@bycrawl/mcp 0.4.1 → 0.5.0

package/README.md

@@ -45,6 +45,26 @@ Add to your MCP config:
 | Job104 | 3 | Search jobs, get company/job details |
 | System | 1 | Health check |
 
+## Usage Examples
+
+### Example 1: Search Threads posts about a topic
+
+> **Prompt:** "What are people saying about OpenAI on Threads?"
+
+Claude will call `threads_search_posts` with `query: "OpenAI"` and return a summary of recent public posts, including text, like counts, and reply counts.
+
+### Example 2: Get LinkedIn company info
+
+> **Prompt:** "Tell me about Anthropic's LinkedIn presence — what do they do, how big are they?"
+
+Claude will call `linkedin_get_company` with `company_id: "anthropic"` and return the company's description, employee count, industry, headquarters, and recent activity.
+
+### Example 3: Fetch YouTube video comments
+
+> **Prompt:** "Summarize the comments on this YouTube video: https://www.youtube.com/watch?v=dQw4w9WgXcQ"
+
+Claude will call `youtube_get_video_comments` with `video_id: "dQw4w9WgXcQ"` and return the top comments with like counts, which it can then summarize for sentiment and key themes.
+
 ## API Key
 
 Get your API key at [bycrawl.com](https://bycrawl.com).

package/build/client.js

@@ -9,15 +9,19 @@ export async function bycrawlGet(path, params) {
                     url.searchParams.set(k, String(v));
             }
         }
+        const apiKey = getApiKey();
+        console.log(`[bycrawlGet] ${url.toString()} apiKey=${apiKey ? apiKey.slice(0, 12) + "..." : "(empty)"}`);
         const res = await fetch(url, {
-            headers: { "x-api-key": getApiKey() },
+            headers: { "x-api-key": apiKey },
             signal: AbortSignal.timeout(120_000),
         });
         const body = await res.text();
+        console.log(`[bycrawlGet] status=${res.status} body=${body.slice(0, 200)}`);
         return { content: [{ type: "text", text: body }] };
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
+        console.error(`[bycrawlGet] error:`, message);
         return { content: [{ type: "text", text: JSON.stringify({ error: message }) }] };
     }
 }

package/build/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,yBAAyB,CAAC;AAIzE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,MAAqE;IAErE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,yBAAyB,CAAC;AAIzE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,MAAqE;IAErE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,QAAQ,EAAE,WAAW,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAEzG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,CAAC,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}

package/build/oauth/callback.d.ts

@@ -0,0 +1,6 @@
+import type { Request, Response } from "express";
+/**
+ * GET /oauth/callback/:nonce
+ * Supabase Auth redirects here after Google login.
+ */
+export declare function oauthCallbackHandler(req: Request, res: Response): Promise<void>;

package/build/oauth/callback.js

@@ -0,0 +1,75 @@
+import { randomBytes } from "node:crypto";
+import { pendingAuthStore, authCodeStore } from "./store.js";
+import { findUserByEmail, findOrCreateMcpKey } from "./user-keys.js";
+const SUPABASE_URL = process.env.SUPABASE_URL;
+const SUPABASE_PUBLISHABLE_KEY = process.env.SUPABASE_PUBLISHABLE_KEY;
+/**
+ * GET /oauth/callback/:nonce
+ * Supabase Auth redirects here after Google login.
+ */
+export async function oauthCallbackHandler(req, res) {
+    try {
+        const nonce = req.params.nonce;
+        const code = req.query.code;
+        if (!nonce || !code) {
+            res.status(400).json({ error: "Missing nonce or code" });
+            return;
+        }
+        // 1. Look up pending auth state
+        const pending = pendingAuthStore.getAndDelete(nonce);
+        if (!pending) {
+            res.status(400).json({ error: "Invalid or expired nonce" });
+            return;
+        }
+        // 2. Exchange Supabase auth code for session (PKCE flow)
+        const tokenRes = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=pkce`, {
+            method: "POST",
+            headers: {
+                apikey: SUPABASE_PUBLISHABLE_KEY,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                auth_code: code,
+                code_verifier: pending.supabaseCodeVerifier,
+            }),
+        });
+        if (!tokenRes.ok) {
+            const err = await tokenRes.text();
+            res.status(502).json({ error: `Supabase token exchange failed: ${err}` });
+            return;
+        }
+        const session = (await tokenRes.json());
+        const email = session.user?.email;
+        if (!email) {
+            res.status(502).json({ error: "No email in Supabase session" });
+            return;
+        }
+        // 3. Find user in ByCrawl
+        const user = await findUserByEmail(email);
+        if (!user) {
+            const loginUrl = `https://bycrawl.com/login?reason=mcp_signup_required&email=${encodeURIComponent(email)}`;
+            res.redirect(302, loginUrl);
+            return;
+        }
+        // 4. Find or create MCP API key
+        const apiKey = await findOrCreateMcpKey(user.id);
+        // 5. Generate auth code and store it
+        const authCode = randomBytes(32).toString("hex");
+        authCodeStore.set(authCode, {
+            clientId: pending.clientId,
+            apiKey,
+            codeChallenge: pending.codeChallenge,
+            redirectUri: pending.redirectUri,
+        });
+        // 6. Redirect back to Claude with auth code
+        const redirectUrl = new URL(pending.redirectUri);
+        redirectUrl.searchParams.set("code", authCode);
+        redirectUrl.searchParams.set("state", pending.state);
+        res.redirect(302, redirectUrl.toString());
+    }
+    catch (err) {
+        console.error("OAuth callback error:", err);
+        res.status(500).json({ error: "Internal server error during OAuth callback" });
+    }
+}
+//# sourceMappingURL=callback.js.map

