@fleetx_io/fleetx-mcp-server 1.1.7 → 2.0.0

package/CHANGELOG.md

@@ -5,19 +5,51 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0] - 2026-06-09
+
+### Added
+
+-   **Remote MCP Server (Streamable HTTP transport)** — server now supports both `stdio` (local) and `http` (remote) transports, selected via `MCP_TRANSPORT` env var.
+-   **OAuth 2.1 Authorization Code Flow with PKCE** — full OAuth server built into the MCP server; Claude authenticates users without ever receiving a FleetX token.
+-   **Google OAuth sign-in** — users authenticate with their existing FleetX Google accounts via `GET /google/callback`.
+-   **FleetX token exchange** — Google ID token is exchanged for a FleetX access token via `POST /api/v2/login/google-one-tap`.
+-   **CIMD support** — advertises `client_id_metadata_document_supported: true` + `token_endpoint_auth_methods_supported: ["none"]` so Claude uses Client ID Metadata Document instead of Dynamic Client Registration.
+-   **Dynamic Client Registration (DCR, RFC 7591)** — `POST /oauth/register` endpoint for MCP Inspector and other dev tools that require DCR.
+-   **Encrypted token storage** — FleetX access tokens stored AES-256-GCM encrypted at rest in SQLite (`better-sqlite3`, WAL mode).
+-   **MCP JWT access tokens** — server issues signed HS256 JWTs (1 hr TTL) as MCP bearer tokens; Claude never sees the underlying FleetX token.
+-   **OAuth discovery endpoints** — `GET /.well-known/oauth-authorization-server` and `GET /.well-known/oauth-protected-resource`.
+-   **`GET /userinfo` endpoint** — returns `sub`, `email`, `name` from the connected account.
+-   **`resolveServerBaseUrl()`** — dynamically resolves the server's public base URL from `MCP_BASE_URL` env var or request `Host` header for local dev.
+-   **Automatic SQLite schema migrations** — `runMigrations()` on startup; handles existing databases with breaking schema changes (e.g. dropped `NOT NULL` on `fleetx_refresh_token`).
+-   **`dotenv/config` loading** — `.env` file loaded automatically at startup; no shell export needed.
+-   **`tsx` dev runner** — replaced `ts-node-dev` with `tsx watch` for native ESM support.
+-   **`npm run dev:http`** script — starts the HTTP/OAuth server in dev mode with hot reload.
+
+### Changed
+
+-   **Fastify replaces raw Node HTTP** for the HTTP transport — all OAuth and MCP routes registered through Fastify with proper middleware.
+-   **Body parsing fix** — MCP POST handler now uses Fastify's pre-parsed `request.body` instead of re-reading the consumed raw stream.
+-   **All auth modes coexist** — API key (env), Basic, raw Bearer, and OAuth MCP JWT all resolved in `resolveCredentials()` with correct priority order.
+-   **Logging to stderr** — all `log()` calls write JSON to stderr so stdout stays clean for the stdio JSON-RPC transport.
+
+### Removed
+
+-   **Refresh token flow** — FleetX `/login/google-one-tap` does not return a refresh token; re-authentication triggers a fresh Google sign-in.
+-   **Legacy SSE transport** — removed in favour of `StreamableHTTPServerTransport`.
+
 ## [1.0.0] - 2026-03-03
 
 ### Added
 
-- MCP server with stdio transport for local AI agent integration.
-- `login` tool for authenticating with the FleetX API.
-- Dynamic tool generation from FleetX API definitions after login.
-- Zod-based input validation for all dynamically registered tools.
-- Automatic Bearer token injection into downstream API calls.
-- Token expiry handling — clears token and prompts re-login on 401/403.
-- Support for path, query, and body parameters in proxied API calls.
-- `npx` support — run directly with `npx @fleetx_io/fleetx-mcp-server`.
-- Global install support via `npm install -g`.
-- MCP Inspector compatibility for debugging and testing.
-- Configuration via environment variables with sensible defaults.
-- Cursor, Claude Desktop, and Windsurf integration examples in README.
+-   MCP server with stdio transport for local AI agent integration.
+-   `login` tool for authenticating with the FleetX API.
+-   Dynamic tool generation from FleetX API definitions after login.
+-   Zod-based input validation for all dynamically registered tools.
+-   Automatic Bearer token injection into downstream API calls.
+-   Token expiry handling — clears token and prompts re-login on 401/403.
+-   Support for path, query, and body parameters in proxied API calls.
+-   `npx` support — run directly with `npx @fleetx_io/fleetx-mcp-server`.
+-   Global install support via `npm install -g`.
+-   MCP Inspector compatibility for debugging and testing.
+-   Configuration via environment variables with sensible defaults.
+-   Cursor, Claude Desktop, and Windsurf integration examples in README.

