skybridge 2.0.0-beta.dba0bc8 → 2.0.0

package/dist/server/auth/providers/authplane.test.js

@@ -36,7 +36,7 @@ describe("authplaneProvider", () => {
         const config = await authplaneProvider({
             issuer: ISSUER,
             resource: "https://coffee.example.com/mcp",
-        });
+        }).resolve();
         expect(jwks().audience).toBe("https://coffee.example.com/mcp");
         expect(jwks().issuer).toBe(ISSUER);
         expect(jwks().jwksUri).toBe(`${ISSUER}/.well-known/jwks.json`);
@@ -50,7 +50,10 @@ describe("authplaneProvider", () => {
         "https://coffee.example.com:8443/mcp",
     ])("passes %s through as both resource and audience", async (resource) => {
         mockDiscovery({ [ISSUER]: ["checkout"] });
-        const config = await authplaneProvider({ issuer: ISSUER, resource });
+        const config = await authplaneProvider({
+            issuer: ISSUER,
+            resource,
+        }).resolve();
         expect(config.baseUrl).toBe(resource);
         expect(jwks().audience).toBe(resource);
     });
@@ -76,7 +79,7 @@ describe("authplaneProvider", () => {
             issuer: ISSUER,
             resource: "https://coffee.example.com/mcp",
             audience: "urn:acme:coffee",
-        });
+        }).resolve();
         expect(jwks().audience).toBe("urn:acme:coffee");
     });
     it.each([
@@ -103,7 +106,7 @@ describe("authplaneProvider", () => {
         await authplaneProvider({
             issuer: `${ISSUER}/`,
             resource: "https://coffee.example.com/mcp",
-        });
+        }).resolve();
         expect(jwks().issuer).toBe(ISSUER);
     });
     it("accepts a local http issuer for development", async () => {
@@ -112,7 +115,7 @@ describe("authplaneProvider", () => {
         await authplaneProvider({
             issuer: local,
             resource: "http://localhost:3000/mcp",
-        });
+        }).resolve();
         expect(jwks().issuer).toBe(local);
         expect(jwks().audience).toBe("http://localhost:3000/mcp");
     });
@@ -123,7 +126,7 @@ describe("authplaneProvider", () => {
             resource: "https://coffee.example.com/mcp",
             scopes: ["checkout"],
             requiredScopes: ["checkout"],
-        });
+        }).resolve();
         expect(config.scopesSupported).toEqual(["checkout"]);
         expect(config.requiredScopes).toEqual(["checkout"]);
     });
@@ -132,7 +135,7 @@ describe("authplaneProvider", () => {
         const config = await authplaneProvider({
             issuer: ISSUER,
             resource: "https://coffee.example.com/mcp",
-        });
+        }).resolve();
         expect(config.oauthMetadata.issuer).toBe(ISSUER);
         expect(config.oauthMetadata.registration_endpoint).toBe(`${ISSUER}/register`);
     });

