@kamilio/wire 0.1.8 → 0.1.10

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -0,0 +1,36 @@
+import http from "node:http";
+export { OAuthAuthorizationError } from "./authorization-error.js";
+export { loopbackTarget, validateAuthorizationRedirect, validateHostedOAuthRedirect } from "./redirect-target.js";
+export interface OAuthLandingPage {
+    title: string;
+    body: string;
+}
+export interface LoopbackAuthorizationOptions {
+    openBrowser?: (url: string) => Promise<void>;
+    readLine?: () => Promise<string>;
+    /** Host receives the full callback URL; this mode never opens a local listener. */
+    waitForCallback?: (request: {
+        authorizationUrl: string;
+        redirectUri: string;
+        signal: AbortSignal;
+    }) => Promise<string>;
+    createServer?: () => http.Server;
+    landingPage?: OAuthLandingPage;
+    callbackPath?: string;
+    /** Exact registered HTTP loopback redirect, including its fixed port and query. */
+    redirectUri?: string;
+    signal?: AbortSignal;
+    /** Bounds listener setup and authorization; defaults to unlimited. */
+    timeoutMs?: number;
+}
+export interface LoopbackAuthorizationSession {
+    redirectUri: string;
+    waitForCode(authorizationUrl: string): Promise<string>;
+    close(): void;
+}
+/** Capture declared configuration regardless of property enumerability. */
+export declare function snapshotLoopbackAuthorizationOptions(options: LoopbackAuthorizationOptions): LoopbackAuthorizationOptions;
+/** Authorization callback denial, retaining the provider diagnostic for host observers. */
+export declare function createLoopbackAuthorizationSession(options?: LoopbackAuthorizationOptions): Promise<LoopbackAuthorizationSession>;
+export declare function extractCodeFromInput(input: string): string | null;
+export declare function buildSuccessPage(landingPage?: OAuthLandingPage): string;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -0,0 +1,317 @@
+import http from "node:http";
+import { parseAuthorizationState } from "./authorization-state.js";
+import { OAuthAuthorizationError } from "./authorization-error.js";
+export { OAuthAuthorizationError } from "./authorization-error.js";
+import { oauthCallbackParameters, loopbackTarget, validateAuthorizationRedirect } from "./redirect-target.js";
+export { loopbackTarget, validateAuthorizationRedirect, validateHostedOAuthRedirect } from "./redirect-target.js";
+/** Capture declared configuration regardless of property enumerability. */
+export function snapshotLoopbackAuthorizationOptions(options) {
+    return { ...options, openBrowser: options.openBrowser?.bind(options), readLine: options.readLine?.bind(options), waitForCallback: options.waitForCallback?.bind(options), createServer: options.createServer?.bind(options),
+        callbackPath: options.callbackPath, redirectUri: options.redirectUri, signal: options.signal, timeoutMs: options.timeoutMs,
+        landingPage: options.landingPage === undefined ? undefined : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body } };
+}
+/** Authorization callback denial, retaining the provider diagnostic for host observers. */
+export async function createLoopbackAuthorizationSession(options = {}) {
+    options = snapshotLoopbackAuthorizationOptions(options);
+    options.signal?.throwIfAborted();
+    const timeoutMs = options.timeoutMs ?? Infinity;
+    if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647))
+        throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+    if (options.waitForCallback !== undefined)
+        return createHostedAuthorizationSession(options, timeoutMs);
+    const target = loopbackTarget(options);
+    const server = options.createServer ? options.createServer() : http.createServer();
+    const controller = new AbortController();
+    let closed = false;
+    let used = false;
+    const callerAbort = () => controller.abort(options.signal?.reason);
+    const teardown = () => {
+        if (closed)
+            return;
+        closed = true;
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", callerAbort);
+        server.closeAllConnections?.();
+        server.close();
+    };
+    const timer = timeoutMs === Infinity ? undefined : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+    timer?.unref?.();
+    controller.signal.addEventListener("abort", teardown, { once: true });
+    options.signal?.addEventListener("abort", callerAbort, { once: true });
+    if (options.signal?.aborted)
+        callerAbort();
+    let port;
+    try {
+        port = await startServer(server, target.port, target.host, controller.signal);
+    }
+    catch (error) {
+        controller.abort(error);
+        throw error;
+    }
+    const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
+    return {
+        redirectUri,
+        async waitForCode(authorizationUrl) {
+            controller.signal.throwIfAborted();
+            if (used)
+                throw new Error("OAuth authorization session has already been used");
+            used = true;
+            try {
+                return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+        close() {
+            controller.abort(new Error("OAuth authorization session closed"));
