@codemem/mcp 0.31.4 → 0.32.1

package/dist/oauth.d.ts

@@ -0,0 +1,176 @@
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import { type OAuthClientInformationFull, type OAuthErrorResponse, type OAuthMetadata, type OAuthProtectedResourceMetadata, type OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+export declare const MCP_OAUTH_PUBLIC_URL_ENV = "CODEMEM_MCP_HTTP_PUBLIC_URL";
+export declare const MCP_OAUTH_RESOURCE_NAME = "codemem MCP";
+export declare const MCP_OAUTH_SCOPES_SUPPORTED: string[];
+export declare const MCP_OAUTH_SERVICE_DOCUMENTATION_URL = "https://github.com/kunickiaj/codemem#readme";
+export interface McpOAuthMetadataOptions {
+    mcpUrl: string;
+    clientsStore: OAuthRegisteredClientsStore;
+}
+export interface RegisteredMcpOAuthClient {
+    status: 201;
+    body: OAuthClientInformationFull;
+}
+export interface McpOAuthRegistrationError {
+    status: 400;
+    body: {
+        error: "invalid_client_metadata";
+        error_description: string;
+    };
+}
+export interface AuthorizationCodeRecord {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    scopes: string[];
+    resource?: string;
+    expiresAt: number;
+    used: boolean;
+}
+export interface OAuthAuthorizationCodeStore {
+    issueCode(record: Omit<AuthorizationCodeRecord, "used">, now?: number): string | undefined;
+    peekCode(code: string): AuthorizationCodeRecord | undefined;
+    consumeCode(code: string): AuthorizationCodeRecord | undefined;
+}
+export interface AccessTokenRecord {
+    clientId: string;
+    grantId?: string;
+    scopes: string[];
+    resource?: string;
+    tokenHash: string;
+    issuedAt: number;
+    expiresAt: number;
+    lastUsedAt: number | null;
+    revokedAt: number | null;
+}
+export type AccessTokenVerificationResult = {
+    ok: true;
+    record: AccessTokenRecord;
+} | {
+    ok: false;
+    reason: "unknown_token" | "expired_token" | "revoked_token";
+};
+export interface OAuthAccessTokenStore {
+    issueToken(clientId: string, now?: number, resource?: string, grantId?: string, scopes?: string[]): {
+        token: string;
+        expiresIn: number;
+    } | undefined;
+    verifyToken(token: string, now?: number): AccessTokenVerificationResult;
+    revokeToken(token: string, now?: number): boolean;
+    revokeTokensForGrant?(grantId: string, now?: number): number;
+}
+export interface RefreshTokenGrantRecord {
+    grantId: string;
+    clientId: string;
+    scopes: string[];
+    resource?: string;
+    currentRefreshTokenHash: string;
+    previousRefreshTokenHash: string | null;
+    issuedAt: number;
+    expiresAt: number;
+    rotatedAt: number | null;
+    revokedAt: number | null;
+}
+export type RefreshTokenRotationResult = {
+    ok: true;
+    grant: RefreshTokenGrantRecord;
+    refreshToken: string;
+    expiresIn: number;
+} | {
+    ok: false;
+    reason: "unknown_refresh_token" | "expired_refresh_token" | "revoked_refresh_token" | "client_mismatch" | "scope_mismatch" | "resource_mismatch" | "refresh_token_replay";
+    grantId?: string;
+};
+export interface OAuthRefreshTokenStore {
+    issueGrant(record: {
+        clientId: string;
+        scopes?: string[];
+        resource?: string;
+    }, now?: number): {
+        grant: RefreshTokenGrantRecord;
+        refreshToken: string;
+        expiresIn: number;
+    } | undefined;
+    rotateRefreshToken(clientId: string, refreshToken: string, options?: {
+        scopes?: string[];
+        resource?: string;
+    }, now?: number): RefreshTokenRotationResult;
+    revokeRefreshToken(token: string, now?: number): string | undefined;
+    revokeGrant(grantId: string, now?: number): boolean;
+}
+export interface McpOAuthRedirectResult {
+    status: 302;
+    location: string;
+}
+export interface McpOAuthErrorResult {
+    status: 400;
+    body: OAuthErrorResponse;
+}
+export interface McpOAuthTokenResult {
+    status: 200;
+    body: OAuthTokens;
+}
+export interface PreparedMcpOAuthAuthorizationRequest {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    scopes: string[];
