@n24q02m/mcp-core 1.0.0-beta.3 → 1.0.0

package/build/auth/local-oauth-app.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Local OAuth 2.1 Authorization Server as an HTTP request handler.
+ *
+ * Provides a self-hosted Authorization Server for single-user MCP servers.
+ * Implements the OAuth 2.1 PKCE flow with credential collection via a
+ * browser-rendered form.
+ *
+ * Routes:
+ * - GET  /authorize                                -- Render credential form
+ * - POST /authorize                                -- Save credentials, return auth code
+ * - POST /otp                                      -- Submit multi-step credential (OTP / 2FA password)
+ * - POST /token                                    -- Exchange auth code + PKCE verifier for JWT
+ * - GET  /setup-status                             -- Poll background setup completion
+ * - GET  /.well-known/oauth-authorization-server   -- RFC 8414 metadata
+ * - GET  /.well-known/oauth-protected-resource     -- RFC 9728 metadata
+ *
+ * The /mcp endpoint is NOT included -- it is mounted by the transport layer.
+ *
+ * This is a TypeScript port of core-py's ``local_oauth_app.py``. Behavior,
+ * protocol, and TTL constants are kept identical for cross-language parity.
+ */
+import { JWTIssuer } from '../oauth/jwt-issuer.js';
+import { type RelayConfigSchema } from './credential-form.js';
+import { type RequestHandler } from './router.js';
+/** Next-step hint returned by credential / step callbacks. */
+export type NextStep = Record<string, unknown>;
+/**
+ * Callback invoked when the user submits credentials via POST /authorize.
+ *
+ * Return ``null`` to finish the flow or a ``next_step`` dict to trigger a
+ * follow-up (OAuth device code, OTP, 2FA password, etc). May be sync or async.
+ */
+export type CredentialsCallback = (creds: Record<string, string>) => NextStep | null | Promise<NextStep | null>;
+/**
+ * Callback invoked when the user submits step input via POST /otp.
+ *
+ * Return ``null`` to complete the flow, a ``{type: "otp_required" |
+ * "password_required", ...}`` dict to chain to another step, or
+ * ``{type: "error", text: "..."}`` to reject the current input and allow
+ * retry. Callbacks comparing secrets MUST use a timing-safe comparison.
+ * May be sync or async.
+ */
+export type StepCallback = (data: Record<string, string>) => NextStep | null | Promise<NextStep | null>;
+export interface LocalOAuthAppOptions {
+    /** Identifier for the MCP server (used for JWT iss / aud). */
+    serverName: string;
+    /** RelayConfigSchema describing the credential form. */
+    relaySchema: RelayConfigSchema;
+    /** Optional callback invoked with credentials after POST /authorize. */
+    onCredentialsSaved?: CredentialsCallback;
+    /** Optional callback invoked with step data after POST /otp. */
+    onStepSubmitted?: StepCallback;
+    /** Optional pre-created JWT issuer. If omitted, one is created automatically. */
+    jwtIssuer?: JWTIssuer;
+    /**
+     * Optional renderer used in place of the default credential form on GET
+     * /authorize. Receives the relay schema and an options object with
+     * ``submitUrl`` (which embeds the PKCE nonce) and returns the full HTML
+     * page. Consumers (email, telegram) use this to inject rich UX while
+     * reusing core OAuth plumbing.
+     */
+    customCredentialFormHtml?: (schema: RelayConfigSchema, options: {
+        submitUrl: string;
+    }) => string;
+}
+export interface LocalOAuthAppResult {
+    /** HTTP request handler to mount on a Node ``http.Server``. */
+    handler: RequestHandler;
+    /** JWT issuer, needed by the transport layer to verify Bearer tokens. */
+    jwtIssuer: JWTIssuer;
+    /** Mark a background setup step as complete (polled by GET /setup-status). */
+    markSetupComplete: (key?: string) => void;
+}
+/**
+ * Create OAuth 2.1 Authorization Server HTTP handler.
+ *
+ * Returns a handler compatible with ``http.createServer`` along with the
+ * ``JWTIssuer`` (for the transport layer to verify Bearer tokens) and a
+ * ``markSetupComplete`` function for background setup callbacks (e.g. GDrive
+ * device code flow).
+ */
+export declare function createLocalOAuthApp(options: LocalOAuthAppOptions): Promise<LocalOAuthAppResult>;
+//# sourceMappingURL=local-oauth-app.d.ts.map

