Merge from upstream 20260508

.github/workflows/node.js.yml

@@ -18,7 +18,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x, 22.x, 24.x]
+        node-version: [22.x, 24.x]
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:

jest.config.ts

@@ -22,33 +22,43 @@
 
 // Copyright (c) 2025 NeiRo21
 
+import { createRequire } from "node:module";
 import type { Config } from "jest";
-import { createJsWithTsPreset, type JestConfigWithTsJest } from "ts-jest";
+import {
+  createDefaultPreset,
+  createJsWithTsPreset,
+  type JestConfigWithTsJest,
+} from "ts-jest";
+
+// Jest 30 loads .ts config files as ESM via Node's native TypeScript support,
+// so `require` is not available. Use createRequire for require.resolve calls.
+// @ts-expect-error: import.meta.url is valid at runtime (ESM), but tsconfig targets CJS.
+const esmRequire = createRequire(import.meta.url);
 
 type ArrayElement<MyArray> = MyArray extends Array<infer T> ? T : never;
 
+const defaultPreset = createDefaultPreset();
+const jsWithTsPreset = createJsWithTsPreset();
+
 const baseConfig: ArrayElement<NonNullable<Config["projects"]>> = {
+  ...defaultPreset,
   roots: ["<rootDir>"],
   testMatch: ["**/*.spec.ts"],
-  preset: "ts-jest",
   modulePathIgnorePatterns: ["dist/", "<rootDir>/examples/"],
   coveragePathIgnorePatterns: [".*.spec.ts", "dist/"],
   clearMocks: true,
   injectGlobals: false,
   setupFilesAfterEnv: ["<rootDir>/jest.setup.ts"],
   moduleNameMapper: {
-    "^jose": require.resolve("jose"),
+    "^jose": esmRequire.resolve("jose"),
   },
 };
 
 // Required by @peculiar/webcrypto, which comes from the polyfills
 // loaded in the setup file.
 process.env.OPENSSL_CONF = "/dev/null";
 
-const presetConfig = createJsWithTsPreset({});
-
 const config: JestConfigWithTsJest = {
-  ...presetConfig,
   reporters: ["default", "github-actions"],
   collectCoverage: true,
   coverageReporters: process.env.CI ? ["text", "lcov"] : ["text"],
@@ -70,10 +80,7 @@ const config: JestConfigWithTsJest = {
     },
     {
       ...baseConfig,
-      // This combination of preset/transformIgnorePatterns enforces that both TS and
-      // JS files are transformed to CJS, and that the transform also applies to the
-      // dependencies in the node_modules, so that ESM-only dependencies are supported.
-      preset: "ts-jest/presets/js-with-ts",
+      ...jsWithTsPreset,
       displayName: "webext",
       roots: ["<rootDir>/packages/webext"],
       // Deliberately allow including node_modules when transforming code. undici can

openid.md

@@ -0,0 +1,36 @@
+```mermaid
+sequenceDiagram
+    actor RO
+    participant RP as MCP Client
+    participant OP as Identity Provider
+    box ESS
+    participant AS as Platform Service
+    participant MCP as MCP Service
+    participant Storage as Storage Service
+    participant Authorization as Authorization Service
+    end
+    activate RP
+    RO->>RP: Initiates login
+    RP->>OP: Authorization request
+    deactivate RP
+    activate OP
+    OP->>RO: Checks identity
+    RO->>OP: Proves identity
+    OP->>RP: Authorizes
+    deactivate OP
+    activate RP
+    RP->>OP: Token request
+    OP->>RP: Issues ID Token
+    RP->>AS: Token exchange
+    AS->>RP: Issues ESS Access Token
+    RP->>MCP: Authenticated request
+    MCP->>MCP: Tool-specific check
+    MCP->>AS: Token exchange
+    AS->>MCP: Issues token (new audience)
+    MCP->>Storage: Request resource
+    Storage->>Authorization: Authorization lookup
+    Authorization->>Storage: Authorization response
+    Storage->>MCP: Return resource
+    MCP->>RP: Tool response
+    deactivate RP
+```