@ambitresearch/genie 1.3.1

package/README.md

@@ -0,0 +1,15 @@
+# @ambitresearch/genie
+
+The genie MCP server provides harness-agnostic UI-component generation, refinement,
+validation, and preview tools. See the [genie documentation](https://ambitresearch.github.io/genie/)
+for installation, configuration, and harness-specific setup.
+
+## Release verification
+
+Releases include npm provenance plus signed tarballs, SBOMs, container images, and the
+Claude Desktop bundle. After installing the package, run `npm audit signatures` to check
+its registry signature and provenance. For release downloads, use `cosign verify-blob`
+with the adjacent `.sig` bundle.
+
+The [supply-chain verification guide](https://github.com/ambitresearch/genie/blob/main/docs/supply-chain.md#verifying-a-release)
+contains the complete certificate identity, issuer, and container verification commands.

package/dist/auth/bearer.d.ts

@@ -0,0 +1,49 @@
+export type TokenScope = "read" | "write";
+/** A single stored token record — hash only, never the plaintext. */
+export interface StoredToken {
+    /** SHA-256 hex digest of the plaintext token. Acts as the record's key. */
+    hash: string;
+    /** First 12 chars of the plaintext (`genie_xxxxxxxx`) — safe to display/log. */
+    prefix: string;
+    sub: string;
+    scopes: TokenScope[];
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+/** Generate a new plaintext token: `genie_<32-char-base32>`. */
+export declare function generateToken(): string;
+/** True if `token` matches the expected `genie_<32-char-base32>` shape. */
+export declare function isValidTokenFormat(token: string): boolean;
+export interface CreateTokenOptions {
+    sub: string;
+    scopes?: TokenScope[];
+}
+/**
+ * Mint a new token, persist its hash, and return the plaintext.
+ * The plaintext is returned exactly once — callers (the CLI) must print it
+ * and never log/store it themselves.
+ */
+export declare function createToken(options: CreateTokenOptions): Promise<{
+    token: string;
+    record: StoredToken;
+}>;
+/** List all stored token records (hashes only — never plaintext). */
+export declare function listTokens(): Promise<StoredToken[]>;
+/**
+ * Revoke every stored token whose prefix starts with `prefix`. Returns the
+ * number of tokens removed.
+ */
+export declare function revokeToken(prefix: string): Promise<number>;
+export interface TokenVerificationResult {
+    ok: boolean;
+    record?: StoredToken;
+}
+/**
+ * Verify a presented plaintext token against the store. Constant-time per
+ * candidate hash comparison (AC: "constant-time crypto.timingSafeEqual").
+ * On success, updates `lastUsedAt` for that record (AC4).
+ */
+export declare function verifyToken(token: string): Promise<TokenVerificationResult>;
+/** Extract a bearer token from an `Authorization` header value, if present. */
+export declare function extractBearerToken(authorizationHeader: string | undefined): string | undefined;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/auth/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1C,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AA6CD,gEAAgE;AAChE,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAoBD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,CAgBD;AAED,qEAAqE;AACrE,wBAAsB,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAGzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOjE;AAUD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAgBjF;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI9F"}