package/build/oauth/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/oauth/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAErE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;AAC/C,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAyB,CAAC;AAEvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAY,EAAE,GAAa;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAA2B,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAA0B,CAAC;QAElD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,yDAAyD;QACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,gCAAgC,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,wBAAwB;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,OAAO,CAAC,oBAAoB;aAC5C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,8DAA8D,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3G,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjD,qCAAqC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QAEH,4CAA4C;QAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC"}

package/build/oauth/crypto.d.ts

@@ -0,0 +1,6 @@
+/** AES-256-GCM encrypt. Returns `iv:ciphertext:tag` in hex. */
+export declare function encryptApiKey(plain: string): string;
+/** Decrypt an `iv:ciphertext:tag` hex blob. */
+export declare function decryptApiKey(blob: string): string;
+/** SHA-256 hex hash — matches ByCrawl gateway's Python hashlib.sha256. */
+export declare function hashApiKey(plain: string): string;

package/build/oauth/crypto.js

@@ -0,0 +1,29 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+const KEY_HEX = process.env.KEY_ENCRYPTION_KEY ?? "";
+function getKey() {
+    if (KEY_HEX.length !== 64)
+        throw new Error("KEY_ENCRYPTION_KEY must be 64 hex chars (32 bytes)");
+    return Buffer.from(KEY_HEX, "hex");
+}
+/** AES-256-GCM encrypt. Returns `iv:ciphertext:tag` in hex. */
+export function encryptApiKey(plain) {
+    const key = getKey();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const encrypted = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${iv.toString("hex")}:${encrypted.toString("hex")}:${tag.toString("hex")}`;
+}
+/** Decrypt an `iv:ciphertext:tag` hex blob. */
+export function decryptApiKey(blob) {
+    const key = getKey();
+    const [ivHex, ctHex, tagHex] = blob.split(":");
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivHex, "hex"));
+    decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+    return decipher.update(ctHex, "hex", "utf8") + decipher.final("utf8");
+}
+/** SHA-256 hex hash — matches ByCrawl gateway's Python hashlib.sha256. */
+export function hashApiKey(plain) {
+    return createHash("sha256").update(plain).digest("hex");
+}
+//# sourceMappingURL=crypto.js.map

package/build/oauth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/oauth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;AAErD,SAAS,MAAM;IACb,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/build/oauth/provider.d.ts