package/dist/server/auth/providers/authplane.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"authplane.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/authplane.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,SAAS,YAAY,CAAC,MAAc,EAAE,MAAgB;IACpD,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAA8B;IACnD,OAAO,EAAE;SACN,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;SAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,mCAAmC,CACnE,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE;YAC1D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,gCAAgC;QAChC,mCAAmC;QACnC,6BAA6B;QAC7B,2BAA2B;QAC3B,qCAAqC;KACtC,CAAC,CAAC,iDAAiD,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QACvE,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAErE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6EAA6E;IAC7E,6DAA6D;IAC7D,EAAE,CAAC,IAAI,CAAC;QACN,uCAAuC;QACvC,CAAC,4BAA4B,EAAE,6BAA6B,CAAC;QAC7D,CAAC,uBAAuB,EAAE,wBAAwB,CAAC;QACnD,+BAA+B;QAC/B,CAAC,gCAAgC,EAAE,gCAAgC,CAAC;QACpE,mCAAmC;QACnC,CAAC,oCAAoC,EAAE,gCAAgC,CAAC;KACzE,CAAC,CAAC,iCAAiC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CACnE,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAChD,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,iBAAiB,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;YAC1C,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;QACrD,CAAC,8BAA8B,EAAE,mCAAmC,CAAC;QACrE,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;KACvE,CAAC,CAAC,mCAAmC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CACnE,OAAO,CACR,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CACV,iBAAiB,CAAC;YAChB,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CACH,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,uEAAuE;QACvE,8CAA8C;QAC9C,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,iBAAiB,CAAC;YACtB,MAAM,EAAE,GAAG,MAAM,GAAG;YACpB,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,KAAK,GAAG,uBAAuB,CAAC;QACtC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEzC,MAAM,iBAAiB,CAAC;YACtB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,2BAA2B;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;YAC1C,MAAM,EAAE,CAAC,UAAU,CAAC;YACpB,cAAc,EAAE,CAAC,UAAU,CAAC;SAC7B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,GAAG,MAAM,WAAW,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { authplaneProvider } from \"./authplane.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nafterEach(() => vi.restoreAllMocks());\n\nconst ISSUER = \"https://auth.acme.com\";\n\nfunction discoveryDoc(issuer: string, scopes: string[]) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: scopes,\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(docs: Record<string, string[]>) {\n  return vi\n    .spyOn(globalThis, \"fetch\")\n    .mockImplementation(async (input: RequestInfo | URL) => {\n      const url = String(input);\n      const entry = Object.entries(docs).find(\n        ([issuer]) => url === `${issuer}/.well-known/openid-configuration`,\n      );\n      if (entry === undefined) {\n        return new Response(null, { status: 404 });\n      }\n      return new Response(JSON.stringify(discoveryDoc(...entry)), {\n        headers: { \"content-type\": \"application/json\" },\n      });\n    });\n}\n\ndescribe(\"authplaneProvider\", () => {\n  it(\"derives the audience from the resource the server advertises\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n    });\n\n    expect(jwks().audience).toBe(\"https://coffee.example.com/mcp\");\n    expect(jwks().issuer).toBe(ISSUER);\n    expect(jwks().jwksUri).toBe(`${ISSUER}/.well-known/jwks.json`);\n    expect(config.baseUrl).toBe(\"https://coffee.example.com/mcp\");\n  });\n\n  it.each([\n    \"https://coffee.example.com/mcp\",\n    \"https://coffee.example.com/v2/mcp\",\n    \"https://coffee.example.com/\",\n    \"http://localhost:3000/mcp\",\n    \"https://coffee.example.com:8443/mcp\",\n  ])(\"passes %s through as both resource and audience\", async (resource) => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({ issuer: ISSUER, resource });\n\n    expect(config.baseUrl).toBe(resource);\n    expect(jwks().audience).toBe(resource);\n  });\n\n  // The metadata router serialises the resource identifier through `URL` before\n  // advertising it. Anything that serialisation would rewrite is refused here,\n  // so the advertised identifier is always the configured one.\n  it.each([\n    // Pathless origin — gains a root path.\n    [\"https://coffee.example.com\", \"https://coffee.example.com/\"],\n    [\"http://localhost:3000\", \"http://localhost:3000/\"],\n    // Uppercase host — lowercased.\n    [\"https://COFFEE.EXAMPLE.COM/mcp\", \"https://coffee.example.com/mcp\"],\n    // Explicit default port — dropped.\n    [\"https://coffee.example.com:443/mcp\", \"https://coffee.example.com/mcp\"],\n  ])(\"rejects %s and names %s instead\", async (resource, published) => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(\n      `is advertised as ${JSON.stringify(published)}`,\n    );\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"lets an explicit audience override the default\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n      audience: \"urn:acme:coffee\",\n    });\n\n    expect(jwks().audience).toBe(\"urn:acme:coffee\");\n  });\n\n  it.each([\n    [\"coffee.example.com/mcp\", /must be an absolute URL/],\n    [\"ftp://coffee.example.com/mcp\", /must use the http or https scheme/],\n    [\"https://coffee.example.com/mcp#frag\", /must not include a fragment/],\n  ])(\"rejects the malformed resource %s\", async (resource, message) => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(\n      message,\n    );\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"rejects a malformed issuer before any discovery\", async () => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() =>\n      authplaneProvider({\n        issuer: \"auth.acme.com\",\n        resource: \"https://coffee.example.com/mcp\",\n      }),\n    ).toThrow(/`issuer` must be an absolute URL/);\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"accepts an issuer carrying a trailing slash\", async () => {\n    // Discovery resolves the issuer itself; the provider passes it through\n    // rather than rewriting the operator's value.\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    await authplaneProvider({\n      issuer: `${ISSUER}/`,\n      resource: \"https://coffee.example.com/mcp\",\n    });\n\n    expect(jwks().issuer).toBe(ISSUER);\n  });\n\n  it(\"accepts a local http issuer for development\", async () => {\n    const local = \"http://localhost:9000\";\n    mockDiscovery({ [local]: [\"checkout\"] });\n\n    await authplaneProvider({\n      issuer: local,\n      resource: \"http://localhost:3000/mcp\",\n    });\n\n    expect(jwks().issuer).toBe(local);\n    expect(jwks().audience).toBe(\"http://localhost:3000/mcp\");\n  });\n\n  it(\"forwards scopes and the required-scope floor\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\", \"profile\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n      scopes: [\"checkout\"],\n      requiredScopes: [\"checkout\"],\n    });\n\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n    expect(config.requiredScopes).toEqual([\"checkout\"]);\n  });\n\n  it(\"advertises the registration endpoint for dynamic client registration\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n    });\n\n    expect(config.oauthMetadata.issuer).toBe(ISSUER);\n    expect(config.oauthMetadata.registration_endpoint).toBe(\n      `${ISSUER}/register`,\n    );\n  });\n});\n"]}
+{"version":3,"file":"authplane.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/authplane.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,SAAS,YAAY,CAAC,MAAc,EAAE,MAAgB;IACpD,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAA8B;IACnD,OAAO,EAAE;SACN,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;SAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,mCAAmC,CACnE,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE;YAC1D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,gCAAgC;QAChC,mCAAmC;QACnC,6BAA6B;QAC7B,2BAA2B;QAC3B,qCAAqC;KACtC,CAAC,CAAC,iDAAiD,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QACvE,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ;SACT,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6EAA6E;IAC7E,6DAA6D;IAC7D,EAAE,CAAC,IAAI,CAAC;QACN,uCAAuC;QACvC,CAAC,4BAA4B,EAAE,6BAA6B,CAAC;QAC7D,CAAC,uBAAuB,EAAE,wBAAwB,CAAC;QACnD,+BAA+B;QAC/B,CAAC,gCAAgC,EAAE,gCAAgC,CAAC;QACpE,mCAAmC;QACnC,CAAC,oCAAoC,EAAE,gCAAgC,CAAC;KACzE,CAAC,CAAC,iCAAiC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CACnE,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAChD,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,iBAAiB,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;YAC1C,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;QACrD,CAAC,8BAA8B,EAAE,mCAAmC,CAAC;QACrE,CAAC,qCAAqC,EAAE,6BAA6B,CAAC;KACvE,CAAC,CAAC,mCAAmC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CACnE,OAAO,CACR,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,EAAE,CACV,iBAAiB,CAAC;YAChB,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CACH,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,uEAAuE;QACvE,8CAA8C;QAC9C,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,iBAAiB,CAAC;YACtB,MAAM,EAAE,GAAG,MAAM,GAAG;YACpB,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,KAAK,GAAG,uBAAuB,CAAC;QACtC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEzC,MAAM,iBAAiB,CAAC;YACtB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,2BAA2B;SACtC,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;YAC1C,MAAM,EAAE,CAAC,UAAU,CAAC;YACpB,cAAc,EAAE,CAAC,UAAU,CAAC;SAC7B,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,gCAAgC;SAC3C,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,GAAG,MAAM,WAAW,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { authplaneProvider } from \"./authplane.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nafterEach(() => vi.restoreAllMocks());\n\nconst ISSUER = \"https://auth.acme.com\";\n\nfunction discoveryDoc(issuer: string, scopes: string[]) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: scopes,\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(docs: Record<string, string[]>) {\n  return vi\n    .spyOn(globalThis, \"fetch\")\n    .mockImplementation(async (input: RequestInfo | URL) => {\n      const url = String(input);\n      const entry = Object.entries(docs).find(\n        ([issuer]) => url === `${issuer}/.well-known/openid-configuration`,\n      );\n      if (entry === undefined) {\n        return new Response(null, { status: 404 });\n      }\n      return new Response(JSON.stringify(discoveryDoc(...entry)), {\n        headers: { \"content-type\": \"application/json\" },\n      });\n    });\n}\n\ndescribe(\"authplaneProvider\", () => {\n  it(\"derives the audience from the resource the server advertises\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n    }).resolve();\n\n    expect(jwks().audience).toBe(\"https://coffee.example.com/mcp\");\n    expect(jwks().issuer).toBe(ISSUER);\n    expect(jwks().jwksUri).toBe(`${ISSUER}/.well-known/jwks.json`);\n    expect(config.baseUrl).toBe(\"https://coffee.example.com/mcp\");\n  });\n\n  it.each([\n    \"https://coffee.example.com/mcp\",\n    \"https://coffee.example.com/v2/mcp\",\n    \"https://coffee.example.com/\",\n    \"http://localhost:3000/mcp\",\n    \"https://coffee.example.com:8443/mcp\",\n  ])(\"passes %s through as both resource and audience\", async (resource) => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource,\n    }).resolve();\n\n    expect(config.baseUrl).toBe(resource);\n    expect(jwks().audience).toBe(resource);\n  });\n\n  // The metadata router serialises the resource identifier through `URL` before\n  // advertising it. Anything that serialisation would rewrite is refused here,\n  // so the advertised identifier is always the configured one.\n  it.each([\n    // Pathless origin — gains a root path.\n    [\"https://coffee.example.com\", \"https://coffee.example.com/\"],\n    [\"http://localhost:3000\", \"http://localhost:3000/\"],\n    // Uppercase host — lowercased.\n    [\"https://COFFEE.EXAMPLE.COM/mcp\", \"https://coffee.example.com/mcp\"],\n    // Explicit default port — dropped.\n    [\"https://coffee.example.com:443/mcp\", \"https://coffee.example.com/mcp\"],\n  ])(\"rejects %s and names %s instead\", async (resource, published) => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(\n      `is advertised as ${JSON.stringify(published)}`,\n    );\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"lets an explicit audience override the default\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n      audience: \"urn:acme:coffee\",\n    }).resolve();\n\n    expect(jwks().audience).toBe(\"urn:acme:coffee\");\n  });\n\n  it.each([\n    [\"coffee.example.com/mcp\", /must be an absolute URL/],\n    [\"ftp://coffee.example.com/mcp\", /must use the http or https scheme/],\n    [\"https://coffee.example.com/mcp#frag\", /must not include a fragment/],\n  ])(\"rejects the malformed resource %s\", async (resource, message) => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() => authplaneProvider({ issuer: ISSUER, resource })).toThrow(\n      message,\n    );\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"rejects a malformed issuer before any discovery\", async () => {\n    const fetchSpy = mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    expect(() =>\n      authplaneProvider({\n        issuer: \"auth.acme.com\",\n        resource: \"https://coffee.example.com/mcp\",\n      }),\n    ).toThrow(/`issuer` must be an absolute URL/);\n    expect(fetchSpy).not.toHaveBeenCalled();\n  });\n\n  it(\"accepts an issuer carrying a trailing slash\", async () => {\n    // Discovery resolves the issuer itself; the provider passes it through\n    // rather than rewriting the operator's value.\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    await authplaneProvider({\n      issuer: `${ISSUER}/`,\n      resource: \"https://coffee.example.com/mcp\",\n    }).resolve();\n\n    expect(jwks().issuer).toBe(ISSUER);\n  });\n\n  it(\"accepts a local http issuer for development\", async () => {\n    const local = \"http://localhost:9000\";\n    mockDiscovery({ [local]: [\"checkout\"] });\n\n    await authplaneProvider({\n      issuer: local,\n      resource: \"http://localhost:3000/mcp\",\n    }).resolve();\n\n    expect(jwks().issuer).toBe(local);\n    expect(jwks().audience).toBe(\"http://localhost:3000/mcp\");\n  });\n\n  it(\"forwards scopes and the required-scope floor\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\", \"profile\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n      scopes: [\"checkout\"],\n      requiredScopes: [\"checkout\"],\n    }).resolve();\n\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n    expect(config.requiredScopes).toEqual([\"checkout\"]);\n  });\n\n  it(\"advertises the registration endpoint for dynamic client registration\", async () => {\n    mockDiscovery({ [ISSUER]: [\"checkout\"] });\n\n    const config = await authplaneProvider({\n      issuer: ISSUER,\n      resource: \"https://coffee.example.com/mcp\",\n    }).resolve();\n\n    expect(config.oauthMetadata.issuer).toBe(ISSUER);\n    expect(config.oauthMetadata.registration_endpoint).toBe(\n      `${ISSUER}/register`,\n    );\n  });\n});\n"]}

