@kamilio/wire 0.1.9 → 0.1.11

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -0,0 +1,179 @@
+import { copyBoundedOAuthJson } from "./bounded-json.js";
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { assertPersistenceNamespace, createNamedSecretStore, isStoredOAuthSession } from "./auth-store-session-store.js";
+import { normalizeStoredOAuthClient } from "./client-registration.js";
+/** One locked document owns a logical server's URL history, grant and clients. */
+export function createResourceBoundOAuthStores(options, namespace, identity) {
+    assertPersistenceNamespace(identity);
+    assertPersistenceNamespace(namespace);
+    const store = createNamedSecretStore(identity, options, { salt: "poe-code:mcp-oauth:resources:v1",
+        directory: ".poe-code/mcp-oauth/resources", service: "poe-code-mcp-oauth-resources", accountPrefix: "resource" }, namespace);
+    const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {},
+        async reset(resource, options = {}) {
+            options.signal?.throwIfAborted();
+            let url;
+            try {
+                url = new URL(resource);
+            }
+            catch {
+                throw new Error("OAuth reset resource must be an absolute HTTP URL");
+            }
+            if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.href.includes("#"))
+                throw new Error("OAuth reset resource must be an HTTP URL without credentials or fragment");
+            await replace({ version: 1, resource: canonicalizeResourceIndicator(url), generation: 1, session: null, clients: {} }, options);
+        },
+        async importSession(value, options = {}) {
+            options.signal?.throwIfAborted();
+            const session = copyBoundedOAuthJson(value, "Invalid OAuth import session");
+            try {
+                if (!isStoredOAuthSession(session) || session.tokens === undefined || session.refreshState !== undefined)
+                    throw new Error("Invalid session");
+                if (typeof session.discovery.resourceMetadata.resource !== "string")
+                    throw new Error("Invalid resource metadata");
+                const resource = new URL(session.resource), issuer = new URL(session.authorizationServer), advertisedResource = new URL(session.discovery.resourceMetadata.resource);
+                if ([resource, issuer, advertisedResource].some(url => !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.href.includes("#")) ||
+                    issuer.href.includes("?") || session.discovery.authorizationServerMetadata.issuer !== session.authorizationServer ||
+                    canonicalizeResourceIndicator(advertisedResource) !== canonicalizeResourceIndicator(resource))
+                    throw new Error("Invalid binding");
+                session.client = normalizeStoredOAuthClient(session.client);
+                if (session.client.registration !== undefined)
+                    session.client.registrationOwnership = "caller";
+                if (session.client.registration?.issuer !== undefined && session.client.registration.issuer !== null &&
+                    session.client.registration.issuer !== session.authorizationServer)
+                    throw new Error("Invalid registration issuer");
+                new Headers({ Authorization: `Bearer ${session.tokens.accessToken}` });
+                session.resource = canonicalizeResourceIndicator(resource);
+            }
+            catch {
+                throw new Error("Invalid OAuth import session or resource binding");
+            }
+            await replace({ version: 1, resource: session.resource, generation: 1, session,
+                clients: { [session.authorizationServer]: session.client } }, options);
+        }
+    };
+    async function replace(record, options) {
+        options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
+        options.signal?.throwIfAborted();
+        const timeoutMs = options.timeoutMs ?? Infinity;
+        if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647))
+            throw new Error("OAuth replacement timeoutMs must be a positive supported timer interval");
+        if (store.withLock === undefined)
+            throw new Error("OAuth resource identity backend must support transaction locks");
+        // Strict reconciliation reads are bypassed only for explicit replacement,
+        // while the raw stable backend lock still serializes every identity writer.
+        await store.withLock(async () => {
+            options.signal?.throwIfAborted();
+            await store.set(JSON.stringify(record));
+            result.initialGrantAllowed = false;
+        }, { signal: options.signal, timeoutMs });
+    }
+    async function read() {
+        const raw = await store.get();
+        if (raw === null)
+            return null;
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Stored OAuth resource identity must be valid JSON; reset explicitly to recover");
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            throw new Error("Invalid stored OAuth resource identity");
+        const record = value;
+        if (!["version", "resource", "generation", "session", "clients"].every(key => Object.hasOwn(record, key)) || record.version !== 1 || typeof record.resource !== "string" || record.resource !== canonicalizeResourceIndicator(record.resource) ||
+            !Number.isSafeInteger(record.generation) || record.generation < 0 ||
+            (record.session !== null && (!isStoredOAuthSession(record.session) || record.session.resource !== record.resource)) ||
+            typeof record.clients !== "object" || record.clients === null || Array.isArray(record.clients))
+            throw new Error("Invalid stored OAuth resource identity; reset explicitly to recover");
+        let resourceUrl;
+        try {
+            resourceUrl = new URL(record.resource);
+        }
+        catch {
+            throw new Error("Invalid stored OAuth resource identity URL");
+        }
+        if (!["http:", "https:"].includes(resourceUrl.protocol) || resourceUrl.username || resourceUrl.password || resourceUrl.href.includes("#"))
+            throw new Error("Invalid stored OAuth resource identity URL");
+        for (const [issuer, client] of Object.entries(record.clients)) {
+            const normalized = normalizeStoredOAuthClient(client);
+            let url;
+            try {
+                url = new URL(issuer);
+            }
+            catch {
+                throw new Error("Invalid stored OAuth resource client issuer");
+            }
+            if (normalized === null || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.href.includes("?") || url.href.includes("#"))
+                throw new Error("Invalid stored OAuth resource client");
+            Object.defineProperty(record.clients, issuer, { value: normalized, enumerable: true, configurable: true, writable: true });
+        }
+        return record;
+    }
+    async function reconcile(resource) {
+        resource = canonicalizeResourceIndicator(resource);
+        const existing = await read();
+        if (existing?.resource === resource) {
+            result.initialGrantAllowed = existing.generation === 0;
+            return existing;
+        }
+        const record = { version: 1, resource, generation: existing === null ? 0 : existing.generation + 1, session: null, clients: {} };
+        if (!Number.isSafeInteger(record.generation))
+            throw new Error("OAuth resource identity generation limit exceeded");
+        await store.set(JSON.stringify(record));
+        result.initialGrantAllowed = record.generation === 0;
+        return record;
+    }
+    result.sessionStore = {
+        async withLock(resource, operation, options) {
+            options = { ...options, signal: options?.signal, timeoutMs: options?.timeoutMs };
+            if (store.withLock === undefined)
+                throw new Error("OAuth resource identity backend must support transaction locks");
+            return store.withLock(async () => {
+                options.signal?.throwIfAborted();
+                await reconcile(resource);
+                options.signal?.throwIfAborted();
+                return operation();
+            }, options);
+        },
+        async load(resource) {
+            // Unauthorized provenance may peek before acquiring the transaction lock.
+            // Only the lock owner may adopt a URL or retire the previous credentials.
+            const record = await read();
+            return record?.resource === canonicalizeResourceIndicator(resource) ? record.session : null;
+        },
+        async save(resource, session) {
+            const record = await reconcile(resource);
+            if (canonicalizeResourceIndicator(session.resource) !== record.resource)
+                throw new Error("OAuth session does not match its resource identity");
+            record.session = session;
+            await store.set(JSON.stringify(record));
+        },
+        async clear(resource) {
+            const record = await reconcile(resource);
+            record.session = null;
+            // Preserve a tombstone so environment grants cannot revive a cleared family.
+            record.generation = Math.max(1, record.generation);
+            result.initialGrantAllowed = false;
+            await store.set(JSON.stringify(record));
+        }
+    };
+    result.clientStore = {
+        async load(issuer) { const record = await read(); return record !== null && Object.hasOwn(record.clients, issuer) ? record.clients[issuer] : null; },
+        async save(issuer, client) {
+            const record = await read();
+            if (record === null)
+                throw new Error("OAuth resource identity must be bound before registering a client");
+            Object.defineProperty(record.clients, issuer, { value: client, enumerable: true, configurable: true, writable: true });
+            await store.set(JSON.stringify(record));
+        },
+        async clear(issuer) {
+            const record = await read();
+            if (record === null || !Object.hasOwn(record.clients, issuer))
+                return;
+            delete record.clients[issuer];
+            await store.set(JSON.stringify(record));
+        }
+    };
+    return result;
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resumable.d.ts

