@n24q02m/hull 0.4.0-beta.9 → 0.5.0-beta.1

package/build/auth/stable-sub.js

@@ -1,38 +0,0 @@
-/**
- * Derive a stable, opaque subject id from a workspace username.
- *
- * TypeScript port of core-py's ``stable_sub.py``. Output is byte-identical for
- * ASCII usernames, locked by the shared ``crypto-vectors.json`` fixture.
- */
-import { createHmac } from 'node:crypto';
-// Used only when CREDENTIAL_SECRET is unset (single-user/dev): the sub stays
-// stable, just predictable. Production multi-user always sets CREDENTIAL_SECRET.
-const DEV_FALLBACK_KEY = Buffer.from('mcp-core-stable-sub-dev-salt', 'utf-8');
-/**
- * Derive a stable, opaque subject id from a workspace username.
- *
- * Same ``(serverName, normalized username)`` -> same ``sub``, so a returning
- * user lands on the same per-``sub`` credential bucket instead of the random
- * subject minted per ``/authorize``. The output shape (22 chars, urlsafe
- * base64, no padding) matches ``randomBytes(16).toString('base64url')`` so
- * downstream code cannot tell a stable sub from a random one.
- *
- * Normalization is ``trim().toLowerCase()``. Python's ``str.casefold()`` maps
- * a few non-ASCII characters differently (``'ß'.casefold() == 'ss'``), so
- * cross-language parity is guaranteed for ASCII usernames only; the divergence
- * is asserted by a test in both languages.
- *
- * SECURITY: with a SHARED relay password the username is a PARTITION key, NOT a
- * secret -- anyone who knows the password can submit any username and reach that
- * bucket. Intentional for a trusted group; untrusted multi-tenant needs per-user
- * secrets or delegated OAuth.
- */
-export function deriveStableSub(username, serverName, credentialSecret) {
-    const normalized = username.trim().toLowerCase();
-    if (!normalized)
-        throw new Error('username must be non-empty');
-    const key = credentialSecret ? Buffer.from(credentialSecret, 'utf-8') : DEV_FALLBACK_KEY;
-    const digest = createHmac('sha256', key).update(`sub:${serverName}:${normalized}`, 'utf8').digest();
-    return digest.subarray(0, 16).toString('base64url');
-}
-//# sourceMappingURL=stable-sub.js.map

package/build/auth/stable-sub.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stable-sub.js","sourceRoot":"","sources":["../../src/auth/stable-sub.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,UAAkB,EAClB,gBAA2C;IAE3C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;IACnG,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACrD,CAAC"}

package/build/auth/well-known.d.ts

@@ -1,4 +0,0 @@
-/** OAuth 2.1 well-known metadata generators (RFC 8414 + RFC 9728). */
-export declare function authorizationServerMetadata(issuerUrl: string): Record<string, unknown>;
-export declare function protectedResourceMetadata(resource: string, authorizationServers: string[]): Record<string, unknown>;
-//# sourceMappingURL=well-known.d.ts.map

package/build/auth/well-known.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBtF;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMnH"}

package/build/auth/well-known.js

@@ -1,26 +0,0 @@
-/** OAuth 2.1 well-known metadata generators (RFC 8414 + RFC 9728). */
-export function authorizationServerMetadata(issuerUrl) {
-    return {
-        issuer: issuerUrl,
-        authorization_endpoint: `${issuerUrl}/authorize`,
-        token_endpoint: `${issuerUrl}/token`,
-        registration_endpoint: `${issuerUrl}/register`,
-        jwks_uri: `${issuerUrl}/.well-known/jwks.json`,
-        response_types_supported: ['code'],
-        grant_types_supported: ['authorization_code', 'refresh_token'],
-        code_challenge_methods_supported: ['S256'],
-        token_endpoint_auth_methods_supported: ['none'],
-        scopes_supported: ['offline_access'],
-        // RFC 9207 / SEP-2468: the AS returns the ``iss`` parameter in every
-        // authorization response so clients can defend against mix-up attacks.
-        authorization_response_iss_parameter_supported: true
-    };
-}
-export function protectedResourceMetadata(resource, authorizationServers) {
-    return {
-        resource,
-        authorization_servers: authorizationServers,
-        bearer_methods_supported: ['header']
-    };
-}
-//# sourceMappingURL=well-known.js.map

