@prmichaelsen/mcp-auth 0.1.0

package/dist/utils/logger.js

@@ -0,0 +1,200 @@
+var LogLevel = /* @__PURE__ */ ((LogLevel2) => {
+  LogLevel2[LogLevel2["DEBUG"] = 0] = "DEBUG";
+  LogLevel2[LogLevel2["INFO"] = 1] = "INFO";
+  LogLevel2[LogLevel2["WARN"] = 2] = "WARN";
+  LogLevel2[LogLevel2["ERROR"] = 3] = "ERROR";
+  return LogLevel2;
+})(LogLevel || {});
+class Logger {
+  config;
+  minLevel;
+  constructor(config = {}) {
+    this.config = {
+      enabled: config.enabled ?? true,
+      level: config.level ?? "info",
+      format: config.format ?? "text",
+      logBodies: config.logBodies ?? false
+    };
+    this.minLevel = this.getLevelValue(this.config.level);
+  }
+  /**
+   * Convert log level string to numeric value
+   */
+  getLevelValue(level) {
+    switch (level) {
+      case "debug":
+        return 0 /* DEBUG */;
+      case "info":
+        return 1 /* INFO */;
+      case "warn":
+        return 2 /* WARN */;
+      case "error":
+        return 3 /* ERROR */;
+      default:
+        return 1 /* INFO */;
+    }
+  }
+  /**
+   * Check if a log level should be logged
+   */
+  shouldLog(level) {
+    return this.config.enabled && level >= this.minLevel;
+  }
+  /**
+   * Format log entry
+   */
+  formatEntry(entry) {
+    if (this.config.format === "json") {
+      return JSON.stringify(entry);
+    }
+    let output = `[${entry.timestamp}] ${entry.level.toUpperCase()}: ${entry.message}`;
+    if (entry.context && Object.keys(entry.context).length > 0) {
+      output += ` ${JSON.stringify(entry.context)}`;
+    }
+    if (entry.error) {
+      output += `
+  Error: ${entry.error.name}: ${entry.error.message}`;
+      if (entry.error.stack) {
+        output += `
+${entry.error.stack}`;
+      }
+    }
+    return output;
+  }
+  /**
+   * Create log entry
+   */
+  createEntry(level, message, context, error) {
+    const entry = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      level,
+      message,
+      context
+    };
+    if (error) {
+      entry.error = {
+        name: error.name,
+        message: error.message,
+        stack: error.stack
+      };
+    }
+    return entry;
+  }
+  /**
+   * Write log entry to output
+   */
+  write(entry) {
+    const formatted = this.formatEntry(entry);
+    switch (entry.level) {
+      case "debug":
+        console.debug(formatted);
+        break;
+      case "info":
+        console.info(formatted);
+        break;
+      case "warn":
+        console.warn(formatted);
+        break;
+      case "error":
+        console.error(formatted);
+        break;
+      default:
+        console.log(formatted);
+    }
+  }
+  /**
+   * Log debug message
+   */
+  debug(message, context) {
+    if (this.shouldLog(0 /* DEBUG */)) {
+      const entry = this.createEntry("debug", message, context);
+      this.write(entry);
+    }
+  }
+  /**
+   * Log info message
+   */
+  info(message, context) {
+    if (this.shouldLog(1 /* INFO */)) {
+      const entry = this.createEntry("info", message, context);
+      this.write(entry);
+    }
+  }
+  /**
+   * Log warning message
+   */
+  warn(message, context) {
+    if (this.shouldLog(2 /* WARN */)) {
+      const entry = this.createEntry("warn", message, context);
+      this.write(entry);
+    }
+  }
+  /**
+   * Log error message
+   */
+  error(message, error, context) {
+    if (this.shouldLog(3 /* ERROR */)) {
+      const entry = this.createEntry("error", message, context, error);
+      this.write(entry);
+    }
+  }
+  /**
+   * Create a child logger with additional context
+   */
+  child(context) {
+    const childLogger = new Logger(this.config);
+    const originalWrite = childLogger.write.bind(childLogger);
+    childLogger.write = (entry) => {
+      entry.context = { ...context, ...entry.context };
