@elnora-ai/mcp-server 0.1.0 → 0.2.0

package/README.md

@@ -15,7 +15,7 @@ Add the Elnora MCP server to your AI client. No installation required — just p
 ### Claude Code
 
 ```bash
-claude mcp add elnora --transport streamable-http https://mcp.elnora.ai/mcp
+claude mcp add elnora --transport http https://mcp.elnora.ai/mcp
 ```
 
 ### Cursor
@@ -40,7 +40,7 @@ Add to your `.vscode/mcp.json`:
 {
   "servers": {
     "elnora": {
-      "type": "streamable-http",
+      "type": "http",
       "url": "https://mcp.elnora.ai/mcp"
     }
   }

package/dist/auth/clients-store.d.ts

@@ -0,0 +1,13 @@
+import { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
+/**
+ * In-memory OAuth client store supporting Dynamic Client Registration (RFC 7591).
+ *
+ * For single-instance deployments (ECS). Migrate to Redis/DynamoDB for multi-instance.
+ */
+export declare class InMemoryClientsStore implements OAuthRegisteredClientsStore {
+    private clients;
+    getClient(clientId: string): OAuthClientInformationFull | undefined;
+    registerClient(client: Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at">): OAuthClientInformationFull;
+}
+//# sourceMappingURL=clients-store.d.ts.map

package/dist/auth/clients-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients-store.d.ts","sourceRoot":"","sources":["../../src/auth/clients-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAGtF;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,2BAA2B;IACtE,OAAO,CAAC,OAAO,CAAiD;IAEhE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAYnE,cAAc,CACZ,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC5E,0BAA0B;CAgB9B"}

package/dist/auth/clients-store.js

@@ -0,0 +1,35 @@
+import crypto from "node:crypto";
+import { CLIENT_SECRET_TTL_SECONDS } from "../constants.js";
+/**
+ * In-memory OAuth client store supporting Dynamic Client Registration (RFC 7591).
+ *
+ * For single-instance deployments (ECS). Migrate to Redis/DynamoDB for multi-instance.
+ */
+export class InMemoryClientsStore {
+    clients = new Map();
+    getClient(clientId) {
+        const client = this.clients.get(clientId);
+        if (!client)
+            return undefined;
+        // Check secret expiration (per SDK docs: don't delete, just check)
+        if (client.client_secret_expires_at && client.client_secret_expires_at < Math.floor(Date.now() / 1000)) {
+            return undefined;
+        }
+        return client;
+    }
+    registerClient(client) {
+        const clientId = crypto.randomUUID();
+        const clientSecret = crypto.randomBytes(32).toString("base64url");
+        const now = Math.floor(Date.now() / 1000);
+        const registered = {
+            ...client,
+            client_id: clientId,
+            client_id_issued_at: now,
+            client_secret: clientSecret,
+            client_secret_expires_at: now + CLIENT_SECRET_TTL_SECONDS,
+        };
+        this.clients.set(clientId, registered);
+        return registered;
+    }
+}
+//# sourceMappingURL=clients-store.js.map