@@ -0,0 +1,66 @@
+import type { OAuthDiscoveryResult, OAuthMetadataFetch, StoredOAuthClient, StoredOAuthSession } from "./types.js";
+/** Sensitive, JSON-serializable record. Store only in private, authenticated host storage. */
+export interface RemoteMcpAuthorizationTransaction {
+    readonly state: string;
+    readonly expiresAt: number;
+    readonly redirectUri: string;
+    readonly codeVerifier: string;
+    readonly requireIssuer: boolean;
+    readonly session: StoredOAuthSession;
+}
+/** Bind each store instance to the authenticated user and logical server. */
+export interface RemoteMcpAuthorizationStore {
+    /** Atomically insert a unique state and capture the current credential generation. Never overwrite a state. */
+    create(transaction: RemoteMcpAuthorizationTransaction): Promise<void>;
+    /** Atomically remove/mark consumed, returning at most once across all workers. Preserve the commit fence. */
+    consume(state: string): Promise<RemoteMcpAuthorizationTransaction | null>;
+    /** Atomically persist only if the consumed transaction's generation is still current.
+     * Reset, deletion, reconfiguration and a superseding grant must invalidate the fence.
+     * Return false if stale. Never implement as an unconditional credential save.
+     */
+    commit(transaction: RemoteMcpAuthorizationTransaction, session: StoredOAuthSession): Promise<boolean>;
+}
+export interface PrepareRemoteMcpAuthorizationOptions {
+    readonly resource: string;
+    readonly redirectUri: string;
+    /** Consent preparation needs only public client identity; a durable host may load the secret at exchange. */
+    readonly client: StoredOAuthClient;
+    readonly scope?: string;
+    /** Optional routing hint; entropy always comes from a fresh 256-bit nonce. */
+    readonly statePrefix?: string;
+    /** Host-validated discovery, including issuer trust and network policy. No implicit network access. */
+    readonly discover: (resource: string, signal?: AbortSignal) => Promise<OAuthDiscoveryResult>;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+    /** Transaction lifetime, at most ten minutes. */
+    readonly ttlMs?: number;
+}
+export interface BeginRemoteMcpAuthorizationOptions extends PrepareRemoteMcpAuthorizationOptions {
+    readonly store: RemoteMcpAuthorizationStore;
+}
+export interface CompleteRemoteMcpAuthorizationOptions {
+    readonly callbackUrl: string;
+    readonly store: RemoteMcpAuthorizationStore;
+    /** Required host network policy. Redirects are rejected, including at the token endpoint. */
+    readonly fetch: OAuthMetadataFetch;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+}
+/** Prepare consent for a host that owns a durable issuance journal.
+ * The transaction contains secrets: persist privately before exposing the URL.
+ * The host must consume state once, validate callback issuer/redirect/expiry,
+ * and fence token persistence against reset or superseding grants.
+ */
+export declare function prepareRemoteMcpAuthorization(options: PrepareRemoteMcpAuthorizationOptions): Promise<{
+    authorizationUrl: string;
+    transaction: RemoteMcpAuthorizationTransaction;
+}>;
+/** Start consent without a listener or a pending callback promise. Only the URL leaves private storage. */
+export declare function beginRemoteMcpAuthorization(options: BeginRemoteMcpAuthorizationOptions): Promise<{
+    authorizationUrl: string;
+    expiresAt: number;
+}>;
+/** Redeem once after any process restart, then conditionally persist. Returns no tokens or callback secrets. */
+export declare function completeRemoteMcpAuthorization(options: CompleteRemoteMcpAuthorizationOptions): Promise<{
+    resource: string;
+}>;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/resumable.js

