@openephemeris/mcp-server 3.13.9 → 3.14.0

package/dist/oauth/store.js

@@ -0,0 +1,361 @@
+/**
+ * src/oauth/store.ts — OAuth authorization code store.
+ *
+ * Architecture: in-memory is always the source of truth for the MCP server
+ * process. When Supabase env vars are present AND valid, codes are ALSO
+ * persisted async to Supabase for durability and multi-instance lookup.
+ *
+ * This means:
+ *   - Unit tests (no env vars) → pure in-memory, zero network calls ✓
+ *   - Production (Supabase set)  → in-memory for hot-path, Supabase for
+ *     persistence/audit trail ✓
+ *
+ * NOTE: The consent page (/api/oauth/approve) writes directly to Supabase
+ * using the service role key without going through this store.  The store
+ * is used by the MCP server's own /oauth/* endpoints.
+ *
+ * Security:
+ *   - NEVER log the `code` value.  Log only the row `id` (uuid).
+ *   - consumeCodeAsync marks codes consumed atomically in Supabase when
+ *     Supabase is reachable; falls through to in-memory otherwise.
+ */
+import https from "node:https";
+import { generateAuthorizationCode } from "./pkce.js";
+import { randomBytes } from "node:crypto";
+// ---------------------------------------------------------------------------
+// Supabase config (read at runtime, never at import time)
+// ---------------------------------------------------------------------------
+function getSupabaseConfig() {
+    const env = process.env;
+    const url = env["SUPABASE_URL"] || "";
+    const key = env["SUPABASE_SERVICE_ROLE_KEY"] || "";
+    if (!url || !key)
+        return null;
+    return { url, key };
+}
+// ---------------------------------------------------------------------------
+// Raw HTTPS helper (mirrors device-db.ts pattern)
+// ---------------------------------------------------------------------------
+function postgrestRequest(method, path, body, extraHeaders) {
+    const cfg = getSupabaseConfig();
+    const parsed = new URL(path, cfg.url);
+    return new Promise((resolve, reject) => {
+        const options = {
+            hostname: parsed.hostname,
+            port: 443,
+            path: parsed.pathname + parsed.search,
+            method,
+            headers: {
+                apikey: cfg.key,
+                Authorization: `Bearer ${cfg.key}`,
+                "Content-Type": "application/json",
+                Prefer: method === "POST" ? "return=representation" : "return=minimal",
+                ...extraHeaders,
+            },
+        };
+        const req = https.request(options, (res) => {
+            let raw = "";
+            res.on("data", (chunk) => { raw += chunk; });
+            res.on("end", () => {
+                try {
+                    resolve({ status: res.statusCode ?? 500, data: JSON.parse(raw) });
+                }
+                catch {
+                    resolve({ status: res.statusCode ?? 500, data: raw });
+                }
+            });
+        });
+        req.on("error", reject);
+        if (body)
+            req.write(JSON.stringify(body));
+        req.end();
+    });
+}
+// ---------------------------------------------------------------------------
+// Supabase persistence (fire-and-forget durability write)
+// ---------------------------------------------------------------------------
+function persistCodeToSupabase(code, options, expiresAt) {
+    const cfg = getSupabaseConfig();
+    if (!cfg)
+        return; // No-op in tests
+    postgrestRequest("POST", "/rest/v1/oauth_authorization_codes", {
+        code,
+        client_id: options.client_id,
+        user_id: options.user_id ?? "00000000-0000-0000-0000-000000000000",
+        redirect_uri: options.redirect_uri,
+        code_challenge: options.code_challenge,
+        code_challenge_method: options.code_challenge_method,
+        scopes: ["openephemeris:read"],
+        consumed: false,
+        expires_at: expiresAt.toISOString(),
+    })
+        .then(({ status, data }) => {