package/dist/auth/clients-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients-store.js","sourceRoot":"","sources":["../../src/auth/clients-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEhE,SAAS,CAAC,QAAgB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,mEAAmE;QACnE,IAAI,MAAM,CAAC,wBAAwB,IAAI,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACvG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CACZ,MAA6E;QAE7E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,UAAU,GAA+B;YAC7C,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,GAAG;YACxB,aAAa,EAAE,YAAY;YAC3B,wBAAwB,EAAE,GAAG,GAAG,yBAAyB;SAC1D,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,55 @@
+import { Response } from "express";
+import { OAuthServerProvider, AuthorizationParams } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import { ElnoraConfig } from "../types.js";
+/**
+ * OAuth 2.1 provider that proxies to the Elnora platform auth system.
+ *
+ * Flow:
+ * 1. MCP client calls /authorize → provider redirects to Elnora platform login
+ * 2. User authenticates on platform → platform redirects back with platform auth code
+ * 3. MCP server exchanges platform code for platform token
+ * 4. MCP server issues its own access + refresh tokens, mapped to the platform token
+ * 5. On token validation, the provider checks its own token store and validates
+ *    the underlying platform token hasn't been revoked
+ *
+ * CoSAI controls:
+ * - MCP-T1: PKCE S256 mandatory (handled by SDK)
+ * - MCP-T1: No token passthrough — MCP tokens are separate from platform tokens
+ * - MCP-T7: Short-lived access tokens (1h), refresh token rotation
+ * - MCP-T9: Audience binding via resource parameter
+ * - MCP-T12: Auth event logging
+ */
+export declare class ElnoraOAuthProvider implements OAuthServerProvider {
+    private _clientsStore;
+    private authSessions;
+    private tokenRecords;
+    private refreshTokenIndex;
+    private config;
+    constructor(config: ElnoraConfig);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    /**
+     * Redirect the user to the Elnora platform login page.
+     * After authentication, the platform redirects back to our callback,
+     * which completes the OAuth flow back to the MCP client.
+     */
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, _redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    /**
+     * Handle the callback from the Elnora platform login.
+     * Called by the /oauth/callback route after the user authenticates.
+     */
+    handlePlatformCallback(mcpCode: string, platformCode: string): void;
+    /**
+     * Get redirect URL for MCP client after platform callback.
+     */
+    getClientRedirectUrl(mcpCode: string): string;
+    private issueTokens;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/auth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAC7G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAqC,MAAM,aAAa,CAAC;AAQ9E;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAoB,YAAW,mBAAmB;IAC7D,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,MAAM,CAAe;gBAEjB,MAAM,EAAE,YAAY;IAKhC,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BxG,6BAA6B,CACjC,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAQZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAoCjB,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA0BjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAyCnD,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAwBhB;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAmBnE;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAc7C,OAAO,CAAC,WAAW;CAwCpB"}