package/build/auth/local-oauth-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-oauth-app.d.ts","sourceRoot":"","sources":["../../src/auth/local-oauth-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,KAAK,iBAAiB,EAAwB,MAAM,sBAAsB,CAAA;AACnF,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,aAAa,CAAA;AAGpB,8DAA8D;AAC9D,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;AAE/G;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;AAEvG,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,WAAW,EAAE,iBAAiB,CAAA;IAC9B,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gEAAgE;IAChE,eAAe,CAAC,EAAE,YAAY,CAAA;IAC9B,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAA;CACjG;AAED,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,OAAO,EAAE,cAAc,CAAA;IACvB,yEAAyE;IACzE,SAAS,EAAE,SAAS,CAAA;IACpB,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1C;AAmED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA2TrG"}

package/build/auth/local-oauth-app.js

@@ -0,0 +1,355 @@
+/**
+ * Local OAuth 2.1 Authorization Server as an HTTP request handler.
+ *
+ * Provides a self-hosted Authorization Server for single-user MCP servers.
+ * Implements the OAuth 2.1 PKCE flow with credential collection via a
+ * browser-rendered form.
+ *
+ * Routes:
+ * - GET  /authorize                                -- Render credential form
+ * - POST /authorize                                -- Save credentials, return auth code
+ * - POST /otp                                      -- Submit multi-step credential (OTP / 2FA password)
+ * - POST /token                                    -- Exchange auth code + PKCE verifier for JWT
+ * - GET  /setup-status                             -- Poll background setup completion
+ * - GET  /.well-known/oauth-authorization-server   -- RFC 8414 metadata
+ * - GET  /.well-known/oauth-protected-resource     -- RFC 9728 metadata
+ *
+ * The /mcp endpoint is NOT included -- it is mounted by the transport layer.
+ *
+ * This is a TypeScript port of core-py's ``local_oauth_app.py``. Behavior,
+ * protocol, and TTL constants are kept identical for cross-language parity.
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { JWTIssuer } from '../oauth/jwt-issuer.js';
+import { renderCredentialForm } from './credential-form.js';
+import { createRouter, htmlResponse, jsonResponse, parseFormBody, parseJsonBody } from './router.js';
+import { authorizationServerMetadata, protectedResourceMetadata } from './well-known.js';
+// Auth codes and PKCE sessions expire after 10 minutes.
+const AUTH_CODE_TTL_S = 600;
+const SESSION_TTL_S = 600;
+// Multi-step auth (OTP / 2FA password) constraints.
+const OTP_TIMEOUT_S = 300;
+const OTP_MAX_ATTEMPTS = 5;
+/**
+ * Verify PKCE S256: ``base64url(sha256(code_verifier)) == code_challenge``,
+ * using a timing-safe comparison to prevent timing attacks.
+ */
+function s256Verify(codeVerifier, codeChallenge) {
+    const computed = createHash('sha256').update(codeVerifier, 'ascii').digest('base64url');
+    if (computed.length !== codeChallenge.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(computed, 'ascii'), Buffer.from(codeChallenge, 'ascii'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Prune entries older than ``ttlMs`` milliseconds from an in-memory store. */
+function pruneExpired(store, ttlMs) {
+    const now = Date.now();
+    for (const [key, value] of store) {
+        if (now - value.createdAt > ttlMs)
+            store.delete(key);
+    }
+}
+/** Derive the public base URL of this request (protocol + host, no trailing slash). */
+function getBaseUrl(req) {
+    const host = req.headers.host ?? 'localhost';
+    const encrypted = req.socket.encrypted === true;
+    const forwardedProto = req.headers['x-forwarded-proto'];