package/build/auth/well-known.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,sBAAsB,EAAE,GAAG,SAAS,YAAY;QAChD,cAAc,EAAE,GAAG,SAAS,QAAQ;QACpC,qBAAqB,EAAE,GAAG,SAAS,WAAW;QAC9C,QAAQ,EAAE,GAAG,SAAS,wBAAwB;QAC9C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;QACpC,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C,EAAE,IAAI;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,oBAA8B;IACxF,OAAO;QACL,QAAQ;QACR,qBAAqB,EAAE,oBAAoB;QAC3C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAA;AACH,CAAC"}

package/build/oauth/cache.d.ts

@@ -1,22 +0,0 @@
-export interface PreAuthSession {
-    sessionId: string;
-    clientId: string;
-    redirectUri: string;
-    state: string;
-    codeChallenge: string;
-    codeChallengeMethod: string;
-    /** Serialized CryptoKeyPair for later credential retrieval */
-    keyPairJwk: JsonWebKey;
-    passphrase: string;
-    expiresAt: number;
-}
-export interface IOAuthSessionCache {
-    save(session: PreAuthSession): void;
-    getAndDelete(sessionId: string): PreAuthSession | null;
-}
-export declare class InMemoryAuthCache implements IOAuthSessionCache {
-    private cache;
-    save(session: PreAuthSession): void;
-    getAndDelete(sessionId: string): PreAuthSession | null;
-}
-//# sourceMappingURL=cache.d.ts.map

package/build/oauth/cache.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/oauth/cache.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,8DAA8D;IAC9D,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAA;IACnC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;CACvD;AAED,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,OAAO,CAAC,KAAK,CAAoC;IAEjD,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAOlC;IAED,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMrD;CACF"}

package/build/oauth/cache.js

@@ -1,24 +0,0 @@
-export class InMemoryAuthCache {
-    constructor() {
-        this.cache = new Map();
-    }
-    save(session) {
-        this.cache.set(session.sessionId, session);
-        // Cleanup expired entries
-        const now = Math.floor(Date.now() / 1000);
-        for (const [id, sess] of this.cache) {
-            if (sess.expiresAt < now)
-                this.cache.delete(id);
-        }
-    }
-    getAndDelete(sessionId) {
-        const sess = this.cache.get(sessionId);
-        if (!sess)
-            return null;
-        this.cache.delete(sessionId);
-        if (sess.expiresAt < Math.floor(Date.now() / 1000))
-            return null;
-        return sess;
-    }
-}
-//# sourceMappingURL=cache.js.map

package/build/oauth/cache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/oauth/cache.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,iBAAiB;IAA9B;QACU,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAkBnD,CAAC;IAhBC,IAAI,CAAC,OAAuB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC1C,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/D,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/build/oauth/index.d.ts

@@ -1,6 +0,0 @@
-export { InMemoryAuthCache, type IOAuthSessionCache, type PreAuthSession } from './cache.js';
-export { JWTIssuer } from './jwt-issuer.js';
-export { verifyPKCE } from './pkce.js';
-export { OAuthProvider, type OAuthProviderOptions } from './provider.js';
-export { type IUserCredentialStore, SqliteUserStore } from './user-store.js';
-//# sourceMappingURL=index.d.ts.map

package/build/oauth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/build/oauth/index.js