package/README.md

@@ -9,10 +9,11 @@ An MCP (Model Context Protocol) server that gives AI agents access to the FleetX
 
 ## How it Works
 
-1. **Hosted:** Your AI agent connects to `https://mcp.fleetx.io/mcp` via URL. **Local:** Your agent launches this server as a subprocess (npx or global install).
-2. The server authenticates — either automatically via credentials (Basic Auth for hosted, env vars for local), or when the agent calls the `login` tool.
-3. After authentication, all available API definitions are fetched and registered as MCP tools with validated inputs.
-4. The agent can now call any FleetX API — the server handles auth, validation, and proxying automatically.
+1. **Claude Connector (OAuth):** Claude connects to `https://mcp.fleetx.io/mcp`, is redirected to Google sign-in, and receives a secure token — no credentials ever shared with Claude.
+2. **Hosted (Basic Auth):** Your AI agent connects via URL with a `Authorization: Basic` header for auto-login.
+3. **Local:** Your agent launches this server as a subprocess (npx or global install) with credentials in env vars.
+4. After authentication, all FleetX API definitions are fetched and registered as MCP tools with validated inputs.
+5. The agent can call any FleetX API — the server handles auth, validation, and proxying automatically.
 
 ---
 
@@ -52,9 +53,52 @@ fleetx-mcp-server
 
 ---
 
-## Hosted MCP Server
+## Claude Connector (OAuth — Recommended)
 
-Use the hosted FleetX MCP server — no local install required. Connect directly from your AI agent.
+The hosted FleetX MCP server supports **Claude Connector** with full OAuth 2.1 authentication. Sign in once with your FleetX Google account and Claude gets access to all FleetX tools — no tokens or passwords needed.
+
+**MCP URL:** `https://mcp.fleetx.io/mcp`
+
+### Connect via claude.ai (Web)
+
+1. Open [claude.ai](https://claude.ai) and go to **Settings → Integrations**
+2. Click **Add custom integration**
+3. Enter the URL:
+   ```
+   https://mcp.fleetx.io/mcp
+   ```
+4. Click **Add** — Claude will automatically open a Google sign-in window
+5. Sign in with your **FleetX Google account** (the same email you use to log in to FleetX)
+6. After sign-in, Claude redirects back and the integration is connected
+7. All FleetX tools appear in Claude immediately — no login tool needed
+
+> The OAuth token is valid for **15 days**. If the underlying FleetX session expires earlier, the server automatically clears the stored token and Claude will prompt you to re-authenticate.
+
+### Connect via Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+**macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`  
+**Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
+
+```json
+{
+  "mcpServers": {
+    "fleetx": {
+      "url": "https://mcp.fleetx.io/mcp",
+      "transport": "streamable-http"
+    }
+  }
+}
+```
+
+Save the file and restart Claude Desktop. On first use, Claude opens a browser window for Google sign-in. After authenticating, all FleetX tools are available.
+
+---
+
+## Hosted MCP Server (Basic Auth)
+
+For clients that don't support OAuth, use Basic Auth to connect to the hosted server.
 
 **URL:** `https://mcp.fleetx.io/mcp`
 
@@ -436,3 +480,9 @@ This opens a web UI where you can connect, call `login`, browse all discovered t
 ## License
 
 ISC
+
+---
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md) for release history and notable changes.