+    const protocol = typeof forwardedProto === 'string' && forwardedProto.length > 0
+        ? forwardedProto.split(',')[0].trim()
+        : encrypted
+            ? 'https'
+            : 'http';
+    return `${protocol}://${host}`;
+}
+/**
+ * Create OAuth 2.1 Authorization Server HTTP handler.
+ *
+ * Returns a handler compatible with ``http.createServer`` along with the
+ * ``JWTIssuer`` (for the transport layer to verify Bearer tokens) and a
+ * ``markSetupComplete`` function for background setup callbacks (e.g. GDrive
+ * device code flow).
+ */
+export async function createLocalOAuthApp(options) {
+    const jwtIssuer = options.jwtIssuer ?? new JWTIssuer(options.serverName);
+    await jwtIssuer.init();
+    // In-memory stores keyed by nonce / auth_code. Each entry has a ``createdAt``
+    // for TTL expiry.
+    const pendingSessions = new Map();
+    const authCodes = new Map();
+    // Single-user local mode: one pending multi-step session at a time.
+    let pendingStep = null;
+    const setupStatus = { gdrive: 'idle' };
+    function markPendingStep() {
+        pendingStep = { active: true, createdAt: Date.now(), attempts: 0 };
+    }
+    function clearPendingStep() {
+        pendingStep = null;
+    }
+    // ------------------------------------------------------------------
+    // Route handlers
+    // ------------------------------------------------------------------
+    async function authorizeGet(req, res) {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const params = url.searchParams;
+        const clientId = params.get('client_id');
+        const redirectUri = params.get('redirect_uri');
+        const state = params.get('state');
+        const codeChallenge = params.get('code_challenge');
+        const codeChallengeMethod = params.get('code_challenge_method') ?? 'S256';
+        if (!clientId || !redirectUri || !state || !codeChallenge) {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Missing required parameters'
+            });
+            return;
+        }
+        const nonce = randomBytes(32).toString('base64url');
+        pendingSessions.set(nonce, {
+            clientId,
+            redirectUri,
+            state,
+            codeChallenge,
+            codeChallengeMethod,
+            createdAt: Date.now()
+        });
+        pruneExpired(pendingSessions, SESSION_TTL_S * 1000);
+        const base = getBaseUrl(req);
+        const submitUrl = `${base}/authorize?nonce=${nonce}`;
+        const html = options.customCredentialFormHtml !== undefined
+            ? options.customCredentialFormHtml(options.relaySchema, { submitUrl })
+            : renderCredentialForm(options.relaySchema, { submitUrl });
+        htmlResponse(res, 200, html);
+    }
+    async function authorizePost(req, res) {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const nonce = url.searchParams.get('nonce');
+        if (!nonce || !pendingSessions.has(nonce)) {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Invalid or expired nonce'
+            });
+            return;
+        }
+        const session = pendingSessions.get(nonce);
+        pendingSessions.delete(nonce);
+        if (Date.now() - session.createdAt > SESSION_TTL_S * 1000) {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Session expired'
+            });
+            return;
+        }
+        let credentials;
+        try {
+            credentials = await parseJsonBody(req);
+        }
+        catch {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Invalid JSON body'
+            });
+            return;
+        }
+        // Save credentials via callback. Callback may return a dict with
+        // next_step info (e.g. GDrive OAuth device code to show in the form).
