@bayonai/mcp 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 0.1.0 - 2026-07-06
+
+- Added OAuth protected-resource metadata helpers.
+- Added OAuth authorization-server metadata helpers.
+- Added MCP bearer `WWW-Authenticate` challenge helper.
+- Added PKCE S256 challenge creation and verification.
+- Added URL-safe token generation, SHA-256 secret hashing, and constant-time
+  comparison helpers.
+- Added dual CJS/ESM package output and packed-package smoke verification.

package/README.md

@@ -0,0 +1,92 @@
+# @bayonai/mcp
+
+Shared MCP OAuth and protocol helpers for Bayon apps.
+
+This package contains app-agnostic helpers for remote MCP servers:
+
+- OAuth protected-resource and authorization-server metadata.
+- `WWW-Authenticate` bearer challenges that point MCP clients to metadata.
+- PKCE S256 challenge creation and verification.
+- Secret hashing, random token generation, and constant-time comparisons.
+
+Application code remains responsible for its own MCP tools/resources/prompts,
+business authorization, persistence, audit logging, and user-consent UI.
+
+## Install
+
+```sh
+pnpm add @bayonai/mcp
+```
+
+## Metadata
+
+```ts
+import {
+  createMcpWwwAuthenticateHeader,
+  getOAuthAuthorizationServerMetadata,
+  getOAuthProtectedResourceMetadata,
+} from "@bayonai/mcp";
+
+const baseUrl = "https://bounded.example/api";
+const scopes = ["bounded.read", "bounded.write"];
+
+export const protectedResource = getOAuthProtectedResourceMetadata({
+  documentationUrl: "https://bounded.example/docs/mcp",
+  scopes,
+  serviceUrl: baseUrl,
+});
+
+export const authorizationServer = getOAuthAuthorizationServerMetadata({
+  scopes,
+  serviceUrl: baseUrl,
+});
+
+export const wwwAuthenticate = createMcpWwwAuthenticateHeader({
+  metadataUrl: `${baseUrl}/.well-known/oauth-protected-resource`,
+  realm: "Bounded MCP",
+  scopes,
+});
+```
+
+## PKCE
+
+```ts
+import { buildPkceChallenge, verifyPkceChallenge } from "@bayonai/mcp";
+
+const challenge = buildPkceChallenge(codeVerifier);
+
+if (!verifyPkceChallenge({ challenge, method: "S256", verifier })) {
+  throw new Error("Invalid PKCE verifier.");
+}
+```
+
+## Token Secrets
+
+```ts
+import { createMcpRandomToken, hashMcpSecret } from "@bayonai/mcp";
+
+const accessToken = `app_mcp_access_${createMcpRandomToken(40)}`;
+const accessTokenHash = hashMcpSecret(accessToken);
+```
+
+Store token hashes, not bearer tokens. The app owns expiry, revocation, refresh
+rotation, and user/session lookup.
+
+## Package Boundaries
+
+Keep these app-specific concerns outside `@bayonai/mcp`:
+
+- Tool/resource/prompt registries.
+- Firestore collection names and indexes.
+- Firebase Auth, service-token, or admin consent flows.
+- Product-specific scopes such as `thunderlist.read` or `bounded.write`.
+- Audit logging and mutation authorization.
+
+## Release Checks
+
+```sh
+corepack pnpm --dir packages/bayonai-mcp run lint
+corepack pnpm --dir packages/bayonai-mcp run build
+corepack pnpm exec vitest run packages/bayonai-mcp/src/metadata.test.ts packages/bayonai-mcp/src/pkce.test.ts packages/bayonai-mcp/src/secrets.test.ts
+corepack pnpm --dir packages/bayonai-mcp run smoke:pack
+```

package/dist/cjs/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./metadata.js"), exports);
+__exportStar(require("./pkce.js"), exports);
+__exportStar(require("./secrets.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,4CAA0B;AAC1B,+CAA6B"}

