@creezio/mcp-facade 0.22.0

package/dist-cjs/oauth/cors-policy.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpCorsAllowlist = mcpCorsAllowlist;
+exports.resolveMcpCorsOrigin = resolveMcpCorsOrigin;
+const store_js_1 = require("./store.js");
+const SAFE_DEFAULTS = [
+    "https://chatgpt.com",
+    "https://chat.openai.com",
+    "https://claude.ai",
+];
+function mcpCorsAllowlist() {
+    const configured = (process.env.MCP_CORS_ORIGINS || "")
+        .split(",")
+        .map((origin) => origin.trim().replace(/\/+$/, ""))
+        .filter(Boolean);
+    const publicUrl = (0, store_js_1.resolveMcpPublicUrl)();
+    return Array.from(new Set([
+        ...(configured.length ? configured : SAFE_DEFAULTS),
+        ...(publicUrl ? [publicUrl] : []),
+    ]));
+}
+function resolveMcpCorsOrigin(origin) {
+    // Requêtes serveur-à-serveur et loopback sans Origin.
+    if (!origin)
+        return "*";
+    const normalized = origin.replace(/\/+$/, "");
+    return mcpCorsAllowlist().includes(normalized) ? origin : "";
+}
+//# sourceMappingURL=cors-policy.js.map

package/dist-cjs/oauth/cors-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-policy.js","sourceRoot":"","sources":["../../src/oauth/cors-policy.ts"],"names":[],"mappings":";;AAQA,4CAYC;AAED,oDAKC;AA3BD,yCAAiD;AAEjD,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,yBAAyB;IACzB,mBAAmB;CACpB,CAAC;AAEF,SAAgB,gBAAgB;IAC9B,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACpD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SAClD,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,IAAA,8BAAmB,GAAE,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,MAAc;IACjD,sDAAsD;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,gBAAgB,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist-cjs/oauth/hono-app.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpHonoApp = createMcpHonoApp;
+/**
+ * Factory Hono `/mcp` + OAuth — SoT kit (équivalent fonctionnel server/mcp/app.ts).
+ * Transport Streamable HTTP et buildMcpServer restent injectés par la marque.
+ */
+const hono_1 = require("hono");
+const cors_1 = require("hono/cors");
+const mcp_admin_js_1 = require("../admin/mcp-admin.js");
+const store_js_1 = require("./store.js");
+const rate_limit_js_1 = require("./rate-limit.js");
+const cors_policy_js_1 = require("./cors-policy.js");
+function createMcpHonoApp(options) {
+    const mcpApp = new hono_1.Hono();
+    const rateLimit = options.mcpRateLimit?.limit ?? 120;
+    const rateWindow = options.mcpRateLimit?.windowMs ?? 60_000;
+    const resolveCors = options.resolveCorsOrigin ?? cors_policy_js_1.resolveMcpCorsOrigin;
+    if (options.ensureSchema) {
+        mcpApp.use("*", async (_c, next) => {
+            options.ensureSchema?.();
+            await next();
+        });
+    }
+    mcpApp.use("*", (0, cors_1.cors)({
+        origin: resolveCors,
+        allowMethods: ["GET", "POST", "DELETE", "OPTIONS"],
+        allowHeaders: [
+            "Authorization",
+            "Content-Type",
+            "Mcp-Session-Id",
+            "MCP-Protocol-Version",
+        ],
+        exposeHeaders: ["Mcp-Session-Id", "WWW-Authenticate"],
+        maxAge: 86400,
+    }));
+    mcpApp.route("/", options.oauthRoutes);
+    if (options.mcpMiddleware) {
+        mcpApp.use("/mcp", options.mcpMiddleware);
+    }
+    function tunnelRequired() {
+        return new Response(JSON.stringify({
+            error: "temporarily_unavailable",
+            error_description: "tunnel requis — configurez l'accès mobile (APP_PUBLIC_URL / MCP_PUBLIC_URL)",
