@minicor/mcp-server 3.9.1 → 4.1.0

package/dist/http-oauth.d.ts

@@ -0,0 +1,60 @@
+/**
+ * OAuth 2.1 authorization bridge for the hosted HTTP server.
+ *
+ * Implements the MCP authorization spec (metadata discovery, dynamic
+ * client registration, authorization code + PKCE, refresh tokens) on top
+ * of the Minicor /auth/signin API. The /authorize endpoint serves a login
+ * form; submitting valid Minicor credentials mints an auth code that the
+ * client exchanges for sealed tokens wrapping the upstream credentials.
+ *
+ * Everything is stateless: client IDs, auth codes, and tokens are all
+ * TokenSealer blobs, so this works across multiple Cloud Run instances.
+ */
+import { type Region } from "./paths.js";
+import type { TokenSealer } from "./http-seal.js";
+export interface UpstreamCredentials {
+    region: Region;
+    apiBase: string;
+    access_token: string;
+    refresh_token: string | null;
+    expires_at: number;
+}
+export interface ClientPayload {
+    redirect_uris: string[];
+}
+export interface CodePayload {
+    creds: UpstreamCredentials;
+    client_id: string;
+    redirect_uri: string;
+    code_challenge: string;
+}
+export interface AccessPayload {
+    creds: UpstreamCredentials;
+}
+export interface RefreshPayload {
+    creds: UpstreamCredentials;
+    client_id: string;
+}
+export interface OauthConfig {
+    sealer: TokenSealer;
+    /** Empty list = any email accepted by the upstream API may sign in. */
+    allowedEmailDomains: string[];
+}
+export interface HandlerResult {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}
+export declare function authorizationServerMetadata(issuer: string): HandlerResult;
+export declare function protectedResourceMetadata(issuer: string): HandlerResult;
+export declare function handleRegister(config: OauthConfig, body: unknown): HandlerResult;
+export interface AuthorizeParams {
+    client_id: string;
+    redirect_uri: string;
+    state: string;
+    code_challenge: string;
+}
+export declare function handleAuthorizeGet(config: OauthConfig, query: URLSearchParams): HandlerResult;
+export declare function handleAuthorizePost(config: OauthConfig, form: URLSearchParams): Promise<HandlerResult>;
+export declare function handleToken(config: OauthConfig, form: URLSearchParams): Promise<HandlerResult>;
+//# sourceMappingURL=http-oauth.d.ts.map

package/dist/http-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-oauth.d.ts","sourceRoot":"","sources":["../src/http-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAyB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAYlD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,uEAAuE;IACvE,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAoBD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAYzE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAOvE;AAgBD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,OAAO,GACZ,aAAa,CA0Bf;AAID,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AA4ID,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,eAAe,GACrB,aAAa,CAQf;AA6DD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,aAAa,CAAC,CA0DxB;AAkCD,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,aAAa,CAAC,CAgExB"}