+      originalWrite(entry);
+    };
+    return childLogger;
+  }
+  /**
+   * Update logger configuration
+   */
+  configure(config) {
+    this.config = { ...this.config, ...config };
+    this.minLevel = this.getLevelValue(this.config.level);
+  }
+}
+const defaultLogger = new Logger();
+function createLogger(config) {
+  return new Logger(config);
+}
+function sanitizeForLogging(data) {
+  if (typeof data !== "object" || data === null) {
+    return data;
+  }
+  const sensitiveKeys = [
+    "password",
+    "token",
+    "secret",
+    "apiKey",
+    "accessToken",
+    "refreshToken",
+    "authorization",
+    "cookie"
+  ];
+  const sanitized = Array.isArray(data) ? [] : {};
+  for (const [key, value] of Object.entries(data)) {
+    const lowerKey = key.toLowerCase();
+    const isSensitive = sensitiveKeys.some((sk) => lowerKey.includes(sk.toLowerCase()));
+    if (isSensitive) {
+      sanitized[key] = "[REDACTED]";
+    } else if (typeof value === "object" && value !== null) {
+      sanitized[key] = sanitizeForLogging(value);
+    } else {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
+export {
+  LogLevel,
+  Logger,
+  createLogger,
+  defaultLogger,
+  sanitizeForLogging
+};
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/logger.ts"],
+  "sourcesContent": ["/**\n * Logging utility for @prmichaelsen/mcp-auth\n * \n * Provides structured logging with different levels and formats.\n */\n\nimport type { LoggingConfig } from '../types.js';\n\n/**\n * Log levels in order of severity\n */\nexport enum LogLevel {\n  DEBUG = 0,\n  INFO = 1,\n  WARN = 2,\n  ERROR = 3\n}\n\n/**\n * Log entry structure\n */\nexport interface LogEntry {\n  timestamp: string;\n  level: string;\n  message: string;\n  context?: Record<string, unknown>;\n  error?: {\n    name: string;\n    message: string;\n    stack?: string;\n  };\n}\n\n/**\n * Logger class for structured logging\n */\nexport class Logger {\n  private config: LoggingConfig;\n  private minLevel: LogLevel;\n  \n  constructor(config: Partial<LoggingConfig> = {}) {\n    this.config = {\n      enabled: config.enabled ?? true,\n      level: config.level ?? 'info',\n      format: config.format ?? 'text',\n      logBodies: config.logBodies ?? false\n    };\n    \n    this.minLevel = this.getLevelValue(this.config.level);\n  }\n  \n  /**\n   * Convert log level string to numeric value\n   */\n  private getLevelValue(level: string): LogLevel {\n    switch (level) {\n      case 'debug': return LogLevel.DEBUG;\n      case 'info': return LogLevel.INFO;\n      case 'warn': return LogLevel.WARN;\n      case 'error': return LogLevel.ERROR;\n      default: return LogLevel.INFO;\n    }\n  }\n  \n  /**\n   * Check if a log level should be logged\n   */\n  private shouldLog(level: LogLevel): boolean {\n    return this.config.enabled && level >= this.minLevel;\n  }\n  \n  /**\n   * Format log entry\n   */\n  private formatEntry(entry: LogEntry): string {\n    if (this.config.format === 'json') {\n      return JSON.stringify(entry);\n    }\n    \n    // Text format\n    let output = `[${entry.timestamp}] ${entry.level.toUpperCase()}: ${entry.message}`;\n    \n    if (entry.context && Object.keys(entry.context).length > 0) {\n      output += ` ${JSON.stringify(entry.context)}`;\n    }\n    \n    if (entry.error) {\n      output += `\\n  Error: ${entry.error.name}: ${entry.error.message}`;\n      if (entry.error.stack) {\n        output += `\\n${entry.error.stack}`;\n      }\n    }\n    \n    return output;\n  }\n  \n  /**\n   * Create log entry\n   */\n  private createEntry(\n    level: string,\n    message: string,\n    context?: Record<string, unknown>,\n    error?: Error\n  ): LogEntry {\n    const entry: LogEntry = {\n      timestamp: new Date().toISOString(),\n      