package/dist/auth/fleetx/exchange.d.ts

@@ -0,0 +1,13 @@
+export interface FleetxAuthResult {
+    accessToken: string;
+}
+/**
+ * Exchanges a Google ID token for a FleetX access token.
+ *
+ * FleetX response format:
+ *   { access_token: "...", token_type: "bearer", scope: "..." }
+ *
+ * User info is NOT included — callers must supply it from the verified Google token.
+ */
+export declare function exchangeGoogleTokenWithFleetx(googleIdToken: string): Promise<FleetxAuthResult>;
+//# sourceMappingURL=exchange.d.ts.map

package/dist/auth/fleetx/exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.d.ts","sourceRoot":"","sources":["../../../src/auth/fleetx/exchange.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAID;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsBpG"}

package/dist/auth/fleetx/exchange.js

@@ -0,0 +1,27 @@
+import axios from "axios";
+import { log } from "../../utils.js";
+const GOOGLE_ONE_TAP_URL = "https://api.fleetx.io/api/v2/login/google-one-tap";
+/**
+ * Exchanges a Google ID token for a FleetX access token.
+ *
+ * FleetX response format:
+ *   { access_token: "...", token_type: "bearer", scope: "..." }
+ *
+ * User info is NOT included — callers must supply it from the verified Google token.
+ */
+export async function exchangeGoogleTokenWithFleetx(googleIdToken) {
+    const form = new FormData();
+    form.append("token", googleIdToken);
+    const { data } = await axios.post(GOOGLE_ONE_TAP_URL, form, {
+        headers: {
+            "Content-Type": "multipart/form-data",
+            clientid: "fleetxweb",
+        },
+    });
+    if (!data.access_token) {
+        throw new Error(`FleetX google-one-tap returned no access_token. Response: ${JSON.stringify(data)}`);
+    }
+    log("FleetX exchange succeeded, token:", data.access_token.slice(0, 8) + "…");
+    return { accessToken: data.access_token };
+}
+//# sourceMappingURL=exchange.js.map

package/dist/auth/fleetx/exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../../src/auth/fleetx/exchange.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAMrC,MAAM,kBAAkB,GAAG,mDAAmD,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,aAAqB;IACvE,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAC/B,kBAAkB,EAClB,IAAI,EACJ;QACE,OAAO,EAAE;YACP,cAAc,EAAE,qBAAqB;YACrC,QAAQ,EAAE,WAAW;SACtB;KACF,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6DAA6D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAE9E,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;AAC5C,CAAC"}

package/dist/auth/google/callback.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+export declare function handleGoogleCallback(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=callback.d.ts.map

package/dist/auth/google/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/auth/google/callback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB5D,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoFtG"}