package/dist/auth/provider.js

@@ -0,0 +1,234 @@
+import crypto from "node:crypto";
+import axios from "axios";
+import { InMemoryClientsStore } from "./clients-store.js";
+import { ACCESS_TOKEN_TTL_SECONDS, REFRESH_TOKEN_TTL_SECONDS, AUTH_CODE_TTL_SECONDS, REQUEST_TIMEOUT_MS, } from "../constants.js";
+/**
+ * OAuth 2.1 provider that proxies to the Elnora platform auth system.
+ *
+ * Flow:
+ * 1. MCP client calls /authorize → provider redirects to Elnora platform login
+ * 2. User authenticates on platform → platform redirects back with platform auth code
+ * 3. MCP server exchanges platform code for platform token
+ * 4. MCP server issues its own access + refresh tokens, mapped to the platform token
+ * 5. On token validation, the provider checks its own token store and validates
+ *    the underlying platform token hasn't been revoked
+ *
+ * CoSAI controls:
+ * - MCP-T1: PKCE S256 mandatory (handled by SDK)
+ * - MCP-T1: No token passthrough — MCP tokens are separate from platform tokens
+ * - MCP-T7: Short-lived access tokens (1h), refresh token rotation
+ * - MCP-T9: Audience binding via resource parameter
+ * - MCP-T12: Auth event logging
+ */
+export class ElnoraOAuthProvider {
+    _clientsStore;
+    authSessions = new Map();
+    tokenRecords = new Map();
+    refreshTokenIndex = new Map(); // refreshToken -> accessToken
+    config;
+    constructor(config) {
+        this.config = config;
+        this._clientsStore = new InMemoryClientsStore();
+    }
+    get clientsStore() {
+        return this._clientsStore;
+    }
+    /**
+     * Redirect the user to the Elnora platform login page.
+     * After authentication, the platform redirects back to our callback,
+     * which completes the OAuth flow back to the MCP client.
+     */
+    async authorize(client, params, res) {
+        const authCode = crypto.randomBytes(32).toString("base64url");
+        // Store session for later exchange
+        this.authSessions.set(authCode, {
+            clientId: client.client_id,
+            codeChallenge: params.codeChallenge,
+            redirectUri: params.redirectUri,
+            scopes: params.scopes || [],
+            state: params.state,
+            resource: params.resource?.toString(),
+            createdAt: Date.now(),
+        });
+        // Schedule cleanup of expired sessions
+        setTimeout(() => this.authSessions.delete(authCode), AUTH_CODE_TTL_SECONDS * 1000);
+        // Redirect to Elnora platform login
+        const loginUrl = new URL(this.config.loginUrl);
+        loginUrl.searchParams.set("mcp_code", authCode);
+        loginUrl.searchParams.set("redirect_uri", `${this.config.publicUrl}/oauth/callback`);
+        loginUrl.searchParams.set("client_id", this.config.platformClientId);
+        console.error(`[auth] authorize: redirecting client ${client.client_id} to platform login`);
+        res.redirect(loginUrl.toString());
+    }
+    async challengeForAuthorizationCode(_client, authorizationCode) {
+        const session = this.authSessions.get(authorizationCode);
+        if (!session) {
+            throw new Error("Invalid or expired authorization code");
+        }
+        return session.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, _redirectUri, resource) {
+        const session = this.authSessions.get(authorizationCode);
+        if (!session) {
+            throw new Error("Invalid or expired authorization code");
+        }
+        if (session.clientId !== client.client_id) {
+            throw new Error("Authorization code was not issued to this client");
+        }
+        // Delete the auth code — single use only
+        this.authSessions.delete(authorizationCode);
+        // Exchange with Elnora platform for a platform token
+        let platformToken;
+        try {
+            const response = await axios.post(this.config.tokenExchangeUrl, {
+                grant_type: "authorization_code",
+                code: session.platformCode || authorizationCode,
+                client_id: this.config.platformClientId,
+                client_secret: this.config.platformClientSecret,
+            }, { timeout: REQUEST_TIMEOUT_MS });
+            platformToken = response.data.access_token;
+        }
+        catch (error) {
+            console.error("[auth] platform token exchange failed:", error);
+            throw new Error("Failed to exchange authorization code with platform");
+        }
+        // Issue MCP tokens (separate from platform token — CoSAI MCP-T1)
+        return this.issueTokens(client.client_id, session.scopes, platformToken, resource?.toString());
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const accessTokenKey = this.refreshTokenIndex.get(refreshToken);
+        if (!accessTokenKey) {
+            throw new Error("Invalid refresh token");
+        }
+        const record = this.tokenRecords.get(accessTokenKey);
+        if (!record || record.clientId !== client.client_id) {
+            throw new Error("Invalid refresh token");
+        }
+        // Rotate: delete old tokens
+        this.tokenRecords.delete(accessTokenKey);
+        this.refreshTokenIndex.delete(refreshToken);
+        console.error(`[auth] refresh token rotation for client ${client.client_id}`);
+        // Issue new tokens with the same platform token
+        return this.issueTokens(client.client_id, scopes || record.scopes, record.platformToken, resource?.toString() || record.resource);
+    }
+    async verifyAccessToken(token) {
+        const record = this.tokenRecords.get(token);
+        if (!record) {
+            throw new Error("Invalid access token");
+        }
+        if (record.expiresAt < Math.floor(Date.now() / 1000)) {
+            this.tokenRecords.delete(token);
+            throw new Error("Access token expired");
+        }
+        // Validate platform token is still valid
+        try {
+            const validation = await axios.post(this.config.tokenValidationUrl, { token: record.platformToken }, { timeout: REQUEST_TIMEOUT_MS });
+            if (!validation.data.valid) {
+                this.tokenRecords.delete(token);
+                throw new Error("Underlying platform token revoked");
+            }
+        }
+        catch (error) {
+            if (axios.isAxiosError(error) && error.response?.status === 401) {
+                this.tokenRecords.delete(token);
+                throw new Error("Underlying platform token revoked");
+            }
+            // Network errors — don't invalidate, just log
+            console.error("[auth] platform token validation failed (non-fatal):", error);
+        }
+        return {
+            token,
+            clientId: record.clientId,
+            scopes: record.scopes,
+            expiresAt: record.expiresAt,
+            resource: record.resource ? new URL(record.resource) : undefined,
+            extra: { platformToken: record.platformToken },