level,\n      message,\n      context\n    };\n    \n    if (error) {\n      entry.error = {\n        name: error.name,\n        message: error.message,\n        stack: error.stack\n      };\n    }\n    \n    return entry;\n  }\n  \n  /**\n   * Write log entry to output\n   */\n  private write(entry: LogEntry): void {\n    const formatted = this.formatEntry(entry);\n    \n    // Use appropriate console method based on level\n    switch (entry.level) {\n      case 'debug':\n        console.debug(formatted);\n        break;\n      case 'info':\n        console.info(formatted);\n        break;\n      case 'warn':\n        console.warn(formatted);\n        break;\n      case 'error':\n        console.error(formatted);\n        break;\n      default:\n        console.log(formatted);\n    }\n  }\n  \n  /**\n   * Log debug message\n   */\n  debug(message: string, context?: Record<string, unknown>): void {\n    if (this.shouldLog(LogLevel.DEBUG)) {\n      const entry = this.createEntry('debug', message, context);\n      this.write(entry);\n    }\n  }\n  \n  /**\n   * Log info message\n   */\n  info(message: string, context?: Record<string, unknown>): void {\n    if (this.shouldLog(LogLevel.INFO)) {\n      const entry = this.createEntry('info', message, context);\n      this.write(entry);\n    }\n  }\n  \n  /**\n   * Log warning message\n   */\n  warn(message: string, context?: Record<string, unknown>): void {\n    if (this.shouldLog(LogLevel.WARN)) {\n      const entry = this.createEntry('warn', message, context);\n      this.write(entry);\n    }\n  }\n  \n  /**\n   * Log error message\n   */\n  error(message: string, error?: Error, context?: Record<string, unknown>): void {\n    if (this.shouldLog(LogLevel.ERROR)) {\n      const entry = this.createEntry('error', message, context, error);\n      this.write(entry);\n    }\n  }\n  \n  /**\n   * Create a child logger with additional context\n   */\n  child(context: Record<string, unknown>): Logger {\n    const childLogger = new Logger(this.config);\n    \n    // Override write to include parent context\n    const originalWrite = childLogger.write.bind(childLogger);\n    childLogger.write = (entry: LogEntry) => {\n      entry.context = { ...context, ...entry.context };\n      originalWrite(entry);\n    };\n    \n    return childLogger;\n  }\n  \n  /**\n   * Update logger configuration\n   */\n  configure(config: Partial<LoggingConfig>): void {\n    this.config = { ...this.config, ...config };\n    this.minLevel = this.getLevelValue(this.config.level);\n  }\n}\n\n/**\n * Default logger instance\n */\nexport const defaultLogger = new Logger();\n\n/**\n * Create a new logger instance\n */\nexport function createLogger(config?: Partial<LoggingConfig>): Logger {\n  return new Logger(config);\n}\n\n/**\n * Sanitize sensitive data from logs\n */\nexport function sanitizeForLogging(data: any): any {\n  if (typeof data !== 'object' || data === null) {\n    return data;\n  }\n  \n  const sensitiveKeys = [\n    'password',\n    'token',\n    'secret',\n    'apiKey',\n    'accessToken',\n    'refreshToken',\n    'authorization',\n    'cookie'\n  ];\n  \n  const sanitized: any = Array.isArray(data) ? [] : {};\n  \n  for (const [key, value] of Object.entries(data)) {\n    const lowerKey = key.toLowerCase();\n    const isSensitive = sensitiveKeys.some(sk => lowerKey.includes(sk.toLowerCase()));\n    \n    if (isSensitive) {\n      sanitized[key] = '[REDACTED]';\n    } else if (typeof value === 'object' && value !== null) {\n      sanitized[key] = sanitizeForLogging(value);\n    } else {\n      sanitized[key] = value;\n    }\n  }\n  \n  return sanitized;\n}\n"],