+        let nextStep = null;
+        if (options.onCredentialsSaved !== undefined) {
+            try {
+                const result = await options.onCredentialsSaved(credentials);
+                if (result !== null && result !== undefined && typeof result === 'object') {
+                    nextStep = result;
+                }
+            }
+            catch {
+                jsonResponse(res, 500, {
+                    error: 'server_error',
+                    error_description: 'Failed to save credentials'
+                });
+                return;
+            }
+        }
+        // Generate auth code.
+        const authCode = randomBytes(32).toString('base64url');
+        authCodes.set(authCode, {
+            codeChallenge: session.codeChallenge,
+            codeChallengeMethod: session.codeChallengeMethod,
+            createdAt: Date.now()
+        });
+        pruneExpired(authCodes, AUTH_CODE_TTL_S * 1000);
+        const separator = session.redirectUri.includes('?') ? '&' : '?';
+        const redirectUrl = `${session.redirectUri}${separator}code=${authCode}&state=${session.state}`;
+        const body = { ok: true, redirect_url: redirectUrl };
+        if (nextStep !== null) {
+            body.next_step = nextStep;
+            // If next_step requires additional input (OTP or 2FA password),
+            // activate pending step session so /otp endpoint accepts input.
+            const stepType = nextStep.type;
+            if (stepType === 'otp_required' || stepType === 'password_required') {
+                markPendingStep();
+            }
+        }
+        jsonResponse(res, 200, body);
+    }
+    async function authorize(req, res) {
+        if (req.method === 'GET') {
+            await authorizeGet(req, res);
+            return;
+        }
+        await authorizePost(req, res);
+    }
+    async function token(req, res) {
+        let form;
+        try {
+            form = await parseFormBody(req);
+        }
+        catch {
+            jsonResponse(res, 400, { error: 'invalid_request' });
+            return;
+        }
+        const grantType = form.grant_type;
+        if (grantType !== 'authorization_code') {
+            jsonResponse(res, 400, { error: 'unsupported_grant_type' });
+            return;
+        }
+        const code = form.code;
+        const codeVerifier = form.code_verifier;
+        if (!code || !codeVerifier) {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Missing code or code_verifier'
+            });
+            return;
+        }
+        const entry = authCodes.get(code);
+        if (entry === undefined) {
+            jsonResponse(res, 400, { error: 'invalid_grant' });
+            return;
+        }
+        authCodes.delete(code);
+        if (Date.now() - entry.createdAt > AUTH_CODE_TTL_S * 1000) {
+            jsonResponse(res, 400, { error: 'invalid_grant' });
+            return;
+        }
+        if (entry.codeChallengeMethod !== 'S256') {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Only S256 is supported'
+            });
+            return;
+        }
+        if (!s256Verify(codeVerifier, entry.codeChallenge)) {
+            jsonResponse(res, 400, { error: 'invalid_grant' });
+            return;
+        }
+        const accessToken = await jwtIssuer.issueAccessToken('local-user');
+        jsonResponse(res, 200, {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: 3600
+        });
+    }
+    async function otpHandler(req, res) {
+        // 1. Active session check.
+        if (pendingStep === null || !pendingStep.active) {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'No active step session'
+            });
+            return;
+        }
