@kamilio/wire 0.1.9 → 0.1.10

package/node_modules/toolcraft/dist/http-hosted-oauth.js

@@ -0,0 +1,473 @@
+import { createHash, createHmac, generateKeyPairSync, randomBytes } from "node:crypto";
+import { exportJWK } from "jose";
+import { createAuthorizationInteractionSecurity, createInMemoryAuthorizationServerStore, createOAuthAuthorizationServer, verifyAuthorizationInteractionCsrf } from "mcp-oauth-server";
+export function isHostedOAuthConfiguration(value) {
+    return typeof value === "object" && value !== null && "kind" in value && value.kind === "hosted";
+}
+function normalizePublicUrl(value) {
+    const url = new URL(value);
+    if (url.hash.length > 0 || url.search.length > 0) {
+        throw new Error("hosted OAuth publicUrl must not contain a query or fragment.");
+    }
+    if (url.username.length > 0 || url.password.length > 0) {
+        throw new Error("hosted OAuth publicUrl must not contain credentials.");
+    }
+    if (url.pathname === "/" || url.pathname.endsWith("/")) {
+        throw new Error("hosted OAuth publicUrl must contain a non-root path without a trailing slash.");
+    }
+    return url;
+}
+function configurationErrors(config, production) {
+    const errors = [];
+    const scopes = config.advanced?.scopes ?? ["mcp", "offline_access"];
+    if (!scopes.includes("mcp"))
+        errors.push("scopes containing required mcp scope");
+    if (scopes.some((scope) => scope.length === 0 || scope.trim() !== scope || scope.includes(" "))) {
+        errors.push("valid space-free scope names");
+    }
+    if (production) {
+        if (normalizePublicUrl(config.publicUrl).protocol !== "https:")
+            errors.push("HTTPS publicUrl");
+        if (!config.storage.capabilities.durable)
+            errors.push("durable storage");
+        if (!config.storage.capabilities.encryptedCredentials)
+            errors.push("encrypted credentials");
+        if (!config.storage.capabilities.stableKeys)
+            errors.push("stable signing and subject keys");
+    }
+    return errors;
+}
+export function hostedOAuth(options) {
+    if (options.provider.name.trim().length === 0)
+        throw new Error("provider.name is required.");
+    if (options.advanced?.interaction === undefined &&
+        (options.provider.login === undefined || options.provider.connect === undefined)) {
+        throw new Error("provider.login and provider.connect are required without an advanced interaction.");
+    }
+    if (options.provider.login !== undefined && options.provider.login.fields.length === 0) {
+        throw new Error("provider.login.fields must contain at least one field.");
+    }
+    const fieldNames = (options.provider.login?.fields ?? []).map((field) => typeof field === "string" ? field : field.name);
+    if (new Set(fieldNames).size !== fieldNames.length ||
+        fieldNames.some((name) => name.length === 0 || name === "signal" || name === "csrf" || name === "transaction")) {
+        throw new Error("provider.login.fields must have unique, non-reserved names.");
+    }
+    if (options.advanced?.interaction !== undefined &&
+        (options.advanced.interaction.paths.length === 0 ||
+            new Set(options.advanced.interaction.paths).size !==
+                options.advanced.interaction.paths.length ||
+            options.advanced.interaction.paths.some((path) => !path.startsWith("/") ||
+                [
+                    "/healthz",
+                    "/oauth/connect",
+                    "/authorize",
+                    "/register",
+                    "/token",
+                    "/revoke",
+                    "/.well-known/oauth-authorization-server",
+                    "/.well-known/jwks.json",
+                    normalizePublicUrl(options.publicUrl).pathname
+                ].includes(path)))) {
+        throw new Error("advanced.interaction.paths must contain unique, non-reserved absolute paths.");
+    }
+    normalizePublicUrl(options.publicUrl);
+    return {
+        ...options,
+        kind: "hosted",
+        async prepare({ production = process.env.NODE_ENV === "production" } = {}) {
+            const errors = configurationErrors(this, production);
+            if (errors.length > 0) {
+                throw new Error(`Hosted OAuth configuration requires: ${errors.join(", ")}.`);
+            }
+            const publicUrl = normalizePublicUrl(this.publicUrl);
+            return {
+                publicUrl,
+                issuer: new URL(publicUrl.origin),