@@ -1,6 +0,0 @@
-export { InMemoryAuthCache } from './cache.js';
-export { JWTIssuer } from './jwt-issuer.js';
-export { verifyPKCE } from './pkce.js';
-export { OAuthProvider } from './provider.js';
-export { SqliteUserStore } from './user-store.js';
-//# sourceMappingURL=index.js.map

package/build/oauth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAGlB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,aAAa,EAEd,MAAM,eAAe,CAAA;AACtB,OAAO,EAA6B,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/build/oauth/jwt-issuer.d.ts

@@ -1,87 +0,0 @@
-/**
- * JWT Issuer and JWKS generation for TypeScript MCP servers.
- * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
- *
- * Two signing modes, selected at construction:
- *
- * - LOCAL single-user (credentialSecret unset): RSA-2048, RS256, kid="key-1",
- *   keys generated on first run and persisted to disk so they survive restarts
- *   on a real machine. Behavior is unchanged from the pre-stability-fix code.
- *
- * - HTTP multi-user (credentialSecret set): Ed25519, EdDSA, signing key DERIVED
- *   deterministically from CREDENTIAL_SECRET via HKDF-SHA256. No disk I/O. Every
- *   container replica converges on the same key without a shared volume or
- *   external secret store, so OAuth tokens survive container recreation
- *   (Watchtower :latest redeploys). kid is the base64url SHA-256 thumbprint of
- *   the raw public key.
- *
- * The two modes are different deployments that never exchange tokens
- * (iss/aud are server-scoped); the per-mode algorithm split is permanent and
- * intentional. Each process runs exactly one algorithm; the verify path uses
- * that single alg, never a {RS256, EdDSA} union.
- */
-import * as jose from 'jose';
-export declare class JWTIssuer {
-    private serverName;
-    private keysDir;
-    private privateKeyPath;
-    private publicKeyPath;
-    private credentialSecret;
-    alg: 'RS256' | 'EdDSA';
-    private kid;
-    private privateKey;
-    private publicKey;
-    private okpX;
-    private _initialized;
-    constructor(serverName: string, keysDir?: string, credentialSecret?: string | null);
-    /** Must call before using issuer — loads/generates (RSA) or derives (EdDSA) keys. */
-    init(): Promise<void>;
-    private deriveEddsaKeys;
-    private loadOrGenerateRsaKeys;
-    /**
-     * Return JWKS payload for /.well-known/jwks.json. Always a `keys` array
-     * (multi-key-aware for future rotation). RSA mode emits an RSA JWK; EdDSA
-     * mode emits an OKP JWK.
-     */
-    getJwks(): Promise<jose.JSONWebKeySet>;
-    /** Issue a JWT access token (typ="access") signed with the active alg. */
-    issueAccessToken(sub: string, expiresInSeconds?: number): Promise<string>;
-    /**
-     * Issue a JWT refresh token (typ="refresh") signed with the active alg.
-     *
-     * Defaults to a 1-year (31536000s) lifetime so long-running MCP clients can
-     * mint fresh access tokens without forcing the user back through the browser
-     * PKCE flow. The access token stays short-lived (1h); the refresh token is the
-     * renewal credential and is rotated on every use (the /token refresh handler
-     * issues a new refresh token each time), so the security control is rotation,
-     * not a short TTL. A short refresh TTL was the residual re-auth driver: a
-     * self-hosted server a user touches only intermittently (less than once a
-     * month) would silently expire its refresh token between sessions, forcing a
-     * fresh browser OAuth tab on the next use. With a 1-year floor, only a
-     * genuinely long idle gap re-prompts. Same key / iss / aud as access tokens;
-     * the typ claim is the only thing distinguishing them, and verifyAccessToken
-     * rejects typ="refresh" so a refresh token can never be used as an access
-     * token at the /mcp resource.
-     */
-    issueRefreshToken(sub: string, expiresInSeconds?: number): Promise<string>;
-    /**
-     * Verify a JWT access token and return its payload. Throws on failure (bad
-     * signature, wrong issuer/audience, expired) — the same jose errors existing
-     * callers already catch. The verify path uses the single active algorithm,
-     * never a union. Additionally rejects tokens whose typ claim is "refresh"
-     * (throwing jose.errors.JWTClaimValidationFailed) so a refresh token cannot
-     * be replayed as an access token. Tokens with typ="access" OR a missing typ
-     * claim are accepted (the latter keeps already-issued pre-refresh-support
-     * tokens valid).
-     */
-    verifyAccessToken(token: string): Promise<jose.JWTPayload>;
-    /**
-     * Verify a JWT refresh token and return its payload. Same key / audience /
-     * issuer checks as verifyAccessToken and throws the same jose errors on
-     * failure; uses the single active algorithm. Additionally asserts
-     * typ=="refresh" (throwing jose.errors.JWTClaimValidationFailed otherwise) so
-     * an access token can never be exchanged at the refresh grant.
-     */
-    verifyRefreshToken(token: string): Promise<jose.JWTPayload>;
-}
-//# sourceMappingURL=jwt-issuer.d.ts.map