package/dist/auth/google/callback.js

@@ -0,0 +1,98 @@
+import { z } from "zod";
+import { exchangeGoogleCode, verifyGoogleIdToken } from "./client.js";
+import { exchangeGoogleTokenWithFleetx } from "../fleetx/exchange.js";
+import { upsertConnectedAccount } from "../storage/connected-account.js";
+import { createAuthorizationCode } from "../storage/authorization-code.js";
+import { consumePendingSession } from "../oauth/pending-sessions.js";
+import { log } from "../../utils.js";
+const callbackSchema = z.object({
+    code: z.string().optional(),
+    state: z.string().min(1),
+    error: z.string().optional(),
+    error_description: z.string().optional(),
+});
+export async function handleGoogleCallback(request, reply) {
+    const parsed = callbackSchema.safeParse(request.query);
+    if (!parsed.success) {
+        return reply.status(400).send({ error: "invalid_callback" });
+    }
+    const { code, state: sessionId, error: googleError } = parsed.data;
+    const pending = consumePendingSession(sessionId);
+    if (!pending) {
+        return reply.status(400).send({ error: "invalid_state", error_description: "Session not found or expired" });
+    }
+    if (googleError || !code) {
+        const url = new URL(pending.redirectUri);
+        url.searchParams.set("error", "access_denied");
+        url.searchParams.set("error_description", googleError ?? "Google login was cancelled");
+        url.searchParams.set("state", pending.state);
+        return reply.redirect(url.toString(), 302);
+    }
+    // ── Step 1: Exchange Google code for tokens ────────────────────────────
+    let tokens;
+    try {
+        tokens = await exchangeGoogleCode(code, pending.serverBaseUrl);
+        log("Google code exchange succeeded");
+    }
+    catch (err) {
+        log("Google code exchange FAILED:", err);
+        return redirectError(reply, pending.redirectUri, pending.state, `Google token exchange failed: ${String(err)}`);
+    }
+    if (!tokens.id_token) {
+        log("Google response missing id_token");
+        return redirectError(reply, pending.redirectUri, pending.state, "Google response missing id_token");
+    }
+    // ── Step 2: Verify Google ID token ────────────────────────────────────
+    let googleUser;
+    try {
+        googleUser = await verifyGoogleIdToken(tokens.id_token);
+        log("Google ID token verified for:", googleUser.email);
+    }
+    catch (err) {
+        log("Google ID token verification FAILED:", err);
+        return redirectError(reply, pending.redirectUri, pending.state, `Google token verification failed: ${String(err)}`);
+    }
+    // ── Step 3: Exchange with FleetX ──────────────────────────────────────
+    let fleetx;
+    try {
+        fleetx = await exchangeGoogleTokenWithFleetx(tokens.id_token);
+    }
+    catch (err) {
+        log("FleetX exchange FAILED:", err);
+        return redirectError(reply, pending.redirectUri, pending.state, `FleetX authentication failed: ${String(err)}`);
+    }
+    // ── Step 4: Persist account + issue auth code ─────────────────────────
+    // User info comes from the verified Google token — FleetX doesn't return it.
+    try {
+        const account = upsertConnectedAccount({
+            userId: googleUser.sub,
+            fleetxAccessToken: fleetx.accessToken,
+            email: googleUser.email,
+            name: googleUser.name,
+        });
+        const authCode = createAuthorizationCode({
+            userId: account.userId,
+            clientId: pending.clientId,
+            redirectUri: pending.redirectUri,
+            codeChallenge: pending.codeChallenge,
+        });
+        log(`OAuth code issued for ${account.email}`);
+        const callbackUrl = new URL(pending.redirectUri);
+        callbackUrl.searchParams.set("code", authCode.code);
+        callbackUrl.searchParams.set("state", pending.state);
+        return reply.redirect(callbackUrl.toString(), 302);
+    }
+    catch (err) {
+        log("Account/code storage FAILED:", err);
+        return redirectError(reply, pending.redirectUri, pending.state, `Storage error: ${String(err)}`);
+    }
+}
+function redirectError(reply, redirectUri, state, description) {
+    log("Redirecting with error:", description);
+    const url = new URL(redirectUri);
+    url.searchParams.set("error", "server_error");
+    url.searchParams.set("error_description", description);
+    url.searchParams.set("state", state);
+    reply.redirect(url.toString(), 302);
+}
+//# sourceMappingURL=callback.js.map

package/dist/auth/google/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../src/auth/google/callback.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAuB,EAAE,KAAmB;IACrF,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAEnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,IAAI,4BAA4B,CAAC,CAAC;QACvF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,CAAC,kCAAkC,CAAC,CAAC;QACxC,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;IACtG,CAAC;IAED,yEAAyE;IACzE,IAAI,UAA2D,CAAC;IAChE,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,GAAG,CAAC,+BAA+B,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,qCAAqC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,yEAAyE;IACzE,IAAI,MAAiE,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACpC,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC;YACrC,MAAM,EAAE,UAAU,CAAC,GAAG;YACtB,iBAAiB,EAAE,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;QAEH,GAAG,CAAC,yBAAyB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,kBAAkB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAmB,EACnB,WAAmB,EACnB,KAAa,EACb,WAAmB;IAEnB,GAAG,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC"}

package/dist/auth/google/client.d.ts

@@ -0,0 +1,17 @@
+export interface GoogleTokens {
+    access_token: string;
+    id_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+}
+export interface GoogleUser {
+    sub: string;
+    email: string;
+    name: string;
+    email_verified: boolean;
+}
+export declare function buildGoogleAuthUrl(state: string, serverBaseUrl: string): string;
+export declare function exchangeGoogleCode(code: string, serverBaseUrl: string): Promise<GoogleTokens>;
+export declare function verifyGoogleIdToken(idToken: string): Promise<GoogleUser>;
+//# sourceMappingURL=client.d.ts.map

package/dist/auth/google/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/auth/google/client.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,OAAO,CAAC;CACzB;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAc/E;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAuBnG;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAc9E"}