+  "mappings": "AAWO,IAAK,WAAL,kBAAKA,cAAL;AACL,EAAAA,oBAAA,WAAQ,KAAR;AACA,EAAAA,oBAAA,UAAO,KAAP;AACA,EAAAA,oBAAA,UAAO,KAAP;AACA,EAAAA,oBAAA,WAAQ,KAAR;AAJU,SAAAA;AAAA,GAAA;AAyBL,MAAM,OAAO;AAAA,EACV;AAAA,EACA;AAAA,EAER,YAAY,SAAiC,CAAC,GAAG;AAC/C,SAAK,SAAS;AAAA,MACZ,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,OAAO,SAAS;AAAA,MACvB,QAAQ,OAAO,UAAU;AAAA,MACzB,WAAW,OAAO,aAAa;AAAA,IACjC;AAEA,SAAK,WAAW,KAAK,cAAc,KAAK,OAAO,KAAK;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,OAAyB;AAC7C,YAAQ,OAAO;AAAA,MACb,KAAK;AAAS,eAAO;AAAA,MACrB,KAAK;AAAQ,eAAO;AAAA,MACpB,KAAK;AAAQ,eAAO;AAAA,MACpB,KAAK;AAAS,eAAO;AAAA,MACrB;AAAS,eAAO;AAAA,IAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,UAAU,OAA0B;AAC1C,WAAO,KAAK,OAAO,WAAW,SAAS,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,OAAyB;AAC3C,QAAI,KAAK,OAAO,WAAW,QAAQ;AACjC,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAGA,QAAI,SAAS,IAAI,MAAM,SAAS,KAAK,MAAM,MAAM,YAAY,CAAC,KAAK,MAAM,OAAO;AAEhF,QAAI,MAAM,WAAW,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,GAAG;AAC1D,gBAAU,IAAI,KAAK,UAAU,MAAM,OAAO,CAAC;AAAA,IAC7C;AAEA,QAAI,MAAM,OAAO;AACf,gBAAU;AAAA,WAAc,MAAM,MAAM,IAAI,KAAK,MAAM,MAAM,OAAO;AAChE,UAAI,MAAM,MAAM,OAAO;AACrB,kBAAU;AAAA,EAAK,MAAM,MAAM,KAAK;AAAA,MAClC;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,YACN,OACA,SACA,SACA,OACU;AACV,UAAM,QAAkB;AAAA,MACtB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,OAAO;AACT,YAAM,QAAQ;AAAA,QACZ,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,MACf;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,MAAM,OAAuB;AACnC,UAAM,YAAY,KAAK,YAAY,KAAK;AAGxC,YAAQ,MAAM,OAAO;AAAA,MACnB,KAAK;AACH,gBAAQ,MAAM,SAAS;AACvB;AAAA,MACF,KAAK;AACH,gBAAQ,KAAK,SAAS;AACtB;AAAA,MACF,KAAK;AACH,gBAAQ,KAAK,SAAS;AACtB;AAAA,MACF,KAAK;AACH,gBAAQ,MAAM,SAAS;AACvB;AAAA,MACF;AACE,gBAAQ,IAAI,SAAS;AAAA,IACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAiB,SAAyC;AAC9D,QAAI,KAAK,UAAU,aAAc,GAAG;AAClC,YAAM,QAAQ,KAAK,YAAY,SAAS,SAAS,OAAO;AACxD,WAAK,MAAM,KAAK;AAAA,IAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,SAAiB,SAAyC;AAC7D,QAAI,KAAK,UAAU,YAAa,GAAG;AACjC,YAAM,QAAQ,KAAK,YAAY,QAAQ,SAAS,OAAO;AACvD,WAAK,MAAM,KAAK;AAAA,IAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,SAAiB,SAAyC;AAC7D,QAAI,KAAK,UAAU,YAAa,GAAG;AACjC,YAAM,QAAQ,KAAK,YAAY,QAAQ,SAAS,OAAO;AACvD,WAAK,MAAM,KAAK;AAAA,IAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAiB,OAAe,SAAyC;AAC7E,QAAI,KAAK,UAAU,aAAc,GAAG;AAClC,YAAM,QAAQ,KAAK,YAAY,SAAS,SAAS,SAAS,KAAK;AAC/D,WAAK,MAAM,KAAK;AAAA,IAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA0C;AAC9C,UAAM,cAAc,IAAI,OAAO,KAAK,MAAM;AAG1C,UAAM,gBAAgB,YAAY,MAAM,KAAK,WAAW;AACxD,gBAAY,QAAQ,CAAC,UAAoB;AACvC,YAAM,UAAU,EAAE,GAAG,SAAS,GAAG,MAAM,QAAQ;AAC/C,oBAAc,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,QAAsC;AAC9C,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO;AAC1C,SAAK,WAAW,KAAK,cAAc,KAAK,OAAO,KAAK;AAAA,EACtD;AACF;AAKO,MAAM,gBAAgB,IAAI,OAAO;AAKjC,SAAS,aAAa,QAAyC;AACpE,SAAO,IAAI,OAAO,MAAM;AAC1B;AAKO,SAAS,mBAAmB,MAAgB;AACjD,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,YAAiB,MAAM,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;AAEnD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,UAAM,WAAW,IAAI,YAAY;AACjC,UAAM,cAAc,cAAc,KAAK,QAAM,SAAS,SAAS,GAAG,YAAY,CAAC,CAAC;AAEhF,QAAI,aAAa;AACf,gBAAU,GAAG,IAAI;AAAA,IACnB,WAAW,OAAO,UAAU,YAAY,UAAU,MAAM;AACtD,gBAAU,GAAG,IAAI,mBAAmB,KAAK;AAAA,IAC3C,OAAO;AACL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AAEA,SAAO;AACT;",
+  "names": ["LogLevel"]
+}

package/dist/utils/validation.js

@@ -0,0 +1,172 @@
+import { ValidationError } from "./errors.js";
+function validateNonEmptyString(value, fieldName) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new ValidationError(`${fieldName} must be a non-empty string`);
+  }
+}
+function validateUrl(value, fieldName) {
+  validateNonEmptyString(value, fieldName);
+  try {
+    new URL(value);
+  } catch {
+    throw new ValidationError(`${fieldName} must be a valid URL`);