+    resource: string | null;
+    state: string | null;
+}
+export declare class InMemoryOAuthClientsStore implements OAuthRegisteredClientsStore {
+    #private;
+    getClient(clientId: string): OAuthClientInformationFull | undefined;
+    registerClient(client: Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at">): OAuthClientInformationFull;
+}
+export declare class InMemoryOAuthAuthorizationCodeStore implements OAuthAuthorizationCodeStore {
+    #private;
+    issueCode(record: Omit<AuthorizationCodeRecord, "used">, now?: number): string | undefined;
+    peekCode(code: string): AuthorizationCodeRecord | undefined;
+    consumeCode(code: string): AuthorizationCodeRecord | undefined;
+}
+export declare class InMemoryOAuthAccessTokenStore implements OAuthAccessTokenStore {
+    #private;
+    issueToken(clientId: string, now?: number, resource?: string, grantId?: string, scopes?: string[]): {
+        token: string;
+        expiresIn: number;
+    } | undefined;
+    verifyToken(token: string, now?: number): AccessTokenVerificationResult;
+    revokeToken(token: string, now?: number): boolean;
+    revokeTokensForGrant(grantId: string, now?: number): number;
+}
+export declare class InMemoryOAuthRefreshTokenStore implements OAuthRefreshTokenStore {
+    #private;
+    issueGrant(record: {
+        clientId: string;
+        scopes?: string[];
+        resource?: string;
+    }, now?: number): {
+        grant: RefreshTokenGrantRecord;
+        refreshToken: string;
+        expiresIn: number;
+    } | undefined;
+    rotateRefreshToken(clientId: string, refreshToken: string, options?: {
+        scopes?: string[];
+        resource?: string;
+    }, now?: number): RefreshTokenRotationResult;
+    revokeRefreshToken(token: string, now?: number): string | undefined;
+    revokeGrant(grantId: string, now?: number): boolean;
+}
+export declare function createInMemoryOAuthClientsStore(): OAuthRegisteredClientsStore;
+export declare function createInMemoryOAuthAuthorizationCodeStore(): OAuthAuthorizationCodeStore;
+export declare function createInMemoryOAuthAccessTokenStore(): OAuthAccessTokenStore;
+export declare function createInMemoryOAuthRefreshTokenStore(): OAuthRefreshTokenStore;
+export declare function createMcpOAuthMetadata(options: McpOAuthMetadataOptions): OAuthMetadata;
+export declare function createMcpProtectedResourceMetadata(mcpUrl: string): OAuthProtectedResourceMetadata;
+export declare function registerMcpOAuthClient(requestBody: unknown, clientsStore: OAuthRegisteredClientsStore): RegisteredMcpOAuthClient | McpOAuthRegistrationError;
+export declare function authorizeMcpOAuthClient(params: URLSearchParams, clientsStore: OAuthRegisteredClientsStore, codeStore: OAuthAuthorizationCodeStore, now?: number): McpOAuthRedirectResult | McpOAuthErrorResult;
+export declare function prepareMcpOAuthAuthorizationRequest(params: URLSearchParams, clientsStore: OAuthRegisteredClientsStore): PreparedMcpOAuthAuthorizationRequest | McpOAuthErrorResult;
+export declare function exchangeMcpOAuthAuthorizationCode(params: URLSearchParams, clientsStore: OAuthRegisteredClientsStore, codeStore: OAuthAuthorizationCodeStore, tokenStore: OAuthAccessTokenStore, now?: number): McpOAuthTokenResult | McpOAuthErrorResult;
+export declare function revokeMcpOAuthAccessToken(params: URLSearchParams, tokenStore: OAuthAccessTokenStore): {
+    status: 200;
+    body: Record<string, never>;
+};