package/dist/http-oauth.js

@@ -0,0 +1,380 @@
+/**
+ * OAuth 2.1 authorization bridge for the hosted HTTP server.
+ *
+ * Implements the MCP authorization spec (metadata discovery, dynamic
+ * client registration, authorization code + PKCE, refresh tokens) on top
+ * of the Minicor /auth/signin API. The /authorize endpoint serves a login
+ * form; submitting valid Minicor credentials mints an auth code that the
+ * client exchanges for sealed tokens wrapping the upstream credentials.
+ *
+ * Everything is stateless: client IDs, auth codes, and tokens are all
+ * TokenSealer blobs, so this works across multiple Cloud Run instances.
+ */
+import crypto from "node:crypto";
+import { resolveDefaultApiBase } from "./paths.js";
+// ─── TTLs ────────────────────────────────────────────────────
+const CLIENT_TTL_MS = 365 * 24 * 60 * 60 * 1000;
+const CODE_TTL_MS = 10 * 60 * 1000;
+const ACCESS_TTL_MAX_MS = 60 * 60 * 1000;
+const ACCESS_TTL_MIN_MS = 60 * 1000;
+const REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function json(status, body) {
+    return {
+        status,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    };
+}
+function oauthError(status, error, description) {
+    return json(status, { error, error_description: description });
+}
+// ─── Discovery metadata ──────────────────────────────────────
+export function authorizationServerMetadata(issuer) {
+    return json(200, {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/token`,
+        registration_endpoint: `${issuer}/register`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: ["minicor"],
+    });
+}
+export function protectedResourceMetadata(issuer) {
+    return json(200, {
+        resource: `${issuer}/mcp`,
+        authorization_servers: [issuer],
+        bearer_methods_supported: ["header"],
+        scopes_supported: ["minicor"],
+    });
+}
+// ─── Dynamic client registration ─────────────────────────────
+function isAllowedRedirectUri(uri) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol === "https:")
+        return true;
+    if (parsed.protocol !== "http:")
+        return false;
+    return ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname);
+}
+export function handleRegister(config, body) {
+    const redirectUris = body?.redirect_uris;
+    if (!Array.isArray(redirectUris) ||
+        redirectUris.length === 0 ||
+        !redirectUris.every((u) => typeof u === "string" && isAllowedRedirectUri(u))) {
+        return oauthError(400, "invalid_redirect_uri", "redirect_uris must be a non-empty array of https URLs (or http on localhost).");
+    }
+    const payload = { redirect_uris: redirectUris };
+    const clientId = config.sealer.seal("client", payload, CLIENT_TTL_MS);
+    return json(201, {
+        client_id: clientId,
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+        redirect_uris: redirectUris,
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+    });
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+/**
+ * Hostname the auth code will be sent to, shown on the login form so users
+ * can spot a phishing attempt: dynamic client registration is open, so the
+ * redirect target — not the form's own URL — is what identifies the app.
+ */
+function redirectHost(redirectUri) {
+    try {
+        return new URL(redirectUri).hostname;
+    }
+    catch {
+        return "";
+    }
+}
+function loginPage(params, error) {
+    const hidden = (name, value) => `<input type="hidden" name="${name}" value="${escapeHtml(value)}" />`;
+    const host = redirectHost(params.redirect_uri);
+    const desc = host
+        ? `The application at <strong>${escapeHtml(host)}</strong> is requesting access to your Minicor account. After signing in you will be redirected there.`