+  }
+}
+function validatePositiveNumber(value, fieldName) {
+  if (typeof value !== "number" || value <= 0 || !Number.isFinite(value)) {
+    throw new ValidationError(`${fieldName} must be a positive number`);
+  }
+}
+function validatePort(value, fieldName) {
+  validatePositiveNumber(value, fieldName);
+  if (!Number.isInteger(value) || value < 1 || value > 65535) {
+    throw new ValidationError(`${fieldName} must be a valid port number (1-65535)`);
+  }
+}
+function validateEnum(value, allowedValues, fieldName) {
+  if (!allowedValues.includes(value)) {
+    throw new ValidationError(
+      `${fieldName} must be one of: ${allowedValues.join(", ")}`
+    );
+  }
+}
+function validateObject(value, fieldName) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ValidationError(`${fieldName} must be an object`);
+  }
+}
+function validateFunction(value, fieldName) {
+  if (typeof value !== "function") {
+    throw new ValidationError(`${fieldName} must be a function`);
+  }
+}
+function validateRequiredFields(obj, requiredFields, objectName = "Object") {
+  for (const field of requiredFields) {
+    if (!(field in obj) || obj[field] === void 0 || obj[field] === null) {
+      throw new ValidationError(`${objectName} is missing required field: ${String(field)}`);
+    }
+  }
+}
+function validateTransportConfig(config) {
+  validateObject(config, "Transport configuration");
+  const cfg = config;
+  validateRequiredFields(cfg, ["type"], "Transport configuration");
+  validateEnum(cfg.type, ["stdio", "sse", "http"], "transport.type");
+  if (cfg.type === "sse" || cfg.type === "http") {
+    if (cfg.port !== void 0) {
+      validatePort(cfg.port, "transport.port");
+    }
+    if (cfg.host !== void 0) {
+      validateNonEmptyString(cfg.host, "transport.host");
+    }
+    if (cfg.basePath !== void 0) {
+      validateNonEmptyString(cfg.basePath, "transport.basePath");
+      const basePath = cfg.basePath;
+      if (!basePath.startsWith("/")) {
+        throw new ValidationError("transport.basePath must start with /");
+      }
+    }
+  }
+}
+function validateRateLimitConfig(config) {
+  validateObject(config, "Rate limit configuration");
+  const cfg = config;
+  validateRequiredFields(cfg, ["enabled", "maxRequests", "windowMs"], "Rate limit configuration");
+  if (typeof cfg.enabled !== "boolean") {
+    throw new ValidationError("rateLimit.enabled must be a boolean");
+  }
+  validatePositiveNumber(cfg.maxRequests, "rateLimit.maxRequests");
+  validatePositiveNumber(cfg.windowMs, "rateLimit.windowMs");
+  if (cfg.keyGenerator !== void 0) {
+    validateFunction(cfg.keyGenerator, "rateLimit.keyGenerator");
+  }
+}
+function validateLoggingConfig(config) {
+  validateObject(config, "Logging configuration");
+  const cfg = config;
+  validateRequiredFields(cfg, ["enabled", "level"], "Logging configuration");
+  if (typeof cfg.enabled !== "boolean") {
+    throw new ValidationError("logging.enabled must be a boolean");
+  }
+  validateEnum(cfg.level, ["debug", "info", "warn", "error"], "logging.level");
+  if (cfg.format !== void 0) {
+    validateEnum(cfg.format, ["json", "text"], "logging.format");
+  }
+  if (cfg.logBodies !== void 0 && typeof cfg.logBodies !== "boolean") {
+    throw new ValidationError("logging.logBodies must be a boolean");
+  }
+}
+function validatePoolingConfig(config) {
+  validateObject(config, "Pooling configuration");
+  const cfg = config;
+  validateRequiredFields(cfg, ["enabled"], "Pooling configuration");
+  if (typeof cfg.enabled !== "boolean") {
+    throw new ValidationError("pooling.enabled must be a boolean");
+  }
+  if (cfg.maxServersPerUser !== void 0) {
+    validatePositiveNumber(cfg.maxServersPerUser, "pooling.maxServersPerUser");
+  }