+        if (status < 200 || status >= 300) {
+            console.warn(`[store] Supabase persist failed: ${status}`, data);
+            return;
+        }
+        const rows = Array.isArray(data) ? data : [data];
+        const id = rows[0]?.id ?? "(unknown)";
+        console.info(`[store] code persisted to Supabase id=${id}`);
+    })
+        .catch((err) => {
+        // Non-fatal — in-memory store is the authoritative source
+        console.warn("[store] Supabase persist error (non-fatal):", err.message);
+    });
+}
+// ---------------------------------------------------------------------------
+// Refresh-token persistence (mirrors persistCodeToSupabase pattern)
+// ---------------------------------------------------------------------------
+function persistRefreshTokenToSupabase(token, meta, expiresAt) {
+    const cfg = getSupabaseConfig();
+    if (!cfg)
+        return; // No-op in tests
+    const m = meta;
+    postgrestRequest("POST", "/rest/v1/oauth_refresh_tokens", {
+        token,
+        client_id: m.client_id ?? "unknown",
+        user_id: m.user_id ?? null,
+        supabase_refresh_token: m.supabase_refresh_token ?? null,
+        consumed: false,
+        expires_at: expiresAt.toISOString(),
+    })
+        .then(({ status, data }) => {
+        if (status < 200 || status >= 300) {
+            console.warn(`[store] Supabase refresh-token persist failed: ${status}`, data);
+            return;
+        }
+        const rows = Array.isArray(data) ? data : [data];
+        const id = rows[0]?.id ?? "(unknown)";
+        console.info(`[store] refresh token persisted to Supabase id=${id}`);
+    })
+        .catch((err) => {
+        // Non-fatal — in-memory store still serves same-instance refreshes
+        console.warn("[store] Supabase refresh-token persist error (non-fatal):", err.message);
+    });
+}
+// ---------------------------------------------------------------------------
+// OAuthStore
+// ---------------------------------------------------------------------------
+export class OAuthStore {
+    /** In-memory is ALWAYS the hot-path source of truth */
+    codes = new Map();
+    refreshTokens = new Map();
+    cleanupTimer = null;
+    constructor() {
+        // Auto-cleanup expired codes every 60 seconds
+        this.cleanupTimer = setInterval(() => this.purgeExpired(), 60_000);
+        if (this.cleanupTimer.unref)
+            this.cleanupTimer.unref();
+    }
+    // ------------------------------------------------------------------
+    // Authorization codes
+    // ------------------------------------------------------------------
+    /**
+     * Issue a new authorization code.
+     *
+     * Always writes to in-memory (fast, test-safe).
+     * Also fire-and-forgets a Supabase persist when env vars are set.
+     */
+    issueCode(options) {
+        const code = generateAuthorizationCode();
+        const expiresInMs = options.expiresInMs ?? 600_000; // 10 min default
+        const expires_at = new Date(Date.now() + expiresInMs);
+        this.codes.set(code, { ...options, used: false, expires_at });
+        // Async durability write — non-blocking
+        persistCodeToSupabase(code, options, expires_at);
+        return code;
+    }
+    /**
+     * Consume a code synchronously from in-memory (single-use).
+     * This is the fast-path used by the token endpoint.
+     */
+    consumeCode(code) {
+        const stored = this.codes.get(code);
+        if (!stored)
+            return null;
+        if (stored.used)
+            return null;
+        if (stored.expires_at < new Date()) {
+            this.codes.delete(code);
+            return null;
+        }
+        stored.used = true;
+        return { ...stored };
+    }
+    /**
+     * Async consume — checks in-memory first, then Supabase.
+     *
+     * Use this from token.ts so production deployments with Supabase
+     * can survive process restarts (code issued before restart lives in DB).