+        : "An application is requesting access to your Minicor account.";
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Minicor — Sign in</title>
+<style>
+  *,:before,:after{box-sizing:border-box;margin:0;padding:0}
+  body{font-family:'Inter',system-ui,sans-serif;background:#f8f9fc;color:#111;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px}
+  .card{background:#fff;border:1px solid #e2e5f1;border-radius:10px;padding:24px;width:100%;max-width:400px}
+  .logo{display:flex;align-items:center;gap:10px;margin-bottom:16px}
+  .logo .wordmark{font-size:18px;font-weight:700}
+  h2{font-size:16px;font-weight:600;margin-bottom:4px}
+  p.desc{font-size:13px;color:#4b5563;margin-bottom:20px}
+  .field{margin-bottom:14px}
+  .field label{display:block;font-size:12px;font-weight:500;color:#4b5563;margin-bottom:5px}
+  .field input[type=email],.field input[type=password]{width:100%;height:36px;padding:0 10px;background:#f3f4f8;border:1px solid #e2e5f1;border-radius:7px;font-size:13px;outline:none}
+  .field input:focus{border-color:#646ecb}
+  .seg{display:flex;background:#f3f4f8;border-radius:7px;padding:3px;gap:2px}
+  .seg label{flex:1;text-align:center;font-size:12px;font-weight:500;border-radius:5px;cursor:pointer;color:#4b5563;user-select:none}
+  .seg input{display:none}
+  .seg input:checked+span{background:#fff;color:#111;box-shadow:0 1px 3px rgba(0,0,0,.08)}
+  .seg label span{display:block;padding:6px 0;border-radius:5px}
+  button{width:100%;height:36px;margin-top:6px;background:#646ecb;color:#fff;border:none;border-radius:7px;font-size:13px;font-weight:600;cursor:pointer}
+  button:hover{background:#5560c0}
+  .error{padding:10px 12px;border-radius:7px;font-size:12px;background:hsl(355 78% 60%/.07);border:1px solid hsl(355 78% 60%/.18);color:hsl(355 78% 60%);margin-bottom:14px}
+</style>
+</head>
+<body>
+<div class="card">
+  <div class="logo">
+    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 118 98" width="30" height="25"><rect width="118" height="98" rx="10" ry="10" fill="#646ecb"/><g transform="translate(5.2,-4.6) scale(1.39)" fill="#fff"><path d="M27.4 59L10.6 38.5 27.4 17.7l4.6 3.7L18.2 38.4l13.8 16.9z"/><path d="M49.6 59l-4.6-3.7L58.9 38.3 45.1 21.4l4.6-3.7L66.5 38.3z"/></g></svg>
+    <span class="wordmark">Minicor</span>
+  </div>
+  <h2>Sign in to continue</h2>
+  <p class="desc">${desc}</p>
+  ${error ? `<div class="error">${escapeHtml(error)}</div>` : ""}
+  <form method="POST" action="/authorize">
+    ${hidden("client_id", params.client_id)}
+    ${hidden("redirect_uri", params.redirect_uri)}
+    ${hidden("state", params.state)}
+    ${hidden("code_challenge", params.code_challenge)}
+    <div class="field">
+      <label for="email">Email</label>
+      <input id="email" name="email" type="email" placeholder="you@company.com" autocomplete="email" required autofocus />
+    </div>
+    <div class="field">
+      <label for="password">Password</label>
+      <input id="password" name="password" type="password" placeholder="••••••••" autocomplete="current-password" required />
+    </div>
+    <div class="field">
+      <label>Region</label>
+      <div class="seg">
+        <label><input type="radio" name="region" value="us" checked /><span>US</span></label>
+        <label><input type="radio" name="region" value="ca" /><span>Canada</span></label>
+      </div>
+    </div>
+    <button type="submit">Sign in</button>
+  </form>
+</div>
+</body>
+</html>`;
+}
+function validateAuthorizeParams(config, params) {
+    const clientId = params.get("client_id") ?? "";
+    const redirectUri = params.get("redirect_uri") ?? "";
+    const client = config.sealer.unseal("client", clientId);
+    if (!client) {
+        return {
+            err: oauthError(400, "invalid_client", "Unknown or expired client_id."),
+        };
+    }