+  if (cfg.idleTimeoutMs !== void 0) {
+    validatePositiveNumber(cfg.idleTimeoutMs, "pooling.idleTimeoutMs");
+  }
+  if (cfg.maxTotalServers !== void 0) {
+    validatePositiveNumber(cfg.maxTotalServers, "pooling.maxTotalServers");
+  }
+}
+function sanitizeString(input) {
+  return input.replace(/[\x00-\x1F\x7F]/g, "").trim();
+}
+function validateUserId(userId) {
+  validateNonEmptyString(userId, "userId");
+  const sanitized = sanitizeString(userId);
+  if (sanitized.length === 0) {
+    throw new ValidationError("userId cannot be empty after sanitization");
+  }
+  if (sanitized.length > 255) {
+    throw new ValidationError("userId must be 255 characters or less");
+  }
+  return sanitized;
+}
+function validateResourceType(resourceType) {
+  validateNonEmptyString(resourceType, "resourceType");
+  const sanitized = sanitizeString(resourceType).toLowerCase();
+  if (sanitized.length === 0) {
+    throw new ValidationError("resourceType cannot be empty after sanitization");
+  }
+  if (!/^[a-z0-9_-]+$/.test(sanitized)) {
+    throw new ValidationError(
+      "resourceType must contain only lowercase letters, numbers, hyphens, and underscores"
+    );
+  }
+  return sanitized;
+}
+function validateAccessToken(token) {
+  validateNonEmptyString(token, "accessToken");
+  const sanitized = token.trim();
+  if (sanitized.length === 0) {
+    throw new ValidationError("accessToken cannot be empty");
+  }
+  if (sanitized.length > 4096) {
+    throw new ValidationError("accessToken is too long (max 4096 characters)");
+  }
+  return sanitized;
+}
+export {
+  sanitizeString,
+  validateAccessToken,
+  validateEnum,
+  validateFunction,
+  validateLoggingConfig,
+  validateNonEmptyString,
+  validateObject,
+  validatePoolingConfig,
+  validatePort,
+  validatePositiveNumber,
+  validateRateLimitConfig,
+  validateRequiredFields,
+  validateResourceType,
+  validateTransportConfig,
+  validateUrl,
+  validateUserId
+};
+//# sourceMappingURL=validation.js.map

package/dist/utils/validation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/validation.ts"],
+  "sourcesContent": ["/**\n * Validation utilities for @prmichaelsen/mcp-auth\n * \n * Provides input validation and sanitization functions.\n */\n\nimport { ValidationError } from './errors.js';\n\n/**\n * Validate that a value is a non-empty string\n */\nexport function validateNonEmptyString(\n  value: unknown,\n  fieldName: string\n): asserts value is string {\n  if (typeof value !== 'string' || value.trim().length === 0) {\n    throw new ValidationError(`${fieldName} must be a non-empty string`);\n  }\n}\n\n/**\n * Validate that a value is a valid URL\n */\nexport function validateUrl(value: unknown, fieldName: string): asserts value is string {\n  validateNonEmptyString(value, fieldName);\n  \n  try {\n    new URL(value);\n  } catch {\n    throw new ValidationError(`${fieldName} must be a valid URL`);\n  }\n}\n\n/**\n * Validate that a value is a positive number\n */\nexport function validatePositiveNumber(\n  value: unknown,\n  fieldName: string\n): asserts value is number {\n  if (typeof value !== 'number' || value <= 0 || !Number.isFinite(value)) {\n    throw new ValidationError(`${fieldName} must be a positive number`);\n  }\n}\n\n/**\n * Validate that a value is a valid port number\n */\nexport function validatePort(value: unknown, fieldName: string): asserts value is number {\n  validatePositiveNumber(value, fieldName);\n  \n  if (!Number.isInteger(value) || value < 1 || value > 65535) {\n    throw new ValidationError(`${fieldName} must be a valid port number (1-65535)`);\n  }\n}\n\n/**\n * Validate that a value is one of the allowed values\n */\nexport function validateEnum<T extends string>(\n  value: unknown,\n  allowedValues: readonly T[],\n  fieldName: string\n): asserts