@@ -0,0 +1,14 @@
+import type { Response } from "express";
+import type { OAuthServerProvider, AuthorizationParams } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+export declare class ByCrawlOAuthProvider implements OAuthServerProvider {
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+}

package/build/oauth/provider.js

@@ -0,0 +1,125 @@
+import { randomBytes, createHash } from "node:crypto";
+import { SignJWT, jwtVerify } from "jose";
+import { pendingAuthStore, authCodeStore, refreshTokenStore, clientStore, } from "./store.js";
+const SUPABASE_URL = process.env.SUPABASE_URL;
+const EXTERNAL_URL = process.env.EXTERNAL_URL;
+const JWT_SECRET = process.env.JWT_SECRET;
+function getJwtKey() {
+    return new TextEncoder().encode(JWT_SECRET);
+}
+async function signJwt(apiKey, clientId) {
+    return new SignJWT({ api_key: apiKey, client_id: clientId })
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuedAt()
+        .setExpirationTime("1h")
+        .sign(getJwtKey());
+}
+export class ByCrawlOAuthProvider {
+    get clientsStore() {
+        return clientStore;
+    }
+    async authorize(client, params, res) {
+        const nonce = randomBytes(16).toString("hex");
+        // Generate PKCE pair for Supabase side
+        const supabaseCodeVerifier = randomBytes(32).toString("hex");
+        const supabaseCodeChallenge = createHash("sha256")
+            .update(supabaseCodeVerifier)
+            .digest("base64url");
+        pendingAuthStore.set(nonce, {
+            state: params.state ?? "",
+            clientId: client.client_id,
+            codeChallenge: params.codeChallenge,
+            redirectUri: params.redirectUri,
+            scopes: params.scopes ?? [],
+            supabaseCodeVerifier,
+        });
+        // Redirect to Supabase Auth (Google OAuth) with PKCE + nonce in path
+        const callbackUrl = `${EXTERNAL_URL}/oauth/callback/${nonce}`;
+        const supabaseAuthUrl = `${SUPABASE_URL}/auth/v1/authorize?provider=google&flow_type=pkce&code_challenge=${supabaseCodeChallenge}&code_challenge_method=S256&redirect_to=${encodeURIComponent(callbackUrl)}`;
+        res.redirect(302, supabaseAuthUrl);
+    }
+    async challengeForAuthorizationCode(_client, authorizationCode) {
+        const entry = authCodeStore.get(authorizationCode);
+        if (!entry)
+            throw new Error("Invalid authorization code");
+        return entry.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode) {
+        const entry = authCodeStore.getAndDelete(authorizationCode);
+        if (!entry)
+            throw new Error("Invalid or expired authorization code");
+        if (entry.clientId !== client.client_id)
+            throw new Error("Client ID mismatch");
+        const accessToken = await signJwt(entry.apiKey, client.client_id);
+        const refreshToken = randomBytes(32).toString("hex");
+        refreshTokenStore.set(refreshToken, {
+            clientId: client.client_id,
+            apiKey: entry.apiKey,
+            scopes: [],
+        });
+        return {
+            access_token: accessToken,
+            token_type: "bearer",
+            expires_in: 3600,
+            refresh_token: refreshToken,
+        };
+    }
+    async exchangeRefreshToken(client, refreshToken) {
+        const entry = refreshTokenStore.getAndDelete(refreshToken);
+        if (!entry)
+            throw new Error("Invalid or expired refresh token");
+        if (entry.clientId !== client.client_id)
+            throw new Error("Client ID mismatch");
+        const accessToken = await signJwt(entry.apiKey, client.client_id);
+        const newRefreshToken = randomBytes(32).toString("hex");
+        // Rotate: store new refresh token
+        refreshTokenStore.set(newRefreshToken, {
+            clientId: client.client_id,
+            apiKey: entry.apiKey,
+            scopes: entry.scopes,
+        });
+        return {
+            access_token: accessToken,
+            token_type: "bearer",
+            expires_in: 3600,
+            refresh_token: newRefreshToken,
+        };
+    }
+    async verifyAccessToken(token) {
+        console.log(`[verifyAccessToken] token prefix=${token.slice(0, 20)}...`);
+        // Backward compat: plain API keys bypass JWT verification
+        if (token.startsWith("sk_byc_")) {
+            console.log(`[verifyAccessToken] plain API key detected`);
+            return {
+                token,
+                clientId: "legacy",
+                scopes: [],
+                expiresAt: Math.floor(Date.now() / 1000) + 3600,
+                extra: { apiKey: token },
+            };
+        }
+        // JWT verification
+        try {
+            const { payload } = await jwtVerify(token, getJwtKey(), {
+                algorithms: ["HS256"],
+            });
+            const apiKey = payload.api_key;
+            console.log(`[verifyAccessToken] JWT valid, clientId=${payload.client_id}, apiKey prefix=${apiKey?.slice(0, 12)}`);
+            return {
+                token,
+                clientId: payload.client_id ?? "unknown",
+                scopes: [],
+                expiresAt: payload.exp,
+                extra: { apiKey },
+            };
+        }
+        catch (err) {
+            console.error(`[verifyAccessToken] JWT verification failed:`, err);
+            throw err;
+        }
+    }
+    async revokeToken(_client, request) {
+        refreshTokenStore.delete(request.token);
+    }
+}
+//# sourceMappingURL=provider.js.map