package/dist/cjs/metadata.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOAuthProtectedResourceMetadata = getOAuthProtectedResourceMetadata;
+exports.getOAuthAuthorizationServerMetadata = getOAuthAuthorizationServerMetadata;
+exports.createMcpWwwAuthenticateHeader = createMcpWwwAuthenticateHeader;
+exports.normalizeMcpScopes = normalizeMcpScopes;
+function getOAuthProtectedResourceMetadata(options) {
+    const serviceUrl = normalizeBaseUrl(assertAbsoluteUrl(options.serviceUrl));
+    const authorizationServerUrl = normalizeBaseUrl(assertAbsoluteUrl(options.authorizationServerUrl ?? serviceUrl));
+    const resourcePath = assertAbsolutePath(options.resourcePath ?? "/mcp");
+    const scopes = normalizeMcpScopes(options.scopes);
+    return {
+        authorization_servers: [authorizationServerUrl],
+        bearer_methods_supported: ["header"],
+        ...(options.documentationUrl
+            ? { resource_documentation: options.documentationUrl }
+            : {}),
+        resource: `${serviceUrl}${resourcePath}`,
+        scopes_supported: scopes,
+    };
+}
+function getOAuthAuthorizationServerMetadata(options) {
+    const authorizationServerUrl = normalizeBaseUrl(assertAbsoluteUrl(options.authorizationServerUrl ?? options.serviceUrl));
+    const scopes = normalizeMcpScopes(options.scopes);
+    return {
+        authorization_endpoint: `${authorizationServerUrl}/oauth/authorize`,
+        code_challenge_methods_supported: ["S256"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        issuer: authorizationServerUrl,
+        registration_endpoint: `${authorizationServerUrl}/oauth/register`,
+        response_types_supported: ["code"],
+        scopes_supported: scopes,
+        token_endpoint: `${authorizationServerUrl}/oauth/token`,
+        token_endpoint_auth_methods_supported: ["none"],
+    };
+}
+function createMcpWwwAuthenticateHeader({ metadataUrl, realm, scopes, }) {
+    const normalizedScopes = normalizeMcpScopes(scopes);
+    return [
+        `Bearer realm="${escapeHeaderValue(realm)}"`,
+        `resource_metadata="${escapeHeaderValue(assertAbsoluteUrl(metadataUrl))}"`,
+        `scope="${escapeHeaderValue(normalizedScopes.join(" "))}"`,
+    ].join(", ");
+}
+function normalizeMcpScopes(scopes) {
+    const normalizedScopes = scopes.map((scope) => scope.trim()).filter(Boolean);
+    if (!normalizedScopes.length) {
+        throw new Error("MCP OAuth scopes must include at least one scope.");
+    }
+    return [...new Set(normalizedScopes)];
+}
+function assertAbsoluteUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.hostname !== "localhost") {
+        throw new Error("MCP OAuth URLs must use https, except localhost.");
+    }
+    return url.toString();
+}
+function normalizeBaseUrl(baseUrl) {
+    return baseUrl.replace(/\/+$/, "");
+}
+function assertAbsolutePath(path) {
+    if (!path.startsWith("/")) {
+        throw new Error("MCP OAuth resourcePath must start with /.");
+    }
+    return path;
+}
+function escapeHeaderValue(value) {
+    if (/[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new Error("MCP OAuth header values cannot contain control characters.");
+    }
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+//# sourceMappingURL=metadata.js.map