package/build/oauth/jwt-issuer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAU5B,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,gBAAgB,CAAe;IACvC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;IACtB,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,YAAY,CAAQ;IAE5B,YAAY,UAAU,EAAE,MAAM,EAAE,OAAO,SAAmB,EAAE,gBAAgB,GAAE,MAAM,GAAG,IAAW,EAOjG;IAED,qFAAqF;IAC/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAc1B;YAEa,eAAe;YAYf,qBAAqB;IA6BnC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAY3C;IAED,0EAA0E;IACpE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5E;IAED;;;;;;;;;;;;;;;;OAgBG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CASjF;IAED;;;;;;;;;OASG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAW/D;IAED;;;;;;OAMG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAWhE;CACF"}

package/build/oauth/jwt-issuer.js

@@ -1,205 +0,0 @@
-/**
- * JWT Issuer and JWKS generation for TypeScript MCP servers.
- * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
- *
- * Two signing modes, selected at construction:
- *
- * - LOCAL single-user (credentialSecret unset): RSA-2048, RS256, kid="key-1",
- *   keys generated on first run and persisted to disk so they survive restarts
- *   on a real machine. Behavior is unchanged from the pre-stability-fix code.
- *
- * - HTTP multi-user (credentialSecret set): Ed25519, EdDSA, signing key DERIVED
- *   deterministically from CREDENTIAL_SECRET via HKDF-SHA256. No disk I/O. Every
- *   container replica converges on the same key without a shared volume or
- *   external secret store, so OAuth tokens survive container recreation
- *   (Watchtower :latest redeploys). kid is the base64url SHA-256 thumbprint of
- *   the raw public key.
- *
- * The two modes are different deployments that never exchange tokens
- * (iss/aud are server-scoped); the per-mode algorithm split is permanent and
- * intentional. Each process runs exactly one algorithm; the verify path uses
- * that single alg, never a {RS256, EdDSA} union.
- */
-import { createHash, createPrivateKey } from 'node:crypto';
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import * as jose from 'jose';
-import { deriveJwtSigningSeed } from '../crypto/kdf.js';
-const DEFAULT_KEYS_DIR = join(homedir(), '.hull', 'jwt-keys');
-// RFC 8410 PKCS8 DER prefix for an Ed25519 private key. Prepended to the
-// 32-byte HKDF seed to build an importable PKCS8 key (jose 6.2.3 cannot import
-// a raw seed via importJWK d-only).
-const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
-export class JWTIssuer {
-    constructor(serverName, keysDir = DEFAULT_KEYS_DIR, credentialSecret = null) {
-        this.kid = 'key-1';
-        this.privateKey = null;
-        this.publicKey = null;
-        this.okpX = null;
-        this._initialized = false;
-        this.serverName = serverName;
-        this.keysDir = keysDir;
-        this.credentialSecret = credentialSecret;
-        this.alg = credentialSecret ? 'EdDSA' : 'RS256';
-        this.privateKeyPath = join(this.keysDir, `${serverName}_private.pem`);
-        this.publicKeyPath = join(this.keysDir, `${serverName}_public.pem`);
-    }
-    /** Must call before using issuer — loads/generates (RSA) or derives (EdDSA) keys. */
-    async init() {
-        if (this._initialized)
-            return;
-        if (this.credentialSecret) {
-            await this.deriveEddsaKeys(this.credentialSecret);
-            // Don't name the source env var in the message: only serverName + the
-            // public kid thumbprint are logged (never the secret), and the literal
-            // "CREDENTIAL_SECRET" token trips the SAST logger-credential heuristic
-            // for no real benefit (parity with core-py jwt_issuer.py).
-            console.error(`JWTIssuer[${this.serverName}]: HTTP multi-user mode, EdDSA signing key derived (kid=${this.kid})`);
-        }
-        else {
-            await this.loadOrGenerateRsaKeys();
-            console.error(`JWTIssuer[${this.serverName}]: local single-user mode, RS256 key on disk (${this.keysDir})`);
-        }
-        this._initialized = true;
-    }
-    async deriveEddsaKeys(credentialSecret) {
-        const seed = deriveJwtSigningSeed(credentialSecret, this.serverName);
-        const der = Buffer.concat([ED25519_PKCS8_PREFIX, seed]);
-        const pem = `-----BEGIN PRIVATE KEY-----\n${der.toString('base64')}\n-----END PRIVATE KEY-----\n`;
-        this.privateKey = await jose.importPKCS8(pem, 'EdDSA', { extractable: false });
-        // Recover the public JWK x via node:crypto (jose has no seed->public path).
-        const jwk = createPrivateKey(pem).export({ format: 'jwk' });
-        this.okpX = jwk.x;
-        this.publicKey = (await jose.importJWK({ kty: 'OKP', crv: 'Ed25519', x: jwk.x }, 'EdDSA'));
-        this.kid = createHash('sha256').update(Buffer.from(jwk.x, 'base64url')).digest('base64url').slice(0, 16);
-    }
-    async loadOrGenerateRsaKeys() {
-        mkdirSync(this.keysDir, { recursive: true, mode: 0o700 });
-        if (process.platform !== 'win32') {
-            chmodSync(this.keysDir, 0o700);
-        }
-        if (existsSync(this.privateKeyPath) && existsSync(this.publicKeyPath)) {
-            const privatePem = readFileSync(this.privateKeyPath, 'utf-8');
-            const publicPem = readFileSync(this.publicKeyPath, 'utf-8');
-            this.privateKey = await jose.importPKCS8(privatePem, 'RS256', { extractable: false });
-            this.publicKey = await jose.importSPKI(publicPem, 'RS256', { extractable: true });
-        }
-        else {
-            const { publicKey, privateKey } = await jose.generateKeyPair('RS256', {