+        };
+    }
+    async revokeToken(client, request) {
+        const token = request.token;
+        // Check if it's an access token
+        const record = this.tokenRecords.get(token);
+        if (record && record.clientId === client.client_id) {
+            this.refreshTokenIndex.delete(record.refreshToken);
+            this.tokenRecords.delete(token);
+            console.error(`[auth] revoked access token for client ${client.client_id}`);
+            return;
+        }
+        // Check if it's a refresh token
+        const accessTokenKey = this.refreshTokenIndex.get(token);
+        if (accessTokenKey) {
+            const rec = this.tokenRecords.get(accessTokenKey);
+            if (rec && rec.clientId === client.client_id) {
+                this.tokenRecords.delete(accessTokenKey);
+                this.refreshTokenIndex.delete(token);
+                console.error(`[auth] revoked refresh token for client ${client.client_id}`);
+            }
+        }
+    }
+    /**
+     * Handle the callback from the Elnora platform login.
+     * Called by the /oauth/callback route after the user authenticates.
+     */
+    handlePlatformCallback(mcpCode, platformCode) {
+        const session = this.authSessions.get(mcpCode);
+        if (!session) {
+            throw new Error("Invalid or expired MCP authorization code");
+        }
+        // Store the platform code for later exchange
+        session.platformCode = platformCode;
+        // Build the redirect back to the MCP client
+        const redirectUrl = new URL(session.redirectUri);
+        redirectUrl.searchParams.set("code", mcpCode);
+        if (session.state) {
+            redirectUrl.searchParams.set("state", session.state);
+        }
+        console.error(`[auth] platform callback: completing auth for client ${session.clientId}`);
+    }
+    /**
+     * Get redirect URL for MCP client after platform callback.
+     */
+    getClientRedirectUrl(mcpCode) {
+        const session = this.authSessions.get(mcpCode);
+        if (!session) {
+            throw new Error("Invalid or expired MCP authorization code");
+        }
+        const redirectUrl = new URL(session.redirectUri);
+        redirectUrl.searchParams.set("code", mcpCode);
+        if (session.state) {
+            redirectUrl.searchParams.set("state", session.state);
+        }
+        return redirectUrl.toString();
+    }
+    issueTokens(clientId, scopes, platformToken, resource) {
+        const accessToken = crypto.randomBytes(32).toString("base64url");
+        const refreshToken = crypto.randomBytes(32).toString("base64url");
+        const now = Math.floor(Date.now() / 1000);
+        const record = {
+            accessToken,
+            refreshToken,
+            platformToken,
+            clientId,
+            scopes,
+            resource,
+            expiresAt: now + ACCESS_TOKEN_TTL_SECONDS,
+            createdAt: now,
+        };
+        this.tokenRecords.set(accessToken, record);
+        this.refreshTokenIndex.set(refreshToken, accessToken);
+        // Schedule cleanup of expired tokens (cap at ~24 days to stay within 32-bit setTimeout limit)
+        const cleanupMs = Math.min(REFRESH_TOKEN_TTL_SECONDS * 1000, 2_000_000_000);
+        setTimeout(() => {
+            this.tokenRecords.delete(accessToken);
+            this.refreshTokenIndex.delete(refreshToken);
+        }, cleanupMs);
+        console.error(`[auth] issued tokens for client ${clientId} (expires ${new Date((now + ACCESS_TOKEN_TTL_SECONDS) * 1000).toISOString()})`);
+        return {
+            access_token: accessToken,
+            token_type: "Bearer",
+            expires_in: ACCESS_TOKEN_TTL_SECONDS,
+            refresh_token: refreshToken,
+        };
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACtB,aAAa,CAAuB;IACpC,YAAY,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,8BAA8B;IAC7E,MAAM,CAAe;IAE7B,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE9D,mCAAmC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC9B,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,uCAAuC;QACvC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC,CAAC;QAEnF,oCAAoC;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAChD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,iBAAiB,CAAC,CAAC;QACrF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAErE,OAAO,CAAC,KAAK,CAAC,wCAAwC,MAAM,CAAC,SAAS,oBAAoB,CAAC,CAAC;QAC5F,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,OAAmC,EACnC,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,YAAqB,EACrB,QAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE5C,qDAAqD;QACrD,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAC/B,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAC5B;gBACE,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,OAAO,CAAC,YAAY,IAAI,iBAAiB;gBAC/C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBACvC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;aAChD,EACD,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;YACF,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,iEAAiE;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE5C,OAAO,CAAC,KAAK,CAAC,4CAA4C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAE9E,gDAAgD;QAChD,OAAO,IAAI,CAAC,WAAW,CACrB,MAAM,CAAC,SAAS,EAChB,MAAM,IAAI,MAAM,CAAC,MAAM,EACvB,MAAM,CAAC,aAAa,EACpB,QAAQ,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,QAAQ,CACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,EAC/B,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,8CAA8C;YAC9C,OAAO,CAAC,KAAK,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YAChE,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,gCAAgC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,0CAA0C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC7C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACzC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrC,OAAO,CAAC,KAAK,CAAC,2CAA2C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,OAAe,EAAE,YAAoB;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,6CAA6C;QAC7C,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;QAEpC,4CAA4C;QAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,wDAAwD,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,WAAW,CACjB,QAAgB,EAChB,MAAgB,EAChB,aAAqB,EACrB,QAAiB;QAEjB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAgB;YAC1B,WAAW;YACX,YAAY;YACZ,aAAa;YACb,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,GAAG,GAAG,wBAAwB;YACzC,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEtD,8FAA8F;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC;QAC5E,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,OAAO,CAAC,KAAK,CAAC,mCAAmC,QAAQ,aAAa,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAE1I,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,wBAAwB;YACpC,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC;CACF"}