+        // 2. Timeout check.
+        if (Date.now() - pendingStep.createdAt > OTP_TIMEOUT_S * 1000) {
+            clearPendingStep();
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Step session expired'
+            });
+            return;
+        }
+        // 3. Parse JSON body BEFORE incrementing attempts. Malformed input
+        // must not consume the user's retry quota nor clear the session.
+        let stepData;
+        try {
+            stepData = await parseJsonBody(req);
+        }
+        catch {
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Invalid JSON body'
+            });
+            return;
+        }
+        // 4. Increment attempts counter (count every valid-JSON submit).
+        pendingStep.attempts += 1;
+        // 5. Attempt limit check.
+        if (pendingStep.attempts > OTP_MAX_ATTEMPTS) {
+            clearPendingStep();
+            jsonResponse(res, 400, {
+                error: 'invalid_request',
+                error_description: 'Too many attempts'
+            });
+            return;
+        }
+        // 6. Dispatch to step callback.
+        let nextStep = null;
+        if (options.onStepSubmitted !== undefined) {
+            try {
+                const result = await options.onStepSubmitted(stepData);
+                if (result !== null && result !== undefined && typeof result === 'object') {
+                    nextStep = result;
+                }
+            }
+            catch {
+                jsonResponse(res, 500, {
+                    error: 'server_error',
+                    error_description: 'Failed to process step input'
+                });
+                return;
+            }
+        }
+        // Error from callback: keep pending session, allow retry.
+        if (nextStep !== null && nextStep.type === 'error') {
+            const errText = typeof nextStep.text === 'string' ? nextStep.text : 'Invalid input';
+            jsonResponse(res, 200, { ok: false, error: errText });
+            return;
+        }
+        // Chain to next step: reset counters so the new step gets its own quota.
+        if (nextStep !== null && (nextStep.type === 'otp_required' || nextStep.type === 'password_required')) {
+            markPendingStep();
+            jsonResponse(res, 200, { ok: true, next_step: nextStep });
+            return;
+        }
+        // Completion (callback returned null / undefined or unknown dict type).
+        clearPendingStep();
+        jsonResponse(res, 200, { ok: true });
+    }
+    async function setupStatusHandler(_req, res) {
+        jsonResponse(res, 200, setupStatus);
+    }
+    async function wellKnownAs(req, res) {
+        const base = getBaseUrl(req);
+        jsonResponse(res, 200, authorizationServerMetadata(base));
+    }
+    async function wellKnownPr(req, res) {
+        const base = getBaseUrl(req);
+        jsonResponse(res, 200, protectedResourceMetadata(base, [base]));
+    }
+    function markSetupComplete(key = 'gdrive') {
+        setupStatus[key] = 'complete';
+    }
+    const handler = createRouter([
+        { method: 'GET', path: '/authorize', handler: authorize },
+        { method: 'POST', path: '/authorize', handler: authorize },
+        { method: 'POST', path: '/token', handler: token },
+        { method: 'POST', path: '/otp', handler: otpHandler },
+        { method: 'GET', path: '/setup-status', handler: setupStatusHandler },
+        { method: 'GET', path: '/.well-known/oauth-authorization-server', handler: wellKnownAs },
+        { method: 'GET', path: '/.well-known/oauth-protected-resource', handler: wellKnownPr }
+    ]);
+    return { handler, jwtIssuer, markSetupComplete };
+}
+//# sourceMappingURL=local-oauth-app.js.map