+                scopes: this.advanced?.scopes ?? ["mcp", "offline_access"]
+            };
+        },
+        async assertProductionReady() {
+            return this.prepare({ production: true });
+        }
+    };
+}
+export class HostedOAuthLoginError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HostedOAuthLoginError";
+    }
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function loginField(field) {
+    if (typeof field !== "string")
+        return field;
+    return {
+        name: field,
+        label: field === "apiKey" ? "API key" : `${field[0]?.toUpperCase() ?? ""}${field.slice(1)}`,
+        type: field === "password" || field === "apiKey" ? "password" : field === "email" ? "email" : "text"
+    };
+}
+function renderLogin(providerName, fields, transaction, csrfToken, error, submittedValues = {}) {
+    const scriptNonce = randomBytes(18).toString("base64");
+    const controls = fields
+        .map((field) => {
+        const name = escapeHtml(field.name);
+        const type = field.type ?? "text";
+        const autocomplete = type === "email" ? "username" : field.name === "password" ? "current-password" : "off";
+        const value = type === "email" ? submittedValues[field.name] ?? "" : "";
+        return `<label>${escapeHtml(field.label ?? field.name)}<input name="${name}" type="${type}" required autocomplete="${autocomplete}"${value.length === 0 ? "" : ` value="${escapeHtml(value)}"`}></label>`;
+    })
+        .join("");
+    const idleLabel = `Connect ${providerName}`;
+    const html = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connect ${escapeHtml(providerName)}</title><style>body{font:16px system-ui;max-width:28rem;margin:10vh auto;padding:1rem;color:#171717}form{display:grid;gap:1rem}label{display:grid;gap:.35rem}input,button{font:inherit;padding:.7rem}button{cursor:pointer}button:disabled{cursor:wait;opacity:.7}.status{margin:0;color:#525252}.error{color:#b42318}</style></head><body><h1>Connect ${escapeHtml(providerName)}</h1>${error === undefined ? "" : `<p class="error" role="alert">${escapeHtml(error)}</p>`}<form id="oauth-connect-form" method="post" action="/oauth/connect"><input type="hidden" name="transaction" value="${escapeHtml(transaction.id)}"><input type="hidden" name="csrf" value="${escapeHtml(csrfToken)}">${controls}<button id="oauth-connect-button" type="submit" data-idle-label="${escapeHtml(idleLabel)}">${escapeHtml(idleLabel)}</button><p id="oauth-connect-status" class="status" role="status" aria-live="polite" hidden>Signing in… This may take a moment.</p></form><script nonce="${scriptNonce}">(()=>{const form=document.getElementById("oauth-connect-form");const button=document.getElementById("oauth-connect-button");const status=document.getElementById("oauth-connect-status");if(!(form instanceof HTMLFormElement)||!(button instanceof HTMLButtonElement)||!(status instanceof HTMLElement))return;const reset=()=>{form.removeAttribute("aria-busy");button.disabled=false;button.textContent=button.dataset.idleLabel||"Connect";status.hidden=true};form.addEventListener("submit",()=>{form.setAttribute("aria-busy","true");button.disabled=true;button.textContent="Connecting…";status.hidden=false});addEventListener("pageshow",reset)})();</script></body></html>`;
+    return {
+        contentSecurityPolicy: loginContentSecurityPolicy(transaction, scriptNonce),
+        html
+    };
+}
+function loginContentSecurityPolicy(transaction, scriptNonce) {
+    const callbackOrigin = new URL(transaction.redirectUri).origin;
+    return `default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-${scriptNonce}'; form-action 'self' ${callbackOrigin}; base-uri 'none'; frame-ancestors 'none'`;
+}
+function renderExpiredConnection() {
+    return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connection expired</title><style>body{font:16px system-ui;max-width:28rem;margin:10vh auto;padding:1rem;color:#171717}p{line-height:1.5}</style></head><body><h1>Connection expired</h1><p>This sign-in link has expired or was already used.</p><p>Close this tab, return to the app that started the connection, and click Connect again.</p></body></html>`;
+}
+function interactionCookieName(transactionId) {
+    const suffix = createHash("sha256").update(transactionId).digest("base64url").slice(0, 22);
+    return `__Host-mcp_oauth_csrf_${suffix}`;
+}
+function writeWebResponse(response, webResponse) {
+    webResponse.headers.forEach((value, name) => response.setHeader(name, value));
+    response.statusCode = webResponse.status;
+    return webResponse.arrayBuffer().then((body) => {