-                modulusLength: 2048,
-                extractable: true
-            });
-            const privatePem = await jose.exportPKCS8(privateKey);
-            const publicPem = await jose.exportSPKI(publicKey);
-            writeFileSync(this.privateKeyPath, privatePem, { mode: 0o600 });
-            writeFileSync(this.publicKeyPath, publicPem, { mode: 0o644 });
-            // Re-import with extractable: false for in-memory storage
-            this.privateKey = await jose.importPKCS8(privatePem, 'RS256', { extractable: false });
-            this.publicKey = await jose.importSPKI(publicPem, 'RS256', { extractable: true });
-        }
-    }
-    /**
-     * Return JWKS payload for /.well-known/jwks.json. Always a `keys` array
-     * (multi-key-aware for future rotation). RSA mode emits an RSA JWK; EdDSA
-     * mode emits an OKP JWK.
-     */
-    async getJwks() {
-        if (!this.publicKey)
-            throw new Error('JWTIssuer not initialized');
-        if (this.alg === 'EdDSA') {
-            return {
-                keys: [{ kty: 'OKP', crv: 'Ed25519', x: this.okpX, use: 'sig', alg: 'EdDSA', kid: this.kid }]
-            };
-        }
-        const jwk = await jose.exportJWK(this.publicKey);
-        jwk.kid = this.kid;
-        jwk.use = 'sig';
-        jwk.alg = 'RS256';
-        return { keys: [jwk] };
-    }
-    /** Issue a JWT access token (typ="access") signed with the active alg. */
-    async issueAccessToken(sub, expiresInSeconds = 3600) {
-        if (!this.privateKey)
-            throw new Error('JWTIssuer not initialized');
-        return new jose.SignJWT({ sub, typ: 'access' })
-            .setProtectedHeader({ alg: this.alg, kid: this.kid })
-            .setIssuer(this.serverName)
-            .setAudience(this.serverName)
-            .setIssuedAt()
-            .setExpirationTime(`${expiresInSeconds}s`)
-            .sign(this.privateKey);
-    }
-    /**
-     * Issue a JWT refresh token (typ="refresh") signed with the active alg.
-     *
-     * Defaults to a 1-year (31536000s) lifetime so long-running MCP clients can
-     * mint fresh access tokens without forcing the user back through the browser
-     * PKCE flow. The access token stays short-lived (1h); the refresh token is the
-     * renewal credential and is rotated on every use (the /token refresh handler
-     * issues a new refresh token each time), so the security control is rotation,
-     * not a short TTL. A short refresh TTL was the residual re-auth driver: a
-     * self-hosted server a user touches only intermittently (less than once a
-     * month) would silently expire its refresh token between sessions, forcing a
-     * fresh browser OAuth tab on the next use. With a 1-year floor, only a
-     * genuinely long idle gap re-prompts. Same key / iss / aud as access tokens;
-     * the typ claim is the only thing distinguishing them, and verifyAccessToken
-     * rejects typ="refresh" so a refresh token can never be used as an access
-     * token at the /mcp resource.
-     */
-    async issueRefreshToken(sub, expiresInSeconds = 31536000) {
-        if (!this.privateKey)
-            throw new Error('JWTIssuer not initialized');
-        return new jose.SignJWT({ sub, typ: 'refresh' })
-            .setProtectedHeader({ alg: this.alg, kid: this.kid })
-            .setIssuer(this.serverName)
-            .setAudience(this.serverName)
-            .setIssuedAt()
-            .setExpirationTime(`${expiresInSeconds}s`)
-            .sign(this.privateKey);
-    }
-    /**
-     * Verify a JWT access token and return its payload. Throws on failure (bad
-     * signature, wrong issuer/audience, expired) — the same jose errors existing
-     * callers already catch. The verify path uses the single active algorithm,
-     * never a union. Additionally rejects tokens whose typ claim is "refresh"
-     * (throwing jose.errors.JWTClaimValidationFailed) so a refresh token cannot
-     * be replayed as an access token. Tokens with typ="access" OR a missing typ
-     * claim are accepted (the latter keeps already-issued pre-refresh-support
-     * tokens valid).
-     */
-    async verifyAccessToken(token) {
-        if (!this.publicKey)
-            throw new Error('JWTIssuer not initialized');
-        const { payload } = await jose.jwtVerify(token, this.publicKey, {
-            issuer: this.serverName,
-            audience: this.serverName,
-            algorithms: [this.alg]
-        });
-        if (payload.typ === 'refresh') {
-            throw new jose.errors.JWTClaimValidationFailed('Refresh token cannot be used as an access token', payload, 'typ');
-        }
-        return payload;
-    }
-    /**
-     * Verify a JWT refresh token and return its payload. Same key / audience /
-     * issuer checks as verifyAccessToken and throws the same jose errors on
-     * failure; uses the single active algorithm. Additionally asserts
-     * typ=="refresh" (throwing jose.errors.JWTClaimValidationFailed otherwise) so
-     * an access token can never be exchanged at the refresh grant.
-     */
-    async verifyRefreshToken(token) {
-        if (!this.publicKey)
-            throw new Error('JWTIssuer not initialized');
-        const { payload } = await jose.jwtVerify(token, this.publicKey, {
-            issuer: this.serverName,
-            audience: this.serverName,
-            algorithms: [this.alg]
-        });
-        if (payload.typ !== 'refresh') {
-            throw new jose.errors.JWTClaimValidationFailed('Token is not a refresh token', payload, 'typ');
-        }
-        return payload;
-    }
-}
-//# sourceMappingURL=jwt-issuer.js.map