package/build/oauth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAU1C,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;AAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;AAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAW,CAAC;AAE3C,SAAS,SAAS;IAChB,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,QAAgB;IACrD,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SACzD,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,OAAO,oBAAoB;IAC/B,IAAI,YAAY;QACd,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9C,uCAAuC;QACvC,MAAM,oBAAoB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,qBAAqB,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC/C,MAAM,CAAC,oBAAoB,CAAC;aAC5B,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE;YAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,oBAAoB;SACrB,CAAC,CAAC;QAEH,qEAAqE;QACrE,MAAM,WAAW,GAAG,GAAG,YAAY,mBAAmB,KAAK,EAAE,CAAC;QAC9D,MAAM,eAAe,GACnB,GAAG,YAAY,oEAAoE,qBAAqB,2CAA2C,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAEvL,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,OAAmC,EACnC,iBAAyB;QAEzB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC,aAAa,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB;QAEzB,MAAM,KAAK,GAAG,aAAa,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE/E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE;YAClC,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QAEH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB;QAEpB,MAAM,KAAK,GAAG,iBAAiB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE/E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAExD,kCAAkC;QAClC,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE;YACrC,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,eAAe;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAEzE,0DAA0D;QAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC1D,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;gBAC/C,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;aACzB,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBACtD,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAiB,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,2CAA2C,OAAO,CAAC,SAAS,mBAAmB,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAEnH,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAG,OAAO,CAAC,SAAoB,IAAI,SAAS;gBACpD,MAAM,EAAE,EAAE;gBACV,SAAS,EAAE,OAAO,CAAC,GAAG;gBACtB,KAAK,EAAE,EAAE,MAAM,EAAE;aAClB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;YACnE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAmC,EACnC,OAAoC;QAEpC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/build/oauth/store.d.ts

@@ -0,0 +1,43 @@
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import type { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
+declare class TtlMap<V> {
+    private ttlMs;
+    private map;
+    private timer;
+    constructor(ttlMs: number);
+    set(key: string, value: V): void;
+    get(key: string): V | undefined;
+    getAndDelete(key: string): V | undefined;
+    delete(key: string): void;
+    private cleanup;
+    destroy(): void;
+}
+export interface PendingAuth {
+    state: string;
+    clientId: string;
+    codeChallenge: string;
+    redirectUri: string;
+    scopes: string[];
+    supabaseCodeVerifier: string;
+}
+export declare const pendingAuthStore: TtlMap<PendingAuth>;
+export interface AuthCode {
+    clientId: string;
+    apiKey: string;
+    codeChallenge: string;
+    redirectUri: string;
+}
+export declare const authCodeStore: TtlMap<AuthCode>;
+export interface RefreshEntry {
+    clientId: string;
+    apiKey: string;
+    scopes: string[];
+}
+export declare const refreshTokenStore: TtlMap<RefreshEntry>;
+declare class InMemoryClientStore implements OAuthRegisteredClientsStore {
+    private clients;
+    getClient(clientId: string): OAuthClientInformationFull | undefined;
+    registerClient(client: Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at">): OAuthClientInformationFull;
+}
+export declare const clientStore: InMemoryClientStore;
+export {};