+        response.end(Buffer.from(body));
+    });
+}
+async function readBody(request, maxBytes = 65_536) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > maxBytes)
+            throw new Error("Request body is too large.");
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
+function toWebRequest(request, issuer, body) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value !== undefined)
+            headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+    }
+    return new Request(new URL(request.url ?? "/", issuer), {
+        method: request.method,
+        headers,
+        ...(body !== undefined && body.length > 0 ? { body: body.toString("utf8") } : {})
+    });
+}
+function credentialsFor(storage, subject) {
+    return {
+        async read() {
+            const credential = await storage.credentials.get(subject);
+            if (credential === undefined)
+                throw new Error("Provider credential is missing; reconnect required.");
+            return credential;
+        },
+        update: (update) => storage.credentials.update(subject, update),
+        delete: () => storage.credentials.delete(subject)
+    };
+}
+/** @internal */
+export async function prepareHostedOAuthRuntime(config) {
+    const prepared = await config.prepare();
+    const fields = (config.provider.login?.fields ?? []).map(loginField);
+    const customInteraction = config.advanced?.interaction;
+    const displayName = config.advanced?.branding?.title ?? config.provider.name;
+    const interaction = {
+        async start({ request, transaction }) {
+            await config.storage.interactions.set(transaction);
+            if (customInteraction !== undefined) {
+                return customInteraction.start({ request, transaction });
+            }
+            const security = createAuthorizationInteractionSecurity({
+                cookieName: interactionCookieName(transaction.id)
+            });
+            const login = renderLogin(displayName, fields, transaction, security.csrfToken);
+            return new Response(login.html, {
+                status: 200,
+                headers: {
+                    "content-type": "text/html; charset=utf-8",
+                    "content-security-policy": login.contentSecurityPolicy,
+                    "cache-control": "no-store",
+                    "referrer-policy": "no-referrer",
+                    "x-content-type-options": "nosniff",
+                    "set-cookie": security.setCookie
+                }
+            });
+        }
+    };
+    await config.storage.cleanup?.();
+    const authorizationServer = createOAuthAuthorizationServer({
+        issuer: prepared.issuer.href,
+        resources: [prepared.publicUrl.href],
+        scopesSupported: prepared.scopes,
+        defaultScopes: prepared.scopes,
+        signingKey: await config.storage.signingKey(),
+        additionalPublicJwks: config.advanced?.additionalPublicJwks,
+        store: config.storage.authorizationServer,
+        interaction,
+        accessTokenTtlSeconds: config.advanced?.accessTokenTtlSeconds,
+        authorizationCodeTtlSeconds: config.advanced?.authorizationCodeTtlSeconds,
+        authorizationTransactionTtlSeconds: config.advanced?.authorizationTransactionTtlSeconds,
+        refreshTokenTtlSeconds: config.advanced?.refreshTokenTtlSeconds,
+        onGrantRevoked: config.storage.onGrantRevoked
+    });
+    const requestHandler = async (request, response) => {
+        const url = new URL(request.url ?? "/", prepared.issuer);
+        if (request.method === "GET" && url.pathname === "/healthz") {
+            try {
+                await config.storage.healthCheck?.();
+                response.writeHead(200, {
+                    "content-type": "application/json",
+                    "cache-control": "no-store"
+                });
+                response.end('{"ok":true}');
+            }
+            catch {
+                response.writeHead(503, {
+                    "content-type": "application/json",
+                    "cache-control": "no-store"
+                });
+                response.end('{"ok":false}');
+            }
+            return true;
+        }
+        if (customInteraction?.paths.includes(url.pathname) === true) {
+            const body = request.method === "GET" || request.method === "HEAD" ? undefined : await readBody(request);
+            const handled = await customInteraction.handle({
+                request: toWebRequest(request, prepared.issuer, body),