+        }
+    };
+}
+function createHostedAuthorizationSession(options, timeoutMs) {
+    validateAuthorizationRedirect(options);
+    const redirectUri = options.redirectUri, controller = new AbortController();
+    let used = false;
+    const aborted = () => controller.abort(options.signal?.reason);
+    const timer = timeoutMs === Infinity ? undefined : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+    timer?.unref?.();
+    const cleanup = () => { clearTimeout(timer); options.signal?.removeEventListener("abort", aborted); };
+    controller.signal.addEventListener("abort", cleanup, { once: true });
+    options.signal?.addEventListener("abort", aborted, { once: true });
+    if (options.signal?.aborted)
+        aborted();
+    return {
+        redirectUri,
+        async waitForCode(authorizationUrl) {
+            controller.signal.throwIfAborted();
+            if (used)
+                throw new Error("OAuth authorization session has already been used");
+            used = true;
+            try {
+                const authorization = new URL(authorizationUrl);
+                if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
+                    throw new Error("OAuth authorization redirect mismatch");
+                const callback = await new Promise((resolve, reject) => {
+                    const onAbort = () => reject(controller.signal.reason);
+                    controller.signal.addEventListener("abort", onAbort, { once: true });
+                    void Promise.resolve().then(() => {
+                        controller.signal.throwIfAborted();
+                        return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
+                    }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+                });
+                controller.signal.throwIfAborted();
+                const url = new URL(callback), base = new URL(redirectUri);
+                if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#")
+                    || [...callback].some(char => char.codePointAt(0) <= 32))
+                    throw new Error("OAuth callback redirect mismatch");
+                const params = readAuthorizationCallbackParameters(url);
+                for (const name of oauthCallbackParameters)
+                    url.searchParams.delete(name);
+                if (url.searchParams.toString() !== base.searchParams.toString())
+                    throw new Error("OAuth callback redirect mismatch");
+                const expected = readExpectedAuthorizationCallback(authorizationUrl);
+                if (expected.state === null)
+                    throw new Error("OAuth authorization missing state");
+                validateAuthorizationCallbackBinding(params, expected);
+                if (params.error !== null)
+                    throw new OAuthAuthorizationError(params.error, params.errorDescription ?? params.error);
+                return validateAuthorizationCallbackParameters(params, expected);
+            }
+            finally {
+                controller.abort(new Error("OAuth authorization session closed"));
+            }
+        },
+        close() { controller.abort(new Error("OAuth authorization session closed")); }
+    };
+}
+async function startServer(server, port, host, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { server.off("error", handleError); signal.removeEventListener("abort", aborted); };
+        const handleError = (error) => { cleanup(); reject(error); };
+        const aborted = () => { cleanup(); reject(signal.reason); };
+        server.once("error", handleError);
+        signal.addEventListener("abort", aborted, { once: true });
+        try {
+            server.listen(port, host, () => {
+                cleanup();
+                if (signal.aborted) {
+                    server.close();
+                    reject(signal.reason);
+                    return;
+                }
+                const address = server.address();
+                if (address === null || typeof address === "string") {
+                    reject(new Error("OAuth listener has no TCP address"));
+                    return;
+                }
+                resolve(address.port);
+            });
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
+    });
+}
+function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath, signal) {
+    signal.throwIfAborted();
+    const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            server.off("request", request);
+            signal.removeEventListener("abort", aborted);
+            fn();
+        };
+        const aborted = () => settle(() => reject(signal.reason));
+        const request = (req, res) => {
+            let url;
+            try {
+                url = new URL(req.url ?? "/", "http://127.0.0.1");
+            }
+            catch {
+                res.writeHead(400);
+                res.end("Invalid callback URL");
+                return;
+            }
+            if (url.pathname !== callbackPath) {
+                res.writeHead(404);
+                res.end("Not found");
+                return;
+            }
+            try {
