@n24q02m/mcp-core 0.1.0

package/build/crypto/aes.d.ts

@@ -0,0 +1,8 @@
+export interface EncryptResult {
+    ciphertext: Uint8Array;
+    iv: Uint8Array;
+    tag: Uint8Array;
+}
+export declare function encrypt(key: CryptoKey, plaintext: string): Promise<EncryptResult>;
+export declare function decrypt(key: CryptoKey, ciphertext: Uint8Array, iv: Uint8Array, tag?: Uint8Array): Promise<string>;
+//# sourceMappingURL=aes.d.ts.map

package/build/crypto/aes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes.d.ts","sourceRoot":"","sources":["../../src/crypto/aes.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,EAAE,EAAE,UAAU,CAAA;IACd,GAAG,EAAE,UAAU,CAAA;CAChB;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAWvF;AAED,wBAAsB,OAAO,CAC3B,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,UAAU,EACtB,EAAE,EAAE,UAAU,EACd,GAAG,CAAC,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/build/crypto/aes.js

@@ -0,0 +1,25 @@
+export async function encrypt(key, plaintext) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const encoded = new TextEncoder().encode(plaintext);
+    const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, encoded);
+    // WebCrypto appends 16-byte GCM tag to ciphertext
+    const combined = new Uint8Array(encrypted);
+    const ciphertext = combined.slice(0, combined.length - 16);
+    const tag = combined.slice(combined.length - 16);
+    return { ciphertext, iv, tag };
+}
+export async function decrypt(key, ciphertext, iv, tag) {
+    let data;
+    if (tag) {
+        data = new Uint8Array(ciphertext.length + tag.length);
+        data.set(ciphertext, 0);
+        data.set(tag, ciphertext.length);
+    }
+    else {
+        data = new Uint8Array(ciphertext);
+    }
+    const ivCopy = new Uint8Array(iv);
+    const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: ivCopy }, key, data);
+    return new TextDecoder().decode(decrypted);
+}
+//# sourceMappingURL=aes.js.map

package/build/crypto/aes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes.js","sourceRoot":"","sources":["../../src/crypto/aes.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,SAAiB;IAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAEpF,kDAAkD;IAClD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAC1D,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAEhD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAc,EACd,UAAsB,EACtB,EAAc,EACd,GAAgB;IAEhB,IAAI,IAA6B,CAAA;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACzF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC"}

package/build/crypto/ecdh.d.ts

@@ -0,0 +1,5 @@
+export declare function generateKeyPair(): Promise<CryptoKeyPair>;
+export declare function exportPublicKey(key: CryptoKey): Promise<string>;
+export declare function importPublicKey(base64url: string): Promise<CryptoKey>;
+export declare function deriveSharedSecret(privateKey: CryptoKey, publicKey: CryptoKey): Promise<ArrayBuffer>;
+//# sourceMappingURL=ecdh.d.ts.map

package/build/crypto/ecdh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdh.d.ts","sourceRoot":"","sources":["../../src/crypto/ecdh.ts"],"names":[],"mappings":"AAEA,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAE9D;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG3E;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAE1G"}

package/build/crypto/ecdh.js

@@ -0,0 +1,16 @@
+const ALGORITHM = { name: 'ECDH', namedCurve: 'P-256' };
+export async function generateKeyPair() {
+    return crypto.subtle.generateKey(ALGORITHM, true, ['deriveKey', 'deriveBits']);
+}
+export async function exportPublicKey(key) {
+    const raw = await crypto.subtle.exportKey('raw', key);
+    return Buffer.from(raw).toString('base64url');
+}
+export async function importPublicKey(base64url) {
+    const raw = Buffer.from(base64url, 'base64url');
+    return crypto.subtle.importKey('raw', raw, ALGORITHM, true, []);
+}
+export async function deriveSharedSecret(privateKey, publicKey) {
+    return crypto.subtle.deriveBits({ name: 'ECDH', public: publicKey }, privateKey, 256);
+}
+//# sourceMappingURL=ecdh.js.map

package/build/crypto/ecdh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdh.js","sourceRoot":"","sources":["../../src/crypto/ecdh.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAEvD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAqB,EAAE,SAAoB;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;AACvF,CAAC"}