package/dist/auth/bearer.js

@@ -0,0 +1,159 @@
+/**
+ * Static Bearer token authentication (M5-02, DRO-274).
+ *
+ * Covers harnesses that don't implement OAuth Dynamic Client Registration
+ * (VS Code Copilot, Cline, Continue.dev): they attach a static
+ * `Authorization: Bearer <token>` header on every MCP-over-HTTP request.
+ * Tokens are minted out-of-band via the admin CLI (`genie token create`),
+ * never re-derived from a password, and stored **hashed** (SHA-256) at
+ * `${GENIE_HOME}/auth/tokens.json` so the plaintext token exists only at
+ * mint time (shown once) and in the client's own header.
+ *
+ * Token format: `genie_<32-char-base32>` — deliberately similar to a GitHub
+ * PAT (`ghp_...`) so it visually reads as "a secret, handle carefully" and
+ * is easy to grep/rotate/revoke by prefix.
+ */
+import { randomBytes, createHash, timingSafeEqual } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+const TOKEN_PREFIX = "genie_";
+/** Crockford-ish base32 alphabet (no padding, unambiguous glyphs). */
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const BASE32_BODY_LENGTH = 32;
+const TOKEN_PATTERN = new RegExp(`^${TOKEN_PREFIX}[${BASE32_ALPHABET}]{${BASE32_BODY_LENGTH}}$`);
+/** Get the auth directory path from GENIE_HOME. */
+function getAuthDir() {
+    const home = process.env.GENIE_HOME || resolve(process.cwd(), ".genie");
+    return resolve(home, "auth");
+}
+function getTokensPath() {
+    return resolve(getAuthDir(), "tokens.json");
+}
+function sha256Hex(input) {
+    return createHash("sha256").update(input, "utf8").digest("hex");
+}
+/** Encode raw bytes as unpadded base32 using BASE32_ALPHABET. */
+function base32Encode(buf, length) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (const byte of buf) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += BASE32_ALPHABET[(value >>> (bits - 5)) & 0x1f];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        out += BASE32_ALPHABET[(value << (5 - bits)) & 0x1f];
+    }
+    return out.slice(0, length);
+}
+/** Generate a new plaintext token: `genie_<32-char-base32>`. */
+export function generateToken() {
+    // 32 base32 chars needs ceil(32*5/8) = 20 bytes of entropy.
+    const body = base32Encode(randomBytes(20), BASE32_BODY_LENGTH);
+    return `${TOKEN_PREFIX}${body}`;
+}
+/** True if `token` matches the expected `genie_<32-char-base32>` shape. */
+export function isValidTokenFormat(token) {
+    return TOKEN_PATTERN.test(token);
+}
+/** Read the token store from disk. Returns an empty store if missing/corrupt. */
+async function loadStore() {
+    try {
+        const content = await readFile(getTokensPath(), "utf-8");
+        const parsed = JSON.parse(content);
+        if (!Array.isArray(parsed.tokens))
+            return { tokens: [] };
+        return parsed;
+    }
+    catch {
+        return { tokens: [] };
+    }
+}
+async function saveStore(store) {
+    const dir = getAuthDir();
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await writeFile(getTokensPath(), JSON.stringify(store, null, 2), { mode: 0o600 });
+}
+/**
+ * Mint a new token, persist its hash, and return the plaintext.
+ * The plaintext is returned exactly once — callers (the CLI) must print it
+ * and never log/store it themselves.
+ */
+export async function createToken(options) {
+    const scopes = options.scopes && options.scopes.length > 0 ? options.scopes : ["read"];
+    const token = generateToken();
+    const record = {
+        hash: sha256Hex(token),
+        prefix: token.slice(0, 12),
+        sub: options.sub,
+        scopes,
+        createdAt: new Date().toISOString(),
+        lastUsedAt: null,
+    };
+    const store = await loadStore();
+    store.tokens.push(record);
+    await saveStore(store);
+    return { token, record };
+}
+/** List all stored token records (hashes only — never plaintext). */
+export async function listTokens() {
+    const store = await loadStore();
+    return store.tokens;
+}
+/**
+ * Revoke every stored token whose prefix starts with `prefix`. Returns the
+ * number of tokens removed.
+ */
+export async function revokeToken(prefix) {
+    const store = await loadStore();
+    const before = store.tokens.length;
+    store.tokens = store.tokens.filter((t) => !t.prefix.startsWith(prefix));
+    const removed = before - store.tokens.length;
+    if (removed > 0)
+        await saveStore(store);
+    return removed;
+}
+/** Constant-time compare of two hex digests (equal length required). */
+function hexTimingSafeEqual(a, b) {
+    const bufA = Buffer.from(a, "hex");
+    const bufB = Buffer.from(b, "hex");
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+/**
+ * Verify a presented plaintext token against the store. Constant-time per
+ * candidate hash comparison (AC: "constant-time crypto.timingSafeEqual").
+ * On success, updates `lastUsedAt` for that record (AC4).
+ */
+export async function verifyToken(token) {
+    if (!isValidTokenFormat(token))
+        return { ok: false };
+    const candidateHash = sha256Hex(token);
+    const store = await loadStore();
+    let matched;
+    // Iterate every record rather than short-circuiting on a Map lookup, so
+    // comparison time doesn't leak whether *some* token existed vs none.
+    for (const record of store.tokens) {
+        if (hexTimingSafeEqual(record.hash, candidateHash)) {
+            matched = record;
+        }
+    }
+    if (matched === undefined)
+        return { ok: false };
+    matched.lastUsedAt = new Date().toISOString();
+    await saveStore(store);
+    return { ok: true, record: matched };
+}
+/** Extract a bearer token from an `Authorization` header value, if present. */
+export function extractBearerToken(authorizationHeader) {
+    if (!authorizationHeader)
+        return undefined;
+    const match = /^Bearer\s+(\S+)$/i.exec(authorizationHeader.trim());
+    return match?.[1];
+}
+//# sourceMappingURL=bearer.js.map