+        }), { status: 503, headers: { "Content-Type": "application/json" } });
+    }
+    function unauthorized(description, opts) {
+        const headers = {
+            "Content-Type": "application/json",
+        };
+        if (opts?.publicMeta !== false) {
+            try {
+                const meta = `${(0, store_js_1.mcpBaseUrl)()}/.well-known/oauth-protected-resource/mcp`;
+                headers["WWW-Authenticate"] =
+                    `Bearer resource_metadata="${meta}", ` +
+                        `error="invalid_token", error_description="${description}"`;
+            }
+            catch (e) {
+                if (!(0, store_js_1.isMcpPublicUrlRequiredError)(e))
+                    throw e;
+            }
+        }
+        return new Response(JSON.stringify({
+            jsonrpc: "2.0",
+            error: { code: -32001, message: `Unauthorized: ${description}` },
+            id: null,
+        }), { status: 401, headers });
+    }
+    mcpApp.all("/mcp", async (c) => {
+        const auth = c.req.header("authorization") || "";
+        const token = auth.replace(/^Bearer\s+/i, "").trim();
+        if (!token || token === auth) {
+            return unauthorized("Bearer token manquant");
+        }
+        const apiKeyAuth = options.apiKeyAuth;
+        if (apiKeyAuth && token.startsWith(apiKeyAuth.prefix)) {
+            const key = apiKeyAuth.verify(token);
+            if (!key) {
+                return unauthorized("clé API invalide ou révoquée", {
+                    publicMeta: false,
+                });
+            }
+            const rate = (0, rate_limit_js_1.checkMcpRateLimit)(`mcp:api-key:${key.id}`, rateLimit, rateWindow);
+            for (const [name, value] of Object.entries((0, rate_limit_js_1.rateLimitHeaders)(rate))) {
+                c.header(name, value);
+            }
+            if (!rate.ok) {
+                return c.json({
+                    error: "rate_limit_exceeded",
+                    error_description: "Limite MCP atteinte",
+                }, 429);
+            }
+            const userId = apiKeyAuth.resolveUserId?.(key) ?? key.user_id ?? null;
+            c.set("mcpAuth", {
+                authType: "api_key",
+                clientId: `api-key:${key.id}`,
+                userId,
+            });
+            const server = await options.buildMcpServer({
+                userId,
+                clientId: `api-key:${key.id}`,
+                scopes: key.scopes,
+            });
+            const transport = options.createTransport();
+            await server.connect(transport);
+            try {
+                return await transport.handleRequest(c);
+            }
+            finally {
+                queueMicrotask(() => {
+                    transport.close().catch(() => { });
+                    server.close().catch(() => { });
+                });
+            }
+        }
+        try {
+            (0, store_js_1.mcpBaseUrl)();
+        }
+        catch (e) {
+            if ((0, store_js_1.isMcpPublicUrlRequiredError)(e))
+                return tunnelRequired();
+            throw e;
+        }
+        const payload = await (0, store_js_1.verifyAccessToken)(token);
+        if (!payload) {
+            return unauthorized("token invalide ou expiré");
+        }
+        let clientOk = false;
+        try {
+            clientOk = (0, mcp_admin_js_1.clientCanAuthenticate)(payload.client_id);
+        }
+        catch {
+            // Admin adapters absents : fallback store (filtre enabled/revoked).