package/build/oauth/store.js

@@ -0,0 +1,66 @@
+import { randomUUID } from "node:crypto";
+// --- TTL Map utility ---
+class TtlMap {
+    ttlMs;
+    map = new Map();
+    timer;
+    constructor(ttlMs) {
+        this.ttlMs = ttlMs;
+        this.timer = setInterval(() => this.cleanup(), 60_000);
+        this.timer.unref();
+    }
+    set(key, value) {
+        this.map.set(key, { value, expiresAt: Date.now() + this.ttlMs });
+    }
+    get(key) {
+        const entry = this.map.get(key);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expiresAt) {
+            this.map.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    getAndDelete(key) {
+        const value = this.get(key);
+        if (value !== undefined)
+            this.map.delete(key);
+        return value;
+    }
+    delete(key) {
+        this.map.delete(key);
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [key, entry] of this.map) {
+            if (now > entry.expiresAt)
+                this.map.delete(key);
+        }
+    }
+    destroy() {
+        clearInterval(this.timer);
+    }
+}
+export const pendingAuthStore = new TtlMap(10 * 60 * 1000); // 10 min
+export const authCodeStore = new TtlMap(5 * 60 * 1000); // 5 min
+export const refreshTokenStore = new TtlMap(30 * 24 * 60 * 60 * 1000); // 30 days
+// --- Client registration (in-memory, persists until restart) ---
+class InMemoryClientStore {
+    clients = new Map();
+    getClient(clientId) {
+        return this.clients.get(clientId);
+    }
+    registerClient(client) {
+        const full = {
+            ...client,
+            client_id: randomUUID(),
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+            client_secret_expires_at: 0, // never expires
+        };
+        this.clients.set(full.client_id, full);
+        return full;
+    }
+}
+export const clientStore = new InMemoryClientStore();
+//# sourceMappingURL=store.js.map

package/build/oauth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,0BAA0B;AAE1B,MAAM,MAAM;IAIU;IAHZ,GAAG,GAAG,IAAI,GAAG,EAA2C,CAAC;IACzD,KAAK,CAAiC;IAE9C,YAAoB,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;QAC/B,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAQ;QACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAaD,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAc,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;AAWlF,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,MAAM,CAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ;AAU1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAe,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU;AAE/F,kEAAkE;AAElE,MAAM,mBAAmB;IACf,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEhE,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,cAAc,CACZ,MAA6E;QAE7E,MAAM,IAAI,GAA+B;YACvC,GAAG,MAAM;YACT,SAAS,EAAE,UAAU,EAAE;YACvB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,wBAAwB,EAAE,CAAC,EAAE,gBAAgB;SAC9C,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC"}

package/build/oauth/user-keys.d.ts

@@ -0,0 +1,6 @@
+/** Look up a user by email in user_profiles. */
+export declare function findUserByEmail(email: string): Promise<{
+    id: string;
+} | null>;
+/** Find existing MCP key or create a new one. Returns the plain API key. */
+export declare function findOrCreateMcpKey(userId: string): Promise<string>;

