` early,\n  // dropping the `resource_metadata` that MCP clients start discovery from.\n  it.each([\n    [\n      \"an expired token\",\n      (key: CryptoKey) => sign(key, {}, { expiresAt: \"-1h\" }),\n      // jose: `\"exp\" claim timestamp check failed`\n      \"Token verification failed: exp  claim timestamp check failed\",\n    ],\n    [\n      \"a token issued for another resource\",\n      (key: CryptoKey) => sign(key, {}, { audience: \"api://other\" }),\n      // jose: `unexpected \"aud\" claim value`\n      \"Token verification failed: unexpected  aud  claim value\",\n    ],\n    [\n      \"a token from another issuer\",\n      (key: CryptoKey) => sign(key, {}, { issuer: \"https://other.test\" }),\n      // jose: `unexpected \"iss\" claim value`\n      \"Token verification failed: unexpected  iss  claim value\",\n    ],\n    [\n      \"a token carrying no aud claim\",\n      (key: CryptoKey) =>\n        new jose.SignJWT({})\n          .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n          .setIssuer(ISSUER)\n          .setExpirationTime(\"1h\")\n          .sign(key),\n      // jose: `missing required \"aud\" claim`\n      \"Token verification failed: missing required  aud  claim\",\n    ],\n  ])(\n    \"keeps the message safe inside the challenge for %s\",\n    async (_, mint, expected) => {\n      const { privateKey, jwksUri } = await startJwks();\n      const verifier = createJwksVerifier({\n        issuer: ISSUER,\n        audience: AUDIENCE,\n        jwksUri,\n      });\n\n      const error = await verifier\n        .verifyAccessToken(await mint(privateKey))\n        .then(\n          () => undefined,\n          (e: Error) => e,\n        );\n\n      expect(error?.message).toBe(expected);\n      // OAuth 2.1 §5.3.1: %x20-21 / %x23-5B / %x5D-7E and nothing else.\n      expect(error?.message).not.toMatch(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]/);\n    },\n  );\n\n  it(\"skips the aud check when no audience is configured (e.g. Clerk)\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({ issuer: ISSUER, jwksUri });\n    // Clerk-shaped access token: no `aud` claim at all.\n    const token = await new jose.SignJWT({ client_id: \"c\", sub: \"u\" })\n      .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n      .setIssuer(ISSUER)\n      .setExpirationTime(\"1h\")\n      .sign(privateKey);\n\n    const auth = await verifier.verifyAccessToken(token);\n    expect(auth.clientId).toBe(\"c\");\n    expect(auth.extra?.subject).toBe(\"u\");\n  });\n\n  it(\"parses array scope claims and trims extra whitespace\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const verifier = createJwksVerifier({\n      issuer: ISSUER,\n      audience: AUDIENCE,\n      jwksUri,\n    });\n\n    const arrayToken = await sign(privateKey, {\n      scope: [\"openid\", \"email\"],\n    });\n    expect((await verifier.verifyAccessToken(arrayToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n\n    const messyToken = await sign(privateKey, { scope: \" openid  email \" });\n    expect((await verifier.verifyAccessToken(messyToken)).scopes).toEqual([\n      \"openid\",\n      \"email\",\n    ]);\n  });\n});\n"]}