package/build/crypto/index.d.ts

@@ -0,0 +1,4 @@
+export { decrypt, type EncryptResult, encrypt } from './aes.js';
+export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
+export { deriveAesKey } from './kdf.js';
+//# sourceMappingURL=index.d.ts.map

package/build/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA"}

package/build/crypto/index.js

@@ -0,0 +1,4 @@
+export { decrypt, encrypt } from './aes.js';
+export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
+export { deriveAesKey } from './kdf.js';
+//# sourceMappingURL=index.js.map

package/build/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAsB,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA"}

package/build/crypto/kdf.d.ts

@@ -0,0 +1,2 @@
+export declare function deriveAesKey(sharedSecret: ArrayBuffer, passphrase: string): Promise<CryptoKey>;
+//# sourceMappingURL=kdf.d.ts.map

package/build/crypto/kdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAEA,wBAAsB,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAWpG"}

package/build/crypto/kdf.js

@@ -0,0 +1,7 @@
+const INFO = new TextEncoder().encode('mcp-relay');
+export async function deriveAesKey(sharedSecret, passphrase) {
+    const salt = new TextEncoder().encode(passphrase);
+    const keyMaterial = await crypto.subtle.importKey('raw', sharedSecret, 'HKDF', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt, info: INFO }, keyMaterial, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+}
+//# sourceMappingURL=kdf.js.map

package/build/crypto/kdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAAA,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAElD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAyB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC"}

package/build/index.d.ts

@@ -0,0 +1,12 @@
+export * from './crypto/index.js';
+export { JWTIssuer } from './oauth/jwt-issuer.js';
+export { InMemoryAuthCache, type IOAuthSessionCache, OAuthProvider, type OAuthProviderOptions, type PreAuthSession } from './oauth/provider.js';
+export { type IUserCredentialStore, SqliteUserStore } from './oauth/user-store.js';
+export { tryOpenBrowser } from './relay/browser.js';
+export { createSession, generatePassphrase, pollForResponses, pollForResult, type RelaySession, sendMessage } from './relay/client.js';
+export type * from './schema/types.js';
+export { deleteConfig, exportConfig, importConfig, listConfigs, readConfig, writeConfig } from './storage/config-file.js';
+export { clearMode, getMode, type ServerMode, setLocalMode } from './storage/mode.js';
+export * from './storage/resolver.js';
+export { acquireSessionLock, releaseSessionLock, type SessionInfo, writeSessionLock } from './storage/session-lock.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,KAAK,YAAY,EACjB,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA"}

package/build/index.js

@@ -0,0 +1,12 @@
+export * from './crypto/index.js';
+// OAuth 2.1 multi-user infrastructure (HTTP mode)
+export { JWTIssuer } from './oauth/jwt-issuer.js';
+export { InMemoryAuthCache, OAuthProvider } from './oauth/provider.js';
+export { SqliteUserStore } from './oauth/user-store.js';
+export { tryOpenBrowser } from './relay/browser.js';
+export { createSession, generatePassphrase, pollForResponses, pollForResult, sendMessage } from './relay/client.js';
+export { deleteConfig, exportConfig, importConfig, listConfigs, readConfig, writeConfig } from './storage/config-file.js';
+export { clearMode, getMode, setLocalMode } from './storage/mode.js';
+export * from './storage/resolver.js';
+export { acquireSessionLock, releaseSessionLock, writeSessionLock } from './storage/session-lock.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EACL,iBAAiB,EAEjB,aAAa,EAGd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA6B,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EAEb,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAmB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA"}

package/build/oauth/index.d.ts

@@ -0,0 +1,4 @@
+export { JWTIssuer } from './jwt-issuer.js';
+export { InMemoryAuthCache, type IOAuthSessionCache, OAuthProvider, type OAuthProviderOptions, type PreAuthSession } from './provider.js';
+export { type IUserCredentialStore, SqliteUserStore } from './user-store.js';
+//# sourceMappingURL=index.d.ts.map

package/build/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/build/oauth/index.js

@@ -0,0 +1,4 @@
+export { JWTIssuer } from './jwt-issuer.js';
+export { InMemoryAuthCache, OAuthProvider } from './provider.js';
+export { SqliteUserStore } from './user-store.js';
+//# sourceMappingURL=index.js.map

package/build/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,iBAAiB,EAEjB,aAAa,EAGd,MAAM,eAAe,CAAA;AACtB,OAAO,EAA6B,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/build/oauth/jwt-issuer.d.ts