package/dist/cjs/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/metadata.ts"],"names":[],"mappings":";;AAQA,8EAmBC;AAED,kFAmBC;AAED,wEAgBC;AAED,gDAQC;AApED,SAAgB,iCAAiC,CAC/C,OAAgC;IAEhC,MAAM,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3E,MAAM,sBAAsB,GAAG,gBAAgB,CAC7C,iBAAiB,CAAC,OAAO,CAAC,sBAAsB,IAAI,UAAU,CAAC,CAChE,CAAC;IACF,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD,OAAO;QACL,qBAAqB,EAAE,CAAC,sBAAsB,CAAC;QAC/C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,gBAAgB;YAC1B,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,gBAAgB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,GAAG,UAAU,GAAG,YAAY,EAAE;QACxC,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED,SAAgB,mCAAmC,CACjD,OAAgC;IAEhC,MAAM,sBAAsB,GAAG,gBAAgB,CAC7C,iBAAiB,CAAC,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,UAAU,CAAC,CACxE,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD,OAAO;QACL,sBAAsB,EAAE,GAAG,sBAAsB,kBAAkB;QACnE,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,MAAM,EAAE,sBAAsB;QAC9B,qBAAqB,EAAE,GAAG,sBAAsB,iBAAiB;QACjE,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,cAAc,EAAE,GAAG,sBAAsB,cAAc;QACvD,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAAC,EAC7C,WAAW,EACX,KAAK,EACL,MAAM,GAKP;IACC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEpD,OAAO;QACL,iBAAiB,iBAAiB,CAAC,KAAK,CAAC,GAAG;QAC5C,sBAAsB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,GAAG;QAC1E,UAAU,iBAAiB,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG;KAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAyB;IAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7E,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAE3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC"}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/cjs/pkce.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPkceChallenge = buildPkceChallenge;
+exports.verifyPkceChallenge = verifyPkceChallenge;
+const crypto_1 = require("crypto");
+function buildPkceChallenge(verifier) {
+    return (0, crypto_1.createHash)("sha256").update(verifier).digest("base64url");
+}
+function verifyPkceChallenge({ challenge, method, verifier, }) {
+    if (method !== "S256") {
+        return false;
+    }
+    const expectedChallenge = buildPkceChallenge(verifier);
+    const expected = Buffer.from(expectedChallenge);
+    const actual = Buffer.from(challenge);
+    return expected.length === actual.length && (0, crypto_1.timingSafeEqual)(expected, actual);
+}
+//# sourceMappingURL=pkce.js.map

package/dist/cjs/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce.ts"],"names":[],"mappings":";;AAEA,gDAEC;AAED,kDAkBC;AAxBD,mCAAqD;AAErD,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,mBAAmB,CAAC,EAClC,SAAS,EACT,MAAM,EACN,QAAQ,GAKT;IACC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtC,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC"}

package/dist/cjs/secrets.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpRandomToken = createMcpRandomToken;
+exports.hashMcpSecret = hashMcpSecret;
+exports.constantTimeEqual = constantTimeEqual;
+const crypto_1 = require("crypto");
+function createMcpRandomToken(bytes) {
+    return (0, crypto_1.randomBytes)(bytes).toString("base64url");
+}
+function hashMcpSecret(secret) {
+    return (0, crypto_1.createHash)("sha256").update(secret).digest("base64url");
+}
+function constantTimeEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return (leftBuffer.length === rightBuffer.length &&
+        (0, crypto_1.timingSafeEqual)(leftBuffer, rightBuffer));
+}
+//# sourceMappingURL=secrets.js.map

package/dist/cjs/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":";;AAEA,oDAEC;AAED,sCAEC;AAED,8CAQC;AAlBD,mCAAkE;AAElE,SAAgB,oBAAoB,CAAC,KAAa;IAChD,OAAO,IAAA,oBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,aAAa,CAAC,MAAc;IAC1C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,SAAgB,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,IAAA,wBAAe,EAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,4 @@
+export * from "./metadata.js";
+export * from "./pkce.js";
+export * from "./secrets.js";
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}