package/dist/server/auth-extra.test-d.js

@@ -0,0 +1,82 @@
+import { expectTypeOf, test } from "vitest";
+import { z } from "zod";
+import { customProvider } from "./auth/providers/custom.js";
+import { workosProvider } from "./auth/providers/workos.js";
+import { McpServer } from "./server.js";
+const workosOAuth = await workosProvider({ domain: "d", audience: "a" });
+const customOAuth = await workosProvider({
+    domain: "d",
+    audience: "a",
+});
+test("a server with no oauth keeps the untyped claim bag", () => {
+    new McpServer({ name: "t", version: "0" }).registerTool({ name: "plain", inputSchema: { q: z.string() } }, (_args, extra) => {
+        expectTypeOf(extra.authInfo?.extra).toEqualTypeOf();
+        return { content: "ok" };
+    });
+});
+test("provider claims reach tool handlers", () => {
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: workosOAuth })
+        .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.authInfo?.extra?.org_id).toEqualTypeOf();
+        expectTypeOf(extra.authInfo?.extra?.permissions).toEqualTypeOf();
+        // @ts-expect-error not a WorkOS claim
+        extra.authInfo?.extra?.nope;
+        return { content: "a" };
+    })
+        .registerTool({ name: "b", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.authInfo?.extra?.sid).toEqualTypeOf();
+        return { content: "b" };
+    });
+});
+test("registered claims survive the mapping into extra", () => {
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: workosOAuth }).registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.authInfo?.extra?.iss).toEqualTypeOf();
+        expectTypeOf(extra.authInfo?.extra?.iat).toEqualTypeOf();
+        return { content: "a" };
+    });
+});
+test("a hand-written verifier carries its own claims", async () => {
+    const verifier = {
+        async verifyAccessToken(token) {
+            return { token, clientId: "c", scopes: [], expiresAt: 1, extra: {} };
+        },
+    };
+    const { oauthMetadata } = await customProvider({
+        issuer: "https://idp.example.com",
+    });
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: { oauthMetadata, verifier } }).registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.authInfo?.extra?.email).toEqualTypeOf();
+        return { content: "a" };
+    });
+});
+test("the legacy verify config still works, with untyped claims", () => {
+    new McpServer({ name: "t", version: "0" }, {}, {
+        oauth: {
+            oauthMetadata: workosOAuth.oauthMetadata,
+            verify: { issuer: "https://idp.example.com" },
+        },
+    }).registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.authInfo?.extra).toEqualTypeOf();
+        return { content: "a" };
+    });
+});
+test("a config must carry exactly one of verifier / verify", () => {
+    // @ts-expect-error one of verifier / verify is required
+    const neither = {
+        oauthMetadata: workosOAuth.oauthMetadata,
+    };
+    void neither;
+});
+test("a provider override adds claims without dropping the provider's", () => {
+    new McpServer({ name: "t", version: "0" }, {}, { oauth: customOAuth })
+        .registerTool({ name: "a", inputSchema: {} }, (_args, extra) => {
+        expectTypeOf(extra.authInfo?.extra?.tenant).toEqualTypeOf();
+        expectTypeOf(extra.authInfo?.extra?.org_id).toEqualTypeOf();
+        return { content: "a" };
+    })
+        .mcpMiddleware("tools/call", (_request, extra, next) => {
+        expectTypeOf(extra.authInfo?.extra?.tenant).toEqualTypeOf();
+        return next();
+    });
+});
+//# sourceMappingURL=auth-extra.test-d.js.map