+    if (!client.redirect_uris.includes(redirectUri)) {
+        return {
+            err: oauthError(400, "invalid_request", "redirect_uri does not match the registered redirect URIs."),
+        };
+    }
+    const responseType = params.get("response_type");
+    const codeChallenge = params.get("code_challenge") ?? "";
+    const challengeMethod = params.get("code_challenge_method") ?? "S256";
+    if (responseType !== "code") {
+        return {
+            err: oauthError(400, "unsupported_response_type", "Only response_type=code is supported."),
+        };
+    }
+    if (!codeChallenge || challengeMethod !== "S256") {
+        return {
+            err: oauthError(400, "invalid_request", "PKCE with code_challenge_method=S256 is required."),
+        };
+    }
+    return {
+        ok: {
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            state: params.get("state") ?? "",
+            code_challenge: codeChallenge,
+        },
+    };
+}
+export function handleAuthorizeGet(config, query) {
+    const validated = validateAuthorizeParams(config, query);
+    if ("err" in validated)
+        return validated.err;
+    return {
+        status: 200,
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+        body: loginPage(validated.ok),
+    };
+}
+async function upstreamSignIn(apiBase, email, password) {
+    const res = await fetch(`${apiBase}/auth/signin`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ username: email, password }),
+    });
+    if (!res.ok)
+        throw new Error("Invalid email or password.");
+    return (await res.json());
+}
+async function upstreamRefresh(apiBase, refreshToken) {
+    try {
+        const res = await fetch(`${apiBase}/auth/refresh`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ refreshToken }),
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+function toCredentials(result, region, apiBase) {
+    return {
+        region,
+        apiBase,
+        access_token: result.access_token,
+        refresh_token: result.refresh_token || null,
+        expires_at: Date.now() + result.expires_in * 1000,
+    };
+}
+function emailDomainAllowed(config, email) {
+    if (config.allowedEmailDomains.length === 0)
+        return true;
+    const domain = email.split("@")[1]?.toLowerCase() ?? "";
+    return config.allowedEmailDomains.includes(domain);
+}
+export async function handleAuthorizePost(config, form) {
+    const validated = validateAuthorizeParams(config, new URLSearchParams({
+        client_id: form.get("client_id") ?? "",
+        redirect_uri: form.get("redirect_uri") ?? "",
+        state: form.get("state") ?? "",
+        code_challenge: form.get("code_challenge") ?? "",
+        response_type: "code",
+    }));
+    if ("err" in validated)
+        return validated.err;
+    const params = validated.ok;
+    const retry = (message) => ({
+        status: 200,
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+        body: loginPage(params, message),
+    });
+    const email = (form.get("email") ?? "").trim();
+    const password = form.get("password") ?? "";
+    const region = form.get("region") === "ca" ? "ca" : "us";
+    if (!email || !password) {
+        return retry("Email and password are required.");
+    }
+    if (!emailDomainAllowed(config, email)) {
+        return retry("This email domain is not allowed on this server.");
+    }
+    const apiBase = resolveDefaultApiBase(region);
+    let creds;
+    try {
+        creds = toCredentials(await upstreamSignIn(apiBase, email, password), region, apiBase);
+    }
+    catch {
+        return retry("Sign-in failed. Check your email, password, and region.");
+    }
+    const codePayload = {
+        creds,
+        client_id: params.client_id,
+        redirect_uri: params.redirect_uri,