package/build/auth/local-oauth-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-oauth-app.js","sourceRoot":"","sources":["../../src/auth/local-oauth-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAA0B,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AACnF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEd,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAsDxF,wDAAwD;AACxD,MAAM,eAAe,GAAG,GAAG,CAAA;AAC3B,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,oDAAoD;AACpD,MAAM,aAAa,GAAG,GAAG,CAAA;AACzB,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAuB1B;;;GAGG;AACH,SAAS,UAAU,CAAC,YAAoB,EAAE,aAAqB;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvF,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAkC,KAAqB,EAAE,KAAa;IACzF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAoB;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;IAC5C,MAAM,SAAS,GAAI,GAAG,CAAC,MAAkC,CAAC,SAAS,KAAK,IAAI,CAAA;IAC5E,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACvD,MAAM,QAAQ,GACZ,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACrC,CAAC,CAAC,SAAS;YACT,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAA;IACd,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAA;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA6B;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACxE,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;IAEtB,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAA;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAA;IAElD,oEAAoE;IACpE,IAAI,WAAW,GAAuB,IAAI,CAAA;IAC1C,MAAM,WAAW,GAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAE9D,SAAS,eAAe;QACtB,WAAW,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IACpE,CAAC;IAED,SAAS,gBAAgB;QACvB,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,qEAAqE;IACrE,iBAAiB;IACjB,qEAAqE;IAErE,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB;QACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAChF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAA;QAEzE,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,6BAA6B;aACjD,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnD,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;YACzB,QAAQ;YACR,WAAW;YACX,KAAK;YACL,aAAa;YACb,mBAAmB;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAA;QACF,YAAY,CAAC,eAAe,EAAE,aAAa,GAAG,IAAI,CAAC,CAAA;QAEnD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,SAAS,GAAG,GAAG,IAAI,oBAAoB,KAAK,EAAE,CAAA;QACpD,MAAM,IAAI,GACR,OAAO,CAAC,wBAAwB,KAAK,SAAS;YAC5C,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC;YACtE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC9D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAChF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,0BAA0B;aAC9C,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAmB,CAAA;QAC5D,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;YAC1D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,iBAAiB;aACrC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,WAAmC,CAAA;QACvC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,aAAa,CAAyB,GAAG,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,mBAAmB;aACvC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,iEAAiE;QACjE,sEAAsE;QACtE,IAAI,QAAQ,GAAoB,IAAI,CAAA;QACpC,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;gBAC5D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1E,QAAQ,GAAG,MAAM,CAAA;gBACnB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;oBACrB,KAAK,EAAE,cAAc;oBACrB,iBAAiB,EAAE,4BAA4B;iBAChD,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE;YACtB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAA;QACF,YAAY,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC,CAAA;QAE/C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;QAC/D,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,QAAQ,QAAQ,UAAU,OAAO,CAAC,KAAK,EAAE,CAAA;QAE/F,MAAM,IAAI,GAA4B,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAA;QAC7E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;YACzB,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC9B,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBACpE,eAAe,EAAE,CAAA;YACnB,CAAC;QACH,CAAC;QACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB;QAChE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;QACD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,GAAoB,EAAE,GAAmB;QAC5D,IAAI,IAA4B,CAAA;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;YAC3D,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,+BAA+B;aACnD,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;YAClD,OAAM;QACR,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAEtB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,eAAe,GAAG,IAAI,EAAE,CAAC;YAC1D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;YAClD,OAAM;QACR,CAAC;QAED,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YACzC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,wBAAwB;aAC5C,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;YAClD,OAAM;QACR,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAA;QAClE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;YACrB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAoB,EAAE,GAAmB;QACjE,2BAA2B;QAC3B,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAChD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,wBAAwB;aAC5C,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,oBAAoB;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,SAAS,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;YAC9D,gBAAgB,EAAE,CAAA;YAClB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,QAAgC,CAAA;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAyB,GAAG,CAAC,CAAA;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,mBAAmB;aACvC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,iEAAiE;QACjE,WAAW,CAAC,QAAQ,IAAI,CAAC,CAAA;QAEzB,0BAA0B;QAC1B,IAAI,WAAW,CAAC,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YAC5C,gBAAgB,EAAE,CAAA;YAClB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,mBAAmB;aACvC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,GAAoB,IAAI,CAAA;QACpC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;gBACtD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1E,QAAQ,GAAG,MAAM,CAAA;gBACnB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;oBACrB,KAAK,EAAE,cAAc;oBACrB,iBAAiB,EAAE,8BAA8B;iBAClD,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAA;YACnF,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QAED,yEAAyE;QACzE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,cAAc,IAAI,QAAQ,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,CAAC;YACrG,eAAe,EAAE,CAAA;YACjB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;YACzD,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,gBAAgB,EAAE,CAAA;QAClB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,IAAqB,EAAE,GAAmB;QAC1E,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB;QAClE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB;QAClE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAG,GAAG,QAAQ;QACvC,WAAW,CAAC,GAAG,CAAC,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE;QACzD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAClD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE;QACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yCAAyC,EAAE,OAAO,EAAE,WAAW,EAAE;QACxF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE;KACvF,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;AAClD,CAAC"}