@@ -0,0 +1,153 @@
+import { exchangeAuthorizationCode } from "./token-endpoint.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+import { normalizeOAuthScope } from "./scope.js";
+const responseParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
+function httpsUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#"))
+        throw new Error();
+    return url;
+}
+function base64url(bytes) {
+    return btoa(String.fromCharCode(...bytes)).split("+").join("-").split("/").join("_").split("=").join("");
+}
+function timestamp(now) {
+    const value = now();
+    if (!Number.isSafeInteger(value) || value < 0 || value > 8_640_000_000_000_000 - 600_000)
+        throw new Error();
+    return value;
+}
+/** Prepare consent for a host that owns a durable issuance journal.
+ * The transaction contains secrets: persist privately before exposing the URL.
+ * The host must consume state once, validate callback issuer/redirect/expiry,
+ * and fence token persistence against reset or superseding grants.
+ */
+export async function prepareRemoteMcpAuthorization(options) {
+    try {
+        const { signal, discover } = options;
+        const now = options.now?.bind(options) ?? Date.now;
+        const resource = httpsUrl(options.resource).href;
+        const redirect = httpsUrl(options.redirectUri);
+        if (responseParameters.some(key => redirect.searchParams.has(key)))
+            throw new Error();
+        const client = structuredClone(options.client);
+        if (typeof client.clientId !== "string" || !client.clientId.trim())
+            throw new Error();
+        const method = normalizeOAuthTokenEndpointAuthMethod(client.tokenEndpointAuthMethod) ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
+        if (client.clientSecret !== undefined && (typeof client.clientSecret !== "string" || !client.clientSecret.trim()))
+            throw new Error();
+        if (client.registration !== undefined && (client.registration.client_id !== client.clientId ||
+            (client.registration.client_secret != null && client.registration.client_secret !== client.clientSecret) ||
+            (client.registration.token_endpoint_auth_method != null && client.registration.token_endpoint_auth_method !== method)))
+            throw new Error();
+        client.tokenEndpointAuthMethod = method;
+        if (client.requestedRedirectUri !== undefined && client.requestedRedirectUri !== redirect.href)
+            throw new Error();
+        if (client.registration?.redirect_uris != null && !client.registration.redirect_uris.includes(redirect.href))
+            throw new Error();
+        const statePrefix = options.statePrefix ?? "";
+        if (typeof statePrefix !== "string" || statePrefix.length > 32 || [...statePrefix].some(c => !(c >= "a" && c <= "z") && !(c >= "A" && c <= "Z") && !(c >= "0" && c <= "9") && c !== "_" && c !== "-"))
+            throw new Error();
+        const scope = normalizeOAuthScope(options.scope);
+        const ttl = options.ttlMs ?? 600_000;
+        if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > 600_000)
+            throw new Error();
+        signal?.throwIfAborted();
+        const metadata = structuredClone(await discover(resource, signal));
+        signal?.throwIfAborted();
+        const server = metadata.authorizationServerMetadata;
+        if (httpsUrl(metadata.resource).href !== resource || httpsUrl(metadata.resourceMetadata.resource).href !== resource ||
+            server.issuer !== metadata.authorizationServer || !metadata.resourceMetadata.authorization_servers.includes(server.issuer) ||
+            !server.response_types_supported.includes("code") || !server.code_challenge_methods_supported.includes("S256"))
+            throw new Error();
+        httpsUrl(server.issuer);
+        httpsUrl(server.token_endpoint);
+        const authorization = httpsUrl(server.authorization_endpoint);
+        const state = statePrefix + base64url(crypto.getRandomValues(new Uint8Array(32)));
+        const codeVerifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
+        const challenge = base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier))));
+        const expiresAt = timestamp(now) + ttl;
+        const session = { resource, authorizationServer: server.issuer,
+            client: { ...client, registrationOwnership: "caller", requestedRedirectUri: redirect.href },
+            ...(scope === undefined ? {} : { requestedScope: scope }),
+            discovery: { resourceMetadataUrl: metadata.resourceMetadataUrl, resourceMetadata: metadata.resourceMetadata, authorizationServerMetadata: server } };
+        for (const [key, value] of Object.entries({ response_type: "code", client_id: client.clientId, redirect_uri: redirect.href,
+            resource, state, code_challenge: challenge, code_challenge_method: "S256" }))
+            authorization.searchParams.set(key, value);
