@codemem/mcp 0.31.3 → 0.32.0

package/dist/audit.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @codemem/mcp — privacy-safe OAuth audit events.
+ *
+ * Phase 1 single-user remote MCP needs operator-visible security events
+ * (registration, authorize, OIDC callback, token issuance, revocation, bearer
+ * verification) without ever logging bearer tokens, authorization codes,
+ * client secrets, OIDC ID tokens, or private memory contents.
+ */
+export type OAuthAuditKind = "registration" | "authorize" | "oidc_callback" | "token" | "refresh" | "rotation" | "revocation" | "bearer";
+export type OAuthAuditOutcome = "success" | "denied" | "error";
+export type BearerDenyReason = "missing_authorization_header" | "malformed_authorization_header" | "unknown_token" | "expired_token" | "revoked_token";
+export interface OAuthAuditEventBase {
+    timestamp: string;
+    outcome: OAuthAuditOutcome;
+    reason?: string;
+    clientId?: string;
+    remoteAddress?: string;
+}
+export type OAuthAuditEvent = OAuthAuditEventBase & {
+    kind: OAuthAuditKind;
+};
+export type OAuthAuditEmitter = (event: OAuthAuditEvent) => void;
+/**
+ * Build an audit event with redaction safety. Throws if a forbidden field
+ * leaks in; callers should never need to pass token/code material here.
+ */
+export declare function buildOAuthAuditEvent(kind: OAuthAuditKind, fields: Omit<OAuthAuditEventBase, "timestamp"> & {
+    now?: number;
+}): OAuthAuditEvent;
+/**
+ * Wrap an audit emitter so any synchronous throw or stream-write failure stays
+ * contained. Audit logging is best-effort observability and must never break
+ * the OAuth/MCP request flow it observes. Failures are reported once per
+ * process to `console.error` so they remain visible without flooding output.
+ */
+export declare function wrapAuditEmitterBestEffort(emit: OAuthAuditEmitter): OAuthAuditEmitter;
+/**
+ * Default audit emitter writes one JSON object per line to stderr. This keeps
+ * MCP HTTP stdout reserved for protocol traffic and is greppable by operators
+ * via `journalctl` or a redirected log file.
+ */
+export declare function createDefaultOAuthAuditEmitter(stream?: NodeJS.WriteStream): OAuthAuditEmitter;
+/**
+ * No-op emitter, used when CODEMEM_MCP_AUDIT=0 or when callers explicitly
+ * want to suppress audit output (for example, embedded tests).
+ */
+export declare function createSilentOAuthAuditEmitter(): OAuthAuditEmitter;
+/**
+ * Resolve an emitter from environment configuration. `CODEMEM_MCP_AUDIT=0`,
+ * `false`, or `no` disables audit logging; anything else (including unset)
+ * uses the default stderr emitter.
+ */
+export declare function resolveOAuthAuditEmitterFromEnv(value?: string | undefined): OAuthAuditEmitter;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,cAAc,GACvB,cAAc,GACd,WAAW,GACX,eAAe,GACf,OAAO,GACP,SAAS,GACT,UAAU,GACV,YAAY,GACZ,QAAQ,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/D,MAAM,MAAM,gBAAgB,GACzB,8BAA8B,GAC9B,gCAAgC,GAChC,eAAe,GACf,eAAe,GACf,eAAe,CAAC;AAEnB,MAAM,WAAW,mBAAmB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7E,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAyBjE;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,eAAe,CAYjB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAYrF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC7C,MAAM,GAAE,MAAM,CAAC,WAA4B,GACzC,iBAAiB,CAInB;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,iBAAiB,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC9C,KAAK,qBAAgC,GACnC,iBAAiB,CAMnB"}

package/dist/content.d.ts

@@ -0,0 +1,13 @@
+export declare function jsonContent(data: unknown): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+};
+export declare function errorContent(message: string): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+};
+//# sourceMappingURL=content.d.ts.map

package/dist/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../src/content.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO;;;;;EAExC;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM;;;;;EAE3C"}

package/dist/http.d.ts

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+/**
+ * @codemem/mcp — MCP Streamable HTTP server bootstrap.
+ *
+ * Local-first HTTP transport for MCP clients. OAuth metadata and Dynamic Client
+ * Registration are exposed for remote MCP setup; public MCP requests require
+ * OAuth bearer tokens.
+ */
+import { type Server } from "node:http";
+import { MemoryStore } from "@codemem/core";
+import { type OAuthAuditEmitter } from "./audit.js";
+import { type OAuthAccessTokenStore } from "./oauth.js";
+export declare const DEFAULT_MCP_HTTP_HOST = "127.0.0.1";
+export declare const DEFAULT_MCP_HTTP_PORT = 38889;
+export interface CodememMcpHttpOptions {
+    host?: string;
+    port?: number | string;
+    dbPath?: string;
+    allowUnsafePublic?: boolean;
+    publicUrl?: string;
+    oauthAccessTokenStore?: OAuthAccessTokenStore;
+    auditEmitter?: OAuthAuditEmitter;
+}
+export interface CodememMcpHttpServer {
+    server: Server;
+    store: MemoryStore;
+    url: string;
+    close: () => Promise<void>;
+}
+export declare function validateMcpHttpHost(host: string | undefined, allowUnsafePublic?: boolean): string;
+export declare function isLoopbackHost(host: string): boolean;
+export declare function isUnsafePublicBindAllowed(value?: string | undefined): boolean;
+export declare function isAllowedMcpHttpRequestHost(header: string | undefined, expectedPort: number): boolean;
+export declare function isAllowedMcpHttpRequestOrigin(header: string | undefined, expectedPort: number): boolean;
+export declare function isAllowedMcpHttpRequestRemoteAddress(address: string | undefined): boolean;
+export declare function parseMcpHttpPort(port: number | string | undefined): number;
+export declare function startCodememMcpHttpServer(options?: CodememMcpHttpOptions): Promise<CodememMcpHttpServer>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAEA;;;;;;GAMG;AAEH,OAAO,EAAsC,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAS3D,OAAO,EAGN,KAAK,iBAAiB,EAGtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAWN,KAAK,qBAAqB,EAC1B,MAAM,YAAY,CAAC;AASpB,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAU3C,MAAM,WAAW,qBAAqB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,YAAY,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,iBAAiB,UAAQ,GAAG,MAAM,CAc/F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,yBAAyB,CACxC,KAAK,qBAA6C,GAChD,OAAO,CAET;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,MAAM,GAClB,OAAO,CAWT;AAED,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,MAAM,GAClB,OAAO,CAkBT;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGzF;AA+BD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAO1E;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CA6N/B"}