+        code_challenge: params.code_challenge,
+    };
+    const code = config.sealer.seal("code", codePayload, CODE_TTL_MS);
+    const redirect = new URL(params.redirect_uri);
+    redirect.searchParams.set("code", code);
+    if (params.state)
+        redirect.searchParams.set("state", params.state);
+    return {
+        status: 302,
+        headers: { Location: redirect.toString() },
+        body: "",
+    };
+}
+// ─── Token endpoint ──────────────────────────────────────────
+function verifyPkce(verifier, challenge) {
+    const computed = crypto
+        .createHash("sha256")
+        .update(verifier, "utf8")
+        .digest("base64url");
+    const a = Buffer.from(computed);
+    const b = Buffer.from(challenge);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+function issueTokens(config, creds, clientId) {
+    const accessTtlMs = Math.min(ACCESS_TTL_MAX_MS, Math.max(ACCESS_TTL_MIN_MS, creds.expires_at - Date.now()));
+    const accessPayload = { creds };
+    const refreshPayload = { creds, client_id: clientId };
+    return json(200, {
+        access_token: config.sealer.seal("access", accessPayload, accessTtlMs),
+        token_type: "bearer",
+        expires_in: Math.floor(accessTtlMs / 1000),
+        refresh_token: config.sealer.seal("refresh", refreshPayload, REFRESH_TTL_MS),
+        scope: "minicor",
+    });
+}
+export async function handleToken(config, form) {
+    const grantType = form.get("grant_type");
+    if (grantType === "authorization_code") {
+        const code = config.sealer.unseal("code", form.get("code") ?? "");
+        if (!code) {
+            return oauthError(400, "invalid_grant", "Invalid or expired authorization code.");
+        }
+        const clientId = form.get("client_id") ?? "";
+        if (clientId !== code.client_id) {
+            return oauthError(400, "invalid_grant", "client_id does not match the authorization code.");
+        }
+        const redirectUri = form.get("redirect_uri");
+        if (redirectUri && redirectUri !== code.redirect_uri) {
+            return oauthError(400, "invalid_grant", "redirect_uri does not match the authorization request.");
+        }
+        const verifier = form.get("code_verifier") ?? "";
+        if (!verifier || !verifyPkce(verifier, code.code_challenge)) {
+            return oauthError(400, "invalid_grant", "PKCE verification failed.");
+        }
+        return issueTokens(config, code.creds, code.client_id);
+    }
+    if (grantType === "refresh_token") {
+        const payload = config.sealer.unseal("refresh", form.get("refresh_token") ?? "");
+        if (!payload) {
+            return oauthError(400, "invalid_grant", "Invalid or expired refresh token.");
+        }
+        const clientId = form.get("client_id");
+        if (clientId && clientId !== payload.client_id) {
+            return oauthError(400, "invalid_grant", "client_id does not match the refresh token.");
+        }
+        const { creds } = payload;
+        if (creds.refresh_token) {
+            const refreshed = await upstreamRefresh(creds.apiBase, creds.refresh_token);
+            if (refreshed) {
+                return issueTokens(config, toCredentials({
+                    ...refreshed,
+                    refresh_token: refreshed.refresh_token || creds.refresh_token,
+                }, creds.region, creds.apiBase), payload.client_id);
+            }
+        }
+        if (Date.now() < creds.expires_at) {
+            return issueTokens(config, creds, payload.client_id);
+        }
+        return oauthError(400, "invalid_grant", "Upstream session expired. Sign in again.");
+    }
+    return oauthError(400, "unsupported_grant_type", "Use authorization_code or refresh_token.");
+}
+//# sourceMappingURL=http-oauth.js.map