+     */
+    async consumeCodeAsync(code) {
+        // Fast path: in-memory hit (covers 99% of cases)
+        const inMem = this.consumeCode(code);
+        if (inMem)
+            return inMem;
+        // Slow path: try Supabase (handles post-restart lookups)
+        const cfg = getSupabaseConfig();
+        if (!cfg)
+            return null;
+        try {
+            const selectPath = `/rest/v1/oauth_authorization_codes` +
+                `?code=eq.${encodeURIComponent(code)}` +
+                `&consumed=eq.false` +
+                `&expires_at=gt.${encodeURIComponent(new Date().toISOString())}` +
+                `&limit=1`;
+            const { status: selStatus, data: selData } = await postgrestRequest("GET", selectPath);
+            if (selStatus < 200 || selStatus >= 300)
+                return null;
+            const rows = Array.isArray(selData) ? selData : [];
+            if (rows.length === 0)
+                return null;
+            const row = rows[0];
+            // Optimistic lock: mark consumed=true WHERE consumed=false
+            const updatePath = `/rest/v1/oauth_authorization_codes?id=eq.${row.id}&consumed=eq.false`;
+            const { status: updStatus } = await postgrestRequest("PATCH", updatePath, {
+                consumed: true,
+            });
+            if (updStatus < 200 || updStatus >= 300) {
+                console.warn(`[store] Supabase consume mark failed id=${row.id} status=${updStatus}`);
+                return null;
+            }
+            console.info(`[store] code consumed from Supabase id=${row.id}`);
+            return {
+                client_id: row.client_id,
+                user_id: row.user_id,
+                redirect_uri: row.redirect_uri,
+                code_challenge: row.code_challenge,
+                code_challenge_method: row.code_challenge_method,
+                used: true,
+                expires_at: new Date(row.expires_at),
+            };
+        }
+        catch (err) {
+            console.warn("[store] Supabase consume error:", err.message);
+            return null;
+        }
+    }
+    // ------------------------------------------------------------------
+    // Refresh tokens
+    //
+    // In-memory map is the hot path. When Supabase is configured, we ALSO
+    // persist to oauth_refresh_tokens so a refresh request that lands on a
+    // different Fly machine (oe-mcp-live has min_machines_running=2) or
+    // arrives after a machine restart can still be honored. Without this,
+    // ~50% of refresh attempts fail with invalid_grant just from
+    // multi-instance load balancing alone.
+    // ------------------------------------------------------------------
+    /**
+     * Refresh-token TTL — 90 days, sliding (reset on each rotation).
+     * Matches GitHub's 6-month convention more closely than Supabase's 30d
+     * default. Tradeoff: longer-lived refresh tokens = bigger blast radius
+     * on leak; rotation + Supabase RLS mitigates this. An active user who
+     * touches OE at least once per 90d gets an effectively permanent
+     * connection.
+     */
+    static REFRESH_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+    storeRefreshToken(token, meta) {
+        const expires_at = new Date(Date.now() + OAuthStore.REFRESH_TTL_MS);
+        this.refreshTokens.set(token, { ...meta, consumed: false, expires_at });
+        // Async durability write — non-blocking
+        persistRefreshTokenToSupabase(token, meta, expires_at);
+    }
+    /**
+     * Synchronous in-memory consume. Kept for backward compat with any callers
+     * that don't need cross-instance resilience. Token endpoint must use
+     * consumeRefreshTokenAsync.
+     */
+    consumeRefreshToken(token) {
+        const stored = this.refreshTokens.get(token);
+        if (!stored || stored.consumed)
+            return null;
+        if (stored.expires_at < new Date()) {
+            // In-memory entry outlived its TTL. Drop it; the Supabase row (if any)
+            // is also past its expires_at and will be rejected by the WHERE filter
+            // in consumeRefreshTokenAsync's slow path.
+            this.refreshTokens.delete(token);
+            return null;
+        }
+        stored.consumed = true;
+        return { ...stored };
+    }
+    /**
+     * Async consume — checks in-memory first, then Supabase. This is what the
+     * token endpoint uses so refresh requests survive machine restarts and
+     * load-balancing across multiple Fly instances.
+     */
+    async consumeRefreshTokenAsync(token) {
+        // Fast path: in-memory hit
+        const inMem = this.consumeRefreshToken(token);
+        if (inMem)
+            return inMem;
+        // Slow path: Supabase lookup with atomic mark-consumed
+        const cfg = getSupabaseConfig();
+        if (!cfg)
+            return null;
+        try {
+            const selectPath = `/rest/v1/oauth_refresh_tokens` +
+                `?token=eq.${encodeURIComponent(token)}` +
+                `&consumed=eq.false` +
+                `&expires_at=gt.${encodeURIComponent(new Date().toISOString())}` +
+                `&limit=1`;
+            const { status: selStatus, data: selData } = await postgrestRequest("GET", selectPath);
+            if (selStatus < 200 || selStatus >= 300)
+                return null;
+            const rows = Array.isArray(selData) ? selData : [];
+            if (rows.length === 0)
+                return null;
+            const row = rows[0];
+            // Optimistic lock: mark consumed=true WHERE consumed=false
+            const updatePath = `/rest/v1/oauth_refresh_tokens?id=eq.${row.id}&consumed=eq.false`;
+            const { status: updStatus } = await postgrestRequest("PATCH", updatePath, {
+                consumed: true,
+            });
+            if (updStatus < 200 || updStatus >= 300) {
+                // Lost the race — another instance consumed it. Treat as invalid.