package/dist/server/auth/providers/clerk.d.ts

@@ -1,5 +1,5 @@
 import type { ExtraClaims } from "../../auth.js";
-import type { OAuthConfig } from "../index.js";
+import type { OAuthProvider } from "../index.js";
 import type { RegisteredClaims } from "../verify.js";
 import { type CustomProviderOptions } from "./custom.js";
 /**
@@ -48,4 +48,4 @@ export type ClerkClaims = {
  */
 export declare function clerkProvider<TCustom extends ExtraClaims = Record<never, never>>(opts: {
     domain: string;
-} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig<ClerkClaims & TCustom & RegisteredClaims>>;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): OAuthProvider<ClerkClaims & TCustom & RegisteredClaims>;

package/dist/server/auth/providers/clerk.js.map

@@ -1 +1 @@
-{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/clerk.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsC1C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAG3B,IAA6E;IAE7E,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAwB;QAC3C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthConfig } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims a Clerk session token (v2) carries. All optional: `o` and `act` appear\n * only with organizations and impersonation, and `email` only when a JWT\n * template adds it.\n *\n * @see https://clerk.com/docs/backend-requests/resources/session-tokens\n * @see https://clerk.com/docs/backend-requests/jwt-templates\n */\nexport type ClerkClaims = {\n  /** Session id. */\n  sid?: string;\n  /** Authorized party: the origin the token was issued to. */\n  azp?: string;\n  /** Session token version. */\n  v?: number;\n  /** Factor verification age, `[since-first-factor, since-second-factor]`. */\n  fva?: number[];\n  /** Active organization, when the user has one. */\n  o?: {\n    /** Organization id. */\n    id?: string;\n    /** Organization slug. */\n    slg?: string;\n    /** Role within the organization. */\n    rol?: string;\n    /** Permissions within the organization. */\n    per?: string;\n    /** Feature-permission map backing `per`. */\n    fpm?: string;\n  };\n  /** Actor, present while a user is being impersonated. */\n  act?: Record<string, unknown>;\n  /** Only when a JWT template adds it; not a default Clerk claim. */\n  email?: string;\n};\n\n/**\n * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.\n * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic\n * Client Registration enabled on the instance, and the OAuth application set to\n * issue JWT access tokens (opaque tokens can't be JWKS-verified).\n *\n * Clerk access tokens carry no `aud` claim, so there is no `audience` option —\n * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).\n */\nexport function clerkProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string } & Omit<CustomProviderOptions, \"issuer\" | \"audience\">,\n): Promise<OAuthConfig<ClerkClaims & TCustom & RegisteredClaims>> {\n  const { domain, ...rest } = opts;\n  return customProvider<ClerkClaims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    ...rest,\n  });\n}\n"]}
+{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/clerk.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsC1C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAG3B,IAA6E;IAE7E,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAwB;QAC3C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthProvider } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims a Clerk session token (v2) carries. All optional: `o` and `act` appear\n * only with organizations and impersonation, and `email` only when a JWT\n * template adds it.\n *\n * @see https://clerk.com/docs/backend-requests/resources/session-tokens\n * @see https://clerk.com/docs/backend-requests/jwt-templates\n */\nexport type ClerkClaims = {\n  /** Session id. */\n  sid?: string;\n  /** Authorized party: the origin the token was issued to. */\n  azp?: string;\n  /** Session token version. */\n  v?: number;\n  /** Factor verification age, `[since-first-factor, since-second-factor]`. */\n  fva?: number[];\n  /** Active organization, when the user has one. */\n  o?: {\n    /** Organization id. */\n    id?: string;\n    /** Organization slug. */\n    slg?: string;\n    /** Role within the organization. */\n    rol?: string;\n    /** Permissions within the organization. */\n    per?: string;\n    /** Feature-permission map backing `per`. */\n    fpm?: string;\n  };\n  /** Actor, present while a user is being impersonated. */\n  act?: Record<string, unknown>;\n  /** Only when a JWT template adds it; not a default Clerk claim. */\n  email?: string;\n};\n\n/**\n * OAuth provider for Clerk. `domain` is the Frontend API URL (e.g.\n * `acme.clerk.accounts.dev`, or a production custom domain). Requires Dynamic\n * Client Registration enabled on the instance, and the OAuth application set to\n * issue JWT access tokens (opaque tokens can't be JWKS-verified).\n *\n * Clerk access tokens carry no `aud` claim, so there is no `audience` option —\n * verification is issuer + JWKS only (matching Clerk's own `mcpAuthClerk`).\n */\nexport function clerkProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string } & Omit<CustomProviderOptions, \"issuer\" | \"audience\">,\n): OAuthProvider<ClerkClaims & TCustom & RegisteredClaims> {\n  const { domain, ...rest } = opts;\n  return customProvider<ClerkClaims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/clerk.test.js

@@ -21,7 +21,7 @@ describe("clerkProvider", () => {
         const fetchSpy = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(doc(issuer)), {
             headers: { "content-type": "application/json" },
         }));
-        await clerkProvider({ domain: "acme.clerk.accounts.dev" });
+        await clerkProvider({ domain: "acme.clerk.accounts.dev" }).resolve();
         expect(fetchSpy).toHaveBeenCalledWith(`${issuer}/.well-known/openid-configuration`, expect.anything());
         expect(jwks().issuer).toBe(issuer);
         expect(jwks().audience).toBeUndefined();

package/dist/server/auth/providers/clerk.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"clerk.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/clerk.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,iCAAiC,CAAC;QACjD,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACH,CAAC;QAEF,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,MAAM,mCAAmC,EAC5C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { clerkProvider } from \"./clerk.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction doc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/oauth/authorize`,\n    token_endpoint: `${issuer}/oauth/token`,\n    registration_endpoint: `${issuer}/oauth/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"profile\", \"email\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\ndescribe(\"clerkProvider\", () => {\n  it(\"verifies issuer + JWKS with no audience (Clerk tokens carry no aud)\", async () => {\n    const issuer = \"https://acme.clerk.accounts.dev\";\n    const fetchSpy = vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n      new Response(JSON.stringify(doc(issuer)), {\n        headers: { \"content-type\": \"application/json\" },\n      }),\n    );\n\n    await clerkProvider({ domain: \"acme.clerk.accounts.dev\" });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${issuer}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(jwks().issuer).toBe(issuer);\n    expect(jwks().audience).toBeUndefined();\n  });\n});\n"]}
+{"version":3,"file":"clerk.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/clerk.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,iCAAiC,CAAC;QACjD,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACH,CAAC;QAEF,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAErE,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,MAAM,mCAAmC,EAC5C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { clerkProvider } from \"./clerk.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction doc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/oauth/authorize`,\n    token_endpoint: `${issuer}/oauth/token`,\n    registration_endpoint: `${issuer}/oauth/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"profile\", \"email\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\ndescribe(\"clerkProvider\", () => {\n  it(\"verifies issuer + JWKS with no audience (Clerk tokens carry no aud)\", async () => {\n    const issuer = \"https://acme.clerk.accounts.dev\";\n    const fetchSpy = vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n      new Response(JSON.stringify(doc(issuer)), {\n        headers: { \"content-type\": \"application/json\" },\n      }),\n    );\n\n    await clerkProvider({ domain: \"acme.clerk.accounts.dev\" }).resolve();\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${issuer}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(jwks().issuer).toBe(issuer);\n    expect(jwks().audience).toBeUndefined();\n  });\n});\n"]}