package/dist/auth/google/client.js

@@ -0,0 +1,50 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { getOAuthConfig } from "../../config/oauth.js";
+const GOOGLE_JWKS = createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+export function buildGoogleAuthUrl(state, serverBaseUrl) {
+    const { GOOGLE_CLIENT_ID } = getOAuthConfig();
+    const params = new URLSearchParams({
+        client_id: GOOGLE_CLIENT_ID,
+        redirect_uri: `${serverBaseUrl}/google/callback`,
+        response_type: "code",
+        scope: "openid email profile",
+        state,
+        access_type: "offline",
+        prompt: "select_account consent",
+    });
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+}
+export async function exchangeGoogleCode(code, serverBaseUrl) {
+    const { GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET } = getOAuthConfig();
+    const body = new URLSearchParams({
+        code,
+        client_id: GOOGLE_CLIENT_ID,
+        client_secret: GOOGLE_CLIENT_SECRET,
+        redirect_uri: `${serverBaseUrl}/google/callback`,
+        grant_type: "authorization_code",
+    });
+    const resp = await fetch("https://oauth2.googleapis.com/token", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!resp.ok) {
+        const text = await resp.text();
+        throw new Error(`Google token exchange failed (${resp.status}): ${text}`);
+    }
+    return resp.json();
+}
+export async function verifyGoogleIdToken(idToken) {
+    const { GOOGLE_CLIENT_ID } = getOAuthConfig();
+    const { payload } = await jwtVerify(idToken, GOOGLE_JWKS, {
+        issuer: ["https://accounts.google.com", "accounts.google.com"],
+        audience: GOOGLE_CLIENT_ID,
+    });
+    return {
+        sub: payload.sub,
+        email: payload["email"],
+        name: payload["name"],
+        email_verified: payload["email_verified"],
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/auth/google/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/auth/google/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAiBvD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC;AAE9F,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,aAAqB;IACrE,MAAM,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,CAAC;IAE9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,gBAAgB;QAC3B,YAAY,EAAE,GAAG,aAAa,kBAAkB;QAChD,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,sBAAsB;QAC7B,KAAK;QACL,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,wBAAwB;KACjC,CAAC,CAAC;IAEH,OAAO,gDAAgD,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,aAAqB;IAC1E,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,cAAc,EAAE,CAAC;IAEpE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,IAAI;QACJ,SAAS,EAAE,gBAAgB;QAC3B,aAAa,EAAE,oBAAoB;QACnC,YAAY,EAAE,GAAG,aAAa,kBAAkB;QAChD,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAA2B,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,MAAM,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,CAAC;IAE9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE;QACxD,MAAM,EAAE,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;QAC9D,QAAQ,EAAE,gBAAgB;KAC3B,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAa;QAC1B,KAAK,EAAE,OAAO,CAAC,OAAO,CAAW;QACjC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAW;QAC/B,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAY;KACrD,CAAC;AACJ,CAAC"}

package/dist/auth/oauth/authorize.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+export declare function handleAuthorize(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/auth/oauth/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAqB5D,wBAAsB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DjG"}