package/dist/constants.d.ts

@@ -1,6 +1,11 @@
-export declare const CHARACTER_LIMIT = 25000;
-export declare const DEFAULT_PAGE_SIZE = 20;
+export declare const CHARACTER_LIMIT = 100000;
+export declare const DEFAULT_PAGE_SIZE = 50;
 export declare const MAX_PAGE_SIZE = 100;
 export declare const REQUEST_TIMEOUT_MS = 30000;
 export declare const LONG_REQUEST_TIMEOUT_MS = 120000;
+export declare const ACCESS_TOKEN_TTL_SECONDS = 3600;
+export declare const REFRESH_TOKEN_TTL_SECONDS: number;
+export declare const AUTH_CODE_TTL_SECONDS = 300;
+export declare const CLIENT_SECRET_TTL_SECONDS: number;
+export declare const SUPPORTED_SCOPES: readonly ["tasks:read", "tasks:write", "files:read", "files:write", "messages:read", "messages:write"];
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,QAAQ,CAAC;AACrC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AACxC,eAAO,MAAM,uBAAuB,SAAS,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,SAAU,CAAC;AACvC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAG/C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AAGxD,eAAO,MAAM,gBAAgB,wGAOnB,CAAC"}

package/dist/constants.js

@@ -1,6 +1,20 @@
-export const CHARACTER_LIMIT = 25000;
-export const DEFAULT_PAGE_SIZE = 20;
+export const CHARACTER_LIMIT = 100_000;
+export const DEFAULT_PAGE_SIZE = 50;
 export const MAX_PAGE_SIZE = 100;
-export const REQUEST_TIMEOUT_MS = 30000;
-export const LONG_REQUEST_TIMEOUT_MS = 120000;
+export const REQUEST_TIMEOUT_MS = 30_000;
+export const LONG_REQUEST_TIMEOUT_MS = 120_000;
+// Auth constants
+export const ACCESS_TOKEN_TTL_SECONDS = 3600; // 1 hour
+export const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 3600; // 30 days
+export const AUTH_CODE_TTL_SECONDS = 300; // 5 minutes
+export const CLIENT_SECRET_TTL_SECONDS = 90 * 24 * 3600; // 90 days
+// MCP scopes
+export const SUPPORTED_SCOPES = [
+    "tasks:read",
+    "tasks:write",
+    "files:read",
+    "files:write",
+    "messages:read",
+    "messages:write",
+];
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,iBAAiB;AACjB,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,CAAC,SAAS;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEnE,aAAa;AACb,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;CACR,CAAC"}