+            clientOk = Boolean((0, store_js_1.getClient)(payload.client_id));
+        }
+        if (!clientOk) {
+            return unauthorized("client OAuth désactivé ou révoqué");
+        }
+        const rate = (0, rate_limit_js_1.checkMcpRateLimit)(`mcp:oauth:${payload.client_id}`, rateLimit, rateWindow);
+        for (const [name, value] of Object.entries((0, rate_limit_js_1.rateLimitHeaders)(rate))) {
+            c.header(name, value);
+        }
+        if (!rate.ok) {
+            return c.json({
+                error: "rate_limit_exceeded",
+                error_description: "Limite MCP atteinte",
+            }, 429);
+        }
+        c.set("mcpAuth", {
+            authType: "oauth",
+            clientId: payload.client_id,
+            userId: payload.user_id,
+        });
+        const server = await options.buildMcpServer({
+            userId: payload.user_id,
+            clientId: payload.client_id,
+            scopes: payload.scope,
+        });
+        const transport = options.createTransport();
+        await server.connect(transport);
+        try {
+            return await transport.handleRequest(c);
+        }
+        finally {
+            queueMicrotask(() => {
+                transport.close().catch(() => { });
+                server.close().catch(() => { });
+            });
+        }
+    });
+    mcpApp.notFound((c) => c.json({ error: "Route inconnue" }, 404));
+    mcpApp.onError((err, c) => {
+        console.error("[mcp]", err);
+        return c.json({ error: err instanceof Error ? err.message : "Erreur serveur" }, 500);
+    });
+    return mcpApp;
+}
+//# sourceMappingURL=hono-app.js.map

package/dist-cjs/oauth/hono-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-app.js","sourceRoot":"","sources":["../../src/oauth/hono-app.ts"],"names":[],"mappings":";;AA2BA,4CAuMC;AAlOD;;;GAGG;AACH,+BAA4B;AAC5B,oCAAiC;AACjC,wDAA8D;AAC9D,yCAKoB;AACpB,mDAAsE;AACtE,qDAAwD;AAaxD,SAAgB,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,MAAM,GAAG,IAAI,WAAI,EAAa,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,IAAI,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,MAAM,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,qCAAoB,CAAC;IAEtE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;YACjC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,GAAG,CACR,GAAG,EACH,IAAA,WAAI,EAAC;QACH,MAAM,EAAE,WAAW;QACnB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;QAClD,YAAY,EAAE;YACZ,eAAe;YACf,cAAc;YACd,gBAAgB;YAChB,sBAAsB;SACvB;QACD,aAAa,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QACrD,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,WAAmB,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS,cAAc;QACrB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,iBAAiB,EACf,6EAA6E;SAChF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,SAAS,YAAY,CACnB,WAAmB,EACnB,IAA+B;QAE/B,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,IAAI,IAAI,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,GAAG,IAAA,qBAAU,GAAE,2CAA2C,CAAC;gBACxE,OAAO,CAAC,kBAAkB,CAAC;oBACzB,6BAA6B,IAAI,KAAK;wBACtC,6CAA6C,WAAW,GAAG,CAAC;YAChE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,IAAA,sCAA2B,EAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,WAAW,EAAE,EAAE;YAChE,EAAE,EAAE,IAAI;SACT,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,YAAY,CAAC,8BAA8B,EAAE;oBAClD,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,IAAA,iCAAiB,EAC5B,eAAe,GAAG,CAAC,EAAE,EAAE,EACvB,SAAS,EACT,UAAU,CACX,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAA,gCAAgB,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,qBAAqB;oBAC5B,iBAAiB,EAAE,qBAAqB;iBACzC,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GACV,UAAU,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;YACzD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;gBACf,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,WAAW,GAAG,CAAC,EAAE,EAAE;gBAC7B,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;gBAC1C,MAAM;gBACN,QAAQ,EAAE,WAAW,GAAG,CAAC,EAAE,EAAE;gBAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACT,cAAc,CAAC,GAAG,EAAE;oBAClB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,IAAA,qBAAU,GAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,IAAA,sCAA2B,EAAC,CAAC,CAAC;gBAAE,OAAO,cAAc,EAAE,CAAC;YAC5D,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAiB,EAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,oCAAqB,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,QAAQ,GAAG,OAAO,CAAC,IAAA,oBAAS,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,mCAAmC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,iCAAiB,EAC5B,aAAa,OAAO,CAAC,SAAS,EAAE,EAChC,SAAS,EACT,UAAU,CACX,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAA,gCAAgB,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,qBAAqB;aACzC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YAC1C,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO,CAAC,KAAK;SACtB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,GAAG,EAAE;gBAClB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAChE,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist-cjs/oauth/index.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpHonoApp = exports.createMcpOAuthRoutes = exports.resolveMcpCorsOrigin = exports.mcpCorsAllowlist = exports.resetMcpRateLimits = exports.rateLimitHeaders = exports.checkMcpRateLimit = exports.verifyPkceS256 = exports.verifyClientSecret = exports.verifyAccessToken = exports.touchOAuthClientLastUsed = exports.signAccessToken = exports.rotateRefreshToken = exports.resourceAcceptable = exports.resolveMcpPublicUrl = exports.resetMcpOAuthAdaptersForTests = exports.registerClient = exports.pruneExpiredCodes = exports.peekAuthCode = exports.normalizeMcpScopes = exports.mcpResourceUrl = exports.mcpOauthReady = exports.mcpBaseUrl = exports.isMcpPublicUrlRequiredError = exports.getMcpOAuthAdapters = exports.getClient = exports.createRefreshToken = exports.createAuthCode = exports.consumeAuthCode = exports.configureMcpOAuth = exports.canonicalizeMcpUrl = exports.McpPublicUrlRequiredError = exports.MCP_SCOPES = exports.MCP_SCOPE_WRITE = exports.MCP_SCOPE_READ = exports.MCP_SCOPE_LEGACY = exports.MCP_SCOPE = exports.REFRESH_TOKEN_TTL_S = exports.ACCESS_TOKEN_TTL_S = void 0;
+var store_js_1 = require("./store.js");
+Object.defineProperty(exports, "ACCESS_TOKEN_TTL_S", { enumerable: true, get: function () { return store_js_1.ACCESS_TOKEN_TTL_S; } });
+Object.defineProperty(exports, "REFRESH_TOKEN_TTL_S", { enumerable: true, get: function () { return store_js_1.REFRESH_TOKEN_TTL_S; } });
+Object.defineProperty(exports, "MCP_SCOPE", { enumerable: true, get: function () { return store_js_1.MCP_SCOPE; } });
+Object.defineProperty(exports, "MCP_SCOPE_LEGACY", { enumerable: true, get: function () { return store_js_1.MCP_SCOPE_LEGACY; } });
+Object.defineProperty(exports, "MCP_SCOPE_READ", { enumerable: true, get: function () { return store_js_1.MCP_SCOPE_READ; } });
+Object.defineProperty(exports, "MCP_SCOPE_WRITE", { enumerable: true, get: function () { return store_js_1.MCP_SCOPE_WRITE; } });
+Object.defineProperty(exports, "MCP_SCOPES", { enumerable: true, get: function () { return store_js_1.MCP_SCOPES; } });
+Object.defineProperty(exports, "McpPublicUrlRequiredError", { enumerable: true, get: function () { return store_js_1.McpPublicUrlRequiredError; } });