@@ -0,0 +1,25 @@
+/**
+ * RSA JWT Issuer and JWKS generation for TypeScript MCP servers.
+ * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
+ */
+import * as jose from 'jose';
+export declare class JWTIssuer {
+    private serverName;
+    private keysDir;
+    private privateKeyPath;
+    private publicKeyPath;
+    private kid;
+    private privateKey;
+    private publicKey;
+    private _initialized;
+    constructor(serverName: string, keysDir?: string);
+    /** Must call before using issuer — loads or generates RSA keys. */
+    init(): Promise<void>;
+    /** Return JWKS payload for /.well-known/jwks.json */
+    getJwks(): Promise<jose.JSONWebKeySet>;
+    /** Issue an RS256 JWT access token. */
+    issueAccessToken(sub: string, expiresInSeconds?: number): Promise<string>;
+    /** Verify JWT and return payload. Throws on failure. */
+    verifyAccessToken(token: string): Promise<jose.JWTPayload>;
+}
+//# sourceMappingURL=jwt-issuer.d.ts.map

package/build/oauth/jwt-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAI5B,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,YAAY,CAAQ;gBAEhB,UAAU,EAAE,MAAM,EAAE,OAAO,SAAmB;IAO1D,mEAAmE;IAC7D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B3B,qDAAqD;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;IAS5C,uCAAuC;IACjC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAW7E,wDAAwD;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;CAQjE"}

package/build/oauth/jwt-issuer.js

@@ -0,0 +1,79 @@
+/**
+ * RSA JWT Issuer and JWKS generation for TypeScript MCP servers.
+ * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import * as jose from 'jose';
+const DEFAULT_KEYS_DIR = join(homedir(), '.mcp-core', 'jwt-keys');
+export class JWTIssuer {
+    constructor(serverName, keysDir = DEFAULT_KEYS_DIR) {
+        this.kid = 'key-1';
+        this.privateKey = null;
+        this.publicKey = null;
+        this._initialized = false;
+        this.serverName = serverName;
+        this.keysDir = keysDir;
+        this.privateKeyPath = join(this.keysDir, `${serverName}_private.pem`);
+        this.publicKeyPath = join(this.keysDir, `${serverName}_public.pem`);
+    }
+    /** Must call before using issuer — loads or generates RSA keys. */
+    async init() {
+        if (this._initialized)
+            return;
+        mkdirSync(this.keysDir, { recursive: true });
+        if (existsSync(this.privateKeyPath) && existsSync(this.publicKeyPath)) {
+            const privatePem = readFileSync(this.privateKeyPath, 'utf-8');
+            const publicPem = readFileSync(this.publicKeyPath, 'utf-8');
+            this.privateKey = await jose.importPKCS8(privatePem, 'RS256');
+            this.publicKey = await jose.importSPKI(publicPem, 'RS256');
+        }
+        else {
+            const { publicKey, privateKey } = await jose.generateKeyPair('RS256', {
+                modulusLength: 2048,
+                extractable: true
+            });
+            this.privateKey = privateKey;
+            this.publicKey = publicKey;
+            const privatePem = await jose.exportPKCS8(privateKey);
+            const publicPem = await jose.exportSPKI(publicKey);
+            writeFileSync(this.privateKeyPath, privatePem, { mode: 0o600 });
+            writeFileSync(this.publicKeyPath, publicPem, { mode: 0o644 });
+        }
+        this._initialized = true;
+    }
+    /** Return JWKS payload for /.well-known/jwks.json */
+    async getJwks() {
+        if (!this.publicKey)
+            throw new Error('JWTIssuer not initialized');
+        const jwk = await jose.exportJWK(this.publicKey);
+        jwk.kid = this.kid;
+        jwk.use = 'sig';
+        jwk.alg = 'RS256';
+        return { keys: [jwk] };
+    }
+    /** Issue an RS256 JWT access token. */
+    async issueAccessToken(sub, expiresInSeconds = 3600) {
+        if (!this.privateKey)
+            throw new Error('JWTIssuer not initialized');
+        return new jose.SignJWT({ sub })
+            .setProtectedHeader({ alg: 'RS256', kid: this.kid })
+            .setIssuer(this.serverName)
+            .setAudience(this.serverName)
+            .setIssuedAt()
+            .setExpirationTime(`${expiresInSeconds}s`)
+            .sign(this.privateKey);
+    }
+    /** Verify JWT and return payload. Throws on failure. */
+    async verifyAccessToken(token) {
+        if (!this.publicKey)
+            throw new Error('JWTIssuer not initialized');
+        const { payload } = await jose.jwtVerify(token, this.publicKey, {
+            issuer: this.serverName,
+            audience: this.serverName
+        });
+        return payload;
+    }
+}
+//# sourceMappingURL=jwt-issuer.js.map