package/dist/server/auth/providers/custom.d.ts

@@ -1,6 +1,6 @@
 import type { OAuthMetadata } from "@modelcontextprotocol/server";
 import type { ExtraClaims } from "../../auth.js";
-import type { OAuthConfig } from "../index.js";
+import type { OAuthProvider } from "../index.js";
 import { type RegisteredClaims } from "../verify.js";
 /** Options accepted by {@link customProvider} and the branded providers. */
 export type CustomProviderOptions = {
@@ -34,7 +34,7 @@ export type CustomProviderOptions = {
  * Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document.
  *
  * @typeParam TExtra - Claims the IdP puts in the access token, reaching handlers
- * as `extra.authInfo.extra`. The branded providers pass their documented claims;
+ * as `extra.http?.authInfo.extra`. The branded providers pass their documented claims;
  * pass your own when wiring an IdP by hand.
  */
-export declare function customProvider<TExtra extends ExtraClaims = ExtraClaims>(opts: CustomProviderOptions): Promise<OAuthConfig<TExtra & RegisteredClaims>>;
+export declare function customProvider<TExtra extends ExtraClaims = ExtraClaims>(opts: CustomProviderOptions): OAuthProvider<TExtra & RegisteredClaims>;

package/dist/server/auth/providers/custom.js

@@ -4,10 +4,13 @@ import { createJwksVerifier } from "../verify.js";
  * Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document.
  *
  * @typeParam TExtra - Claims the IdP puts in the access token, reaching handlers
- * as `extra.authInfo.extra`. The branded providers pass their documented claims;
+ * as `extra.http?.authInfo.extra`. The branded providers pass their documented claims;
  * pass your own when wiring an IdP by hand.
  */
-export async function customProvider(opts) {
+export function customProvider(opts) {
+    return { resolve: () => resolveCustomProvider(opts) };
+}
+async function resolveCustomProvider(opts) {
     const discovered = await discoverAuthorizationServer(opts.issuer);
     // JWKS verification needs a signing-key URL; without it the server can't verify
     // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply

package/dist/server/auth/providers/custom.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAyB,MAAM,cAAc,CAAC;AA+BzE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,IAAI,UAAU,GAAG,UAAU,CAAC;IAC5B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,kDAAkD,IAAI,CAAC,mBAAmB,iBAAiB,IAAI,CAAC,MAAM,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/K,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,gBAAgB,GACpB,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAuB,gBAAgB;QACxD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,QAAQ,EAAE,kBAAkB,CAAS;YACnC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;SACpD,CAAC;QACF,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/server\";\nimport type { ExtraClaims } from \"../../auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\nimport { createJwksVerifier, type RegisteredClaims } from \"../verify.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  /** Advertise this URL as the authorization server (served AS metadata `issuer`\n   * and PRM `authorization_servers`). Its own discovery document supplies the\n   * advertised endpoints, DCR registration, scopes and the `iss` tokens are\n   * verified against; only `jwks_uri` still comes from `issuer`'s document. Use\n   * when DCR/authorize/token live at a different URL than the discovery issuer\n   * (e.g. Descope's agentic URL vs. its base-project URL). `serverUrl` wins if\n   * both are set. */\n  authorizationServer?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/**\n * Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document.\n *\n * @typeParam TExtra - Claims the IdP puts in the access token, reaching handlers\n * as `extra.authInfo.extra`. The branded providers pass their documented claims;\n * pass your own when wiring an IdP by hand.\n */\nexport async function customProvider<TExtra extends ExtraClaims = ExtraClaims>(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig<TExtra & RegisteredClaims>> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  let advertised = discovered;\n  if (opts.authorizationServer) {\n    try {\n      advertised = await discoverAuthorizationServer(opts.authorizationServer);\n    } catch (err) {\n      console.warn(\n        `OAuth discovery failed for authorizationServer ${opts.authorizationServer}; advertising ${opts.issuer} metadata instead: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n  const base: DiscoveredMetadata = { ...advertised, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl (skybridge-as-AS) overrides the advertised issuer, keeping the\n  // IdP as the token issuer. authorizationServer re-asserts its own URL so a\n  // failed AS discovery still points clients at the AS. serverUrl wins.\n  const advertisedIssuer =\n    opts.serverUrl?.replace(/\\/$/, \"\") ??\n    opts.authorizationServer?.replace(/\\/$/, \"\");\n  const oauthMetadata: DiscoveredMetadata = advertisedIssuer\n    ? {\n        ...base,\n        issuer: advertisedIssuer,\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verifier: createJwksVerifier<TExtra>({\n      issuer: advertised.issuer,\n      audience: opts.audience,\n      jwksUri: advertised.jwks_uri ?? discovered.jwks_uri,\n    }),\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAyB,MAAM,cAAc,CAAC;AA+BzE;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAA2B;IAE3B,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAS,IAAI,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,IAAI,UAAU,GAAG,UAAU,CAAC;IAC5B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,kDAAkD,IAAI,CAAC,mBAAmB,iBAAiB,IAAI,CAAC,MAAM,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/K,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,gBAAgB,GACpB,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAuB,gBAAgB;QACxD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,QAAQ,EAAE,kBAAkB,CAAS;YACnC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;SACpD,CAAC;QACF,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/server\";\nimport type { ExtraClaims } from \"../../auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig, OAuthProvider } from \"../index.js\";\nimport { createJwksVerifier, type RegisteredClaims } from \"../verify.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  /** Advertise this URL as the authorization server (served AS metadata `issuer`\n   * and PRM `authorization_servers`). Its own discovery document supplies the\n   * advertised endpoints, DCR registration, scopes and the `iss` tokens are\n   * verified against; only `jwks_uri` still comes from `issuer`'s document. Use\n   * when DCR/authorize/token live at a different URL than the discovery issuer\n   * (e.g. Descope's agentic URL vs. its base-project URL). `serverUrl` wins if\n   * both are set. */\n  authorizationServer?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/**\n * Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document.\n *\n * @typeParam TExtra - Claims the IdP puts in the access token, reaching handlers\n * as `extra.http?.authInfo.extra`. The branded providers pass their documented claims;\n * pass your own when wiring an IdP by hand.\n */\nexport function customProvider<TExtra extends ExtraClaims = ExtraClaims>(\n  opts: CustomProviderOptions,\n): OAuthProvider<TExtra & RegisteredClaims> {\n  return { resolve: () => resolveCustomProvider<TExtra>(opts) };\n}\n\nasync function resolveCustomProvider<TExtra extends ExtraClaims>(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig<TExtra & RegisteredClaims>> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  let advertised = discovered;\n  if (opts.authorizationServer) {\n    try {\n      advertised = await discoverAuthorizationServer(opts.authorizationServer);\n    } catch (err) {\n      console.warn(\n        `OAuth discovery failed for authorizationServer ${opts.authorizationServer}; advertising ${opts.issuer} metadata instead: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n  const base: DiscoveredMetadata = { ...advertised, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl (skybridge-as-AS) overrides the advertised issuer, keeping the\n  // IdP as the token issuer. authorizationServer re-asserts its own URL so a\n  // failed AS discovery still points clients at the AS. serverUrl wins.\n  const advertisedIssuer =\n    opts.serverUrl?.replace(/\\/$/, \"\") ??\n    opts.authorizationServer?.replace(/\\/$/, \"\");\n  const oauthMetadata: DiscoveredMetadata = advertisedIssuer\n    ? {\n        ...base,\n        issuer: advertisedIssuer,\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verifier: createJwksVerifier<TExtra>({\n      issuer: advertised.issuer,\n      audience: opts.audience,\n      jwksUri: advertised.jwks_uri ?? discovered.jwks_uri,\n    }),\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}