+                console.warn(`[store] Supabase refresh-token consume race lost id=${row.id} status=${updStatus}`);
+                return null;
+            }
+            console.info(`[store] refresh token consumed from Supabase id=${row.id}`);
+            const result = {
+                consumed: true,
+                client_id: row.client_id,
+            };
+            if (row.user_id)
+                result.user_id = row.user_id;
+            if (row.supabase_refresh_token)
+                result.supabase_refresh_token = row.supabase_refresh_token;
+            return result;
+        }
+        catch (err) {
+            console.warn("[store] Supabase refresh-token consume error:", err.message);
+            return null;
+        }
+    }
+    generateRefreshToken() {
+        return randomBytes(32).toString("hex");
+    }
+    // ------------------------------------------------------------------
+    // Test utilities
+    // ------------------------------------------------------------------
+    reset() {
+        this.codes.clear();
+        this.refreshTokens.clear();
+    }
+    // ------------------------------------------------------------------
+    // Cleanup
+    // ------------------------------------------------------------------
+    purgeExpired() {
+        const now = new Date();
+        for (const [code, stored] of this.codes) {
+            if (stored.expires_at < now)
+                this.codes.delete(code);
+        }
+    }
+    destroy() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+    }
+}

package/dist/oauth/supabase-jwt.d.ts

@@ -0,0 +1,39 @@
+/**
+ * src/oauth/supabase-jwt.ts — Issue real Supabase JWTs for OAuth code exchange.
+ *
+ * Strategy:
+ *   1. After the consent page stores an authorization code (with user_id) in
+ *      Supabase, the token endpoint consumes that code and retrieves user_id.
+ *   2. This module verifies the user exists via the Admin API, then signs an
+ *      HS256 JWT using SUPABASE_JWT_SECRET — the same secret Supabase GoTrue
+ *      uses internally.
+ *   3. The resulting JWT starts with "eyJ" → extractAuth classifies it as a
+ *      JWT → the Go sidecar validates it via ValidateSupabaseJWT (HS256 path).
+ *
+ * Why HS256 self-sign instead of GoTrue session APIs:
+ *   - Zero extra HTTP round-trips beyond the user-existence check.
+ *   - The Go sidecar uses loadLiveBillingMetadata to fetch tier from the DB,
+ *     so JWT-embedded app_metadata.billing_tier isn't required.
+ *   - generate_link + OTP exchange adds fragile indirection for no benefit.
+ *
+ * Fallback: If env vars aren't set (test/dev), returns null and the token
+ * endpoint falls back to placeholder tokens.
+ *
+ * Required env vars:
+ *   - SUPABASE_URL              (e.g. https://xxxx.supabase.co)
+ *   - SUPABASE_SERVICE_ROLE_KEY (for Admin API user lookup)
+ *   - SUPABASE_JWT_SECRET       (for HS256 signing)
+ */
+export interface SupabaseSessionTokens {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type: "bearer";
+}
+/**
+ * Verify the user exists in Supabase, then self-sign an HS256 JWT using
+ * SUPABASE_JWT_SECRET. Returns null if any required env var is missing
+ * or the user doesn't exist.
+ */
+export declare function issueSupabaseJWT(userId: string): Promise<SupabaseSessionTokens | null>;
+export declare function refreshSupabaseSession(refreshToken: string): Promise<SupabaseSessionTokens | null>;

package/dist/oauth/supabase-jwt.js

@@ -0,0 +1,194 @@
+/**
+ * src/oauth/supabase-jwt.ts — Issue real Supabase JWTs for OAuth code exchange.
+ *
+ * Strategy:
+ *   1. After the consent page stores an authorization code (with user_id) in
+ *      Supabase, the token endpoint consumes that code and retrieves user_id.
+ *   2. This module verifies the user exists via the Admin API, then signs an
+ *      HS256 JWT using SUPABASE_JWT_SECRET — the same secret Supabase GoTrue
+ *      uses internally.
+ *   3. The resulting JWT starts with "eyJ" → extractAuth classifies it as a
+ *      JWT → the Go sidecar validates it via ValidateSupabaseJWT (HS256 path).