+                const callbackParameters = readAuthorizationCallbackParameters(url);
+                validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+                if (callbackParameters.error !== null)
+                    throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+                const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(buildSuccessPage(options.landingPage));
+                settle(() => resolve(code));
+            }
+            catch (error) {
+                res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8", "X-Content-Type-Options": "nosniff" });
+                res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
+                settle(() => reject(error));
+            }
+        };
+        server.on("request", request);
+        signal.addEventListener("abort", aborted, { once: true });
+        if (options.readLine !== undefined) {
+            void Promise.resolve().then(() => settled ? undefined : options.readLine()).then(input => {
+                if (settled)
+                    return;
+                const callbackParameters = extractCallbackParametersFromInput(input);
+                if (callbackParameters === null)
+                    throw new Error("OAuth callback missing authorization code");
+                validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+                if (callbackParameters.error !== null)
+                    throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+                const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+                settle(() => resolve(code));
+            }).catch(error => settle(() => reject(error)));
+        }
+        if (options.openBrowser !== undefined) {
+            void Promise.resolve().then(() => settled ? undefined : options.openBrowser(authorizationUrl))
+                .catch(error => settle(() => reject(error)));
+        }
+    });
+}
+export function extractCodeFromInput(input) {
+    try {
+        return extractCallbackParametersFromInput(input)?.code ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function extractCallbackParametersFromInput(input) {
+    const trimmed = input.replaceAll("\r", "").replaceAll("\n", "").trim();
+    if (trimmed.length === 0) {
+        return null;
+    }
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return {
+            code: trimmed,
+            error: null,
+            errorDescription: null,
+            state: null,
+            iss: null
+        };
+    }
+    return readAuthorizationCallbackParameters(url);
+}
+function readAuthorizationCallbackParameters(url) {
+    for (const parameter of oauthCallbackParameters) {
+        if (url.searchParams.getAll(parameter).length > 1)
+            throw new Error(`OAuth callback parameter '${parameter}' must occur only once`);
+    }
+    return { code: url.searchParams.get("code"), error: url.searchParams.get("error"),
+        errorDescription: url.searchParams.get("error_description"), state: url.searchParams.get("state"), iss: url.searchParams.get("iss") };
+}
+function readExpectedAuthorizationCallback(authorizationUrl) {
+    const url = new URL(authorizationUrl);
+    const state = url.searchParams.get("state");
+    const parsedState = parseAuthorizationState(state);
+    return {
+        state,
+        issuer: parsedState?.issuer ?? null,
+        requireIssuer: parsedState?.requireIssuer ?? false
+    };
+}
+function validateAuthorizationCallbackParameters(callback, expected) {
+    validateAuthorizationCallbackBinding(callback, expected);
+    if (callback.code === null || callback.code.length === 0) {
+        throw new Error("OAuth callback missing authorization code");
+    }
+    return callback.code;
+}
+function validateAuthorizationCallbackBinding(callback, expected) {
+    if (expected.state !== null) {
+        if (callback.state === null || callback.state.length === 0) {
+            throw new Error("OAuth callback missing state");
+        }
+        if (callback.state !== expected.state) {
+            throw new Error("OAuth callback state mismatch");
+        }
+    }
+    if (expected.requireIssuer) {
+        if (callback.iss === null || callback.iss.length === 0) {
+            throw new Error("OAuth callback missing issuer");
+        }
+    }
+    if (callback.iss !== null &&
+        callback.iss.length > 0 &&
+        expected.issuer !== null &&
+        callback.iss !== expected.issuer) {
+        throw new Error("OAuth callback issuer mismatch");
+    }
+}
+function escapeHtml(text) {
+    return text
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}
+export function buildSuccessPage(landingPage) {
+    const title = landingPage?.title ?? "Connected";
+    const body = landingPage?.body ?? "You can close this tab and return to your terminal.";
+    return [
+        "<!DOCTYPE html>",
+        `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
+        '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
+        '<div style="text-align:center">',
+        `<h1>${escapeHtml(title)}</h1>`,
+        `<p style="color:#666">${escapeHtml(body)}</p>`,
+        "</div></body></html>"
+    ].join("");
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/oauth-form.d.ts