package/build/oauth/user-keys.js

@@ -0,0 +1,89 @@
+import { randomBytes } from "node:crypto";
+import { encryptApiKey, hashApiKey } from "./crypto.js";
+/** All read scopes needed by MCP tools — no write/admin scopes. */
+const MCP_SCOPES = [
+    // Threads
+    "threads:read", "threads:feed",
+    // X
+    "x:profile", "x:timeline", "x:tweet", "x:search",
+    // Facebook
+    "fb:profile", "fb:posts", "fb:post", "fb:search", "fb:post_comments",
+    "fb:marketplace_browse", "fb:marketplace_search", "fb:marketplace_item",
+    // Reddit
+    "reddit:subreddit", "reddit:posts", "reddit:search", "reddit:post", "reddit:user",
+    // Instagram
+    "ig:tags", "ig:user", "ig:post", "ig:post_comments", "ig:user_posts",
+    // TikTok
+    "tiktok:video", "tiktok:user", "tiktok:videos", "tiktok:categories",
+    "tiktok:comments", "tiktok:search", "tiktok:subtitles",
+    // LinkedIn
+    "linkedin:company", "linkedin:jobs", "linkedin:job", "linkedin:post",
+    "linkedin:user", "linkedin:user-search",
+    // YouTube
+    "youtube:video", "youtube:channel", "youtube:search", "youtube:comments", "youtube:transcription",
+    // Dcard
+    "dcard:post", "dcard:comments", "dcard:forum", "dcard:forum_posts", "dcard:search", "dcard:persona",
+    // Job104
+    "job104:search", "job104:company", "job104:job",
+    // Google Maps
+    "gmaps:search", "gmaps:place",
+];
+const SUPABASE_URL = process.env.SUPABASE_URL;
+const SUPABASE_SECRET_KEY = process.env.SUPABASE_SECRET_KEY;
+function supabaseHeaders() {
+    return {
+        apikey: SUPABASE_SECRET_KEY,
+        Authorization: `Bearer ${SUPABASE_SECRET_KEY}`,
+        "Content-Type": "application/json",
+    };
+}
+/** Look up a user by email in user_profiles. */
+export async function findUserByEmail(email) {
+    const url = `${SUPABASE_URL}/rest/v1/user_profiles?email=eq.${encodeURIComponent(email)}&select=id`;
+    const res = await fetch(url, { headers: supabaseHeaders() });
+    if (!res.ok)
+        throw new Error(`Supabase user lookup failed: ${res.status}`);
+    const rows = (await res.json());
+    return rows.length > 0 ? rows[0] : null;
+}
+/** Find existing MCP key or create a new one. Returns the plain API key. */
+export async function findOrCreateMcpKey(userId) {
+    // 1. Look for existing active MCP key with encrypted_key
+    const findUrl = `${SUPABASE_URL}/rest/v1/api_keys?user_id=eq.${userId}&name=eq.MCP Connector&is_active=eq.true&select=encrypted_key`;
+    const findRes = await fetch(findUrl, { headers: supabaseHeaders() });
+    if (!findRes.ok)
+        throw new Error(`Supabase key lookup failed: ${findRes.status}`);
+    const existing = (await findRes.json());
+    if (existing.length > 0 && existing[0].encrypted_key) {
+        const { decryptApiKey } = await import("./crypto.js");
+        return decryptApiKey(existing[0].encrypted_key);
+    }
+    // 2. Generate a new key
+    const plain = `sk_byc_${randomBytes(32).toString("hex")}`;
+    const keyHash = hashApiKey(plain);
+    const encrypted = encryptApiKey(plain);
+    const keyPrefix = plain.slice(0, 16); // matches dashboard crypto.ts
+    const insertUrl = `${SUPABASE_URL}/rest/v1/api_keys`;
+    const insertRes = await fetch(insertUrl, {
+        method: "POST",
+        headers: {
+            ...supabaseHeaders(),
+            Prefer: "return=minimal",
+        },
+        body: JSON.stringify({
+            user_id: userId,
+            name: "MCP Connector",
+            key_prefix: keyPrefix,
+            key_hash: keyHash,
+            encrypted_key: encrypted,
+            scopes: MCP_SCOPES,
+            is_active: true,
+        }),
+    });
+    if (!insertRes.ok) {
+        const body = await insertRes.text();
+        throw new Error(`Supabase key insert failed: ${insertRes.status} ${body}`);
+    }
+    return plain;
+}
+//# sourceMappingURL=user-keys.js.map

package/build/oauth/user-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-keys.js","sourceRoot":"","sources":["../../src/oauth/user-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExD,mEAAmE;AACnE,MAAM,UAAU,GAAG;IACjB,UAAU;IACV,cAAc,EAAE,cAAc;IAC9B,IAAI;IACJ,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU;IAChD,WAAW;IACX,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB;IACpE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB;IACvE,SAAS;IACT,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa;IACjF,YAAY;IACZ,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe;IACpE,SAAS;IACT,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB;IACnE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB;IACtD,WAAW;IACX,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe;IACpE,eAAe,EAAE,sBAAsB;IACvC,UAAU;IACV,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,uBAAuB;IACjG,QAAQ;IACR,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe;IACnG,SAAS;IACT,eAAe,EAAE,gBAAgB,EAAE,YAAY;IAC/C,cAAc;IACd,cAAc,EAAE,aAAa;CAC9B,CAAC;AAEF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;AAC/C,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAoB,CAAC;AAE7D,SAAS,eAAe;IACtB,OAAO;QACL,MAAM,EAAE,mBAAmB;QAC3B,aAAa,EAAE,UAAU,mBAAmB,EAAE;QAC9C,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,GAAG,YAAY,mCAAmC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,yDAAyD;IACzD,MAAM,OAAO,GACX,GAAG,YAAY,gCAAgC,MAAM,+DAA+D,CAAC;IACvH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4C,CAAC;IAEnF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IAED,wBAAwB;IACxB,MAAM,KAAK,GAAG,UAAU,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,8BAA8B;IAEpE,MAAM,SAAS,GAAG,GAAG,YAAY,mBAAmB,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,eAAe,EAAE;YACpB,MAAM,EAAE,gBAAgB;SACzB;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,IAAI;SAChB,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/build/server.js