package/dist/auth/oauth/authorize.js

@@ -0,0 +1,74 @@
+import { z } from "zod";
+import { randomBytes } from "node:crypto";
+import { buildGoogleAuthUrl } from "../google/client.js";
+import { addPendingSession } from "./pending-sessions.js";
+import { fetchClientMetadata, isKnownClient } from "./cimd.js";
+import { findClient } from "../storage/oauth-client.js";
+import { CLAUDE_CLIENT_ID, CLAUDE_REDIRECT_URI } from "../../config/oauth.js";
+import { resolveServerBaseUrl } from "../../utils-http.js";
+import { log } from "../../utils.js";
+const authorizeQuerySchema = z.object({
+    client_id: z.string().min(1),
+    redirect_uri: z.string().min(1),
+    response_type: z.literal("code"),
+    state: z.string().min(1),
+    code_challenge: z.string().min(43).max(128),
+    code_challenge_method: z.literal("S256"),
+    scope: z.string().optional(),
+});
+export async function handleAuthorize(request, reply) {
+    const parsed = authorizeQuerySchema.safeParse(request.query);
+    if (!parsed.success) {
+        return reply.status(400).send({
+            error: "invalid_request",
+            error_description: parsed.error.issues.map((i) => i.message).join("; "),
+        });
+    }
+    const { client_id, redirect_uri, state, code_challenge, code_challenge_method } = parsed.data;
+    // ── Client validation ────────────────────────────────────────────────────
+    if (!isKnownClient(client_id, [CLAUDE_CLIENT_ID], (id) => !!findClient(id))) {
+        return reply.status(400).send({ error: "invalid_client", error_description: "Unknown client_id" });
+    }
+    // ── Validate redirect_uri ────────────────────────────────────────────────
+    let allowedUris = null;
+    // 1. CIMD: client_id is a URL → fetch metadata document
+    try {
+        const u = new URL(client_id);
+        if (u.protocol === "http:" || u.protocol === "https:") {
+            const meta = await fetchClientMetadata(client_id);
+            if (meta)
+                allowedUris = meta.redirect_uris;
+        }
+    }
+    catch { /* not a URL */ }
+    // 2. DCR: client registered via /oauth/register
+    if (!allowedUris) {
+        const dcrClient = findClient(client_id);
+        if (dcrClient)
+            allowedUris = dcrClient.redirectUris;
+    }
+    // 3. Pre-registered static client
+    if (!allowedUris && client_id === CLAUDE_CLIENT_ID) {
+        allowedUris = [CLAUDE_REDIRECT_URI];
+    }
+    if (!allowedUris || !allowedUris.includes(redirect_uri)) {
+        return reply.status(400).send({
+            error: "invalid_request",
+            error_description: "redirect_uri not registered for this client",
+        });
+    }
+    // ── Store pending session and redirect to Google ─────────────────────────
+    const serverBaseUrl = resolveServerBaseUrl(request);
+    const sessionId = randomBytes(32).toString("hex");
+    addPendingSession(sessionId, {
+        clientId: client_id,
+        redirectUri: redirect_uri,
+        state,
+        codeChallenge: code_challenge,
+        codeChallengeMethod: code_challenge_method,
+        serverBaseUrl,
+    });
+    log(`OAuth authorize: client=${client_id} session=${sessionId.slice(0, 8)}… → Google (base=${serverBaseUrl})`);
+    return reply.redirect(buildGoogleAuthUrl(sessionId, serverBaseUrl), 302);
+}
+//# sourceMappingURL=authorize.js.map

package/dist/auth/oauth/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/auth/oauth/authorize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB,EAAE,KAAmB;IAChF,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAE9F,4EAA4E;IAC5E,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,4EAA4E;IAC5E,IAAI,WAAW,GAAoB,IAAI,CAAC;IAExC,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE3B,gDAAgD;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,SAAS;YAAE,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC;IACtD,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,WAAW,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACnD,WAAW,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,6CAA6C;SACjE,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,iBAAiB,CAAC,SAAS,EAAE;QAC3B,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,YAAY;QACzB,KAAK;QACL,aAAa,EAAE,cAAc;QAC7B,mBAAmB,EAAE,qBAAqB;QAC1C,aAAa;KACd,CAAC,CAAC;IAEH,GAAG,CAAC,2BAA2B,SAAS,YAAY,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,oBAAoB,aAAa,GAAG,CAAC,CAAC;IAE/G,OAAO,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3E,CAAC"}

package/dist/auth/oauth/cimd.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Client ID Metadata Document (CIMD) support.
+ *
+ * When the client_id is a URL, we fetch that URL to retrieve the client's
+ * published metadata (redirect_uris, client_name, etc.) and validate the
+ * request against it instead of a hardcoded registry.
+ *
+ * Spec: https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml
+ * MCP auth spec §2.3
+ */
+export interface ClientMetadata {
+    client_id: string;
+    redirect_uris: string[];
+    client_name?: string;
+    token_endpoint_auth_method?: string;
+    grant_types?: string[];
+    response_types?: string[];
+}
+/**
+ * Fetches the CIMD for a given client_id URL.
+ * Tries the client_id URL directly first; if that returns non-JSON or fails,
+ * tries `{origin}/.well-known/oauth-client-metadata` as a fallback.
+ * Returns null if the client_id is not a URL or the document cannot be fetched.
+ */
+export declare function fetchClientMetadata(clientId: string): Promise<ClientMetadata | null>;
+/**
+ * Returns true if the client_id is:
+ *   - a URL (CIMD client), OR
+ *   - in the pre-registered allowlist, OR
+ *   - registered via DCR (checked via the provided lookup function)
+ */
+export declare function isKnownClient(clientId: string, preRegistered: string[], dcrLookup?: (id: string) => boolean): boolean;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/auth/oauth/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAWD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA2B1F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EAAE,EACvB,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GAClC,OAAO,CAET"}