@@ -0,0 +1,10 @@
+import type { OAuthTokenEndpointAuthMethod } from "./types.js";
+export declare function createOAuthFormRequest(input: {
+    clientId: string;
+    clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+    params: Record<string, string>;
+}): {
+    body: URLSearchParams;
+    headers: Headers;
+};

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/oauth-form.js

@@ -0,0 +1,20 @@
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+export function createOAuthFormRequest(input) {
+    const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ??
+        (input.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && (input.clientSecret === undefined || input.clientSecret.trim() === ""))
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const body = new URLSearchParams(input.params);
+    const headers = new Headers({ Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" });
+    if (method === "client_secret_basic") {
+        const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+        const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+        headers.set("Authorization", `Basic ${btoa(`${encoded}:${encodedSecret}`)}`);
+    }
+    else {
+        body.set("client_id", input.clientId);
+        if (method === "client_secret_post")
+            body.set("client_secret", input.clientSecret);
+    }
+    return { body, headers };
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/persistence-options.d.ts

@@ -0,0 +1,3 @@
+import type { CreateSecretStoreInput } from "auth-store";
+/** Own scalar policies while retaining selected live host dependencies. */
+export declare function snapshotOAuthPersistenceOptions(options: CreateSecretStoreInput): CreateSecretStoreInput;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/persistence-options.js

@@ -0,0 +1,10 @@
+/** Own scalar policies while retaining selected live host dependencies. */
+export function snapshotOAuthPersistenceOptions(options) {
+    const file = options.fileStore, keychain = options.keychainStore, lock = keychain?.lock;
+    return { ...options, backend: options.backend, env: options.env, platform: options.platform, backendEnvVar: options.backendEnvVar,
+        ...(file === undefined ? {} : { fileStore: { ...file, fs: file.fs, filePath: file.filePath, salt: file.salt,
+                defaultDirectory: file.defaultDirectory, defaultFileName: file.defaultFileName, throwOnInvalidDocument: file.throwOnInvalidDocument,
+                getHomeDirectory: file.getHomeDirectory?.bind(file), getMachineIdentity: file.getMachineIdentity?.bind(file), getRandomBytes: file.getRandomBytes?.bind(file) } }),
+        ...(keychain === undefined ? {} : { keychainStore: { ...keychain, service: keychain.service, account: keychain.account,
+                runCommand: keychain.runCommand?.bind(keychain), ...(lock === undefined ? {} : { lock: { ...lock, fs: lock.fs, directory: lock.directory } }) } }) };
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/pkce.js

@@ -0,0 +1,8 @@
+import { sha256 } from "@noble/hashes/sha2.js";
+import { base64url } from "jose";
+export function generateCodeVerifier() {
+    return base64url.encode(crypto.getRandomValues(new Uint8Array(32)));
+}
+export function generateCodeChallenge(verifier) {
+    return base64url.encode(sha256(new TextEncoder().encode(verifier)));
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/redirect-target.d.ts