package/build/auth/router.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Internal minimal HTTP router. Not exported from the package.
+ * Matches requests by method + pathname, calls first matching handler.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export type RequestHandler = (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+interface Route {
+    method: string;
+    path: string;
+    handler: RequestHandler;
+}
+export declare function createRouter(routes: Route[]): RequestHandler;
+export declare function parseJsonBody<T = Record<string, unknown>>(req: IncomingMessage): Promise<T>;
+export declare function parseFormBody(req: IncomingMessage): Promise<Record<string, string>>;
+export declare function jsonResponse(res: ServerResponse, status: number, body: unknown): void;
+export declare function htmlResponse(res: ServerResponse, status: number, html: string): void;
+export {};
+//# sourceMappingURL=router.d.ts.map

package/build/auth/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/auth/router.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhG,UAAU,KAAK;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,cAAc,CAAA;CACxB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAuB5D;AAED,wBAAsB,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,CAajG;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAczF;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGrF;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGpF"}

package/build/auth/router.js

@@ -0,0 +1,62 @@
+export function createRouter(routes) {
+    return async (req, res) => {
+        const method = req.method?.toUpperCase() ?? 'GET';
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const pathname = url.pathname;
+        for (const route of routes) {
+            if (route.method === method && route.path === pathname) {
+                try {
+                    await route.handler(req, res);
+                }
+                catch {
+                    if (!res.headersSent) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'internal_error' }));
+                    }
+                }
+                return;
+            }
+        }
+        res.writeHead(404, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'not_found' }));
+    };
+}
+export async function parseJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on('data', (chunk) => chunks.push(chunk));
+        req.on('end', () => {
+            try {
+                resolve(JSON.parse(Buffer.concat(chunks).toString('utf-8')));
+            }
+            catch {
+                reject(new Error('Invalid JSON'));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+export async function parseFormBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on('data', (chunk) => chunks.push(chunk));
+        req.on('end', () => {
+            const params = new URLSearchParams(Buffer.concat(chunks).toString('utf-8'));
+            const result = {};
+            for (const [key, value] of params) {
+                result[key] = value;
+            }
+            resolve(result);
+        });
+        req.on('error', reject);
+    });
+}
+export function jsonResponse(res, status, body) {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+export function htmlResponse(res, status, html) {
+    res.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(html);
+}
+//# sourceMappingURL=router.js.map

package/build/auth/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/auth/router.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,KAAK,CAAA;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;QAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;oBACtD,CAAC;gBACH,CAAC;gBACD,OAAM;YACR,CAAC;QACH,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACjD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAA8B,GAAoB;IACnF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YAC3E,MAAM,MAAM,GAA2B,EAAE,CAAA;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACrB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC7E,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IAC5E,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}

package/build/auth/well-known.d.ts

@@ -0,0 +1,4 @@
+/** OAuth 2.1 well-known metadata generators (RFC 8414 + RFC 9728). */
+export declare function authorizationServerMetadata(issuerUrl: string): Record<string, unknown>;
+export declare function protectedResourceMetadata(resource: string, authorizationServers: string[]): Record<string, unknown>;
+//# sourceMappingURL=well-known.d.ts.map

package/build/auth/well-known.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtF;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMnH"}

package/build/auth/well-known.js

@@ -0,0 +1,20 @@
+/** OAuth 2.1 well-known metadata generators (RFC 8414 + RFC 9728). */
+export function authorizationServerMetadata(issuerUrl) {
+    return {
+        issuer: issuerUrl,
+        authorization_endpoint: `${issuerUrl}/authorize`,
+        token_endpoint: `${issuerUrl}/token`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none']
+    };
+}
+export function protectedResourceMetadata(resource, authorizationServers) {
+    return {
+        resource,
+        authorization_servers: authorizationServers,
+        bearer_methods_supported: ['header']
+    };
+}
+//# sourceMappingURL=well-known.js.map

package/build/auth/well-known.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,sBAAsB,EAAE,GAAG,SAAS,YAAY;QAChD,cAAc,EAAE,GAAG,SAAS,QAAQ;QACpC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,oBAA8B;IACxF,OAAO;QACL,QAAQ;QACR,qBAAqB,EAAE,oBAAoB;QAC3C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAA;AACH,CAAC"}