value is T {\n  if (!allowedValues.includes(value as T)) {\n    throw new ValidationError(\n      `${fieldName} must be one of: ${allowedValues.join(', ')}`\n    );\n  }\n}\n\n/**\n * Validate that a value is a valid object\n */\nexport function validateObject(\n  value: unknown,\n  fieldName: string\n): asserts value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new ValidationError(`${fieldName} must be an object`);\n  }\n}\n\n/**\n * Validate that a value is a function\n */\nexport function validateFunction(\n  value: unknown,\n  fieldName: string\n): asserts value is Function {\n  if (typeof value !== 'function') {\n    throw new ValidationError(`${fieldName} must be a function`);\n  }\n}\n\n/**\n * Validate required fields in an object\n */\nexport function validateRequiredFields<T extends Record<string, unknown>>(\n  obj: T,\n  requiredFields: (keyof T)[],\n  objectName: string = 'Object'\n): void {\n  for (const field of requiredFields) {\n    if (!(field in obj) || obj[field] === undefined || obj[field] === null) {\n      throw new ValidationError(`${objectName} is missing required field: ${String(field)}`);\n    }\n  }\n}\n\n/**\n * Validate transport configuration\n */\nexport function validateTransportConfig(config: unknown): void {\n  validateObject(config, 'Transport configuration');\n  \n  const cfg = config as Record<string, unknown>;\n  \n  validateRequiredFields(cfg, ['type'], 'Transport configuration');\n  validateEnum(cfg.type, ['stdio', 'sse', 'http'] as const, 'transport.type');\n  \n  if (cfg.type === 'sse' || cfg.type === 'http') {\n    if (cfg.port !== undefined) {\n      validatePort(cfg.port, 'transport.port');\n    }\n    \n    if (cfg.host !== undefined) {\n      validateNonEmptyString(cfg.host, 'transport.host');\n    }\n    \n    if (cfg.basePath !== undefined) {\n      validateNonEmptyString(cfg.basePath, 'transport.basePath');\n      \n      const basePath = cfg.basePath as string;\n      if (!basePath.startsWith('/')) {\n        throw new ValidationError('transport.basePath must start with /');\n      }\n    }\n  }\n}\n\n/**\n * Validate rate limit configuration\n */\nexport function validateRateLimitConfig(config: unknown): void {\n  validateObject(config, 'Rate limit configuration');\n  \n  const cfg = config as Record<string, unknown>;\n  \n  validateRequiredFields(cfg, ['enabled', 'maxRequests', 'windowMs'], 'Rate limit configuration');\n  \n  if (typeof cfg.enabled !== 'boolean') {\n    throw new ValidationError('rateLimit.enabled must be a boolean');\n  }\n  \n  validatePositiveNumber(cfg.maxRequests, 'rateLimit.maxRequests');\n  validatePositiveNumber(cfg.windowMs, 'rateLimit.windowMs');\n  \n  if (cfg.keyGenerator !== undefined) {\n    validateFunction(cfg.keyGenerator, 'rateLimit.keyGenerator');\n  }\n}\n\n/**\n * Validate logging configuration\n */\nexport function validateLoggingConfig(config: unknown): void {\n  validateObject(config, 'Logging configuration');\n  \n  const cfg = config as Record<string, unknown>;\n  \n  validateRequiredFields(cfg, ['enabled', 'level'], 'Logging configuration');\n  \n  if (typeof cfg.enabled !== 'boolean') {\n    throw new ValidationError('logging.enabled must be a boolean');\n  }\n  \n  validateEnum(cfg.level, ['debug', 'info', 'warn', 'error'] as const, 'logging.level');\n  \n  if (cfg.format !== undefined) {\n    validateEnum(cfg.format, ['json', 'text'] as const, 'logging.format');\n  }\n  \n  if (cfg.logBodies !== undefined && typeof cfg.logBodies !== 'boolean') {\n    throw new ValidationError('logging.logBodies must be a boolean');\n  }\n}\n\n/**\n * Validate pooling configuration\n */\nexport function validatePoolingConfig(config: unknown): void {\n  validateObject(config, 'Pooling configuration');\n  \n  const cfg = config as Record<string, unknown>;\n  \n  validateRequiredFields(cfg, ['enabled'], 'Pooling configuration');\n  \n  if (typeof cfg.enabled !