@@ -0,0 +1,10 @@
+import type { LoopbackAuthorizationOptions } from "./loopback-authorization.js";
+export declare const oauthCallbackParameters: string[];
+export declare function loopbackTarget(options: LoopbackAuthorizationOptions): {
+    port: number;
+    host: string;
+    callbackPath: string;
+};
+/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
+export declare function validateAuthorizationRedirect(options: LoopbackAuthorizationOptions): void;
+export declare function validateHostedOAuthRedirect(redirectUri: string, callbackPath?: string): void;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/redirect-target.js

@@ -0,0 +1,42 @@
+export const oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
+export function loopbackTarget(options) {
+    if (options.redirectUri !== undefined) {
+        let url;
+        try {
+            url = new URL(options.redirectUri);
+        }
+        catch (cause) {
+            throw new Error("Invalid OAuth loopback redirect URI", { cause });
+        }
+        if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
+            || url.username || url.password || url.href.includes("#") || url.port === "0"
+            || oauthCallbackParameters.some(name => url.searchParams.has(name))
+            || [...options.redirectUri].some(char => char.codePointAt(0) <= 32)
+            || (options.callbackPath !== undefined && options.callbackPath !== url.pathname))
+            throw new Error("Invalid OAuth loopback redirect URI");
+        return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
+    }
+    const callbackPath = options.callbackPath ?? "/callback";
+    const parsed = new URL(callbackPath, "http://127.0.0.1");
+    if (!callbackPath.startsWith("/") || parsed.origin !== "http://127.0.0.1" || parsed.pathname !== callbackPath || parsed.search || parsed.hash)
+        throw new Error("Invalid OAuth loopback callback path");
+    return { port: 0, host: "127.0.0.1", callbackPath };
+}
+/** Hosted redirects are explicit HTTPS URLs; local redirects retain loopback policy. */
+export function validateAuthorizationRedirect(options) {
+    if (options.waitForCallback === undefined) {
+        loopbackTarget(options);
+        return;
+    }
+    if (typeof options.waitForCallback !== "function" || options.redirectUri === undefined)
+        throw new Error("Hosted OAuth callbacks require redirectUri and waitForCallback");
+    validateHostedOAuthRedirect(options.redirectUri, options.callbackPath);
+}
+export function validateHostedOAuthRedirect(redirectUri, callbackPath) {
+    const url = new URL(redirectUri);
+    if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#") || url.port === "0"
+        || oauthCallbackParameters.some(name => url.searchParams.has(name))
+        || [...redirectUri].some(char => char.codePointAt(0) <= 32)
+        || (callbackPath !== undefined && callbackPath !== url.pathname))
+        throw new Error("Invalid hosted OAuth redirect URI");
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/register-client.d.ts

@@ -0,0 +1,20 @@
+import type { OAuthClientMetadata, OAuthClientRegistration, OAuthMetadataFetch, OAuthTokenEndpointAuthMethod } from "./types.js";
+export type RegisterOAuthClientOptions = {
+    /** Discovered endpoint approved by the host's network and issuer policy. */
+    registrationEndpoint: string;
+    metadata?: OAuthClientMetadata;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+    fetch: OAuthMetadataFetch;
+    signal?: AbortSignal;
+} & ({
+    redirectUri: string;
+    redirectUris?: never;
+} | {
+    redirectUri?: never;
+    /** One to 32 distinct redirects, transmitted exactly as supplied. */
+    redirectUris: readonly string[];
+});
+/** RFC 7591 registration only: no consent, persistence, or automatic retries.
+ * The host owns issuer/redirect binding and private persistence of the returned registration.
+ */
+export declare function registerOAuthClient(input: RegisterOAuthClientOptions): Promise<OAuthClientRegistration>;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/register-client.js