package/build/oauth/jwt-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,OAAO,SAAS;IAUpB,YAAY,UAAkB,EAAE,OAAO,GAAG,gBAAgB;QALlD,QAAG,GAAG,OAAO,CAAA;QACb,eAAU,GAA0B,IAAI,CAAA;QACxC,cAAS,GAA0B,IAAI,CAAA;QACvC,iBAAY,GAAG,KAAK,CAAA;QAG1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,cAAc,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,aAAa,CAAC,CAAA;IACrE,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY;YAAE,OAAM;QAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE5C,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YAC7D,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;gBACpE,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;YACF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;YAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAE1B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAElD,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChD,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QAClB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QACf,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;QACjB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,gBAAgB,GAAG,IAAI;QACzD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;aAC7B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}

package/build/oauth/provider.d.ts

@@ -0,0 +1,67 @@
+/**
+ * OAuth 2.1 Provider logic for TypeScript MCP servers.
+ *
+ * Implements the "MCP Server as Authorization Server" pattern.
+ * The MCP Server issues JWTs, processes PKCE verification,
+ * and uses the Relay Server purely as a UI consent transport.
+ */
+import type { RelayConfigSchema } from '../schema/types.js';
+import type { JWTIssuer } from './jwt-issuer.js';
+export interface PreAuthSession {
+    sessionId: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    /** Serialized CryptoKeyPair for later credential retrieval */
+    keyPairJwk: JsonWebKey;
+    passphrase: string;
+    expiresAt: number;
+}
+export interface IOAuthSessionCache {
+    save(session: PreAuthSession): void;
+    getAndDelete(sessionId: string): PreAuthSession | null;
+}
+export declare class InMemoryAuthCache implements IOAuthSessionCache {
+    private cache;
+    save(session: PreAuthSession): void;
+    getAndDelete(sessionId: string): PreAuthSession | null;
+}
+export interface OAuthProviderOptions {
+    serverName: string;
+    relayBaseUrl: string;
+    relaySchema: RelayConfigSchema;
+    jwtIssuer: JWTIssuer;
+    cache?: IOAuthSessionCache;
+}
+export declare class OAuthProvider {
+    private serverName;
+    private relayBaseUrl;
+    private relaySchema;
+    private jwtIssuer;
+    private cache;
+    constructor(options: OAuthProviderOptions);
+    /**
+     * Create a relay session and return the URL to redirect the user to.
+     */
+    createAuthorizeRedirect(clientId: string, redirectUri: string, state: string, codeChallenge: string, codeChallengeMethod?: string): Promise<string>;
+    /**
+     * Exchange the authorization code (relay session ID) for an access_token.
+     * PKCE verification is performed.
+     *
+     * @param code The authorization code from the client.
+     * @param codeVerifier The PKCE code verifier.
+     * @param userIdExtractor Function to derive a unique user_id from the credentials.
+     * @returns Tuple of [access_token, credentials]
+     */
+    exchangeCode(code: string, codeVerifier: string, userIdExtractor: (credentials: Record<string, string>) => string): Promise<{
+        accessToken: string;
+        credentials: Record<string, string>;
+    }>;
+    /**
+     * Get RFC 8414 Authorization Server Metadata.
+     */
+    getMetadata(baseUrl: string): Record<string, unknown>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/build/oauth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,8DAA8D;IAC9D,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAA;IACnC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;CACvD;AAED,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,OAAO,CAAC,KAAK,CAAoC;IAEjD,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IASnC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;CAOvD;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,iBAAiB,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,KAAK,CAAC,EAAE,kBAAkB,CAAA;CAC3B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,YAAY,CAAQ;IAC5B,OAAO,CAAC,WAAW,CAAmB;IACtC,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,KAAK,CAAoB;gBAErB,OAAO,EAAE,oBAAoB;IAQzC;;OAEG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,mBAAmB,SAAS,GAC3B,OAAO,CAAC,MAAM,CAAC;IAqBlB;;;;;;;;OAQG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,GAC/D,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAwDxE;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAYtD"}