package/dist/auth/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBpC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAC9B,sEAAsE;AACtE,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,IAAI,eAAe,KAAK,kBAAkB,IAAI,CAAC,CAAC;AAEjG,mDAAmD;AACnD,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,iEAAiE;AACjE,SAAS,YAAY,CAAC,GAAW,EAAE,MAAc;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,GAAG,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa;IAC3B,4DAA4D;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC/D,OAAO,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAqB;IAC5C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAI3D,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAkB,CAAC;IAC5F,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAgB;QAC1B,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;QACtB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,IAAI;KACjB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,IAAI,OAAgC,CAAC;IACrC,wEAAwE;IACxE,qEAAqE;IACrE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YACnD,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAChD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,mBAAuC;IACxE,IAAI,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/auth/oauth/authorize.d.ts

@@ -0,0 +1,19 @@
+import type { OAuthStore } from "./store.js";
+export interface AuthorizeQuery {
+    response_type?: string;
+    client_id?: string;
+    redirect_uri?: string;
+    scope?: string;
+    state?: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+}
+export declare class AuthorizeError extends Error {
+    readonly status: number;
+    constructor(message: string, status?: number);
+}
+/** AC3 — render the minimal server-rendered consent screen (GET /authorize). */
+export declare function renderConsentScreen(store: OAuthStore, query: AuthorizeQuery): string;
+/** AC3 — handle the consent decision (POST /authorize); returns the redirect URL. */
+export declare function handleConsentDecision(store: OAuthStore, params: URLSearchParams, decision: string): string;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/auth/oauth/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,cAAe,SAAQ,KAAK;IAGrC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADvB,OAAO,EAAE,MAAM,EACN,MAAM,GAAE,MAAY;CAIhC;AAmDD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CA4BpF;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,GACf,MAAM,CA8BR"}

package/dist/auth/oauth/authorize.js

@@ -0,0 +1,111 @@
+export class AuthorizeError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.status = status;
+    }
+}
+const SUPPORTED_SCOPES = ["read", "write"];
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (ch) => {
+        switch (ch) {
+            case "&":
+                return "&amp;";
+            case "<":
+                return "&lt;";
+            case ">":
+                return "&gt;";
+            case '"':
+                return "&quot;";
+            default:
+                return "&#39;";
+        }
+    });
+}
+function validateAuthorizeRequest(store, query) {
+    if (query.response_type !== "code") {
+        throw new AuthorizeError("response_type must be 'code'.");
+    }
+    if (!query.client_id)
+        throw new AuthorizeError("client_id is required.");
+    const client = store.getClient(query.client_id);
+    if (client === undefined)
+        throw new AuthorizeError("Unknown client_id.");
+    if (!query.redirect_uri || !client.redirect_uris.includes(query.redirect_uri)) {
+        throw new AuthorizeError("redirect_uri is missing or not registered for this client.");
+    }
+    if (query.code_challenge_method !== "S256" || !query.code_challenge) {
+        throw new AuthorizeError("PKCE code_challenge with method S256 is required.");
+    }
+    const requestedScopes = (query.scope ?? "read").split(/\s+/).filter(Boolean);
+    const scopes = requestedScopes.filter((s) => SUPPORTED_SCOPES.includes(s));
+    if (scopes.length === 0)
+        throw new AuthorizeError("No valid scopes requested.");
+    return {
+        clientId: query.client_id,
+        redirectUri: query.redirect_uri,
+        scopes,
+        codeChallenge: query.code_challenge,
+    };
+}
+/** AC3 — render the minimal server-rendered consent screen (GET /authorize). */
+export function renderConsentScreen(store, query) {
+    const { scopes } = validateAuthorizeRequest(store, query);
+    const params = new URLSearchParams({
+        response_type: query.response_type ?? "",
+        client_id: query.client_id ?? "",
+        redirect_uri: query.redirect_uri ?? "",
+        scope: scopes.join(" "),
+        state: query.state ?? "",
+        code_challenge: query.code_challenge ?? "",
+        code_challenge_method: query.code_challenge_method ?? "",
+    });
+    return `<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>genie — Authorize</title></head>
+<body>
+  <h1>Authorize access to genie</h1>
+  <p>This application is requesting the following permissions:</p>
+  <ul>
+    ${scopes.map((s) => `<li>${escapeHtml(s)}</li>`).join("\n    ")}
+  </ul>
+  <form method="POST" action="/authorize">
+    <input type="hidden" name="params" value="${escapeHtml(params.toString())}">
+    <button type="submit" name="decision" value="allow">Allow</button>
+    <button type="submit" name="decision" value="deny">Deny</button>
+  </form>
+</body>
+</html>`;
+}
+/** AC3 — handle the consent decision (POST /authorize); returns the redirect URL. */
+export function handleConsentDecision(store, params, decision) {
+    const query = {
+        response_type: params.get("response_type") ?? undefined,
+        client_id: params.get("client_id") ?? undefined,
+        redirect_uri: params.get("redirect_uri") ?? undefined,
+        scope: params.get("scope") ?? undefined,
+        state: params.get("state") ?? undefined,
+        code_challenge: params.get("code_challenge") ?? undefined,
+        code_challenge_method: params.get("code_challenge_method") ?? undefined,
+    };
+    const { clientId, redirectUri, scopes, codeChallenge } = validateAuthorizeRequest(store, query);
+    const redirectUrl = new URL(redirectUri);
+    if (decision !== "allow") {
+        redirectUrl.searchParams.set("error", "access_denied");
+        if (query.state)
+            redirectUrl.searchParams.set("state", query.state);
+        return redirectUrl.toString();
+    }
+    const code = store.issueAuthorizationCode({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        scope: scopes.join(" "),
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+    });
+    redirectUrl.searchParams.set("code", code);
+    if (query.state)
+        redirectUrl.searchParams.set("state", query.state);
+    return redirectUrl.toString();
+}
+//# sourceMappingURL=authorize.js.map