package/dist/server/auth/providers/custom.test.js

@@ -46,7 +46,7 @@ describe("customProvider", () => {
             audience: "my-api",
             baseUrl: "https://app.example.test",
             scopes: ["openid"],
-        });
+        }).resolve();
         expect(config.baseUrl).toBe("https://app.example.test");
         expect(jwks()).toEqual({
             issuer: base,
@@ -62,7 +62,7 @@ describe("customProvider", () => {
             issuer: base,
             audience: "a",
             metadataOverrides: { issuer: "https://evil.test" },
-        });
+        }).resolve();
         expect(jwks().issuer).toBe(base);
         expect(config.oauthMetadata.issuer).toBe(base);
     });
@@ -72,18 +72,21 @@ describe("customProvider", () => {
             issuer: base,
             audience: "a",
             metadataOverrides: { jwks_uri: "https://evil.test/keys" },
-        });
+        }).resolve();
         expect(jwks().jwksUri).toBe(`${base}/jwks`);
     });
     it("serves metadata without a registration_endpoint when the IdP has no DCR", async () => {
         const base = await serveDiscovery({ registration_endpoint: undefined });
-        const config = await customProvider({ issuer: base, audience: "a" });
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+        }).resolve();
         expect(config.oauthMetadata.registration_endpoint).toBeUndefined();
         expect(jwks().issuer).toBe(base);
     });
     it("throws when discovery has no jwks_uri (token verification needs it)", async () => {
         const base = await serveDiscovery({ jwks_uri: undefined });
-        await expect(customProvider({ issuer: base, audience: "a" })).rejects.toThrow(/jwks_uri/);
+        await expect(customProvider({ issuer: base, audience: "a" }).resolve()).rejects.toThrow(/jwks_uri/);
     });
     it("serverUrl advertises this server as the AS, keeping the IdP as the token issuer", async () => {
         const base = await serveDiscovery();
@@ -92,7 +95,7 @@ describe("customProvider", () => {
             audience: "a",
             serverUrl: "https://app.example.test/",
             scopes: ["openid"],
-        });
+        }).resolve();
         // AS metadata + advertised scopes reflect this server.
         expect(config.oauthMetadata.issuer).toBe("https://app.example.test");
         expect(config.oauthMetadata.scopes_supported).toEqual(["openid"]);
@@ -106,7 +109,7 @@ describe("customProvider", () => {
             issuer: base,
             audience: "a",
             authorizationServer: `${as}/`,
-        });
+        }).resolve();
         expect(config.oauthMetadata.issuer).toBe(as);
         expect(config.oauthMetadata.authorization_endpoint).toBe(`${as}/authorize`);
         expect(config.oauthMetadata.registration_endpoint).toBe(`${as}/register`);
@@ -124,7 +127,7 @@ describe("customProvider", () => {
             issuer: base,
             audience: "a",
             authorizationServer: `${base}/agentic/P1/MS1`,
-        });
+        }).resolve();
         expect(warn).toHaveBeenCalledOnce();
         expect(config.oauthMetadata.issuer).toBe(`${base}/agentic/P1/MS1`);
         expect(config.oauthMetadata.authorization_endpoint).toBe(`${base}/authorize`);
@@ -139,7 +142,7 @@ describe("customProvider", () => {
             audience: "a",
             serverUrl: "https://app.example.test/",
             authorizationServer: as,
-        });
+        }).resolve();
         expect(config.oauthMetadata.issuer).toBe("https://app.example.test");
         expect(config.oauthMetadata.token_endpoint).toBe(`${as}/token`);
         expect(jwks().issuer).toBe(as);
@@ -151,7 +154,7 @@ describe("customProvider", () => {
             audience: "a",
             baseUrl: "https://app.example.test",
             metadataOverrides: { token_endpoint: "https://override/token" },
-        });
+        }).resolve();
         expect(config.oauthMetadata.token_endpoint).toBe("https://override/token");
     });
 });