+export declare function normalizeMcpPublicUrl(value: string): URL;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAIpG,OAAO,EACN,KAAK,0BAA0B,EAG/B,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,8BAA8B,EAEnC,KAAK,WAAW,EAEhB,MAAM,0CAA0C,CAAC;AAElD,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AACtE,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AACrD,eAAO,MAAM,0BAA0B,UAAkC,CAAC;AAC1E,eAAO,MAAM,mCAAmC,gDAAgD,CAAC;AAkBjG,MAAM,WAAW,uBAAuB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,2BAA2B,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACxC,MAAM,EAAE,GAAG,CAAC;IACZ,IAAI,EAAE,0BAA0B,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACzC,MAAM,EAAE,GAAG,CAAC;IACZ,IAAI,EAAE;QAAE,KAAK,EAAE,yBAAyB,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,2BAA2B;IAC3C,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAC;IAC5D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAC;CAC/D;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,6BAA6B,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC;AAE9E,MAAM,WAAW,qBAAqB;IACrC,UAAU,CACT,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,EAAE,GACf;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACpD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,6BAA6B,CAAC;IACxE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,oBAAoB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7D;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,CAAC;IAChC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,0BAA0B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrF;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACH,uBAAuB,GACvB,uBAAuB,GACvB,uBAAuB,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEL,MAAM,WAAW,sBAAsB;IACtC,UAAU,CACT,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,GAAG,CAAC,EAAE,MAAM,GACV;QAAE,KAAK,EAAE,uBAAuB,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC3F,kBAAkB,CACjB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAClD,GAAG,CAAC,EAAE,MAAM,GACV,0BAA0B,CAAC;IAC9B,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,GAAG,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,GAAG,CAAC;IACZ,IAAI,EAAE,kBAAkB,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,GAAG,CAAC;IACZ,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,oCAAoC;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,qBAAa,yBAA0B,YAAW,2BAA2B;;IAG5E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAInE,cAAc,CACb,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC3E,0BAA0B;CAkC7B;AAED,qBAAa,mCAAoC,YAAW,2BAA2B;;IAGtF,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS;IAQ9F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS;IAM3D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS;CAY9D;AAED,qBAAa,6BAA8B,YAAW,qBAAqB;;IAI1E,UAAU,CACT,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,GAAE,MAAM,EAAO,GACnB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAsBnD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,6BAA6B;IAc3E,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO;IAWrD,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM;CAgB/D;AAED,qBAAa,8BAA+B,YAAW,sBAAsB;;IAM5E,UAAU,CACT,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,GAAG,SAAa,GACd;QAAE,KAAK,EAAE,uBAAuB,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IA4B1F,kBAAkB,CACjB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,EACtD,GAAG,SAAa,GACd,0BAA0B;IA8C7B,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS;IASvE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO;CA4BvD;AAED,wBAAgB,+BAA+B,IAAI,2BAA2B,CAE7E;AAED,wBAAgB,yCAAyC,IAAI,2BAA2B,CAEvF;AAED,wBAAgB,mCAAmC,IAAI,qBAAqB,CAE3E;AAED,wBAAgB,oCAAoC,IAAI,sBAAsB,CAE7E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa,CAoBtF;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,8BAA8B,CAWjG;AAED,wBAAgB,sBAAsB,CACrC,WAAW,EAAE,OAAO,EACpB,YAAY,EAAE,2BAA2B,GACvC,wBAAwB,GAAG,yBAAyB,CAkDtD;AAED,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,2BAA2B,EACzC,SAAS,EAAE,2BAA2B,EACtC,GAAG,SAAa,GACd,sBAAsB,GAAG,mBAAmB,CAqB9C;AAED,wBAAgB,mCAAmC,CAClD,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,2BAA2B,GACvC,oCAAoC,GAAG,mBAAmB,CAyB5D;AAED,wBAAgB,iCAAiC,CAChD,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,2BAA2B,EACzC,SAAS,EAAE,2BAA2B,EACtC,UAAU,EAAE,qBAAqB,EACjC,GAAG,SAAa,GACd,mBAAmB,GAAG,mBAAmB,CA6D3C;AAED,wBAAgB,yBAAyB,CACxC,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,qBAAqB,GAC/B;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,CAI9C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAoBxD"}