package/dist/esm/metadata.js

@@ -0,0 +1,68 @@
+export function getOAuthProtectedResourceMetadata(options) {
+    const serviceUrl = normalizeBaseUrl(assertAbsoluteUrl(options.serviceUrl));
+    const authorizationServerUrl = normalizeBaseUrl(assertAbsoluteUrl(options.authorizationServerUrl ?? serviceUrl));
+    const resourcePath = assertAbsolutePath(options.resourcePath ?? "/mcp");
+    const scopes = normalizeMcpScopes(options.scopes);
+    return {
+        authorization_servers: [authorizationServerUrl],
+        bearer_methods_supported: ["header"],
+        ...(options.documentationUrl
+            ? { resource_documentation: options.documentationUrl }
+            : {}),
+        resource: `${serviceUrl}${resourcePath}`,
+        scopes_supported: scopes,
+    };
+}
+export function getOAuthAuthorizationServerMetadata(options) {
+    const authorizationServerUrl = normalizeBaseUrl(assertAbsoluteUrl(options.authorizationServerUrl ?? options.serviceUrl));
+    const scopes = normalizeMcpScopes(options.scopes);
+    return {
+        authorization_endpoint: `${authorizationServerUrl}/oauth/authorize`,
+        code_challenge_methods_supported: ["S256"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        issuer: authorizationServerUrl,
+        registration_endpoint: `${authorizationServerUrl}/oauth/register`,
+        response_types_supported: ["code"],
+        scopes_supported: scopes,
+        token_endpoint: `${authorizationServerUrl}/oauth/token`,
+        token_endpoint_auth_methods_supported: ["none"],
+    };
+}
+export function createMcpWwwAuthenticateHeader({ metadataUrl, realm, scopes, }) {
+    const normalizedScopes = normalizeMcpScopes(scopes);
+    return [
+        `Bearer realm="${escapeHeaderValue(realm)}"`,
+        `resource_metadata="${escapeHeaderValue(assertAbsoluteUrl(metadataUrl))}"`,
+        `scope="${escapeHeaderValue(normalizedScopes.join(" "))}"`,
+    ].join(", ");
+}
+export function normalizeMcpScopes(scopes) {
+    const normalizedScopes = scopes.map((scope) => scope.trim()).filter(Boolean);
+    if (!normalizedScopes.length) {
+        throw new Error("MCP OAuth scopes must include at least one scope.");
+    }
+    return [...new Set(normalizedScopes)];
+}
+function assertAbsoluteUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.hostname !== "localhost") {
+        throw new Error("MCP OAuth URLs must use https, except localhost.");
+    }
+    return url.toString();
+}
+function normalizeBaseUrl(baseUrl) {
+    return baseUrl.replace(/\/+$/, "");
+}
+function assertAbsolutePath(path) {
+    if (!path.startsWith("/")) {
+        throw new Error("MCP OAuth resourcePath must start with /.");
+    }
+    return path;
+}
+function escapeHeaderValue(value) {
+    if (/[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new Error("MCP OAuth header values cannot contain control characters.");
+    }
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+//# sourceMappingURL=metadata.js.map

package/dist/esm/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/metadata.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,iCAAiC,CAC/C,OAAgC;IAEhC,MAAM,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3E,MAAM,sBAAsB,GAAG,gBAAgB,CAC7C,iBAAiB,CAAC,OAAO,CAAC,sBAAsB,IAAI,UAAU,CAAC,CAChE,CAAC;IACF,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD,OAAO;QACL,qBAAqB,EAAE,CAAC,sBAAsB,CAAC;QAC/C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,gBAAgB;YAC1B,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,gBAAgB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE,GAAG,UAAU,GAAG,YAAY,EAAE;QACxC,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAAgC;IAEhC,MAAM,sBAAsB,GAAG,gBAAgB,CAC7C,iBAAiB,CAAC,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,UAAU,CAAC,CACxE,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD,OAAO;QACL,sBAAsB,EAAE,GAAG,sBAAsB,kBAAkB;QACnE,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,MAAM,EAAE,sBAAsB;QAC9B,qBAAqB,EAAE,GAAG,sBAAsB,iBAAiB;QACjE,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,MAAM;QACxB,cAAc,EAAE,GAAG,sBAAsB,cAAc;QACvD,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,EAC7C,WAAW,EACX,KAAK,EACL,MAAM,GAKP;IACC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEpD,OAAO;QACL,iBAAiB,iBAAiB,CAAC,KAAK,CAAC,GAAG;QAC5C,sBAAsB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,GAAG;QAC1E,UAAU,iBAAiB,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG;KAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7E,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAE3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC"}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/pkce.js