package/dist/auth/oauth/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/auth/oauth/authorize.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,cAAe,SAAQ,KAAK;IAG5B;IAFX,YACE,OAAe,EACN,SAAiB,GAAG;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAc;IAG/B,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE3C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE;QACtC,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,OAAO,OAAO,CAAC;YACjB,KAAK,GAAG;gBACN,OAAO,MAAM,CAAC;YAChB,KAAK,GAAG;gBACN,OAAO,MAAM,CAAC;YAChB,KAAK,GAAG;gBACN,OAAO,QAAQ,CAAC;YAClB;gBACE,OAAO,OAAO,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAiB,EAAE,KAAqB;IAMxE,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,cAAc,CAAC,wBAAwB,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,cAAc,CAAC,4DAA4D,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,cAAc,CAAC,mDAAmD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,4BAA4B,CAAC,CAAC;IAEhF,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,WAAW,EAAE,KAAK,CAAC,YAAY;QAC/B,MAAM;QACN,aAAa,EAAE,KAAK,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,KAAiB,EAAE,KAAqB;IAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QACtC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;QAC1C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE;KACzD,CAAC,CAAC;IAEH,OAAO;;;;;;;MAOH,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;;;gDAGnB,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;;;;;QAKrE,CAAC;AACT,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CACnC,KAAiB,EACjB,MAAuB,EACvB,QAAgB;IAEhB,MAAM,KAAK,GAAmB;QAC5B,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;QACvD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;QAC/C,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;QACrD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACvC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACvC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS;QACzD,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,SAAS;KACxE,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEhG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,KAAK;YAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC;QACxC,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IAEH,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,KAAK;QAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/auth/oauth/config.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OAuth signing-key resolution (DRO-273 / M5-01).
+ *
+ * The server refuses to start OAuth-protected endpoints without a signing
+ * key of adequate length — see Implementation Notes in the issue.
+ */
+export declare class MissingOAuthKeyError extends Error {
+}
+export declare function resolveOAuthSigningKey(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/oauth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQnF"}