+                async complete({ transactionId, accountId, credential }) {
+                    const subject = await config.storage.resolveSubject(config.provider.name, accountId);
+                    await config.storage.credentials.set(subject, credential);
+                    const completed = await authorizationServer.completeAuthorization({
+                        transactionId,
+                        subject
+                    });
+                    await config.storage.interactions.delete(transactionId);
+                    return new Response(null, {
+                        status: 303,
+                        headers: {
+                            location: completed.redirectUrl.href,
+                            "cache-control": "no-store",
+                            "content-security-policy": "default-src 'none'",
+                            "referrer-policy": "no-referrer"
+                        }
+                    });
+                }
+            });
+            await writeWebResponse(response, handled);
+            return true;
+        }
+        if (request.method === "POST" && url.pathname === "/oauth/connect") {
+            const body = new URLSearchParams((await readBody(request)).toString("utf8"));
+            const transactionId = body.get("transaction") ?? "";
+            const transaction = await config.storage.interactions.get(transactionId);
+            const csrf = body.get("csrf") ?? "";
+            if (transaction === undefined ||
+                !verifyAuthorizationInteractionCsrf({
+                    cookieHeader: request.headers.cookie ?? null,
+                    submittedToken: csrf,
+                    cookieName: interactionCookieName(transactionId)
+                }) ||
+                transaction.expiresAt <= Date.now()) {
+                response.writeHead(400, {
+                    "content-type": "text/html; charset=utf-8",
+                    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'",
+                    "cache-control": "no-store",
+                    "referrer-policy": "no-referrer",
+                    "x-content-type-options": "nosniff"
+                });
+                response.end(renderExpiredConnection());
+                return true;
+            }
+            const controller = new AbortController();
+            request.once("aborted", () => controller.abort());
+            const values = Object.assign(Object.create(null), {
+                signal: controller.signal
+            });
+            for (const field of fields)
+                values[field.name] = body.get(field.name) ?? "";
+            try {
+                const connect = config.provider.connect;
+                if (connect === undefined)
+                    throw new Error("Provider form connection is not configured.");
+                const connected = await connect(values);
+                if (connected.accountId.trim().length === 0)
+                    throw new Error("Provider returned an empty accountId.");
+                const subject = await config.storage.resolveSubject(config.provider.name, connected.accountId);
+                await config.storage.credentials.set(subject, connected.credential);
+                const completed = await authorizationServer.completeAuthorization({
+                    transactionId,
+                    subject
+                });
+                await config.storage.interactions.delete(transactionId);
+                response.writeHead(303, {
+                    location: completed.redirectUrl.href,
+                    "cache-control": "no-store",
+                    "content-security-policy": "default-src 'none'",
+                    "referrer-policy": "no-referrer"
+                });
+                response.end();
+            }
+            catch (error) {
+                const safeError = error instanceof HostedOAuthLoginError
+                    ? error.message
+                    : "Sign-in failed. Please try again.";
+                const login = renderLogin(displayName, fields, transaction, csrf, safeError, values);
+                response.writeHead(400, {
+                    "content-type": "text/html; charset=utf-8",
+                    "content-security-policy": login.contentSecurityPolicy,
+                    "cache-control": "no-store",
+                    "referrer-policy": "no-referrer",
+                    "x-content-type-options": "nosniff"
+                });
+                response.end(login.html);