@@ -0,0 +1,68 @@
+import { fetchMcpResponse } from "../http-fetch.js";
+import { parseOAuthClientRegistration } from "./client-registration.js";
+import { loopbackTarget, validateHostedOAuthRedirect } from "./redirect-target.js";
+import { readOAuthJsonObjectResponse } from "./token-endpoint.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+/** RFC 7591 registration only: no consent, persistence, or automatic retries.
+ * The host owns issuer/redirect binding and private persistence of the returned registration.
+ */
+export async function registerOAuthClient(input) {
+    if (input.redirectUri !== undefined && input.redirectUris !== undefined)
+        throw new Error("Specify either redirectUri or redirectUris, not both");
+    const redirects = input.redirectUris === undefined ? [input.redirectUri] : input.redirectUris;
+    if (!Array.isArray(redirects) || redirects.length === 0 || redirects.length > 32)
+        throw new Error("OAuth registration requires one to 32 redirect URIs");
+    const redirectUris = [];
+    const seen = new Set();
+    for (const redirectUri of redirects) {
+        if (typeof redirectUri !== "string" || redirectUri.length === 0)
+            throw new Error("Invalid OAuth registration redirect URI");
+        if (seen.has(redirectUri))
+            throw new Error("Duplicate OAuth registration redirect URI");
+        if (new URL(redirectUri).protocol === "https:")
+            validateHostedOAuthRedirect(redirectUri);
+        else
+            loopbackTarget({ redirectUri });
+        seen.add(redirectUri);
+        redirectUris.push(redirectUri);
+    }
+    const body = JSON.stringify(buildClientRegistrationBody(input.metadata, redirectUris, normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? "none"));
+    if (new TextEncoder().encode(body).byteLength > 65_536)
+        throw new Error("OAuth registration request is too large");
+    input.signal?.throwIfAborted();
+    const deadline = AbortSignal.timeout(30_000);
+    const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
+    const response = await fetchMcpResponse(input.fetch, input.registrationEndpoint, {
+        method: "POST", headers: { Accept: "application/json", "Content-Type": "application/json" }, body, signal
+    });
+    return parseOAuthClientRegistration(await readOAuthJsonObjectResponse(response, signal));
+}
+function getOwnString(input, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    return descriptor !== undefined && "value" in descriptor && typeof descriptor.value === "string" ? descriptor.value : undefined;
+}
+function buildClientRegistrationBody(metadata, redirectUris, tokenEndpointAuthMethod) {
+    const body = {
+        redirect_uris: redirectUris,
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: tokenEndpointAuthMethod
+    };
+    const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
+    const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");
+    const softwareId = metadata === undefined ? undefined : getOwnString(metadata, "softwareId");
+    const softwareVersion = metadata === undefined ? undefined : getOwnString(metadata, "softwareVersion");
+    if (clientName !== undefined && clientName.length > 0) {
+        body.client_name = clientName;
+    }
+    if (scope !== undefined && scope.length > 0) {
+        body.scope = scope;
+    }
+    if (softwareId !== undefined && softwareId.length > 0) {
+        body.software_id = softwareId;
+    }
+    if (softwareVersion !== undefined && softwareVersion.length > 0) {
+        body.software_version = softwareVersion;
+    }
+    return body;
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.d.ts

@@ -0,0 +1,20 @@
+import type { CreateSecretStoreInput } from "auth-store";
+import { type OAuthClientStore } from "./auth-store-session-store.js";
+import type { OAuthSessionStore, StoredOAuthSession } from "./types.js";
+export interface ResourceBoundOAuthStores {
+    readonly sessionStore: OAuthSessionStore;
+    readonly clientStore: OAuthClientStore;
+    readonly initialGrantAllowed: boolean;
+    /** Retire grants/clients even when their document cannot be decrypted or parsed. */
+    /** Explicitly replace the bound grant and original client in one transaction. */
+    importSession(session: StoredOAuthSession, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<void>;
+    reset(resource: string, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<void>;
+}
+/** One locked document owns a logical server's URL history, grant and clients. */
+export declare function createResourceBoundOAuthStores(options: CreateSecretStoreInput, namespace: string | undefined, identity: string): ResourceBoundOAuthStores;