+        authorization.searchParams.delete("scope");
+        if (scope !== undefined)
+            authorization.searchParams.set("scope", scope);
+        signal?.throwIfAborted();
+        return { authorizationUrl: authorization.href, transaction: { state, expiresAt, redirectUri: redirect.href, codeVerifier,
+                requireIssuer: server.authorization_response_iss_parameter_supported === true, session } };
+    }
+    catch {
+        throw new Error("Unable to prepare MCP authorization");
+    }
+}
+/** Start consent without a listener or a pending callback promise. Only the URL leaves private storage. */
+export async function beginRemoteMcpAuthorization(options) {
+    try {
+        const { store, signal } = options;
+        const method = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+        if (method !== undefined && method !== "none" && options.client.clientSecret === undefined)
+            throw new Error();
+        const { authorizationUrl, transaction } = await prepareRemoteMcpAuthorization(options);
+        signal?.throwIfAborted();
+        await store.create(transaction);
+        signal?.throwIfAborted();
+        return { authorizationUrl, expiresAt: transaction.expiresAt };
+    }
+    catch {
+        throw new Error("Unable to begin MCP authorization");
+    }
+}
+/** Redeem once after any process restart, then conditionally persist. Returns no tokens or callback secrets. */
+export async function completeRemoteMcpAuthorization(options) {
+    try {
+        const { store, fetch, signal } = options;
+        const now = options.now?.bind(options) ?? Date.now;
+        const callback = httpsUrl(options.callbackUrl);
+        for (const key of responseParameters)
+            if (callback.searchParams.getAll(key).length > 1)
+                throw new Error();
+        const state = callback.searchParams.get("state");
+        if (!state || state.length > 256)
+            throw new Error();
+        signal?.throwIfAborted();
+        const stored = await store.consume(state);
+        if (stored === null)
+            throw new Error();
+        const transaction = structuredClone(stored);
+        if (transaction.state !== state || !Number.isSafeInteger(transaction.expiresAt) || transaction.expiresAt <= timestamp(now))
+            throw new Error();
+        const expected = httpsUrl(transaction.redirectUri);
+        const issuer = callback.searchParams.get("iss");
+        if ((transaction.requireIssuer && issuer === null) || (issuer !== null && issuer !== transaction.session.authorizationServer))
+            throw new Error();
+        const code = callback.searchParams.get("code");
+        if (!code || callback.searchParams.has("error"))
+            throw new Error();
+        for (const key of responseParameters)
+            callback.searchParams.delete(key);
+        // Compare query pairs without changing their encoding/order requirements on the registered redirect.
+        const actualPairs = [...callback.searchParams].sort(), expectedPairs = [...expected.searchParams].sort();
+        if (callback.origin !== expected.origin || callback.pathname !== expected.pathname || JSON.stringify(actualPairs) !== JSON.stringify(expectedPairs))
+            throw new Error();
+        const session = structuredClone(transaction.session);
+        const tokenEndpoint = httpsUrl(String(session.discovery.authorizationServerMetadata.token_endpoint)).href;
+        signal?.throwIfAborted();
+        session.tokens = await exchangeAuthorizationCode({ tokenEndpoint, clientId: session.client.clientId,
+            clientSecret: session.client.clientSecret, tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
+            code, codeVerifier: transaction.codeVerifier, redirectUri: transaction.redirectUri, resource: session.resource, fetch, signal, now });
+        if (session.tokens.scope === undefined && session.requestedScope !== undefined)
+            session.tokens.scope = session.requestedScope;
+        signal?.throwIfAborted();
+        if (transaction.expiresAt <= timestamp(now) || !await store.commit(transaction, session))
+            throw new Error();
+        return { resource: session.resource };
+    }
+    catch {
+        throw new Error("Unable to complete MCP authorization");
+    }
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/revoke-token.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthMetadataFetch, OAuthTokenEndpointAuthMethod } from "./types.js";
+/** RFC 7009 revocation; no retries or host persistence changes. */
+export declare function revokeOAuthToken(input: {
+    revocationEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+    token: string;
+    tokenTypeHint?: "access_token" | "refresh_token";
+    fetch: OAuthMetadataFetch;
+    signal?: AbortSignal;
+}): Promise<void>;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/revoke-token.js