package/build/oauth/provider.js

@@ -0,0 +1,129 @@
+/**
+ * OAuth 2.1 Provider logic for TypeScript MCP servers.
+ *
+ * Implements the "MCP Server as Authorization Server" pattern.
+ * The MCP Server issues JWTs, processes PKCE verification,
+ * and uses the Relay Server purely as a UI consent transport.
+ */
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { createSession, pollForResult } from '../relay/client.js';
+export class InMemoryAuthCache {
+    constructor() {
+        this.cache = new Map();
+    }
+    save(session) {
+        this.cache.set(session.sessionId, session);
+        // Cleanup expired entries
+        const now = Math.floor(Date.now() / 1000);
+        for (const [id, sess] of this.cache) {
+            if (sess.expiresAt < now)
+                this.cache.delete(id);
+        }
+    }
+    getAndDelete(sessionId) {
+        const sess = this.cache.get(sessionId);
+        if (!sess)
+            return null;
+        this.cache.delete(sessionId);
+        if (sess.expiresAt < Math.floor(Date.now() / 1000))
+            return null;
+        return sess;
+    }
+}
+export class OAuthProvider {
+    constructor(options) {
+        this.serverName = options.serverName;
+        this.relayBaseUrl = options.relayBaseUrl;
+        this.relaySchema = options.relaySchema;
+        this.jwtIssuer = options.jwtIssuer;
+        this.cache = options.cache ?? new InMemoryAuthCache();
+    }
+    /**
+     * Create a relay session and return the URL to redirect the user to.
+     */
+    async createAuthorizeRedirect(clientId, redirectUri, state, codeChallenge, codeChallengeMethod = 'S256') {
+        const session = await createSession(this.relayBaseUrl, this.serverName, this.relaySchema);
+        // Export private key for later credential retrieval
+        const privateJwk = await crypto.subtle.exportKey('jwk', session.keyPair.privateKey);
+        const preAuth = {
+            sessionId: session.sessionId,
+            clientId,
+            redirectUri,
+            state,
+            codeChallenge,
+            codeChallengeMethod,
+            keyPairJwk: privateJwk,
+            passphrase: session.passphrase,
+            expiresAt: Math.floor(Date.now() / 1000) + 600 // 10 minutes
+        };
+        this.cache.save(preAuth);
+        return session.relayUrl;
+    }
+    /**
+     * Exchange the authorization code (relay session ID) for an access_token.
+     * PKCE verification is performed.
+     *
+     * @param code The authorization code from the client.
+     * @param codeVerifier The PKCE code verifier.
+     * @param userIdExtractor Function to derive a unique user_id from the credentials.
+     * @returns Tuple of [access_token, credentials]
+     */
+    async exchangeCode(code, codeVerifier, userIdExtractor) {
+        const preAuth = this.cache.getAndDelete(code);
+        if (!preAuth)
+            throw new Error('invalid_grant: Expired or invalid code');
+        // Verify PKCE
+        if (preAuth.codeChallengeMethod === 'S256') {
+            const digest = createHash('sha256').update(codeVerifier).digest('base64url');
+            const expected = Buffer.from(digest);
+            const actual = Buffer.from(preAuth.codeChallenge);
+            if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+                throw new Error('invalid_grant: PKCE verification failed');
+            }
+        }
+        else if (preAuth.codeChallengeMethod === 'plain') {
+            const expected = Buffer.from(codeVerifier);
+            const actual = Buffer.from(preAuth.codeChallenge);
+            if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+                throw new Error('invalid_grant: PKCE plain verification failed');
+            }
+        }
+        else {
+            throw new Error('unsupported_challenge_method');
+        }
+        // Reconstruct key pair to decrypt relay credentials
+        const privateKey = await crypto.subtle.importKey('jwk', preAuth.keyPairJwk, { name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveKey', 'deriveBits']);
+        const publicKey = await crypto.subtle.importKey('jwk', { ...preAuth.keyPairJwk, d: undefined }, { name: 'ECDH', namedCurve: 'P-256' }, true, []);
+        const reconstructedSession = {
+            sessionId: preAuth.sessionId,
+            keyPair: { privateKey, publicKey },
+            passphrase: preAuth.passphrase,
+            relayUrl: ''
+        };
+        // Poll for credentials (short timeout — form already submitted)
+        const credentials = await pollForResult(this.relayBaseUrl, reconstructedSession, 1000, 10_000);
+        // Extract unique user_id
+        const userId = userIdExtractor(credentials);
+        if (!userId)
+            throw new Error('server_error: Unable to extract user_id from credentials');
+        // Issue access token
+        const accessToken = await this.jwtIssuer.issueAccessToken(userId);
+        return { accessToken, credentials };
+    }
+    /**
+     * Get RFC 8414 Authorization Server Metadata.
+     */
+    getMetadata(baseUrl) {
+        return {
+            issuer: baseUrl,
+            authorization_endpoint: `${baseUrl}/authorize`,
+            token_endpoint: `${baseUrl}/token`,
+            jwks_uri: `${baseUrl}/.well-known/jwks.json`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            code_challenge_methods_supported: ['S256', 'plain'],
+            token_endpoint_auth_methods_supported: ['none']
+        };
+    }
+}
+//# sourceMappingURL=provider.js.map