+ *
+ * Why HS256 self-sign instead of GoTrue session APIs:
+ *   - Zero extra HTTP round-trips beyond the user-existence check.
+ *   - The Go sidecar uses loadLiveBillingMetadata to fetch tier from the DB,
+ *     so JWT-embedded app_metadata.billing_tier isn't required.
+ *   - generate_link + OTP exchange adds fragile indirection for no benefit.
+ *
+ * Fallback: If env vars aren't set (test/dev), returns null and the token
+ * endpoint falls back to placeholder tokens.
+ *
+ * Required env vars:
+ *   - SUPABASE_URL              (e.g. https://xxxx.supabase.co)
+ *   - SUPABASE_SERVICE_ROLE_KEY (for Admin API user lookup)
+ *   - SUPABASE_JWT_SECRET       (for HS256 signing)
+ */
+import https from "node:https";
+import { createHmac, randomBytes } from "node:crypto";
+function getConfig() {
+    const url = process.env["SUPABASE_URL"] || "";
+    const key = process.env["SUPABASE_SERVICE_ROLE_KEY"] || "";
+    if (!url || !key)
+        return null;
+    return { url, serviceRoleKey: key };
+}
+// ---------------------------------------------------------------------------
+// Admin API request helper (raw HTTPS, no dependencies)
+// ---------------------------------------------------------------------------
+function adminRequest(method, pathname, body, cfg) {
+    const parsed = new URL(pathname, cfg.url);
+    return new Promise((resolve, reject) => {
+        const options = {
+            hostname: parsed.hostname,
+            port: 443,
+            path: parsed.pathname + parsed.search,
+            method,
+            headers: {
+                apikey: cfg.serviceRoleKey,
+                Authorization: `Bearer ${cfg.serviceRoleKey}`,
+                "Content-Type": "application/json",
+            },
+        };
+        const req = https.request(options, (res) => {
+            let raw = "";
+            res.on("data", (chunk) => { raw += chunk; });
+            res.on("end", () => {
+                try {
+                    resolve({ status: res.statusCode ?? 500, data: JSON.parse(raw) });
+                }
+                catch {
+                    resolve({ status: res.statusCode ?? 500, data: raw });
+                }
+            });
+        });
+        req.on("error", reject);
+        req.setTimeout(10_000, () => {
+            req.destroy(new Error("Supabase admin request timed out"));
+        });
+        if (body)
+            req.write(JSON.stringify(body));
+        req.end();
+    });
+}
+// ---------------------------------------------------------------------------
+// Get user by ID — verifies existence and retrieves email for JWT claims
+// ---------------------------------------------------------------------------
+async function getUserById(userId, cfg) {
+    try {
+        const { status, data } = await adminRequest("GET", `/auth/v1/admin/users/${encodeURIComponent(userId)}`, null, cfg);
+        if (status < 200 || status >= 300) {
+            console.warn(`[supabase-jwt] getUserById failed: status=${status}`, data);
+            return null;
+        }
+        const user = data;
+        if (!user.id || !user.email)
+            return null;
+        return { id: user.id, email: user.email };
+    }
+    catch (err) {
+        console.warn("[supabase-jwt] getUserById error:", err.message);
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Issue a real Supabase-compatible JWT for a given user_id
+// ---------------------------------------------------------------------------
+/**
+ * Verify the user exists in Supabase, then self-sign an HS256 JWT using
+ * SUPABASE_JWT_SECRET. Returns null if any required env var is missing
+ * or the user doesn't exist.
+ */
+export async function issueSupabaseJWT(userId) {
+    const cfg = getConfig();
+    if (!cfg)
+        return null;
+    const secret = process.env["SUPABASE_JWT_SECRET"];
+    if (!secret) {
+        console.warn("[supabase-jwt] SUPABASE_JWT_SECRET not set, cannot issue JWT");
+        return null;
+    }
+    // Verify the user exists and get their email for the JWT claims
+    const user = await getUserById(userId, cfg);
+    if (!user) {
+        console.warn(`[supabase-jwt] Cannot issue JWT: user ${userId} not found`);
+        return null;
+    }
+    return signJWT(userId, user.email, secret);
+}
+// ---------------------------------------------------------------------------
+// HS256 JWT signing — mirrors Supabase GoTrue's internal token structure
+// ---------------------------------------------------------------------------
+// The Go sidecar's ValidateSupabaseJWT accepts HS256 tokens signed with
+// SUPABASE_JWT_SECRET. Tier/billing resolution happens via a live DB lookup
+// in loadLiveBillingMetadata, so the JWT doesn't need billing_tier in
+// app_metadata — sub (user_id) is sufficient.