+Object.defineProperty(exports, "canonicalizeMcpUrl", { enumerable: true, get: function () { return store_js_1.canonicalizeMcpUrl; } });
+Object.defineProperty(exports, "configureMcpOAuth", { enumerable: true, get: function () { return store_js_1.configureMcpOAuth; } });
+Object.defineProperty(exports, "consumeAuthCode", { enumerable: true, get: function () { return store_js_1.consumeAuthCode; } });
+Object.defineProperty(exports, "createAuthCode", { enumerable: true, get: function () { return store_js_1.createAuthCode; } });
+Object.defineProperty(exports, "createRefreshToken", { enumerable: true, get: function () { return store_js_1.createRefreshToken; } });
+Object.defineProperty(exports, "getClient", { enumerable: true, get: function () { return store_js_1.getClient; } });
+Object.defineProperty(exports, "getMcpOAuthAdapters", { enumerable: true, get: function () { return store_js_1.getMcpOAuthAdapters; } });
+Object.defineProperty(exports, "isMcpPublicUrlRequiredError", { enumerable: true, get: function () { return store_js_1.isMcpPublicUrlRequiredError; } });
+Object.defineProperty(exports, "mcpBaseUrl", { enumerable: true, get: function () { return store_js_1.mcpBaseUrl; } });
+Object.defineProperty(exports, "mcpOauthReady", { enumerable: true, get: function () { return store_js_1.mcpOauthReady; } });
+Object.defineProperty(exports, "mcpResourceUrl", { enumerable: true, get: function () { return store_js_1.mcpResourceUrl; } });
+Object.defineProperty(exports, "normalizeMcpScopes", { enumerable: true, get: function () { return store_js_1.normalizeMcpScopes; } });
+Object.defineProperty(exports, "peekAuthCode", { enumerable: true, get: function () { return store_js_1.peekAuthCode; } });
+Object.defineProperty(exports, "pruneExpiredCodes", { enumerable: true, get: function () { return store_js_1.pruneExpiredCodes; } });
+Object.defineProperty(exports, "registerClient", { enumerable: true, get: function () { return store_js_1.registerClient; } });
+Object.defineProperty(exports, "resetMcpOAuthAdaptersForTests", { enumerable: true, get: function () { return store_js_1.resetMcpOAuthAdaptersForTests; } });
+Object.defineProperty(exports, "resolveMcpPublicUrl", { enumerable: true, get: function () { return store_js_1.resolveMcpPublicUrl; } });
+Object.defineProperty(exports, "resourceAcceptable", { enumerable: true, get: function () { return store_js_1.resourceAcceptable; } });
+Object.defineProperty(exports, "rotateRefreshToken", { enumerable: true, get: function () { return store_js_1.rotateRefreshToken; } });
+Object.defineProperty(exports, "signAccessToken", { enumerable: true, get: function () { return store_js_1.signAccessToken; } });
+Object.defineProperty(exports, "touchOAuthClientLastUsed", { enumerable: true, get: function () { return store_js_1.touchOAuthClientLastUsed; } });
+Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return store_js_1.verifyAccessToken; } });
+Object.defineProperty(exports, "verifyClientSecret", { enumerable: true, get: function () { return store_js_1.verifyClientSecret; } });
+Object.defineProperty(exports, "verifyPkceS256", { enumerable: true, get: function () { return store_js_1.verifyPkceS256; } });
+var rate_limit_js_1 = require("./rate-limit.js");
+Object.defineProperty(exports, "checkMcpRateLimit", { enumerable: true, get: function () { return rate_limit_js_1.checkMcpRateLimit; } });
+Object.defineProperty(exports, "rateLimitHeaders", { enumerable: true, get: function () { return rate_limit_js_1.rateLimitHeaders; } });
+Object.defineProperty(exports, "resetMcpRateLimits", { enumerable: true, get: function () { return rate_limit_js_1.resetMcpRateLimits; } });
+var cors_policy_js_1 = require("./cors-policy.js");