+            }
+            return true;
+        }
+        const oauthPaths = new Set([
+            "/.well-known/oauth-authorization-server",
+            "/.well-known/jwks.json",
+            "/authorize",
+            "/register",
+            "/token",
+            "/revoke"
+        ]);
+        if (!oauthPaths.has(url.pathname))
+            return false;
+        const body = request.method === "POST" ? await readBody(request) : undefined;
+        await writeWebResponse(response, await authorizationServer.handle(toWebRequest(request, prepared.issuer, body)));
+        return true;
+    };
+    return {
+        mcpPath: prepared.publicUrl.pathname,
+        oauth: {
+            resource: prepared.publicUrl.href,
+            authorizationServers: [authorizationServer.issuer],
+            requiredScopes: ["mcp"],
+            scopesSupported: [...prepared.scopes],
+            verifier: {
+                async verify(input) {
+                    const verified = await authorizationServer.verifyAccessToken(input.token, prepared.publicUrl.href);
+                    return {
+                        token: input.token,
+                        issuer: authorizationServer.issuer,
+                        audience: [verified.resource],
+                        scopes: [...verified.scopes],
+                        expiresAt: verified.expiresAt,
+                        claims: { sub: verified.subject, client_id: verified.clientId, jti: verified.tokenId },
+                        subject: verified.subject,
+                        clientId: verified.clientId
+                    };
+                }
+            }
+        },
+        requestHandler,
+        async requestServices(identity) {
+            const credentials = credentialsFor(config.storage, identity.subject);
+            await credentials.read();
+            return config.provider.services({ credentials, identity });
+        }
+    };
+}
+export function createInMemoryHostedOAuthStorage(options) {
+    if (options.development !== true) {
+        throw new Error("In-memory hosted OAuth storage requires explicit development mode.");
+    }
+    const credentials = new Map();
+    const interactions = new Map();
+    const updates = new Map();
+    const subjectSalt = randomBytes(32);
+    let signingKeyPromise;
+    return {
+        authorizationServer: createInMemoryAuthorizationServerStore(),
+        interactions: {
+            async set(transaction) {
+                interactions.set(transaction.id, structuredClone(transaction));
+            },
+            async get(transactionId) {
+                const transaction = interactions.get(transactionId);
+                return transaction === undefined ? undefined : structuredClone(transaction);
+            },
+            async delete(transactionId) {
+                interactions.delete(transactionId);
+            }
+        },
+        capabilities: {
+            durable: false,
+            encryptedCredentials: false,
+            stableKeys: false,
+            shared: false
+        },
+        credentials: {
+            async get(subject) {
+                return credentials.get(subject);
+            },
+            async set(subject, credential) {
+                credentials.set(subject, credential);
+            },
+            async delete(subject) {
+                credentials.delete(subject);
+            },
+            async update(subject, update) {
+                const previous = updates.get(subject) ?? Promise.resolve();
+                const next = previous.then(async () => {
+                    const current = credentials.get(subject);
+                    if (current === undefined)
+                        throw new Error("Provider credential is missing; reconnect required.");
+                    const replacement = await update(current);
+                    credentials.set(subject, replacement);
+                    return replacement;
+                });
+                updates.set(subject, next);
+                try {
+                    return await next;
+                }
+                finally {
+                    if (updates.get(subject) === next)
+                        updates.delete(subject);
+                }
+            }
+        },
+        async signingKey() {
+            signingKeyPromise ??= (async () => {
+                const { privateKey, publicKey } = generateKeyPairSync("ec", {
+                    namedCurve: "prime256v1"
+                });
+                return {