package/build/oauth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAA;AAsBpF,MAAM,OAAO,iBAAiB;IAA9B;QACU,UAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAkBnD,CAAC;IAhBC,IAAI,CAAC,OAAuB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC1C,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/D,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAUD,MAAM,OAAO,aAAa;IAOxB,YAAY,OAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;QACtC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,iBAAiB,EAAE,CAAA;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,QAAgB,EAChB,WAAmB,EACnB,KAAa,EACb,aAAqB,EACrB,mBAAmB,GAAG,MAAM;QAE5B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAEzF,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAEnF,MAAM,OAAO,GAAmB;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ;YACR,WAAW;YACX,KAAK;YACL,aAAa;YACb,mBAAmB;YACnB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,aAAa;SAC7D,CAAA;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACxB,OAAO,OAAO,CAAC,QAAQ,CAAA;IACzB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAoB,EACpB,eAAgE;QAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAEvE,cAAc;QACd,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,mBAAmB,KAAK,OAAO,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC9C,KAAK,EACL,OAAO,CAAC,UAAU,EAClB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EACrC,IAAI,EACJ,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAA;QACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,EACvC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EACrC,IAAI,EACJ,EAAE,CACH,CAAA;QACD,MAAM,oBAAoB,GAAiB;YACzC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAA;QAED,gEAAgE;QAChE,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAE9F,yBAAyB;QACzB,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAExF,qBAAqB;QACrB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QACjE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAAe;QACzB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,sBAAsB,EAAE,GAAG,OAAO,YAAY;YAC9C,cAAc,EAAE,GAAG,OAAO,QAAQ;YAClC,QAAQ,EAAE,GAAG,OAAO,wBAAwB;YAC5C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;YAC7C,gCAAgC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YACnD,qCAAqC,EAAE,CAAC,MAAM,CAAC;SAChD,CAAA;IACH,CAAC;CACF"}

package/build/oauth/user-store.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Per-user encrypted credential store for MCP HTTP modes.
+ * Uses better-sqlite3 for persistence and Node.js crypto for AES-256-GCM at-rest encryption.
+ */
+export interface IUserCredentialStore {
+    saveCredentials(userId: string, config: Record<string, string>): void;
+    getCredentials(userId: string): Record<string, string> | null;
+    deleteCredentials(userId: string): void;
+}
+export declare class SqliteUserStore implements IUserCredentialStore {
+    private db;
+    private masterKey;
+    /**
+     * @param dbPath Path to the SQLite DB file.
+     * @param masterKey 32-byte AES key for at-rest encryption.
+     */
+    constructor(dbPath: string, masterKey: Buffer);
+    private encrypt;
+    private decrypt;
+    saveCredentials(userId: string, config: Record<string, string>): void;
+    getCredentials(userId: string): Record<string, string> | null;
+    deleteCredentials(userId: string): void;
+    close(): void;
+}
+//# sourceMappingURL=user-store.d.ts.map