package/dist/auth/oauth/config.js

@@ -0,0 +1,16 @@
+/**
+ * OAuth signing-key resolution (DRO-273 / M5-01).
+ *
+ * The server refuses to start OAuth-protected endpoints without a signing
+ * key of adequate length — see Implementation Notes in the issue.
+ */
+export class MissingOAuthKeyError extends Error {
+}
+export function resolveOAuthSigningKey(env = process.env) {
+    const key = env.OAUTH_HS256_KEY;
+    if (key === undefined || key.length < 32) {
+        throw new MissingOAuthKeyError("OAUTH_HS256_KEY env var must be set to a string of at least 32 characters to enable OAuth.");
+    }
+    return key;
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/oauth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/auth/oauth/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,oBAAoB,CAC5B,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/oauth/dcr.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthStore } from "./store.js";
+export interface DcrRequestBody {
+    redirect_uris?: unknown;
+    client_name?: unknown;
+    [key: string]: unknown;
+}
+export declare class DcrValidationError extends Error {
+}
+/**
+ * RFC 7591 Dynamic Client Registration (AC2). Accepts a DCR request body and
+ * registers a new client, returning `{ client_id, client_secret,
+ * client_secret_expires_at: 0 }` (non-expiring secret — no rotation in v1).
+ */
+export declare function registerDynamicClient(store: OAuthStore, body: DcrRequestBody): Record<string, unknown>;
+//# sourceMappingURL=dcr.d.ts.map

package/dist/auth/oauth/dcr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dcr.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/dcr.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAEhD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,cAAc,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6BzB"}

package/dist/auth/oauth/dcr.js

@@ -0,0 +1,38 @@
+export class DcrValidationError extends Error {
+}
+/**
+ * RFC 7591 Dynamic Client Registration (AC2). Accepts a DCR request body and
+ * registers a new client, returning `{ client_id, client_secret,
+ * client_secret_expires_at: 0 }` (non-expiring secret — no rotation in v1).
+ */
+export function registerDynamicClient(store, body) {
+    const redirectUris = body.redirect_uris;
+    if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+        throw new DcrValidationError("redirect_uris is required and must be a non-empty array.");
+    }
+    for (const uri of redirectUris) {
+        if (typeof uri !== "string" || uri.length === 0) {
+            throw new DcrValidationError("Each redirect_uri must be a non-empty string.");
+        }
+        let parsedUri;
+        try {
+            parsedUri = new URL(uri);
+        }
+        catch {
+            throw new DcrValidationError("Each redirect_uri must be an absolute HTTP(S) URL.");
+        }
+        if (parsedUri.protocol !== "http:" && parsedUri.protocol !== "https:") {
+            throw new DcrValidationError("Each redirect_uri must use the http or https scheme.");
+        }
+    }
+    const clientName = typeof body.client_name === "string" ? body.client_name : undefined;
+    const client = store.registerClient(redirectUris, clientName);
+    return {
+        client_id: client.client_id,
+        client_secret: client.client_secret,
+        client_secret_expires_at: client.client_secret_expires_at,
+        redirect_uris: client.redirect_uris,
+        client_name: client.client_name,
+    };
+}
+//# sourceMappingURL=dcr.js.map

package/dist/auth/oauth/dcr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dcr.js","sourceRoot":"","sources":["../../../src/auth/oauth/dcr.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;CAAG;AAEhD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiB,EACjB,IAAoB;IAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAAC,0DAA0D,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,kBAAkB,CAAC,+CAA+C,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,oDAAoD,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,IAAI,kBAAkB,CAAC,sDAAsD,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvF,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,YAAwB,EAAE,UAAU,CAAC,CAAC;IAC1E,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC"}

package/dist/auth/oauth/jwt.d.ts

@@ -0,0 +1,13 @@
+export interface JwtPayload {
+    sub: string;
+    scope: string;
+    iat: number;
+    exp: number;
+    client_id: string;
+    [key: string]: unknown;
+}
+export declare function signJwtHS256(payload: JwtPayload, secret: string): string;
+export declare class JwtVerificationError extends Error {
+}
+export declare function verifyJwtHS256(token: string, secret: string): JwtPayload;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/auth/oauth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/jwt.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAOxE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAsBxE"}