package/dist/server/auth/providers/custom.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,MAAM,OAAO,GAAkB,EAAE,CAAC;AAClC,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAW;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,cAAc,CAAC;YACnB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAW;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CACV,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAChD,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QACH,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,4DAA4D;QAC5D,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,GAAG,EAAE,GAAG;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,GAAG,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,GAAG,IAAI,iBAAiB;SAC9C,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,IAAI,CACtD,GAAG,IAAI,YAAY,CACpB,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,mBAAmB,EAAE,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nconst servers: http.Server[] = [];\nafterEach(() => {\n  for (const srv of servers.splice(0)) {\n    srv.close();\n  }\n});\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  servers.push(srv);\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(jwks()).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"ignores a runtime issuer override (keeps the discovered trust anchor)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { issuer: \"https://evil.test\" } as never,\n    });\n    expect(jwks().issuer).toBe(base);\n    expect(config.oauthMetadata.issuer).toBe(base);\n  });\n\n  it(\"ignores a runtime jwks_uri override (keeps the discovered signing keys)\", async () => {\n    const base = await serveDiscovery();\n    await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { jwks_uri: \"https://evil.test/keys\" } as never,\n    });\n    expect(jwks().jwksUri).toBe(`${base}/jwks`);\n  });\n\n  it(\"serves metadata without a registration_endpoint when the IdP has no DCR\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    const config = await customProvider({ issuer: base, audience: \"a\" });\n    expect(config.oauthMetadata.registration_endpoint).toBeUndefined();\n    expect(jwks().issuer).toBe(base);\n  });\n\n  it(\"throws when discovery has no jwks_uri (token verification needs it)\", async () => {\n    const base = await serveDiscovery({ jwks_uri: undefined });\n    await expect(\n      customProvider({ issuer: base, audience: \"a\" }),\n    ).rejects.toThrow(/jwks_uri/);\n  });\n\n  it(\"serverUrl advertises this server as the AS, keeping the IdP as the token issuer\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      scopes: [\"openid\"],\n    });\n    // AS metadata + advertised scopes reflect this server.\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.scopes_supported).toEqual([\"openid\"]);\n    // but the token's issuer is still verified against the IdP.\n    expect(jwks().issuer).toBe(base);\n  });\n\n  it(\"authorizationServer supplies the advertised metadata and the verified issuer\", async () => {\n    const base = await serveDiscovery();\n    const as = await serveDiscovery({ scopes_supported: [\"checkout\"] });\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      authorizationServer: `${as}/`,\n    });\n\n    expect(config.oauthMetadata.issuer).toBe(as);\n    expect(config.oauthMetadata.authorization_endpoint).toBe(`${as}/authorize`);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${as}/register`);\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n    expect(jwks()).toEqual({\n      issuer: as,\n      audience: \"a\",\n      jwksUri: `${as}/jwks`,\n    });\n  });\n\n  it(\"falls back to the issuer's metadata when the authorizationServer is undiscoverable\", async () => {\n    const base = await serveDiscovery();\n    const warn = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      authorizationServer: `${base}/agentic/P1/MS1`,\n    });\n\n    expect(warn).toHaveBeenCalledOnce();\n    expect(config.oauthMetadata.issuer).toBe(`${base}/agentic/P1/MS1`);\n    expect(config.oauthMetadata.authorization_endpoint).toBe(\n      `${base}/authorize`,\n    );\n    expect(jwks().issuer).toBe(base);\n    warn.mockRestore();\n  });\n\n  it(\"serverUrl takes precedence over authorizationServer\", async () => {\n    const base = await serveDiscovery();\n    const as = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      authorizationServer: as,\n    });\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.token_endpoint).toBe(`${as}/token`);\n    expect(jwks().issuer).toBe(as);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}
+{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,MAAM,OAAO,GAAkB,EAAE,CAAC;AAClC,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAW;SAC5D,CAAC,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,cAAc,CAAC;YACnB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAW;SACnE,CAAC,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;SACd,CAAC,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CACV,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAC1D,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC,OAAO,EAAE,CAAC;QACb,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,4DAA4D;QAC5D,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,GAAG,EAAE,GAAG;SAC9B,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,GAAG,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,GAAG,IAAI,iBAAiB;SAC9C,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,IAAI,CACtD,GAAG,IAAI,YAAY,CACpB,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,mBAAmB,EAAE,EAAE;SACxB,CAAC,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nconst servers: http.Server[] = [];\nafterEach(() => {\n  for (const srv of servers.splice(0)) {\n    srv.close();\n  }\n});\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  servers.push(srv);\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n    }).resolve();\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(jwks()).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"ignores a runtime issuer override (keeps the discovered trust anchor)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { issuer: \"https://evil.test\" } as never,\n    }).resolve();\n    expect(jwks().issuer).toBe(base);\n    expect(config.oauthMetadata.issuer).toBe(base);\n  });\n\n  it(\"ignores a runtime jwks_uri override (keeps the discovered signing keys)\", async () => {\n    const base = await serveDiscovery();\n    await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { jwks_uri: \"https://evil.test/keys\" } as never,\n    }).resolve();\n    expect(jwks().jwksUri).toBe(`${base}/jwks`);\n  });\n\n  it(\"serves metadata without a registration_endpoint when the IdP has no DCR\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n    }).resolve();\n    expect(config.oauthMetadata.registration_endpoint).toBeUndefined();\n    expect(jwks().issuer).toBe(base);\n  });\n\n  it(\"throws when discovery has no jwks_uri (token verification needs it)\", async () => {\n    const base = await serveDiscovery({ jwks_uri: undefined });\n    await expect(\n      customProvider({ issuer: base, audience: \"a\" }).resolve(),\n    ).rejects.toThrow(/jwks_uri/);\n  });\n\n  it(\"serverUrl advertises this server as the AS, keeping the IdP as the token issuer\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      scopes: [\"openid\"],\n    }).resolve();\n    // AS metadata + advertised scopes reflect this server.\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.scopes_supported).toEqual([\"openid\"]);\n    // but the token's issuer is still verified against the IdP.\n    expect(jwks().issuer).toBe(base);\n  });\n\n  it(\"authorizationServer supplies the advertised metadata and the verified issuer\", async () => {\n    const base = await serveDiscovery();\n    const as = await serveDiscovery({ scopes_supported: [\"checkout\"] });\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      authorizationServer: `${as}/`,\n    }).resolve();\n\n    expect(config.oauthMetadata.issuer).toBe(as);\n    expect(config.oauthMetadata.authorization_endpoint).toBe(`${as}/authorize`);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${as}/register`);\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n    expect(jwks()).toEqual({\n      issuer: as,\n      audience: \"a\",\n      jwksUri: `${as}/jwks`,\n    });\n  });\n\n  it(\"falls back to the issuer's metadata when the authorizationServer is undiscoverable\", async () => {\n    const base = await serveDiscovery();\n    const warn = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      authorizationServer: `${base}/agentic/P1/MS1`,\n    }).resolve();\n\n    expect(warn).toHaveBeenCalledOnce();\n    expect(config.oauthMetadata.issuer).toBe(`${base}/agentic/P1/MS1`);\n    expect(config.oauthMetadata.authorization_endpoint).toBe(\n      `${base}/authorize`,\n    );\n    expect(jwks().issuer).toBe(base);\n    warn.mockRestore();\n  });\n\n  it(\"serverUrl takes precedence over authorizationServer\", async () => {\n    const base = await serveDiscovery();\n    const as = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      authorizationServer: as,\n    }).resolve();\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.token_endpoint).toBe(`${as}/token`);\n    expect(jwks().issuer).toBe(as);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    }).resolve();\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}

package/dist/server/auth/providers/descope.d.ts

@@ -1,5 +1,5 @@
 import type { ExtraClaims } from "../../auth.js";
-import type { OAuthConfig } from "../index.js";
+import type { OAuthProvider } from "../index.js";
 import type { RegisteredClaims } from "../verify.js";
 import { type CustomProviderOptions } from "./custom.js";
 /**
@@ -41,4 +41,4 @@ export type DescopeClaims = {
  */
 export declare function descopeProvider<TCustom extends ExtraClaims = Record<never, never>>(opts: {
     url: string;
-} & Omit<CustomProviderOptions, "issuer">): Promise<OAuthConfig<DescopeClaims & TCustom & RegisteredClaims>>;
+} & Omit<CustomProviderOptions, "issuer">): OAuthProvider<DescopeClaims & TCustom & RegisteredClaims>;

package/dist/server/auth/providers/descope.js.map

@@ -1 +1 @@
-{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AA2BzE;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,YAAoB;IACpD,OAAO,YAAY,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAG7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IAC5E,OAAO,cAAc,CAA0B;QAC7C,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,mBAAmB,EAAE,KAAK;QAC1B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthConfig } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Claims a Descope session JWT carries. Roles and permissions are nested per\n * tenant when the project uses tenants, and flat otherwise. `email` arrives only\n * through a Custom Claims flow action or a JWT template.\n *\n * @see https://docs.descope.com/authorization/session-management\n * @see https://docs.descope.com/management/token/jwt-templates\n */\nexport type DescopeClaims = {\n  /** Authentication methods used, e.g. `[\"otp\"]`. */\n  amr?: string[];\n  /** Descope Resource Name: where the token is stored. */\n  drn?: string;\n  /** The user's active tenant. */\n  dct?: string;\n  /** Associated tenants, keyed by tenant id. */\n  tenants?: Record<string, { roles?: string[]; permissions?: string[] }>;\n  /** Roles, when the project has no tenants. */\n  roles?: string[];\n  /** Permissions, when the project has no tenants. */\n  permissions?: string[];\n  /** Only via a Custom Claims action or JWT template; not a default claim. */\n  email?: string;\n};\n\n/**\n * Turns the console's Discovery URL into the authorization server's base URL:\n * drops a `/.well-known/openid-configuration` (or `oauth-authorization-server`)\n * suffix, since discovery appends that path itself, and any trailing slash.\n */\nfunction toAuthorizationServerUrl(discoveryUrl: string): string {\n  return discoveryUrl.replace(/\\/\\.well-known\\/[^?#]*$/, \"\").replace(/\\/$/, \"\");\n}\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR\n * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`\n * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to\n * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client\n * id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig<DescopeClaims & TCustom & RegisteredClaims>> {\n  const { url, audience, ...rest } = opts;\n  const asUrl = toAuthorizationServerUrl(url);\n  const projectId = projectIdFromUrl(asUrl);\n  const issuer = `${asUrl.slice(0, asUrl.indexOf(\"/agentic/\"))}/${projectId}`;\n  return customProvider<DescopeClaims & TCustom>({\n    issuer,\n    audience: audience ?? projectId,\n    authorizationServer: asUrl,\n    ...rest,\n  });\n}\n"]}
+{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AA2BzE;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,YAAoB;IACpD,OAAO,YAAY,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAG7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IAC5E,OAAO,cAAc,CAA0B;QAC7C,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,mBAAmB,EAAE,KAAK;QAC1B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthProvider } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Claims a Descope session JWT carries. Roles and permissions are nested per\n * tenant when the project uses tenants, and flat otherwise. `email` arrives only\n * through a Custom Claims flow action or a JWT template.\n *\n * @see https://docs.descope.com/authorization/session-management\n * @see https://docs.descope.com/management/token/jwt-templates\n */\nexport type DescopeClaims = {\n  /** Authentication methods used, e.g. `[\"otp\"]`. */\n  amr?: string[];\n  /** Descope Resource Name: where the token is stored. */\n  drn?: string;\n  /** The user's active tenant. */\n  dct?: string;\n  /** Associated tenants, keyed by tenant id. */\n  tenants?: Record<string, { roles?: string[]; permissions?: string[] }>;\n  /** Roles, when the project has no tenants. */\n  roles?: string[];\n  /** Permissions, when the project has no tenants. */\n  permissions?: string[];\n  /** Only via a Custom Claims action or JWT template; not a default claim. */\n  email?: string;\n};\n\n/**\n * Turns the console's Discovery URL into the authorization server's base URL:\n * drops a `/.well-known/openid-configuration` (or `oauth-authorization-server`)\n * suffix, since discovery appends that path itself, and any trailing slash.\n */\nfunction toAuthorizationServerUrl(discoveryUrl: string): string {\n  return discoveryUrl.replace(/\\/\\.well-known\\/[^?#]*$/, \"\").replace(/\\/$/, \"\");\n}\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR\n * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`\n * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to\n * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client\n * id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): OAuthProvider<DescopeClaims & TCustom & RegisteredClaims> {\n  const { url, audience, ...rest } = opts;\n  const asUrl = toAuthorizationServerUrl(url);\n  const projectId = projectIdFromUrl(asUrl);\n  const issuer = `${asUrl.slice(0, asUrl.indexOf(\"/agentic/\"))}/${projectId}`;\n  return customProvider<DescopeClaims & TCustom>({\n    issuer,\n    audience: audience ?? projectId,\n    authorizationServer: asUrl,\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/descope.test.js