package/dist/index.js

@@ -1,9 +1,13 @@
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import express from "express";
 import { ElnoraApiClient } from "./services/elnora-api-client.js";
-import { authMiddleware } from "./auth/middleware.js";
-import { protectedResourceMetadataHandler } from "./auth/protected-resource.js";
+import { ElnoraOAuthProvider } from "./auth/provider.js";
 import { createElnoraServer } from "./server.js";
+import { corsMiddleware } from "./middleware/cors.js";
+import { mcpRateLimiter } from "./middleware/rate-limiter.js";
+import { SUPPORTED_SCOPES } from "./constants.js";
 function requireEnv(name) {
     const value = process.env[name];
     if (!value) {
@@ -17,25 +21,81 @@ function loadConfig() {
         authUrl: requireEnv("ELNORA_AUTH_URL"),
         tokenValidationUrl: requireEnv("ELNORA_TOKEN_VALIDATION_URL"),
         port: parseInt(process.env.PORT || "3000", 10),
+        publicUrl: requireEnv("ELNORA_PUBLIC_URL"),
+        loginUrl: requireEnv("ELNORA_LOGIN_URL"),
+        tokenExchangeUrl: requireEnv("ELNORA_TOKEN_EXCHANGE_URL"),
+        platformClientId: requireEnv("ELNORA_PLATFORM_CLIENT_ID"),
+        platformClientSecret: requireEnv("ELNORA_PLATFORM_CLIENT_SECRET"),
     };
 }
 async function main() {
     const config = loadConfig();
     const app = express();
-    app.use(express.json());
-    // Health check
+    // --- Security middleware (CoSAI MCP-T7) ---
+    app.use(corsMiddleware(config));
+    app.use(express.json({ limit: "1mb" })); // Payload size limit (CoSAI MCP-T10)
+    // Health check (no auth)
     app.get("/health", (_req, res) => {
         res.json({ status: "ok", service: "elnora-mcp-server" });
     });
-    // OAuth Protected Resource Metadata (per MCP spec, RFC 9728)
-    app.get("/.well-known/oauth-protected-resource", protectedResourceMetadataHandler(config));
-    // MCP endpoint with auth
-    app.post("/mcp", authMiddleware(config), async (req, res) => {
+    // --- OAuth 2.1 Authorization Server ---
+    const provider = new ElnoraOAuthProvider(config);
+    const issuerUrl = new URL(config.publicUrl);
+    const mcpServerUrl = new URL(`${config.publicUrl}/mcp`);
+    // Install OAuth routes: /.well-known/oauth-authorization-server,
+    // /.well-known/oauth-protected-resource, /authorize, /token, /register, /revoke
+    app.use(mcpAuthRouter({
+        provider,
+        issuerUrl,
+        resourceServerUrl: mcpServerUrl,
+        scopesSupported: [...SUPPORTED_SCOPES],
+        resourceName: "Elnora MCP Server",
+        serviceDocumentationUrl: new URL("https://github.com/Elnora-AI/elnora-mcp-server"),
+    }));
+    // Platform OAuth callback — receives the auth code from Elnora platform login
+    // CSRF protection: validates mcp_code exists in our session store (CoSAI MCP-T7)
+    app.get("/oauth/callback", (req, res) => {
+        const mcpCode = req.query.mcp_code;
+        const platformCode = req.query.code;
+        const error = req.query.error;
+        if (error) {
+            console.error(`[auth] platform callback error: ${error}`);
+            res.status(400).json({ error: "platform_auth_failed", error_description: error });
+            return;
+        }
+        if (!mcpCode || !platformCode) {
+            res.status(400).json({ error: "invalid_request", error_description: "Missing mcp_code or code parameter" });
+            return;
+        }
+        try {
+            provider.handlePlatformCallback(mcpCode, platformCode);
+            const redirectUrl = provider.getClientRedirectUrl(mcpCode);
+            res.redirect(redirectUrl);
+        }
+        catch (err) {
+            console.error("[auth] platform callback failed:", err);
+            res.status(400).json({
+                error: "invalid_grant",
+                error_description: err instanceof Error ? err.message : "Callback processing failed",
+            });
+        }
+    });
+    // --- MCP Endpoint (protected by bearer auth + rate limiting) ---
+    const authMiddleware = requireBearerAuth({
+        verifier: provider,
+        requiredScopes: [],
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpServerUrl),
+    });
+    app.post("/mcp", mcpRateLimiter(), authMiddleware, async (req, res) => {
         try {
-            // Create per-request MCP server and API client
-            const client = new ElnoraApiClient(config, req.bearerToken);
-            const getClient = () => client;
-            const server = createElnoraServer(config, getClient);
+            // Extract auth context (set by provider.verifyAccessToken)
+            const platformToken = req.auth?.extra?.platformToken || "";
+            const clientId = req.auth?.clientId || "unknown";
+            const scopes = req.auth?.scopes || [];
+            // Create per-request MCP server and API client with auth context
+            const client = new ElnoraApiClient(config, platformToken);
+            const getContext = () => ({ client, clientId, scopes });