package/dist/server/auth-extra.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-extra.test-d.js","sourceRoot":"","sources":["../../src/server/auth-extra.test-d.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAqB;IAC3D,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;CACd,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EACjD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACf,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,aAAa,EAE9C,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACnE,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAEtD,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,aAAa,EAE3D,CAAC;QACJ,sCAAsC;QACtC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEnD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,IAAI,SAAS,CACX,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAC3B,EAAE,EACF,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEnD,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,EAEnD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;IAEhE,MAAM,QAAQ,GAA0B;QACtC,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC;KACF,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC;QAC7C,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC;IACH,IAAI,SAAS,CACX,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAC3B,EAAE,EACF,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CACvC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,aAAa,EAErD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACrE,IAAI,SAAS,CACX,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAC3B,EAAE,EACF;QACE,KAAK,EAAE;YACL,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,MAAM,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;SAC9C;KACF,CACF,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,aAAa,EAE9C,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,wDAAwD;IACxD,MAAM,OAAO,GAAgB;QAC3B,aAAa,EAAE,WAAW,CAAC,aAAa;KACzC,CAAC;IACF,KAAK,OAAO,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACnE,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAEtD,CAAC;QACJ,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAEtD,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,aAAa,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,aAAa,EAEtD,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC","sourcesContent":["import { expectTypeOf, test } from \"vitest\";\nimport { z } from \"zod\";\nimport type { OAuthConfig } from \"./auth/index.js\";\nimport { customProvider } from \"./auth/providers/custom.js\";\nimport { workosProvider } from \"./auth/providers/workos.js\";\nimport type { TokenVerifier } from \"./auth.js\";\nimport { McpServer } from \"./server.js\";\n\nconst workosOAuth = await workosProvider({ domain: \"d\", audience: \"a\" });\nconst customOAuth = await workosProvider<{ tenant: string }>({\n  domain: \"d\",\n  audience: \"a\",\n});\n\ntest(\"a server with no oauth keeps the untyped claim bag\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n    { name: \"plain\", inputSchema: { q: z.string() } },\n    (_args, extra) => {\n      expectTypeOf(extra.authInfo?.extra).toEqualTypeOf<\n        Record<string, unknown> | undefined\n      >();\n      return { content: \"ok\" };\n    },\n  );\n});\n\ntest(\"provider claims reach tool handlers\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }, {}, { oauth: workosOAuth })\n    .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.authInfo?.extra?.org_id).toEqualTypeOf<\n        string | undefined\n      >();\n      expectTypeOf(extra.authInfo?.extra?.permissions).toEqualTypeOf<\n        string[] | undefined\n      >();\n      // @ts-expect-error not a WorkOS claim\n      extra.authInfo?.extra?.nope;\n      return { content: \"a\" };\n    })\n    .registerTool({ name: \"b\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.authInfo?.extra?.sid).toEqualTypeOf<\n        string | undefined\n      >();\n      return { content: \"b\" };\n    });\n});\n\ntest(\"registered claims survive the mapping into extra\", () => {\n  new McpServer(\n    { name: \"t\", version: \"0\" },\n    {},\n    { oauth: workosOAuth },\n  ).registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n    expectTypeOf(extra.authInfo?.extra?.iss).toEqualTypeOf<\n      string | undefined\n    >();\n    expectTypeOf(extra.authInfo?.extra?.iat).toEqualTypeOf<\n      number | undefined\n    >();\n    return { content: \"a\" };\n  });\n});\n\ntest(\"a hand-written verifier carries its own claims\", async () => {\n  type Claims = { subject?: string; email?: string };\n  const verifier: TokenVerifier<Claims> = {\n    async verifyAccessToken(token) {\n      return { token, clientId: \"c\", scopes: [], expiresAt: 1, extra: {} };\n    },\n  };\n  const { oauthMetadata } = await customProvider({\n    issuer: \"https://idp.example.com\",\n  });\n  new McpServer(\n    { name: \"t\", version: \"0\" },\n    {},\n    { oauth: { oauthMetadata, verifier } },\n  ).registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n    expectTypeOf(extra.authInfo?.extra?.email).toEqualTypeOf<\n      string | undefined\n    >();\n    return { content: \"a\" };\n  });\n});\n\ntest(\"the legacy verify config still works, with untyped claims\", () => {\n  new McpServer(\n    { name: \"t\", version: \"0\" },\n    {},\n    {\n      oauth: {\n        oauthMetadata: workosOAuth.oauthMetadata,\n        verify: { issuer: \"https://idp.example.com\" },\n      },\n    },\n  ).registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n    expectTypeOf(extra.authInfo?.extra).toEqualTypeOf<\n      Record<string, unknown> | undefined\n    >();\n    return { content: \"a\" };\n  });\n});\n\ntest(\"a config must carry exactly one of verifier / verify\", () => {\n  // @ts-expect-error one of verifier / verify is required\n  const neither: OAuthConfig = {\n    oauthMetadata: workosOAuth.oauthMetadata,\n  };\n  void neither;\n});\n\ntest(\"a provider override adds claims without dropping the provider's\", () => {\n  new McpServer({ name: \"t\", version: \"0\" }, {}, { oauth: customOAuth })\n    .registerTool({ name: \"a\", inputSchema: {} }, (_args, extra) => {\n      expectTypeOf(extra.authInfo?.extra?.tenant).toEqualTypeOf<\n        string | undefined\n      >();\n      expectTypeOf(extra.authInfo?.extra?.org_id).toEqualTypeOf<\n        string | undefined\n      >();\n      return { content: \"a\" };\n    })\n    .mcpMiddleware(\"tools/call\", (_request, extra, next) => {\n      expectTypeOf(extra.authInfo?.extra?.tenant).toEqualTypeOf<\n        string | undefined\n      >();\n      return next();\n    });\n});\n"]}

package/dist/server/auth.d.ts

@@ -0,0 +1,58 @@
+import { type BearerAuthMiddlewareOptions } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import type { AuthInfo as SdkAuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import type { RequestHandler } from "express";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { type BearerAuthMiddlewareOptions, requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { type AuthMetadataOptions, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+/** Claims a verifier puts in `AuthInfo["extra"]`: any JSON-ish bag of them. */
+export type ExtraClaims = Record<string, unknown>;
+/**
+ * A validated access token, as resolved by a
+ * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to
+ * handlers on `extra.authInfo`.
+ *
+ * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The
+ * claims are owned by whoever verifies the token: parameterize the verifier and
+ * the shape flows through {@link OAuthConfig} to every handler.
+ *
+ * @typeParam TExtra - Claims populated in `extra`.
+ *
+ * @example
+ * ```ts
+ * type Claims = { subject?: string; email?: string };
+ *
+ * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {
+ *   // ...
+ * }
+ * ```
+ */
+export type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<SdkAuthInfo, "extra"> & {
+    extra?: TExtra;
+};
+/**
+ * Checks a bearer token and resolves the claims it carries. The type parameter
+ * is what makes `extra.authInfo.extra` typed downstream, so a verifier is the
+ * single source for the claim shape.
+ *
+ * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,
+ * or hand it to the `oauth` server option inside an {@link OAuthConfig}.
+ *
+ * @typeParam TExtra - Claims this verifier populates in `AuthInfo["extra"]`.
+ */
+export type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {
+    verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;
+};
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export declare function optionalBearerAuth(options: BearerAuthMiddlewareOptions): RequestHandler;