@@ -0,0 +1,23 @@
+import { fetchMcpResponse } from "../http-fetch.js";
+import { readBoundedResponseText } from "../http-response.js";
+import { createOAuthFormRequest } from "./oauth-form.js";
+import { readOAuthJsonObjectResponse } from "./token-endpoint.js";
+/** RFC 7009 revocation; no retries or host persistence changes. */
+export async function revokeOAuthToken(input) {
+    if (typeof input.token !== "string" || input.token.trim() === "")
+        throw new Error("OAuth revocation requires a token");
+    const { body, headers } = createOAuthFormRequest({
+        ...input,
+        params: { token: input.token, ...(input.tokenTypeHint === undefined ? {} : { token_type_hint: input.tokenTypeHint }) }
+    });
+    input.signal?.throwIfAborted();
+    const deadline = AbortSignal.timeout(30_000);
+    const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
+    const response = await fetchMcpResponse(input.fetch, input.revocationEndpoint, {
+        method: "POST", headers, body: body.toString(), signal
+    });
+    if (!response.ok)
+        await readOAuthJsonObjectResponse(response, signal);
+    // RFC 7009 intentionally permits an empty body, including for an invalid token.
+    await readBoundedResponseText(response, 1024 * 1024, undefined, signal);
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/scope.d.ts