package/dist/auth/oauth/jwt.js

@@ -0,0 +1,46 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** Minimal HS256 JWT sign/verify — no external deps (RFC 7519 subset used by genie's OAuth). */
+function base64url(input) {
+    const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+    return buf.toString("base64url");
+}
+function base64urlToBuffer(input) {
+    return Buffer.from(input, "base64url");
+}
+export function signJwtHS256(payload, secret) {
+    const header = { alg: "HS256", typ: "JWT" };
+    const encodedHeader = base64url(JSON.stringify(header));
+    const encodedPayload = base64url(JSON.stringify(payload));
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = createHmac("sha256", secret).update(signingInput).digest();
+    return `${signingInput}.${base64url(signature)}`;
+}
+export class JwtVerificationError extends Error {
+}
+export function verifyJwtHS256(token, secret) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new JwtVerificationError("Malformed JWT");
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    let header;
+    try {
+        header = JSON.parse(base64urlToBuffer(encodedHeader).toString("utf8"));
+    }
+    catch {
+        throw new JwtVerificationError("Malformed JWT header");
+    }
+    if (header.alg !== "HS256")
+        throw new JwtVerificationError("Unsupported JWT algorithm");
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const expected = createHmac("sha256", secret).update(signingInput).digest();
+    const actual = base64urlToBuffer(encodedSignature);
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+        throw new JwtVerificationError("Invalid signature");
+    }
+    const payload = JSON.parse(base64urlToBuffer(encodedPayload).toString("utf8"));
+    if (typeof payload.exp === "number" && Date.now() / 1000 > payload.exp) {
+        throw new JwtVerificationError("Token expired");
+    }
+    return payload;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/auth/oauth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/oauth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,gGAAgG;AAEhG,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAWD,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,MAAc;IAC9D,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7E,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAiC,CAAC;IAC5F,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC;IAC7F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACvE,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auth/oauth/metadata.d.ts

@@ -0,0 +1,9 @@
+export interface OAuthMetadataOptions {
+    issuer: string;
+}
+/**
+ * RFC 8414 Authorization Server Metadata (AC1). Served at
+ * `/.well-known/oauth-authorization-server`.
+ */
+export declare function buildAuthorizationServerMetadata(opts: OAuthMetadataOptions): Record<string, unknown>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/auth/oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/metadata.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAapG"}

package/dist/auth/oauth/metadata.js

@@ -0,0 +1,19 @@
+/**
+ * RFC 8414 Authorization Server Metadata (AC1). Served at
+ * `/.well-known/oauth-authorization-server`.
+ */
+export function buildAuthorizationServerMetadata(opts) {
+    const { issuer } = opts;
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/token`,
+        registration_endpoint: `${issuer}/register`,
+        scopes_supported: ["read", "write"],
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+    };
+}
+//# sourceMappingURL=metadata.js.map

package/dist/auth/oauth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/auth/oauth/metadata.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAA0B;IACzE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/auth/oauth/router.d.ts

@@ -0,0 +1,32 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { OAuthStore } from "./store.js";
+import { type JwtPayload } from "./jwt.js";
+import { MissingOAuthKeyError } from "./config.js";
+export { MissingOAuthKeyError };
+export interface OAuthHttpRouterOptions {
+    /** Public base URL clients see this server at (issuer). */
+    issuer: string;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Wires the OAuth 2.0 + DCR endpoints (RFC 7591 / RFC 8414) onto genie's
+ * Streamable HTTP server (DRO-273 / M5-01):
+ *   GET  /.well-known/oauth-authorization-server
+ *   POST /register
+ *   GET  /authorize   (consent screen)
+ *   POST /authorize   (consent decision)
+ *   POST /token
+ *
+ * Returns `undefined` (feature disabled) if `OAUTH_HS256_KEY` is unset or too
+ * short — callers should refuse to start OAuth-protected routes in that case
+ * per the issue's Implementation Notes, while still allowing unauthenticated
+ * MCP transport to run (OAuth is opt-in).
+ */
+export declare function createOAuthRouter(opts: OAuthHttpRouterOptions): {
+    signingKey: string;
+    store: OAuthStore;
+    handle: (req: IncomingMessage, res: ServerResponse, pathname: string) => boolean;
+    verifyBearerToken: (authorizationHeader: string | undefined) => JwtPayload;
+};
+export declare function tryCreateOAuthRouter(opts: OAuthHttpRouterOptions): ReturnType<typeof createOAuthRouter> | undefined;
+//# sourceMappingURL=router.d.ts.map

package/dist/auth/oauth/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKxC,OAAO,EAAwC,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAA0B,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,GAAG;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACjF,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC;CAC5E,CAiIA;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,sBAAsB,GAC3B,UAAU,CAAC,OAAO,iBAAiB,CAAC,GAAG,SAAS,CAOlD"}