package/dist/server/auth.js

@@ -0,0 +1,28 @@
+import { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+export { requireBearerAuth, } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+export { mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+/**
+ * Like `requireBearerAuth`, but lets requests through when no
+ * `Authorization` header is present. Used for mixed-auth servers where some
+ * tools are public and others require sign-in: each tool enforces its own
+ * `securitySchemes` against `extra.authInfo`.
+ *
+ * Behavior:
+ * - No `Authorization` header → `next()` without `req.auth`.
+ * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.
+ * - Invalid / malformed / expired / insufficient-scope → same error response
+ *   as `requireBearerAuth` (401/403). Sending a bad token is still a client
+ *   error.
+ */
+export function optionalBearerAuth(options) {
+    const required = requireBearerAuth(options);
+    return (req, res, next) => {
+        if (!req.headers.authorization) {
+            next();
+            return;
+        }
+        return required(req, res, next);
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AAKxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAEL,iBAAiB,GAClB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAEL,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AA2CzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nimport type { AuthInfo as SdkAuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\n\nimport type { RequestHandler } from \"express\";\n\nexport { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nexport {\n  type BearerAuthMiddlewareOptions,\n  requireBearerAuth,\n} from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nexport {\n  type AuthMetadataOptions,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\n/** Claims a verifier puts in `AuthInfo[\"extra\"]`: any JSON-ish bag of them. */\nexport type ExtraClaims = Record<string, unknown>;\n\n/**\n * A validated access token, as resolved by a\n * [verifier](https://docs.skybridge.tech/api-reference/verifier) and handed to\n * handlers on `extra.authInfo`.\n *\n * Unparameterized, `extra` stays the SDK's `Record<string, unknown>` bag. The\n * claims are owned by whoever verifies the token: parameterize the verifier and\n * the shape flows through {@link OAuthConfig} to every handler.\n *\n * @typeParam TExtra - Claims populated in `extra`.\n *\n * @example\n * ```ts\n * type Claims = { subject?: string; email?: string };\n *\n * async function verifyAccessToken(token: string): Promise<AuthInfo<Claims>> {\n *   // ...\n * }\n * ```\n */\nexport type AuthInfo<TExtra extends ExtraClaims = ExtraClaims> = Omit<\n  SdkAuthInfo,\n  \"extra\"\n> & { extra?: TExtra };\n\n/**\n * Checks a bearer token and resolves the claims it carries. The type parameter\n * is what makes `extra.authInfo.extra` typed downstream, so a verifier is the\n * single source for the claim shape.\n *\n * Pass one to {@link requireBearerAuth} or {@link optionalBearerAuth} directly,\n * or hand it to the `oauth` server option inside an {@link OAuthConfig}.\n *\n * @typeParam TExtra - Claims this verifier populates in `AuthInfo[\"extra\"]`.\n */\nexport type TokenVerifier<TExtra extends ExtraClaims = ExtraClaims> = {\n  verifyAccessToken(token: string): Promise<AuthInfo<TExtra>>;\n};\n\n/**\n * Like `requireBearerAuth`, but lets requests through when no\n * `Authorization` header is present. Used for mixed-auth servers where some\n * tools are public and others require sign-in: each tool enforces its own\n * `securitySchemes` against `extra.authInfo`.\n *\n * Behavior:\n * - No `Authorization` header → `next()` without `req.auth`.\n * - Valid Bearer token → `req.auth` set, same as `requireBearerAuth`.\n * - Invalid / malformed / expired / insufficient-scope → same error response\n *   as `requireBearerAuth` (401/403). Sending a bad token is still a client\n *   error.\n */\nexport function optionalBearerAuth(\n  options: BearerAuthMiddlewareOptions,\n): RequestHandler {\n  const required = requireBearerAuth(options);\n  return (req, res, next) => {\n    if (!req.headers.authorization) {\n      next();\n      return;\n    }\n    return required(req, res, next);\n  };\n}\n"]}