package/dist/oidc.d.ts

@@ -0,0 +1,35 @@
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import { type McpOAuthErrorResult, type McpOAuthRedirectResult } from "./oauth.js";
+export declare const MCP_OIDC_ISSUER_URL_ENV = "CODEMEM_MCP_OIDC_ISSUER_URL";
+export declare const MCP_OIDC_CLIENT_ID_ENV = "CODEMEM_MCP_OIDC_CLIENT_ID";
+export declare const MCP_OIDC_CLIENT_SECRET_ENV = "CODEMEM_MCP_OIDC_CLIENT_SECRET";
+export declare const MCP_OAUTH_ALLOWED_SUBJECT_ENV = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT";
+export declare const MCP_OAUTH_ALLOWED_EMAIL_ENV = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL";
+export interface OidcConfig {
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    allowedSubject?: string;
+    allowedEmail?: string;
+}
+export interface PendingOidcAuthorization {
+    oauthParams: string;
+    nonce: string;
+    expiresAt: number;
+}
+export interface OidcPendingAuthorizationStore {
+    issue(record: Omit<PendingOidcAuthorization, "expiresAt">, now?: number): string | undefined;
+    consume(state: string): PendingOidcAuthorization | undefined;
+}
+export declare class InMemoryOidcPendingAuthorizationStore implements OidcPendingAuthorizationStore {
+    #private;
+    issue(record: Omit<PendingOidcAuthorization, "expiresAt">, now?: number): string | undefined;
+    consume(state: string): PendingOidcAuthorization | undefined;
+}
+export declare function createInMemoryOidcPendingAuthorizationStore(): OidcPendingAuthorizationStore;
+export declare function resolveOidcConfig(env?: NodeJS.ProcessEnv): OidcConfig | undefined;
+export declare function beginOidcAuthorization(params: URLSearchParams, clientsStore: OAuthRegisteredClientsStore, pendingStore: OidcPendingAuthorizationStore, config: OidcConfig | undefined, publicMcpUrl: string, now?: number): Promise<McpOAuthRedirectResult | McpOAuthErrorResult>;
+export declare function completeOidcAuthorization(callbackParams: URLSearchParams, pendingStore: OidcPendingAuthorizationStore, config: OidcConfig, publicMcpUrl: string, now?: number): Promise<{
+    oauthParams: URLSearchParams;
+} | McpOAuthErrorResult>;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAE3B,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AACrE,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,0BAA0B,mCAAmC,CAAC;AAC3E,eAAO,MAAM,6BAA6B,sCAAsC,CAAC;AACjF,eAAO,MAAM,2BAA2B,oCAAoC,CAAC;AAQ7E,MAAM,WAAW,UAAU;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC7C,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7F,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAAC;CAC7D;AAoCD,qBAAa,qCAAsC,YAAW,6BAA6B;;IAG1F,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS;IAQhG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;CAW5D;AAED,wBAAgB,2CAA2C,IAAI,6BAA6B,CAE3F;AAED,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,GAAG,SAAS,CAkB9F;AAED,wBAAsB,sBAAsB,CAC3C,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,2BAA2B,EACzC,YAAY,EAAE,6BAA6B,EAC3C,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,EACpB,GAAG,SAAa,GACd,OAAO,CAAC,sBAAsB,GAAG,mBAAmB,CAAC,CAoBvD;AAED,wBAAsB,yBAAyB,CAC9C,cAAc,EAAE,eAAe,EAC/B,YAAY,EAAE,6BAA6B,EAC3C,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,MAAM,EACpB,GAAG,SAAa,GACd,OAAO,CAAC;IAAE,WAAW,EAAE,eAAe,CAAA;CAAE,GAAG,mBAAmB,CAAC,CAiCjE"}

package/dist/project-scope.d.ts

@@ -1,4 +1,8 @@
 import { type MemoryFilters } from "@codemem/core";
 export declare function resolveDefaultProject(): string | null;
+export declare function resolveWriteProject(input: {
+    project?: string | null;
+    envProject?: string | null;
+}): string | null;
 export declare function buildFilters(raw: Record<string, unknown>, defaultProject?: string | null): MemoryFilters | undefined;
 //# sourceMappingURL=project-scope.d.ts.map

package/dist/project-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-scope.d.ts","sourceRoot":"","sources":["../src/project-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,eAAe,CAAC;AAEnE,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAGrD;AAED,wBAAgB,YAAY,CAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,gBAA0B,GACtC,aAAa,GAAG,SAAS,CA0C3B"}
+{"version":3,"file":"project-scope.d.ts","sourceRoot":"","sources":["../src/project-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,eAAe,CAAC;AAOnE,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAErD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,MAAM,GAAG,IAAI,CAEhB;AAED,wBAAgB,YAAY,CAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,gBAA0B,GACtC,aAAa,GAAG,SAAS,CA0C3B"}