package/build/oauth/jwt-issuer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;AAE7D,yEAAyE;AACzE,+EAA+E;AAC/E,oCAAoC;AACpC,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;AAEnF,MAAM,OAAO,SAAS;IAapB,YAAY,UAAkB,EAAE,OAAO,GAAG,gBAAgB,EAAE,gBAAgB,GAAkB,IAAI;QAN1F,QAAG,GAAG,OAAO,CAAA;QACb,eAAU,GAA0B,IAAI,CAAA;QACxC,cAAS,GAA0B,IAAI,CAAA;QACvC,SAAI,GAAkB,IAAI,CAAA;QAC1B,iBAAY,GAAG,KAAK,CAAA;QAG1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAA;QACxC,IAAI,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,cAAc,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,aAAa,CAAC,CAAA;IACrE,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY;YAAE,OAAM;QAC7B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YACjD,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,UAAU,2DAA2D,IAAI,CAAC,GAAG,GAAG,CAAC,CAAA;QACnH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;YAClC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,UAAU,iDAAiD,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,gBAAwB;QACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAA;QACvD,MAAM,GAAG,GAAG,gCAAgC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,+BAA+B,CAAA;QACjG,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,4EAA4E;QAC5E,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAkB,CAAA;QAC5E,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;QACjB,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAmB,CAAA;QAC5G,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1G,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;gBACpE,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAElD,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAE7D,0DAA0D;YAC1D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,IAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACxG,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChD,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QAClB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QACf,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;QACjB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,gBAAgB,GAAG,IAAI;QACzD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACpD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,gBAAgB,GAAG,QAAQ;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACpD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iDAAiD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAChG,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}