+                    algorithm: "ES256",
+                    keyId: randomBytes(16).toString("base64url"),
+                    privateKey,
+                    publicJwk: await exportJWK(publicKey)
+                };
+            })();
+            return await signingKeyPromise;
+        },
+        async resolveSubject(providerName, accountId) {
+            return createHmac("sha256", subjectSalt)
+                .update(providerName)
+                .update("\0")
+                .update(accountId)
+                .digest("base64url");
+        }
+    };
+}

package/node_modules/toolcraft/dist/http.compile-check.js

@@ -0,0 +1,31 @@
+import { S } from "toolcraft-schema";
+import { defineCommand, defineGroup } from "./index.js";
+import { createHTTPMCPServer, runHTTPMCP } from "./http.js";
+const ignoredRoot = defineGroup({
+    name: "root",
+    children: [
+        defineCommand({
+            name: "whoami",
+            params: S.Object({}),
+            handler: async ({ requester }) => requester
+        })
+    ]
+});
+const ignoredOptions = {
+    name: "toolcraft-http-test",
+    version: "1.0.0",
+    hostname: "127.0.0.1",
+    port: 0,
+    path: "/mcp",
+    enableJsonResponse: true,
+    allowedHosts: ["127.0.0.1"],
+    allowedOrigins: ["https://example.com"],
+    maxRequestBytes: 1_000_000,
+    maxConcurrentToolCalls: 4,
+    requestTimeoutMs: 30_000,
+    requestServices(context) {
+        return { requester: context.auth?.subject ?? "anonymous" };
+    }
+};
+const ignoredServer = createHTTPMCPServer(ignoredRoot, ignoredOptions);
+const ignoredHandle = runHTTPMCP(ignoredRoot, ignoredOptions);

package/node_modules/toolcraft/dist/http.d.ts

@@ -0,0 +1,31 @@
+import "./node-require-shim.js";
+import { type HttpListenOptions, type HttpServer, type HttpServerHandle, type HttpToolContext, type HttpTransportOptions, type TinyHttpMcpServerOAuthOptions } from "tiny-http-mcp-server/server";
+import type { Group } from "./index.js";
+import type { OAuthAuthorizationServer } from "mcp-oauth-server";
+import { type RunMCPOptions } from "./mcp.js";
+import { type HostedOAuthConfiguration } from "./http-hosted-oauth.js";
+export type ToolcraftHTTPContext = HttpToolContext;
+export type ToolcraftHTTPServer = HttpServer;
+export type ToolcraftHTTPServerHandle = HttpServerHandle;
+type HTTPTransportControls = Omit<HttpTransportOptions, "name" | "version" | "validateToolArguments" | "oauth" | "requestHandler">;
+type HTTPListenControls = Omit<HttpListenOptions, "port" | "hostname" | "path">;
+export interface RunHTTPMCPOptions<TServices extends object = Record<string, unknown>> extends RunMCPOptions<TServices>, HTTPTransportControls, HTTPListenControls {
+    hostname?: string;
+    port?: number;
+    path?: string;
+    requestServices?(context: ToolcraftHTTPContext): Partial<TServices> | Promise<Partial<TServices>>;
+    oauth?: TinyHttpMcpServerOAuthOptions | HostedOAuthConfiguration<unknown, TServices>;
+}
+export interface HTTPMCPAuthorizationOptions {
+    authorizationServer: Pick<OAuthAuthorizationServer, "issuer" | "verifyAccessToken">;
+    resource: string;
+    requiredScopes?: readonly string[];
+    scopesSupported?: readonly string[];
+}
+export declare function createHTTPMCPAuthorization(options: HTTPMCPAuthorizationOptions): import("tiny-http-mcp-server/server").TinyHttpMcpServerOAuthOptions;
+export declare function createHTTPMCPServer<TServices extends object = Record<string, unknown>>(roots: Group<TServices> | Group<TServices>[], options: RunHTTPMCPOptions<TServices>): Promise<ToolcraftHTTPServer>;
+export declare function runHTTPMCP<TServices extends object = Record<string, unknown>>(roots: Group<TServices> | Group<TServices>[], options: RunHTTPMCPOptions<TServices>): Promise<ToolcraftHTTPServerHandle>;
+export type { HttpListenOptions, HttpObservabilityEvent, HttpObservabilityOptions, RequestAuthInfo, Session, SessionStore, StreamableHttpTransportOptions, TinyHttpMcpServerOAuthOptions, TokenVerifier, VerifiedAccessToken } from "tiny-http-mcp-server/server";
+export { createJwksTokenVerifier, TokenVerificationError } from "tiny-http-mcp-server/server";
+export { createAuthorizationInteractionSecurity, createInMemoryAuthorizationServerStore, createOAuthAuthorizationServer, verifyAuthorizationInteractionCsrf } from "mcp-oauth-server";
+export type { AuthorizationInteraction, AuthorizationInteractionSecurity, AuthorizationServerStore, OAuthAuthorizationServer, OAuthAuthorizationServerOptions, VerifiedAuthorizationServerToken } from "mcp-oauth-server";