+function signJWT(userId, email, secret) {
+    const now = Math.floor(Date.now() / 1000);
+    const expiresIn = 3600; // 1 hour
+    const header = { alg: "HS256", typ: "JWT" };
+    const payload = {
+        aud: "authenticated",
+        exp: now + expiresIn,
+        iat: now,
+        nbf: now,
+        iss: process.env["SUPABASE_URL"]
+            ? `${process.env["SUPABASE_URL"]}/auth/v1`
+            : "https://mcp.openephemeris.com/auth/v1",
+        sub: userId,
+        email,
+        role: "authenticated",
+        session_id: `mcp_oauth_${Date.now()}`,
+        app_metadata: { provider: "mcp_oauth", providers: ["mcp_oauth"] },
+        user_metadata: {},
+    };
+    const b64url = (obj) => Buffer.from(JSON.stringify(obj)).toString("base64url");
+    const headerEncoded = b64url(header);
+    const payloadEncoded = b64url(payload);
+    const signingInput = `${headerEncoded}.${payloadEncoded}`;
+    const signature = createHmac("sha256", secret)
+        .update(signingInput)
+        .digest("base64url");
+    const accessToken = `${signingInput}.${signature}`;
+    const refreshToken = randomBytes(32).toString("hex");
+    console.info(`[supabase-jwt] HS256 JWT issued for user ${userId}`);
+    return {
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_in: expiresIn,
+        token_type: "bearer",
+    };
+}
+// ---------------------------------------------------------------------------
+// Refresh a Supabase session (for grant_type=refresh_token flow)
+// ---------------------------------------------------------------------------
+// Note: Our self-signed JWTs use random hex refresh tokens, not real Supabase
+// refresh tokens. This function handles the case where a real Supabase refresh
+// token was obtained (e.g. from a future generate_link integration). For
+// self-signed tokens, the token endpoint falls back to issueSupabaseJWT with
+// the stored user_id instead of calling this.
+export async function refreshSupabaseSession(refreshToken) {
+    const cfg = getConfig();
+    if (!cfg)
+        return null;
+    try {
+        const { status, data } = await adminRequest("POST", "/auth/v1/token?grant_type=refresh_token", { refresh_token: refreshToken }, cfg);
+        if (status < 200 || status >= 300) {
+            console.warn(`[supabase-jwt] refresh failed: status=${status}`);
+            return null;
+        }
+        const result = data;
+        if (!result.access_token?.startsWith("eyJ"))
+            return null;
+        return {
+            access_token: result.access_token,
+            refresh_token: result.refresh_token || "",
+            expires_in: result.expires_in || 3600,
+            token_type: "bearer",
+        };
+    }
+    catch (err) {
+        console.warn("[supabase-jwt] refresh error:", err.message);
+        return null;
+    }
+}

package/dist/oauth/token.d.ts

@@ -0,0 +1,21 @@
+/**
+ * src/oauth/token.ts — OAuth 2.1 Token endpoint.
+ *
+ * POST /oauth/token
+ *
+ * Supports:
+ *   - grant_type=authorization_code (with PKCE S256 verification)
+ *   - grant_type=refresh_token (with rotation enforcement)
+ *
+ * Token issuance strategy:
+ *   1. In-memory store validates code/PKCE/redirect_uri
+ *   2. If Supabase env vars are set AND the stored code has a user_id,
+ *      issue a real Supabase JWT via supabase-jwt.ts
+ *   3. Otherwise fall back to local placeholder tokens (test path)
+ *
+ * The Supabase path is never attempted unless BOTH SUPABASE_URL and
+ * SUPABASE_SERVICE_ROLE_KEY are set. Tests run without either.
+ */
+import express from "express";
+import type { OAuthStore } from "./store.js";
+export declare function oauthTokenRouter(store: OAuthStore): express.Router;