package/build/oauth/pkce.d.ts

@@ -1,10 +0,0 @@
-/**
- * Verify PKCE code challenge.
- * Throws an error if verification fails.
- *
- * @param codeVerifier The PKCE code verifier.
- * @param codeChallenge The stored code challenge.
- * @param method The code challenge method (S256 or plain).
- */
-export declare function verifyPKCE(codeVerifier: string, codeChallenge: string, method: string): void;
-//# sourceMappingURL=pkce.d.ts.map

package/build/oauth/pkce.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAqB5F"}

package/build/oauth/pkce.js

@@ -1,34 +0,0 @@
-import { createHash, timingSafeEqual } from 'node:crypto';
-/**
- * Verify PKCE code challenge.
- * Throws an error if verification fails.
- *
- * @param codeVerifier The PKCE code verifier.
- * @param codeChallenge The stored code challenge.
- * @param method The code challenge method (S256 or plain).
- */
-export function verifyPKCE(codeVerifier, codeChallenge, method) {
-    if (method === 'S256') {
-        const digest = createHash('sha256').update(codeVerifier).digest('base64url');
-        const expected = Buffer.from(digest);
-        const actual = Buffer.from(codeChallenge);
-        const isLengthEqual = expected.length === actual.length;
-        const compareActual = isLengthEqual ? actual : expected;
-        if (!timingSafeEqual(expected, compareActual) || !isLengthEqual) {
-            throw new Error('invalid_grant: PKCE verification failed');
-        }
-    }
-    else if (method === 'plain') {
-        const expected = Buffer.from(codeVerifier);
-        const actual = Buffer.from(codeChallenge);
-        const isLengthEqual = expected.length === actual.length;
-        const compareActual = isLengthEqual ? actual : expected;
-        if (!timingSafeEqual(expected, compareActual) || !isLengthEqual) {
-            throw new Error('invalid_grant: PKCE plain verification failed');
-        }
-    }
-    else {
-        throw new Error('unsupported_challenge_method');
-    }
-}
-//# sourceMappingURL=pkce.js.map