package/dist/http-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-oauth.js","sourceRoot":"","sources":["../src/http-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAe,MAAM,YAAY,CAAC;AAGhE,gEAAgE;AAEhE,MAAM,aAAa,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4ChD,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO;QACL,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,MAAc,EACd,KAAa,EACb,WAAmB;IAEnB,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,gEAAgE;AAEhE,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE;QACf,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,SAAS,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE;QACf,QAAQ,EAAE,GAAG,MAAM,MAAM;QACzB,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,CAAC,SAAS,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAEhE,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,IAAa;IAEb,MAAM,YAAY,GAAI,IAAoC,EAAE,aAAa,CAAC;IAC1E,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC5B,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,YAAY,CAAC,KAAK,CACjB,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,oBAAoB,CAAC,CAAC,CAAC,CACxD,EACD,CAAC;QACD,OAAO,UAAU,CACf,GAAG,EACH,sBAAsB,EACtB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,GAAG,EAAE;QACf,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,YAAY;QAC3B,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC;AAWD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,WAAmB;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAuB,EAAE,KAAc;IACxD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAC7C,8BAA8B,IAAI,YAAY,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,8BAA8B,UAAU,CAAC,IAAI,CAAC,wGAAwG;QACxJ,CAAC,CAAC,8DAA8D,CAAC;IACnE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAmCW,IAAI;IACpB,KAAK,CAAC,CAAC,CAAC,sBAAsB,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;;MAE1D,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;MACrC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC;MAC3C,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;MAC7B,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;QAoB7C,CAAC;AACT,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAmB,EACnB,MAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAgB,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,gBAAgB,EAAE,+BAA+B,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,GAAG,EAAE,UAAU,CACb,GAAG,EACH,iBAAiB,EACjB,2DAA2D,CAC5D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IACtE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,2BAA2B,EAAE,uCAAuC,CAAC;SAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,mDAAmD,CAAC;SAC7F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE;YACF,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAChC,cAAc,EAAE,aAAa;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAmB,EACnB,KAAsB;IAEtB,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC;IAC7C,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;QACvD,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,KAAa,EACb,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,eAAe,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,MAA0B,EAC1B,MAAc,EACd,OAAe;IAEf,OAAO;QACL,MAAM;QACN,OAAO;QACP,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QAC3C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAmB,EAAE,KAAa;IAC5D,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAmB,EACnB,IAAqB;IAErB,MAAM,SAAS,GAAG,uBAAuB,CACvC,MAAM,EACN,IAAI,eAAe,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;QACtC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAC5C,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAC9B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAChD,aAAa,EAAE,MAAM;KACtB,CAAC,CACH,CAAC;IACF,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAE5B,MAAM,KAAK,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;QACvD,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;KACjC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CACnB,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,EAC9C,MAAM,EACN,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,WAAW,GAAgB;QAC/B,KAAK;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK;QAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE;QAC1C,IAAI,EAAE,EAAE;KACT,CAAC;AACJ,CAAC;AAED,gEAAgE;AAEhE,SAAS,UAAU,CAAC,QAAgB,EAAE,SAAiB;IACrD,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;SACxB,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAClB,MAAmB,EACnB,KAA0B,EAC1B,QAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,iBAAiB,EACjB,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAC3D,CAAC;IACF,MAAM,aAAa,GAAkB,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtE,OAAO,IAAI,CAAC,GAAG,EAAE;QACf,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC;QACtE,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1C,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,cAAc,CAAC;QAC5E,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAmB,EACnB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,wCAAwC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,kDAAkD,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7C,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,wDAAwD,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5D,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,2BAA2B,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAClC,SAAS,EACT,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAC5E,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,WAAW,CAChB,MAAM,EACN,aAAa,CACX;oBACE,GAAG,SAAS;oBACZ,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;iBAC9D,EACD,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,OAAO,CACd,EACD,OAAO,CAAC,SAAS,CAClB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YAClC,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,EAAE,wBAAwB,EAAE,0CAA0C,CAAC,CAAC;AAC/F,CAAC"}