package/dist/auth/oauth/cimd.js

@@ -0,0 +1,63 @@
+/**
+ * Client ID Metadata Document (CIMD) support.
+ *
+ * When the client_id is a URL, we fetch that URL to retrieve the client's
+ * published metadata (redirect_uris, client_name, etc.) and validate the
+ * request against it instead of a hardcoded registry.
+ *
+ * Spec: https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml
+ * MCP auth spec §2.3
+ */
+function isUrl(value) {
+    try {
+        const u = new URL(value);
+        return u.protocol === "http:" || u.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Fetches the CIMD for a given client_id URL.
+ * Tries the client_id URL directly first; if that returns non-JSON or fails,
+ * tries `{origin}/.well-known/oauth-client-metadata` as a fallback.
+ * Returns null if the client_id is not a URL or the document cannot be fetched.
+ */
+export async function fetchClientMetadata(clientId) {
+    if (!isUrl(clientId))
+        return null;
+    const candidates = [
+        clientId,
+        `${new URL(clientId).origin}/.well-known/oauth-client-metadata`,
+    ];
+    for (const url of candidates) {
+        try {
+            const resp = await fetch(url, {
+                headers: { Accept: "application/json" },
+                signal: AbortSignal.timeout(5000),
+            });
+            if (!resp.ok)
+                continue;
+            const ct = resp.headers.get("content-type") ?? "";
+            if (!ct.includes("json"))
+                continue;
+            const doc = (await resp.json());
+            if (Array.isArray(doc.redirect_uris))
+                return doc;
+        }
+        catch {
+            // try next candidate
+        }
+    }
+    return null;
+}
+/**
+ * Returns true if the client_id is:
+ *   - a URL (CIMD client), OR
+ *   - in the pre-registered allowlist, OR
+ *   - registered via DCR (checked via the provided lookup function)
+ */
+export function isKnownClient(clientId, preRegistered, dcrLookup) {
+    return isUrl(clientId) || preRegistered.includes(clientId) || (dcrLookup?.(clientId) ?? false);
+}
+//# sourceMappingURL=cimd.js.map

package/dist/auth/oauth/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/auth/oauth/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,oCAAoC;KAChE,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAEvB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAEnC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAmB,CAAC;YAClD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAAE,OAAO,GAAG,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,aAAuB,EACvB,SAAmC;IAEnC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;AACjG,CAAC"}

package/dist/auth/oauth/pending-sessions.d.ts

@@ -0,0 +1,5 @@
+import type { PendingAuthSession } from "./types.js";
+export declare function addPendingSession(sessionId: string, session: Omit<PendingAuthSession, "expiresAt">): void;
+/** Returns the session and removes it (single-use). Returns null if missing or expired. */
+export declare function consumePendingSession(sessionId: string): PendingAuthSession | null;
+//# sourceMappingURL=pending-sessions.d.ts.map

package/dist/auth/oauth/pending-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-sessions.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/pending-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAarD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,IAAI,CAEzG;AAED,2FAA2F;AAC3F,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAMlF"}

package/dist/auth/oauth/pending-sessions.js

@@ -0,0 +1,24 @@
+import { PENDING_SESSION_TTL_MS } from "../../config/oauth.js";
+const pendingSessions = new Map();
+// Purge expired sessions every 5 minutes
+setInterval(() => {
+    const now = Date.now();
+    for (const [id, session] of pendingSessions) {
+        if (session.expiresAt < now)
+            pendingSessions.delete(id);
+    }
+}, 5 * 60 * 1000).unref();
+export function addPendingSession(sessionId, session) {
+    pendingSessions.set(sessionId, { ...session, expiresAt: Date.now() + PENDING_SESSION_TTL_MS });
+}
+/** Returns the session and removes it (single-use). Returns null if missing or expired. */
+export function consumePendingSession(sessionId) {
+    const session = pendingSessions.get(sessionId);
+    if (!session)
+        return null;
+    pendingSessions.delete(sessionId);
+    if (session.expiresAt < Date.now())
+        return null;
+    return session;
+}
+//# sourceMappingURL=pending-sessions.js.map

package/dist/auth/oauth/pending-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-sessions.js","sourceRoot":"","sources":["../../../src/auth/oauth/pending-sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE9D,yCAAyC;AACzC,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,eAAe,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;YAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAE1B,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAA8C;IACjG,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC"}