package/build/index.d.ts

@@ -1,3 +1,4 @@
+export { authorizationServerMetadata, type CapabilityInfo, type ConfigField, type CredentialsCallback, createLocalOAuthApp, type LocalOAuthAppOptions, type LocalOAuthAppResult, type NextStep, protectedResourceMetadata, type RelayConfigSchema, type RenderOptions, renderCredentialForm, type StepCallback } from './auth/index.js';
 export * from './crypto/index.js';
 export { JWTIssuer } from './oauth/jwt-issuer.js';
 export { InMemoryAuthCache, type IOAuthSessionCache, OAuthProvider, type OAuthProviderOptions, type PreAuthSession } from './oauth/provider.js';
@@ -5,8 +6,9 @@ export { type IUserCredentialStore, SqliteUserStore } from './oauth/user-store.j
 export { tryOpenBrowser } from './relay/browser.js';
 export { createSession, generatePassphrase, pollForResponses, pollForResult, type RelaySession, sendMessage } from './relay/client.js';
 export type * from './schema/types.js';
-export { deleteConfig, exportConfig, importConfig, listConfigs, readConfig, writeConfig } from './storage/config-file.js';
+export { deleteConfig, exportConfig, importConfig, listConfigs, readConfig, scheduleReloadExit, writeConfig } from './storage/config-file.js';
 export { clearMode, getMode, type ServerMode, setLocalMode } from './storage/mode.js';
 export * from './storage/resolver.js';
 export { acquireSessionLock, releaseSessionLock, type SessionInfo, writeSessionLock } from './storage/session-lock.js';
+export { type LocalServerHandle, type RunLocalServerOptions, runLocalServer } from './transport/local-server.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,KAAK,YAAY,EACjB,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACb,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,oBAAoB,EACpB,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAA;AACxB,cAAc,mBAAmB,CAAA;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,KAAK,YAAY,EACjB,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,WAAW,EACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,cAAc,EACf,MAAM,6BAA6B,CAAA"}

package/build/index.js

@@ -1,3 +1,5 @@
+// Local OAuth 2.1 Authorization Server (single-user, 127.0.0.1)
+export { authorizationServerMetadata, createLocalOAuthApp, protectedResourceMetadata, renderCredentialForm } from './auth/index.js';
 export * from './crypto/index.js';
 // OAuth 2.1 multi-user infrastructure (HTTP mode)
 export { JWTIssuer } from './oauth/jwt-issuer.js';
@@ -5,8 +7,10 @@ export { InMemoryAuthCache, OAuthProvider } from './oauth/provider.js';
 export { SqliteUserStore } from './oauth/user-store.js';
 export { tryOpenBrowser } from './relay/browser.js';
 export { createSession, generatePassphrase, pollForResponses, pollForResult, sendMessage } from './relay/client.js';
-export { deleteConfig, exportConfig, importConfig, listConfigs, readConfig, writeConfig } from './storage/config-file.js';
+export { deleteConfig, exportConfig, importConfig, listConfigs, readConfig, scheduleReloadExit, writeConfig } from './storage/config-file.js';
 export { clearMode, getMode, setLocalMode } from './storage/mode.js';
 export * from './storage/resolver.js';
 export { acquireSessionLock, releaseSessionLock, writeSessionLock } from './storage/session-lock.js';
+// Local MCP server entry point (OAuth AS + /mcp transport on 127.0.0.1)
+export { runLocalServer } from './transport/local-server.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EACL,iBAAiB,EAEjB,aAAa,EAGd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA6B,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EAEb,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAmB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAI3B,mBAAmB,EAInB,yBAAyB,EAGzB,oBAAoB,EAErB,MAAM,iBAAiB,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EACL,iBAAiB,EAEjB,aAAa,EAGd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA6B,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EAEb,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,WAAW,EACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAmB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,wEAAwE;AACxE,OAAO,EAGL,cAAc,EACf,MAAM,6BAA6B,CAAA"}

package/build/relay/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/relay/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsCH;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BlE"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/relay/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AA4CH;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqClE"}