package/dist/http-seal.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Stateless token sealing for the hosted HTTP server.
+ *
+ * OAuth artifacts (auth codes, access/refresh tokens, client IDs) are
+ * self-contained AES-256-GCM blobs so any Cloud Run instance can verify
+ * them without shared storage. The payload carries the upstream Minicor
+ * credentials; nothing is persisted server-side.
+ */
+export type SealedType = "access" | "refresh" | "code" | "client";
+export declare class TokenSealer {
+    private key;
+    constructor(secret: string);
+    seal(type: SealedType, payload: unknown, ttlMs: number): string;
+    /** Returns the payload, or null if the blob is invalid, expired, or of the wrong type. */
+    unseal<T>(type: SealedType, blob: string): T | null;
+}
+//# sourceMappingURL=http-seal.d.ts.map

package/dist/http-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-seal.d.ts","sourceRoot":"","sources":["../src/http-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAWlE,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAS;gBAER,MAAM,EAAE,MAAM;IAS1B,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAgB/D,0FAA0F;IAC1F,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI;CAuBpD"}

package/dist/http-seal.js

@@ -0,0 +1,63 @@
+/**
+ * Stateless token sealing for the hosted HTTP server.
+ *
+ * OAuth artifacts (auth codes, access/refresh tokens, client IDs) are
+ * self-contained AES-256-GCM blobs so any Cloud Run instance can verify
+ * them without shared storage. The payload carries the upstream Minicor
+ * credentials; nothing is persisted server-side.
+ */
+import crypto from "node:crypto";
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+export class TokenSealer {
+    key;
+    constructor(secret) {
+        if (!secret || secret.length < 32) {
+            throw new Error("MCP_TOKEN_SECRET must be set to a random string of at least 32 characters. Generate one with: openssl rand -base64 48");
+        }
+        this.key = crypto.createHash("sha256").update(secret, "utf8").digest();
+    }
+    seal(type, payload, ttlMs) {
+        const envelope = {
+            t: type,
+            exp: Date.now() + ttlMs,
+            p: payload,
+        };
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const cipher = crypto.createCipheriv("aes-256-gcm", this.key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(JSON.stringify(envelope), "utf8"),
+            cipher.final(),
+        ]);
+        const tag = cipher.getAuthTag();
+        return Buffer.concat([iv, tag, ciphertext]).toString("base64url");
+    }
+    /** Returns the payload, or null if the blob is invalid, expired, or of the wrong type. */
+    unseal(type, blob) {
+        try {
+            const raw = Buffer.from(blob, "base64url");
+            if (raw.length <= IV_LENGTH + TAG_LENGTH)
+                return null;
+            const iv = raw.subarray(0, IV_LENGTH);
+            const tag = raw.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+            const ciphertext = raw.subarray(IV_LENGTH + TAG_LENGTH);
+            const decipher = crypto.createDecipheriv("aes-256-gcm", this.key, iv);
+            decipher.setAuthTag(tag);
+            const plaintext = Buffer.concat([
+                decipher.update(ciphertext),
+                decipher.final(),
+            ]).toString("utf8");
+            const envelope = JSON.parse(plaintext);
+            if (envelope.t !== type)
+                return null;
+            if (typeof envelope.exp !== "number" || Date.now() > envelope.exp) {
+                return null;
+            }
+            return envelope.p;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=http-seal.js.map

package/dist/http-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-seal.js","sourceRoot":"","sources":["../src/http-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAUjC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,MAAM,OAAO,WAAW;IACd,GAAG,CAAS;IAEpB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,IAAgB,EAAE,OAAgB,EAAE,KAAa;QACpD,MAAM,QAAQ,GAAmB;YAC/B,CAAC,EAAE,IAAI;YACP,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YACvB,CAAC,EAAE,OAAO;SACX,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAC/C,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,0FAA0F;IAC1F,MAAM,CAAI,IAAgB,EAAE,IAAY;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS,GAAG,UAAU;gBAAE,OAAO,IAAI,CAAC;YACtD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC3B,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAmB,CAAC;YACzD,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACrC,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAClE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,QAAQ,CAAC,CAAM,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/http-server.d.ts

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+/**
+ * Minicor MCP — Hosted HTTP server
+ *
+ * Serves the MCP server over the Streamable HTTP transport with an
+ * OAuth 2.1 flow bridged to Minicor account sign-in, so it can be added
+ * to Claude (custom connectors) or any remote-MCP client by URL.
+ *
+ * Stateless by design for Cloud Run: every /mcp request builds a fresh
+ * server bound to the credentials sealed inside the bearer token, and no
+ * OAuth state is kept in memory, so any instance can serve any request.
+ */
+export interface HttpServerOptions {
+    port?: number;
+    host?: string;
+    /** Public base URL (issuer). Defaults to MCP_PUBLIC_URL, else derived per request from Host / X-Forwarded-Proto. */
+    publicUrl?: string;
+    /** Secret for sealing tokens. Defaults to MCP_TOKEN_SECRET. */
+    tokenSecret?: string;
+    /** Comma-separated in env (ALLOWED_EMAIL_DOMAINS); empty = rely on upstream auth only. */
+    allowedEmailDomains?: string[];
+}
+export interface RunningHttpServer {
+    port: number;
+    url: string;
+    close: () => Promise<void>;
+}
+export declare function startHttpServer(opts?: HttpServerOptions): Promise<RunningHttpServer>;
+//# sourceMappingURL=http-server.d.ts.map

package/dist/http-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;GAUG;AAoBH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oHAAoH;IACpH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AA0DD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,wBAAsB,eAAe,CACnC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAkL5B"}