+            const server = createElnoraServer(config, getContext);
             // Stateless transport — new transport per request
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
@@ -52,9 +112,17 @@ async function main() {
             }
         }
     });
+    // GET and DELETE on /mcp return 405 per MCP Streamable HTTP spec (stateless mode)
+    app.get("/mcp", (_req, res) => {
+        res.status(405).json({ error: "method_not_allowed", error_description: "Stateless server — use POST" });
+    });
+    app.delete("/mcp", (_req, res) => {
+        res.status(405).json({ error: "method_not_allowed", error_description: "Stateless server — sessions not supported" });
+    });
     app.listen(config.port, () => {
         console.error(`Elnora MCP server running on http://localhost:${config.port}/mcp`);
-        console.error(`Protected Resource Metadata: http://localhost:${config.port}/.well-known/oauth-protected-resource`);
+        console.error(`OAuth AS Metadata: ${config.publicUrl}/.well-known/oauth-authorization-server`);
+        console.error(`Protected Resource Metadata: ${getOAuthProtectedResourceMetadataUrl(mcpServerUrl)}`);
         console.error(`Health check: http://localhost:${config.port}/health`);
     });
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC;QACpC,OAAO,EAAE,UAAU,CAAC,iBAAiB,CAAC;QACtC,kBAAkB,EAAE,UAAU,CAAC,6BAA6B,CAAC;QAC7D,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,eAAe;IACf,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3F,yBAAyB;IACzB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,+CAA+C;YAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,WAAY,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC;YAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAErD,kDAAkD;YAClD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,SAAS;gBAC7B,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,KAAK,CAAC,iDAAiD,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,CACX,iDAAiD,MAAM,CAAC,IAAI,uCAAuC,CACpG,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,oCAAoC,EAAE,MAAM,iDAAiD,CAAC;AACtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AACnG,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC;QACpC,OAAO,EAAE,UAAU,CAAC,iBAAiB,CAAC;QACtC,kBAAkB,EAAE,UAAU,CAAC,6BAA6B,CAAC;QAC7D,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;QAC9C,SAAS,EAAE,UAAU,CAAC,mBAAmB,CAAC;QAC1C,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC;QACxC,gBAAgB,EAAE,UAAU,CAAC,2BAA2B,CAAC;QACzD,gBAAgB,EAAE,UAAU,CAAC,2BAA2B,CAAC;QACzD,oBAAoB,EAAE,UAAU,CAAC,+BAA+B,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,6CAA6C;IAC7C,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC;IAE9E,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,MAAM,CAAC,CAAC;IAExD,iEAAiE;IACjE,gFAAgF;IAChF,GAAG,CAAC,GAAG,CACL,aAAa,CAAC;QACZ,QAAQ;QACR,SAAS;QACT,iBAAiB,EAAE,YAAY;QAC/B,eAAe,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACtC,YAAY,EAAE,mBAAmB;QACjC,uBAAuB,EAAE,IAAI,GAAG,CAAC,gDAAgD,CAAC;KACnF,CAAC,CACH,CAAC;IAEF,8EAA8E;IAC9E,iFAAiF;IACjF,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,QAAkB,CAAC;QAC7C,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,IAAc,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAe,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,QAAQ,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC3D,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;aACrF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,MAAM,cAAc,GAAG,iBAAiB,CAAC;QACvC,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,oCAAoC,CAAC,YAAY,CAAC;KACxE,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,IAAI,CAAC;YACH,2DAA2D;YAC3D,MAAM,aAAa,GAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,aAAwB,IAAI,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,SAAS,CAAC;YACjD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;YAEtC,iEAAiE;YACjE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAEtD,kDAAkD;YAClD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,SAAS;gBAC7B,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC1G,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,KAAK,CAAC,iDAAiD,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,SAAS,yCAAyC,CAAC,CAAC;QAC/F,OAAO,CAAC,KAAK,CAAC,gCAAgC,oCAAoC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/middleware/cors.d.ts

@@ -0,0 +1,11 @@
+import { RequestHandler } from "express";
+import { ElnoraConfig } from "../types.js";
+/**
+ * CORS middleware restricting origins to the Elnora platform domain.
+ * CoSAI MCP-T7: Prevent cross-origin data leaks and CORS policy bypass.
+ *
+ * MCP clients communicate via direct HTTP (not browser), so CORS is primarily
+ * defense-in-depth against browser-based attacks targeting the MCP endpoint.
+ */
+export declare function corsMiddleware(config: ElnoraConfig): RequestHandler;
+//# sourceMappingURL=cors.d.ts.map

package/dist/middleware/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAsCnE"}