package/build/oauth/pkce.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,aAAqB,EAAE,MAAc;IACpF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAA;QACvD,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;QACvD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACzC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAA;QACvD,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;QACvD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjD,CAAC;AACH,CAAC"}

package/build/oauth/provider.d.ts

@@ -1,52 +0,0 @@
-/**
- * OAuth 2.1 Provider logic for TypeScript MCP servers.
- *
- * Implements the "MCP Server as Authorization Server" pattern.
- * The MCP Server issues JWTs, processes PKCE verification,
- * and uses the Relay Server purely as a UI consent transport.
- */
-import type { RelayConfigSchema } from '../schema/types.js';
-import { type IOAuthSessionCache } from './cache.js';
-import type { JWTIssuer } from './jwt-issuer.js';
-export { InMemoryAuthCache, type IOAuthSessionCache, type PreAuthSession } from './cache.js';
-export interface OAuthProviderOptions {
-    serverName: string;
-    relayBaseUrl: string;
-    relaySchema: RelayConfigSchema;
-    jwtIssuer: JWTIssuer;
-    cache?: IOAuthSessionCache;
-}
-export declare class OAuthProvider {
-    private serverName;
-    private relayBaseUrl;
-    private relaySchema;
-    private jwtIssuer;
-    private cache;
-    constructor(options: OAuthProviderOptions);
-    /**
-     * Create a relay session and return the URL to redirect the user to.
-     */
-    createAuthorizeRedirect(clientId: string, redirectUri: string, state: string, codeChallenge: string, codeChallengeMethod?: string): Promise<string>;
-    /**
-     * Exchange the authorization code (relay session ID) for an access_token.
-     * PKCE verification is performed.
-     *
-     * @param code The authorization code from the client.
-     * @param codeVerifier The PKCE code verifier.
-     * @param userIdExtractor Function to derive a unique user_id from the credentials.
-     * @returns Tuple of [access_token, credentials]
-     */
-    exchangeCode(code: string, codeVerifier: string, userIdExtractor: (credentials: Record<string, string>) => string): Promise<{
-        accessToken: string;
-        credentials: Record<string, string>;
-    }>;
-    /**
-     * Reconstruct relay session from pre-auth session.
-     */
-    private reconstructRelaySession;
-    /**
-     * Get RFC 8414 Authorization Server Metadata.
-     */
-    getMetadata(baseUrl: string): Record<string, unknown>;
-}
-//# sourceMappingURL=provider.d.ts.map

package/build/oauth/provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAqB,KAAK,kBAAkB,EAAuB,MAAM,YAAY,CAAA;AAC5F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAGhD,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAA;AAEnB,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,KAAK,CAAC,EAAE,kBAAkB,CAAA;CAC3B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,YAAY,CAAQ;IAC5B,OAAO,CAAC,WAAW,CAAmB;IACtC,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,KAAK,CAAoB;IAEjC,YAAY,OAAO,EAAE,oBAAoB,EAMxC;IAED;;OAEG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,mBAAmB,SAAS,GAC3B,OAAO,CAAC,MAAM,CAAC,CAmBjB;IAED;;;;;;;;OAQG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,GAC/D,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAoBvE;IAED;;OAEG;YACW,uBAAuB;IAwBrC;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWpD;CACF"}