@@ -0,0 +1,2 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export declare function normalizeOAuthScope(scope: unknown): string | undefined;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/scope.js

@@ -0,0 +1,9 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export function normalizeOAuthScope(scope) {
+    if (scope === undefined)
+        return undefined;
+    if (typeof scope !== "string" || [...scope].some(char => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+        throw new Error("Invalid OAuth scope syntax");
+    const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+    return normalized || undefined;
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/session-transaction.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthSessionStore } from "./types.js";
+/** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
+export declare function withOAuthSessionTransaction<T>(store: OAuthSessionStore, resource: string, operation: () => Promise<T>, options?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<T>;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/session-transaction.js

@@ -0,0 +1,50 @@
+import { waitForOAuthOperation } from "./cancellable-operation.js";
+const queues = new WeakMap();
+/** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
+export async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
+    const timeoutMs = options.timeoutMs ?? Infinity;
+    if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647))
+        throw new Error("sessionLockTimeoutMs must be an integer from 1 to 2147483647 milliseconds");
+    options.signal?.throwIfAborted();
+    const started = performance.now();
+    const pending = queues.get(store) ?? new Map();
+    queues.set(store, pending);
+    const previous = pending.get(resource) ?? Promise.resolve();
+    let release;
+    const current = new Promise(resolve => { release = resolve; });
+    const tail = previous.then(() => current);
+    pending.set(resource, tail);
+    let running;
+    try {
+        let timer;
+        let rejectWait;
+        const waiting = new Promise((resolve, reject) => { rejectWait = reject; previous.then(resolve, reject); });
+        const abort = () => rejectWait(options.signal?.reason);
+        try {
+            if (timeoutMs !== Infinity)
+                timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
+            options.signal?.addEventListener("abort", abort, { once: true });
+            if (options.signal?.aborted)
+                abort();
+            await waiting;
+        }
+        finally {
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", abort);
+        }
+        options.signal?.throwIfAborted();
+        running = (async () => store.withLock === undefined ? operation() : store.withLock(resource, operation, {
+            signal: options.signal, timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
+        }))();
+        return await waitForOAuthOperation(running, options.signal);
+    }
+    finally {
+        // Cancellation settles the caller, but unfinished host work still owns the lease.
+        if (running === undefined)
+            release();
+        else
+            void running.then(release, release);
+        void tail.then(() => { if (pending.get(resource) === tail)
+            pending.delete(resource); });
+    }
+}

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-auth-method.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthTokenEndpointAuthMethod } from "./types.js";
+export declare function normalizeOAuthTokenEndpointAuthMethod(value: unknown): OAuthTokenEndpointAuthMethod | undefined;

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/token-auth-method.js

@@ -0,0 +1,7 @@
+export function normalizeOAuthTokenEndpointAuthMethod(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+        throw new Error("Unsupported OAuth token endpoint authentication method");
+    return value;
+}

package/node_modules/toolcraft/node_modules/{mcp-oauth → tiny-http-mcp-server/node_modules/mcp-oauth}/dist/client/token-endpoint.d.ts

@@ -1,10 +1,12 @@
-import type { OAuthMetadataFetch, StoredOAuthTokens } from "./types.js";
+import type { OAuthMetadataFetch, StoredOAuthTokens, OAuthTokenEndpointAuthMethod } from "./types.js";
 interface OAuthErrorShape {
     error: string;
     error_description?: string;
     error_uri?: string;
 }
 export declare class OAuthError extends Error {
+    /** Recognize errors from separately bundled copies of this package. */
+    static is(value: unknown): value is OAuthError;
     readonly error: string;
     readonly errorDescription: string | undefined;
     readonly errorUri: string | undefined;
@@ -13,28 +15,34 @@ export declare class OAuthError extends Error {
     readonly status: number;
     readonly retryable: boolean;
     readonly terminal: boolean;
-    constructor(shape: OAuthErrorShape, status: number);
+    /** True only when a complete OAuth error response establishes rejection. */
+    readonly outcomeKnown: boolean;
+    constructor(shape: OAuthErrorShape, status: number, outcomeKnown?: boolean);
 }
 export declare function isRetryableOAuthError(error: unknown): error is OAuthError;
 export declare function exchangeAuthorizationCode(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     code: string;
     codeVerifier: string;
     redirectUri: string;
     resource: string;
     fetch: OAuthMetadataFetch;
+    signal?: AbortSignal;
     now: () => number;
 }): Promise<StoredOAuthTokens>;
 export declare function refreshAccessToken(input: {
     tokenEndpoint: string;
     clientId: string;
     clientSecret?: string;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
     refreshToken: string;
     resource: string;
     fetch: OAuthMetadataFetch;
+    signal?: AbortSignal;
     now: () => number;
 }): Promise<StoredOAuthTokens>;
-export declare function readOAuthJsonObjectResponse(response: Response): Promise<Record<string, unknown>>;
+export declare function readOAuthJsonObjectResponse(response: Response, signal?: AbortSignal): Promise<Record<string, unknown>>;
 export {};