+Object.defineProperty(exports, "mcpCorsAllowlist", { enumerable: true, get: function () { return cors_policy_js_1.mcpCorsAllowlist; } });
+Object.defineProperty(exports, "resolveMcpCorsOrigin", { enumerable: true, get: function () { return cors_policy_js_1.resolveMcpCorsOrigin; } });
+var routes_js_1 = require("./routes.js");
+Object.defineProperty(exports, "createMcpOAuthRoutes", { enumerable: true, get: function () { return routes_js_1.createMcpOAuthRoutes; } });
+var hono_app_js_1 = require("./hono-app.js");
+Object.defineProperty(exports, "createMcpHonoApp", { enumerable: true, get: function () { return hono_app_js_1.createMcpHonoApp; } });
+//# sourceMappingURL=index.js.map

package/dist-cjs/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":";;;AAcA,uCAiCoB;AAhClB,8GAAA,kBAAkB,OAAA;AAClB,+GAAA,mBAAmB,OAAA;AACnB,qGAAA,SAAS,OAAA;AACT,4GAAA,gBAAgB,OAAA;AAChB,0GAAA,cAAc,OAAA;AACd,2GAAA,eAAe,OAAA;AACf,sGAAA,UAAU,OAAA;AACV,qHAAA,yBAAyB,OAAA;AACzB,8GAAA,kBAAkB,OAAA;AAClB,6GAAA,iBAAiB,OAAA;AACjB,2GAAA,eAAe,OAAA;AACf,0GAAA,cAAc,OAAA;AACd,8GAAA,kBAAkB,OAAA;AAClB,qGAAA,SAAS,OAAA;AACT,+GAAA,mBAAmB,OAAA;AACnB,uHAAA,2BAA2B,OAAA;AAC3B,sGAAA,UAAU,OAAA;AACV,yGAAA,aAAa,OAAA;AACb,0GAAA,cAAc,OAAA;AACd,8GAAA,kBAAkB,OAAA;AAClB,wGAAA,YAAY,OAAA;AACZ,6GAAA,iBAAiB,OAAA;AACjB,0GAAA,cAAc,OAAA;AACd,yHAAA,6BAA6B,OAAA;AAC7B,+GAAA,mBAAmB,OAAA;AACnB,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,2GAAA,eAAe,OAAA;AACf,oHAAA,wBAAwB,OAAA;AACxB,6GAAA,iBAAiB,OAAA;AACjB,8GAAA,kBAAkB,OAAA;AAClB,0GAAA,cAAc,OAAA;AAWhB,iDAIyB;AAHvB,kHAAA,iBAAiB,OAAA;AACjB,iHAAA,gBAAgB,OAAA;AAChB,mHAAA,kBAAkB,OAAA;AAIpB,mDAA0E;AAAjE,kHAAA,gBAAgB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAE/C,yCAAmD;AAA1C,iHAAA,oBAAoB,OAAA;AAC7B,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA"}

package/dist-cjs/oauth/rate-limit.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkMcpRateLimit = checkMcpRateLimit;
+exports.rateLimitHeaders = rateLimitHeaders;
+exports.resetMcpRateLimits = resetMcpRateLimits;
+const windows = new Map();
+function checkMcpRateLimit(bucket, limit, windowMs) {
+    const now = Date.now();
+    let state = windows.get(bucket);
+    if (!state || now - state.startedAt >= windowMs) {
+        state = { startedAt: now, hits: 0 };
+        windows.set(bucket, state);
+    }
+    const retryAfter = Math.max(1, Math.ceil((state.startedAt + windowMs - now) / 1000));
+    if (state.hits >= limit) {
+        return { ok: false, limit, remaining: 0, retryAfter };
+    }
+    state.hits += 1;
+    return {
+        ok: true,
+        limit,
+        remaining: Math.max(0, limit - state.hits),
+        retryAfter,
+    };
+}
+function rateLimitHeaders(result) {
+    return {
+        "X-RateLimit-Limit": String(result.limit),
+        "X-RateLimit-Remaining": String(result.remaining),
+        ...(result.ok ? {} : { "Retry-After": String(result.retryAfter) }),
+    };
+}
+/** Réservé aux tests ciblés. */
+function resetMcpRateLimits() {
+    windows.clear();
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist-cjs/oauth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/oauth/rate-limit.ts"],"names":[],"mappings":";;AAWA,8CAyBC;AAED,4CAQC;AAGD,gDAEC;AAjDD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;AAS/C,SAAgB,iBAAiB,CAC/B,MAAc,EACd,KAAa,EACb,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;QAChD,KAAK,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CACrD,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IAChB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1C,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAC9B,MAA0B;IAE1B,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,gCAAgC;AAChC,SAAgB,kBAAkB;IAChC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC"}