@@ -0,0 +1,14 @@
+import { createHash, timingSafeEqual } from "crypto";
+export function buildPkceChallenge(verifier) {
+    return createHash("sha256").update(verifier).digest("base64url");
+}
+export function verifyPkceChallenge({ challenge, method, verifier, }) {
+    if (method !== "S256") {
+        return false;
+    }
+    const expectedChallenge = buildPkceChallenge(verifier);
+    const expected = Buffer.from(expectedChallenge);
+    const actual = Buffer.from(challenge);
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+//# sourceMappingURL=pkce.js.map

package/dist/esm/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,SAAS,EACT,MAAM,EACN,QAAQ,GAKT;IACC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtC,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC"}

package/dist/esm/secrets.js

@@ -0,0 +1,14 @@
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+export function createMcpRandomToken(bytes) {
+    return randomBytes(bytes).toString("base64url");
+}
+export function hashMcpSecret(secret) {
+    return createHash("sha256").update(secret).digest("base64url");
+}
+export function constantTimeEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return (leftBuffer.length === rightBuffer.length &&
+        timingSafeEqual(leftBuffer, rightBuffer));
+}
+//# sourceMappingURL=secrets.js.map

package/dist/esm/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAElE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./metadata.js";
+export * from "./pkce.js";
+export * from "./secrets.js";

package/dist/metadata.d.ts

@@ -0,0 +1,31 @@
+export type McpOAuthMetadataOptions = {
+    authorizationServerUrl?: string;
+    documentationUrl?: string;
+    resourcePath?: string;
+    scopes: readonly string[];
+    serviceUrl: string;
+};
+export declare function getOAuthProtectedResourceMetadata(options: McpOAuthMetadataOptions): {
+    resource: string;
+    scopes_supported: string[];
+    resource_documentation?: string | undefined;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+};
+export declare function getOAuthAuthorizationServerMetadata(options: McpOAuthMetadataOptions): {
+    authorization_endpoint: string;
+    code_challenge_methods_supported: string[];
+    grant_types_supported: string[];
+    issuer: string;
+    registration_endpoint: string;
+    response_types_supported: string[];
+    scopes_supported: string[];
+    token_endpoint: string;
+    token_endpoint_auth_methods_supported: string[];
+};
+export declare function createMcpWwwAuthenticateHeader({ metadataUrl, realm, scopes, }: {
+    metadataUrl: string;
+    realm: string;
+    scopes: readonly string[];
+}): string;
+export declare function normalizeMcpScopes(scopes: readonly string[]): string[];

package/dist/pkce.d.ts

@@ -0,0 +1,6 @@
+export declare function buildPkceChallenge(verifier: string): string;
+export declare function verifyPkceChallenge({ challenge, method, verifier, }: {
+    challenge: string;
+    method: string;
+    verifier: string;
+}): boolean;

package/dist/secrets.d.ts

@@ -0,0 +1,3 @@
+export declare function createMcpRandomToken(bytes: number): string;
+export declare function hashMcpSecret(secret: string): string;
+export declare function constantTimeEqual(left: string, right: string): boolean;

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@bayonai/mcp",
+  "version": "0.1.0",
+  "description": "Shared MCP OAuth and protocol helpers for Bayon apps.",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "oauth",
+    "pkce",
+    "bayon"
+  ],
+  "homepage": "https://github.com/toledoroy/Thunderlist#readme",
+  "bugs": {
+    "url": "https://github.com/toledoroy/Thunderlist/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/toledoroy/Thunderlist.git",
+    "directory": "packages/bayonai-mcp"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js",
+      "default": "./dist/esm/index.js"
+    }
+  },
+  "main": "dist/cjs/index.js",
+  "module": "dist/esm/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.cjs.json && tsc -p tsconfig.esm.json && node scripts/prepare-dist.mjs",
+    "lint": "tsc --noEmit -p tsconfig.cjs.json && tsc --noEmit -p tsconfig.esm.json",
+    "prepack": "pnpm run build",
+    "smoke:pack": "node scripts/smoke-package.mjs"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "typescript": "^5"
+  }
+}