@@ -37,7 +37,7 @@ describe("descopeProvider", () => {
             [PROJECT]: ["openid", "profile", "email", "phone"],
             [AGENTIC]: ["checkout"],
         });
-        const config = await descopeProvider({ url: AGENTIC });
+        const config = await descopeProvider({ url: AGENTIC }).resolve();
         expect(fetchSpy).toHaveBeenCalledWith(`${PROJECT}/.well-known/openid-configuration`, expect.anything());
         expect(jwks().issuer).toBe(AGENTIC);
         expect(jwks().audience).toBe("P123");
@@ -49,13 +49,13 @@ describe("descopeProvider", () => {
         mockDiscovery({ [PROJECT]: ["openid"], [AGENTIC]: ["checkout"] });
         const config = await descopeProvider({
             url: `${AGENTIC}/.well-known/openid-configuration`,
-        });
+        }).resolve();
         expect(config.oauthMetadata.issuer).toBe(AGENTIC);
         expect(config.scopesSupported).toEqual(["checkout"]);
     });
     it("lets an explicit audience override the derived project id", async () => {
         mockDiscovery({ [PROJECT]: ["openid"], [AGENTIC]: ["checkout"] });
-        await descopeProvider({ url: AGENTIC, audience: "custom" });
+        await descopeProvider({ url: AGENTIC, audience: "custom" }).resolve();
         expect(jwks().audience).toBe("custom");
     });
 });

package/dist/server/auth/providers/descope.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc,EAAE,MAAgB;IACpD,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,OAAO,GAAG,oDAAoD,CAAC;AAErE,SAAS,aAAa,CAAC,IAA8B;IACnD,OAAO,EAAE;SACN,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;SAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,mCAAmC,CACnE,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE;YAC1D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;YAClD,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,OAAO,mCAAmC,EAC7C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,GAAG,OAAO,WAAW,CACtB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,GAAG,EAAE,GAAG,OAAO,mCAAmC;SACnD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5D,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string, scopes: string[]) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: scopes,\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nconst PROJECT = \"https://api.descope.com/v1/apps/P123\";\nconst AGENTIC = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n\nfunction mockDiscovery(docs: Record<string, string[]>) {\n  return vi\n    .spyOn(globalThis, \"fetch\")\n    .mockImplementation(async (input: RequestInfo | URL) => {\n      const url = String(input);\n      const entry = Object.entries(docs).find(\n        ([issuer]) => url === `${issuer}/.well-known/openid-configuration`,\n      );\n      if (entry === undefined) {\n        return new Response(null, { status: 404 });\n      }\n      return new Response(JSON.stringify(discoveryDoc(...entry)), {\n        headers: { \"content-type\": \"application/json\" },\n      });\n    });\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"verifies against the agentic issuer it advertises\", async () => {\n    const fetchSpy = mockDiscovery({\n      [PROJECT]: [\"openid\", \"profile\", \"email\", \"phone\"],\n      [AGENTIC]: [\"checkout\"],\n    });\n\n    const config = await descopeProvider({ url: AGENTIC });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${PROJECT}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(jwks().issuer).toBe(AGENTIC);\n    expect(jwks().audience).toBe(\"P123\");\n    expect(config.oauthMetadata.issuer).toBe(AGENTIC);\n    expect(config.oauthMetadata.registration_endpoint).toBe(\n      `${AGENTIC}/register`,\n    );\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n  });\n\n  it(\"accepts a URL carrying the well-known suffix\", async () => {\n    mockDiscovery({ [PROJECT]: [\"openid\"], [AGENTIC]: [\"checkout\"] });\n\n    const config = await descopeProvider({\n      url: `${AGENTIC}/.well-known/openid-configuration`,\n    });\n\n    expect(config.oauthMetadata.issuer).toBe(AGENTIC);\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    mockDiscovery({ [PROJECT]: [\"openid\"], [AGENTIC]: [\"checkout\"] });\n\n    await descopeProvider({ url: AGENTIC, audience: \"custom\" });\n\n    expect(jwks().audience).toBe(\"custom\");\n  });\n});\n"]}
+{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEzD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc,EAAE,MAAgB;IACpD,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,OAAO,GAAG,oDAAoD,CAAC;AAErE,SAAS,aAAa,CAAC,IAA8B;IACnD,OAAO,EAAE;SACN,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;SAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAwB,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,mCAAmC,CACnE,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE;YAC1D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;YAClD,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAEjE,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,OAAO,mCAAmC,EAC7C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,GAAG,OAAO,WAAW,CACtB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,GAAG,EAAE,GAAG,OAAO,mCAAmC;SACnD,CAAC,CAAC,OAAO,EAAE,CAAC;QAEb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAEtE,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\nimport { lastJwksConfig as jwks } from \"./verify-spy.js\";\n\nvi.mock(\"../verify.js\", () => import(\"./verify-spy.js\"));\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string, scopes: string[]) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: scopes,\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nconst PROJECT = \"https://api.descope.com/v1/apps/P123\";\nconst AGENTIC = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n\nfunction mockDiscovery(docs: Record<string, string[]>) {\n  return vi\n    .spyOn(globalThis, \"fetch\")\n    .mockImplementation(async (input: RequestInfo | URL) => {\n      const url = String(input);\n      const entry = Object.entries(docs).find(\n        ([issuer]) => url === `${issuer}/.well-known/openid-configuration`,\n      );\n      if (entry === undefined) {\n        return new Response(null, { status: 404 });\n      }\n      return new Response(JSON.stringify(discoveryDoc(...entry)), {\n        headers: { \"content-type\": \"application/json\" },\n      });\n    });\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"verifies against the agentic issuer it advertises\", async () => {\n    const fetchSpy = mockDiscovery({\n      [PROJECT]: [\"openid\", \"profile\", \"email\", \"phone\"],\n      [AGENTIC]: [\"checkout\"],\n    });\n\n    const config = await descopeProvider({ url: AGENTIC }).resolve();\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${PROJECT}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(jwks().issuer).toBe(AGENTIC);\n    expect(jwks().audience).toBe(\"P123\");\n    expect(config.oauthMetadata.issuer).toBe(AGENTIC);\n    expect(config.oauthMetadata.registration_endpoint).toBe(\n      `${AGENTIC}/register`,\n    );\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n  });\n\n  it(\"accepts a URL carrying the well-known suffix\", async () => {\n    mockDiscovery({ [PROJECT]: [\"openid\"], [AGENTIC]: [\"checkout\"] });\n\n    const config = await descopeProvider({\n      url: `${AGENTIC}/.well-known/openid-configuration`,\n    }).resolve();\n\n    expect(config.oauthMetadata.issuer).toBe(AGENTIC);\n    expect(config.scopesSupported).toEqual([\"checkout\"]);\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    mockDiscovery({ [PROJECT]: [\"openid\"], [AGENTIC]: [\"checkout\"] });\n\n    await descopeProvider({ url: AGENTIC, audience: \"custom\" }).resolve();\n\n    expect(jwks().audience).toBe(\"custom\");\n  });\n});\n"]}