package/build/oauth/user-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.d.ts","sourceRoot":"","sources":["../../src/oauth/user-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;IACrE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;IAC7D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACxC;AAED,qBAAa,eAAgB,YAAW,oBAAoB;IAC1D,OAAO,CAAC,EAAE,CAAmB;IAC7B,OAAO,CAAC,SAAS,CAAQ;IAEzB;;;OAGG;gBACS,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAmB7C,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,OAAO;IASf,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAerE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAc7D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIvC,KAAK,IAAI,IAAI;CAGd"}

package/build/oauth/user-store.js

@@ -0,0 +1,78 @@
+/**
+ * Per-user encrypted credential store for MCP HTTP modes.
+ * Uses better-sqlite3 for persistence and Node.js crypto for AES-256-GCM at-rest encryption.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import Database from 'better-sqlite3';
+export class SqliteUserStore {
+    /**
+     * @param dbPath Path to the SQLite DB file.
+     * @param masterKey 32-byte AES key for at-rest encryption.
+     */
+    constructor(dbPath, masterKey) {
+        if (masterKey.length !== 32)
+            throw new Error('masterKey must be 32 bytes');
+        this.masterKey = masterKey;
+        // Ensure directory exists
+        mkdirSync(dirname(dbPath), { recursive: true });
+        this.db = new Database(dbPath);
+        this.db.pragma('journal_mode = WAL');
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS users (
+        user_id TEXT PRIMARY KEY,
+        encrypted_config BLOB NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      )
+    `);
+    }
+    encrypt(plaintext) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.masterKey, iv, { authTagLength: 16 });
+        const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        // Layout: [12 iv] [16 tag] [... ciphertext]
+        return Buffer.concat([iv, tag, encrypted]);
+    }
+    decrypt(payload) {
+        const iv = payload.subarray(0, 12);
+        const tag = payload.subarray(12, 28);
+        const ciphertext = payload.subarray(28);
+        const decipher = createDecipheriv('aes-256-gcm', this.masterKey, iv, { authTagLength: 16 });
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf-8');
+    }
+    saveCredentials(userId, config) {
+        const now = Math.floor(Date.now() / 1000);
+        const encrypted = this.encrypt(JSON.stringify(config));
+        this.db
+            .prepare(`
+        INSERT INTO users (user_id, encrypted_config, created_at, updated_at)
+        VALUES (?, ?, ?, ?)
+        ON CONFLICT(user_id) DO UPDATE SET
+          encrypted_config = excluded.encrypted_config,
+          updated_at = excluded.updated_at
+      `)
+            .run(userId, encrypted, now, now);
+    }
+    getCredentials(userId) {
+        const row = this.db.prepare('SELECT encrypted_config FROM users WHERE user_id = ?').get(userId);
+        if (!row)
+            return null;
+        try {
+            return JSON.parse(this.decrypt(Buffer.from(row.encrypted_config)));
+        }
+        catch {
+            return null;
+        }
+    }
+    deleteCredentials(userId) {
+        this.db.prepare('DELETE FROM users WHERE user_id = ?').run(userId);
+    }
+    close() {
+        this.db.close();
+    }
+}
+//# sourceMappingURL=user-store.js.map

package/build/oauth/user-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.js","sourceRoot":"","sources":["../../src/oauth/user-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AAQrC,MAAM,OAAO,eAAe;IAI1B;;;OAGG;IACH,YAAY,MAAc,EAAE,SAAiB;QAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAC1E,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAE1B,0BAA0B;QAC1B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAE/C,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;KAOZ,CAAC,CAAA;IACJ,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAA;QACvF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QAC/B,4CAA4C;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAA;IAC5C,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAClC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACzF,CAAC;IAED,eAAe,CAAC,MAAc,EAAE,MAA8B;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAEtD,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC;;;;;;OAMR,CAAC;aACD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,MAAM,CAEjF,CAAA;QAEb,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAErB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;CACF"}