package/dist/provider.d.ts

@@ -0,0 +1,51 @@
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import type { AuthorizationParams, OAuthServerProvider } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import { type OAuthClientInformationFull, type OAuthTokenRevocationRequest, type OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { Response } from "express";
+import { type OAuthAccessTokenStore, type OAuthAuthorizationCodeStore, type OAuthRefreshTokenStore } from "./oauth.js";
+import { type OidcConfig, type OidcPendingAuthorizationStore } from "./oidc.js";
+export interface MemoryOAuthServerProviderOptions {
+    clientsStore: OAuthRegisteredClientsStore;
+    codeStore: OAuthAuthorizationCodeStore;
+    tokenStore: OAuthAccessTokenStore;
+    refreshTokenStore?: OAuthRefreshTokenStore;
+    publicMcpUrl: string;
+    oidc?: {
+        config: OidcConfig;
+        pendingStore: OidcPendingAuthorizationStore;
+    };
+    now?: () => number;
+}
+/**
+ * MemoryOAuthServerProvider adapts codemem's existing in-memory stores to the
+ * `@modelcontextprotocol/sdk` `OAuthServerProvider` contract so the SDK's
+ * `mcpAuthRouter` and `requireBearerAuth` middleware can drive the OAuth
+ * lifecycle. This class is the boundary between SDK-handled HTTP and
+ * codemem-owned storage / upstream-OIDC bridging.
+ *
+ * Conventions encoded here:
+ * - `authorize()` does NOT mint the MCP authorization code itself. It
+ *   persists pending state and redirects the user-agent to the upstream OIDC
+ *   provider. The MCP code is issued later by codemem's own /oauth/callback
+ *   route (wired in codemem-b20m.3) after the upstream identity is validated.
+ * - PKCE is validated by the SDK token handler against the challenge returned
+ *   from `challengeForAuthorizationCode`. We do not re-verify here.
+ * - `expiresAt` returned in `AuthInfo` is epoch SECONDS per the SDK's
+ *   `requireBearerAuth` expectations; the underlying store records ms.
+ * - Refresh-token grants use dual-token rotation: the current token and one
+ *   previous token are accepted to tolerate client retry races, while older
+ *   replayed tokens revoke the whole grant.
+ */
+export declare class MemoryOAuthServerProvider implements OAuthServerProvider {
+    #private;
+    constructor(options: MemoryOAuthServerProviderOptions);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAWpG,OAAO,KAAK,EACX,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EACN,KAAK,0BAA0B,EAE/B,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAEhB,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAEN,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,6BAA6B,EAClC,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,gCAAgC;IAChD,YAAY,EAAE,2BAA2B,CAAC;IAC1C,SAAS,EAAE,2BAA2B,CAAC;IACvC,UAAU,EAAE,qBAAqB,CAAC;IAClC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,YAAY,EAAE,6BAA6B,CAAA;KAAE,CAAC;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;;gBAUxD,OAAO,EAAE,gCAAgC;IAWrD,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAEK,SAAS,CACd,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC;IAoBV,6BAA6B,CAClC,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAaZ,yBAAyB,CAC9B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,WAAW,CAAC;IAiEjB,oBAAoB,CACzB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,WAAW,CAAC;IA8BjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0BnD,WAAW,CAChB,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,IAAI,CAAC;CAMhB"}

package/dist/schemas.d.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+export declare const filterSchema: {
+    visibility: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    include_visibility: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exclude_visibility: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    include_workspace_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exclude_workspace_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    include_workspace_kinds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exclude_workspace_kinds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    include_actor_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exclude_actor_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    include_trust_states: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exclude_trust_states: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ownership_scope: z.ZodOptional<z.ZodString>;
+    personal_first: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
+    trust_bias: z.ZodOptional<z.ZodString>;
+    widen_shared_when_weak: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
+    widen_shared_min_personal_results: z.ZodOptional<z.ZodNumber>;
+    widen_shared_min_personal_score: z.ZodOptional<z.ZodNumber>;
+    scope_id: z.ZodOptional<z.ZodString>;
+    include_scope_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    exclude_scope_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    kind: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+};
+export declare const memoryKindSchema: z.ZodEnum<{
+    discovery: "discovery";
+    change: "change";
+    feature: "feature";
+    bugfix: "bugfix";
+    refactor: "refactor";
+    decision: "decision";
+    exploration: "exploration";
+}>;
+export declare const filterNames: string[];
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;CAqBxB,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;EAQ3B,CAAC;AAEH,eAAO,MAAM,WAAW,UAAuC,CAAC"}