package/dist/server/auth/providers/stytch.d.ts

@@ -1,5 +1,5 @@
 import type { ExtraClaims } from "../../auth.js";
-import type { OAuthConfig } from "../index.js";
+import type { OAuthProvider } from "../index.js";
 import type { RegisteredClaims } from "../verify.js";
 import { type CustomProviderOptions } from "./custom.js";
 /**
@@ -22,4 +22,4 @@ export type StytchClaims = {
 export declare function stytchProvider<TCustom extends ExtraClaims = Record<never, never>>(opts: {
     domain: string;
     audience: string;
-} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig<StytchClaims & TCustom & RegisteredClaims>>;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): OAuthProvider<StytchClaims & TCustom & RegisteredClaims>;

package/dist/server/auth/providers/stytch.js.map

@@ -1 +1 @@
-{"version":3,"file":"stytch.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/stytch.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAc1C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAG5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAyB;QAC5C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthConfig } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims a Stytch Connected Apps access token carries. Beyond the subject,\n * everything is project-configured through the client's access-token template.\n *\n * @see https://stytch.com/docs/api-reference/consumer/api/connected-apps/tokens/connected-app-access-token-object\n * @see https://stytch.com/docs/api/connected-apps-create\n */\nexport type StytchClaims = {\n  /** Only when the client's access-token template adds it. */\n  email?: string;\n};\n\n/**\n * OAuth provider for Stytch Connected Apps. `domain` is the project domain,\n * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires\n * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID\n * (the default token audience).\n */\nexport function stytchProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): Promise<OAuthConfig<StytchClaims & TCustom & RegisteredClaims>> {\n  const { domain, ...rest } = opts;\n  return customProvider<StytchClaims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    ...rest,\n  });\n}\n"]}
+{"version":3,"file":"stytch.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/stytch.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAc1C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAG5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAyB;QAC5C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthProvider } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims a Stytch Connected Apps access token carries. Beyond the subject,\n * everything is project-configured through the client's access-token template.\n *\n * @see https://stytch.com/docs/api-reference/consumer/api/connected-apps/tokens/connected-app-access-token-object\n * @see https://stytch.com/docs/api/connected-apps-create\n */\nexport type StytchClaims = {\n  /** Only when the client's access-token template adds it. */\n  email?: string;\n};\n\n/**\n * OAuth provider for Stytch Connected Apps. `domain` is the project domain,\n * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires\n * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID\n * (the default token audience).\n */\nexport function stytchProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): OAuthProvider<StytchClaims & TCustom & RegisteredClaims> {\n  const { domain, ...rest } = opts;\n  return customProvider<StytchClaims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/workos.d.ts

@@ -1,5 +1,5 @@
 import type { ExtraClaims } from "../../auth.js";
-import type { OAuthConfig } from "../index.js";
+import type { OAuthProvider } from "../index.js";
 import type { RegisteredClaims } from "../verify.js";
 import { type CustomProviderOptions } from "./custom.js";
 /**
@@ -30,4 +30,4 @@ export type WorkosClaims = {
 export declare function workosProvider<TCustom extends ExtraClaims = Record<never, never>>(opts: {
     domain: string;
     audience: string;
-} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig<WorkosClaims & TCustom & RegisteredClaims>>;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): OAuthProvider<WorkosClaims & TCustom & RegisteredClaims>;

package/dist/server/auth/providers/workos.js.map

@@ -1 +1 @@
-{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/workos.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB1C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAG5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAyB;QAC5C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthConfig } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims a WorkOS AuthKit access token carries. All optional: `org_id`, `role`\n * and `permissions` appear only when an organization is selected at sign-in, and\n * `email` only when a JWT template adds it.\n *\n * @see https://workos.com/docs/authkit/sessions/integrating-sessions/access-token\n * @see https://workos.com/docs/authkit/jwt-templates\n */\nexport type WorkosClaims = {\n  /** Session id, used for signing out. */\n  sid?: string;\n  /** Organization selected at sign-in. */\n  org_id?: string;\n  /** Role of the selected organization membership. */\n  role?: string;\n  /** Permissions assigned to the role. */\n  permissions?: string[];\n  /** Only when a JWT template adds it; not a default AuthKit claim. */\n  email?: string;\n};\n\n/**\n * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.\n * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard\n * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.\n */\nexport function workosProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): Promise<OAuthConfig<WorkosClaims & TCustom & RegisteredClaims>> {\n  const { domain, ...rest } = opts;\n  return customProvider<WorkosClaims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    ...rest,\n  });\n}\n"]}
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/workos.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB1C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAG5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAyB;QAC5C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;QAC3B,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ExtraClaims } from \"../../auth.js\";\nimport type { OAuthProvider } from \"../index.js\";\nimport type { RegisteredClaims } from \"../verify.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * Claims a WorkOS AuthKit access token carries. All optional: `org_id`, `role`\n * and `permissions` appear only when an organization is selected at sign-in, and\n * `email` only when a JWT template adds it.\n *\n * @see https://workos.com/docs/authkit/sessions/integrating-sessions/access-token\n * @see https://workos.com/docs/authkit/jwt-templates\n */\nexport type WorkosClaims = {\n  /** Session id, used for signing out. */\n  sid?: string;\n  /** Organization selected at sign-in. */\n  org_id?: string;\n  /** Role of the selected organization membership. */\n  role?: string;\n  /** Permissions assigned to the role. */\n  permissions?: string[];\n  /** Only when a JWT template adds it; not a default AuthKit claim. */\n  email?: string;\n};\n\n/**\n * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.\n * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard\n * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.\n */\nexport function workosProvider<\n  TCustom extends ExtraClaims = Record<never, never>,\n>(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): OAuthProvider<WorkosClaims & TCustom & RegisteredClaims> {\n  const { domain, ...rest } = opts;\n  return customProvider<WorkosClaims & TCustom>({\n    issuer: toIssuerUrl(domain),\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/setup.test.js

@@ -54,7 +54,6 @@ async function bootServer(jwksUri, { baseUrl = "https://app.example.test" } = {}
     const app = new Skybridge({
         name: "auth-test",
         version: "0.0.0",
-        capabilities: {},
         oauth: {
             ...(baseUrl === null ? {} : { baseUrl }),
             oauthMetadata: {
@@ -183,7 +182,6 @@ async function bootMixedServer(jwksUri) {
     const app = new Skybridge({
         name: "mixed-auth-test",
         version: "0.0.0",
-        capabilities: {},
         oauth: {
             baseUrl: "https://app.example.test",
             oauthMetadata: {
@@ -401,7 +399,6 @@ async function bootScopedServer(jwksUri) {
     const app = new Skybridge({
         name: "scoped-auth-test",
         version: "0.0.0",
-        capabilities: {},
         oauth: {
             baseUrl: "https://app.example.test",
             oauthMetadata: {