@@ -4,13 +4,13 @@ import { registerXTools } from "./tools/x.js";
 import { registerFacebookTools } from "./tools/facebook.js";
 import { registerRedditTools } from "./tools/reddit.js";
 import { registerLinkedinTools } from "./tools/linkedin.js";
-import { registerXiaohongshuTools } from "./tools/xiaohongshu.js";
 import { registerTiktokTools } from "./tools/tiktok.js";
 import { registerInstagramTools } from "./tools/instagram.js";
 import { registerYoutubeTools } from "./tools/youtube.js";
 import { registerDcardTools } from "./tools/dcard.js";
 import { registerSystemTools } from "./tools/system.js";
 import { registerJob104Tools } from "./tools/job104.js";
+import { registerGmapsTools } from "./tools/gmaps.js";
 export function createServer() {
     const server = new McpServer({
         name: "bycrawl",
@@ -21,12 +21,12 @@ export function createServer() {
     registerFacebookTools(server);
     registerRedditTools(server);
     registerLinkedinTools(server);
-    registerXiaohongshuTools(server);
     registerTiktokTools(server);
     registerInstagramTools(server);
     registerYoutubeTools(server);
     registerDcardTools(server);
     registerJob104Tools(server);
+    registerGmapsTools(server);
     registerSystemTools(server);
     return server;
 }

package/build/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE5B,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7B,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE5B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/tools/dcard.js

@@ -1,25 +1,17 @@
 import { z } from "zod";
 import { bycrawlGet } from "../client.js";
 export function registerDcardTools(server) {
-    server.tool("dcard_get_post", "Get a Dcard post by ID", { postId: z.string().describe("Dcard post ID") }, async ({ postId }) => bycrawlGet(`/dcard/posts/${postId}`));
-    server.tool("dcard_get_post_comments", "Get comments for a Dcard post", {
-        postId: z.string().describe("Dcard post ID"),
-        sort: z
-            .enum(["oldest", "newest", "popular"])
-            .optional()
-            .describe("Sort order"),
-    }, async ({ postId, sort }) => bycrawlGet(`/dcard/posts/${postId}/comments`, { sort }));
-    server.tool("dcard_get_forum", "Get Dcard forum info by alias", { alias: z.string().describe("Forum alias (e.g. trending, talk, mood)") }, async ({ alias }) => bycrawlGet(`/dcard/forums/${alias}`));
+    server.tool("dcard_get_forum", "Get Dcard forum info by alias", { alias: z.string().describe("Forum alias (e.g. trending, talk, mood)") }, { readOnlyHint: true }, async ({ alias }) => bycrawlGet(`/dcard/forums/${alias}`));
     server.tool("dcard_get_forum_posts", "Get posts from a Dcard forum", {
         alias: z.string().describe("Forum alias (e.g. trending, talk, mood)"),
-        limit: z.number().optional().describe("Number of posts (1-30)"),
+        count: z.number().optional().describe("Number of posts (1-30)"),
         popular: z.boolean().optional().describe("Show popular posts only"),
-    }, async ({ alias, limit, popular }) => bycrawlGet(`/dcard/forums/${alias}/posts`, { limit, popular }));
+    }, { readOnlyHint: true }, async ({ alias, count, popular }) => bycrawlGet(`/dcard/forums/${alias}/posts`, { count, popular }));
     server.tool("dcard_search_posts", "Search Dcard posts by keyword", {
         q: z.string().describe("Search query"),
-        limit: z.number().optional().describe("Number of results (1-100)"),
+        count: z.number().optional().describe("Number of results (1-100)"),
         offset: z.number().optional().describe("Offset for pagination"),
-    }, async ({ q, limit, offset }) => bycrawlGet("/dcard/search/posts", { q, limit, offset }));
-    server.tool("dcard_get_persona", "Get a Dcard persona by UID", { uid: z.string().describe("Dcard persona UID") }, async ({ uid }) => bycrawlGet(`/dcard/personas/${uid}`));
+    }, { readOnlyHint: true }, async ({ q, count, offset }) => bycrawlGet("/dcard/posts/search", { q, count, offset }));
+    server.tool("dcard_get_persona", "Get a Dcard persona by username", { username: z.string().describe("Dcard username") }, { readOnlyHint: true }, async ({ username }) => bycrawlGet(`/dcard/personas/${username}`));
 }
 //# sourceMappingURL=dcard.js.map