== 'boolean') {\n    throw new ValidationError('pooling.enabled must be a boolean');\n  }\n  \n  if (cfg.maxServersPerUser !== undefined) {\n    validatePositiveNumber(cfg.maxServersPerUser, 'pooling.maxServersPerUser');\n  }\n  \n  if (cfg.idleTimeoutMs !== undefined) {\n    validatePositiveNumber(cfg.idleTimeoutMs, 'pooling.idleTimeoutMs');\n  }\n  \n  if (cfg.maxTotalServers !== undefined) {\n    validatePositiveNumber(cfg.maxTotalServers, 'pooling.maxTotalServers');\n  }\n}\n\n/**\n * Sanitize string input (remove control characters, trim)\n */\nexport function sanitizeString(input: string): string {\n  return input\n    .replace(/[\\x00-\\x1F\\x7F]/g, '') // Remove control characters\n    .trim();\n}\n\n/**\n * Validate and sanitize user ID\n */\nexport function validateUserId(userId: unknown): string {\n  validateNonEmptyString(userId, 'userId');\n  \n  const sanitized = sanitizeString(userId);\n  \n  if (sanitized.length === 0) {\n    throw new ValidationError('userId cannot be empty after sanitization');\n  }\n  \n  if (sanitized.length > 255) {\n    throw new ValidationError('userId must be 255 characters or less');\n  }\n  \n  return sanitized;\n}\n\n/**\n * Validate and sanitize resource type\n */\nexport function validateResourceType(resourceType: unknown): string {\n  validateNonEmptyString(resourceType, 'resourceType');\n  \n  const sanitized = sanitizeString(resourceType).toLowerCase();\n  \n  if (sanitized.length === 0) {\n    throw new ValidationError('resourceType cannot be empty after sanitization');\n  }\n  \n  if (!/^[a-z0-9_-]+$/.test(sanitized)) {\n    throw new ValidationError(\n      'resourceType must contain only lowercase letters, numbers, hyphens, and underscores'\n    );\n  }\n  \n  return sanitized;\n}\n\n/**\n * Validate access token format (basic check)\n */\nexport function validateAccessToken(token: unknown): string {\n  validateNonEmptyString(token, 'accessToken');\n  \n  const sanitized = token.trim();\n  \n  if (sanitized.length === 0) {\n    throw new ValidationError('accessToken cannot be empty');\n  }\n  \n  if (sanitized.length > 4096) {\n    throw new ValidationError('accessToken is too long (max 4096 characters)');\n  }\n  \n  return sanitized;\n}\n"],
+  "mappings": "AAMA,SAAS,uBAAuB;AAKzB,SAAS,uBACd,OACA,WACyB;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,UAAM,IAAI,gBAAgB,GAAG,SAAS,6BAA6B;AAAA,EACrE;AACF;AAKO,SAAS,YAAY,OAAgB,WAA4C;AACtF,yBAAuB,OAAO,SAAS;AAEvC,MAAI;AACF,QAAI,IAAI,KAAK;AAAA,EACf,QAAQ;AACN,UAAM,IAAI,gBAAgB,GAAG,SAAS,sBAAsB;AAAA,EAC9D;AACF;AAKO,SAAS,uBACd,OACA,WACyB;AACzB,MAAI,OAAO,UAAU,YAAY,SAAS,KAAK,CAAC,OAAO,SAAS,KAAK,GAAG;AACtE,UAAM,IAAI,gBAAgB,GAAG,SAAS,4BAA4B;AAAA,EACpE;AACF;AAKO,SAAS,aAAa,OAAgB,WAA4C;AACvF,yBAAuB,OAAO,SAAS;AAEvC,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ,OAAO;AAC1D,UAAM,IAAI,gBAAgB,GAAG,SAAS,wCAAwC;AAAA,EAChF;AACF;AAKO,SAAS,aACd,OACA,eACA,WACoB;AACpB,MAAI,CAAC,cAAc,SAAS,KAAU,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,GAAG,SAAS,oBAAoB,cAAc,KAAK,IAAI,CAAC;AAAA,IAC1D;AAAA,EACF;AACF;AAKO,SAAS,eACd,OACA,WAC0C;AAC1C,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,gBAAgB,GAAG,SAAS,oBAAoB;AAAA,EAC5D;AACF;AAKO,SAAS,iBACd,OACA,WAC2B;AAC3B,MAAI,OAAO,UAAU,YAAY;AAC/B,UAAM,IAAI,gBAAgB,GAAG,SAAS,qBAAqB;AAAA,EAC7D;AACF;AAKO,SAAS,uBACd,KACA,gBACA,aAAqB,UACf;AACN,aAAW,SAAS,gBAAgB;AAClC,QAAI,EAAE,SAAS,QAAQ,IAAI,KAAK,MAAM,UAAa,IAAI,KAAK,MAAM,MAAM;AACtE,YAAM,IAAI,gBAAgB,GAAG,UAAU,+BAA+B,OAAO,KAAK,CAAC,EAAE;AAAA,IACvF;AAAA,EACF;AACF;AAKO,SAAS,wBAAwB,QAAuB;AAC7D,iBAAe,QAAQ,yBAAyB;AAEhD,QAAM,MAAM;AAEZ,yBAAuB,KAAK,CAAC,MAAM,GAAG,yBAAyB;AAC/D,eAAa,IAAI,MAAM,CAAC,SAAS,OAAO,MAAM,GAAY,gBAAgB;AAE1E,MAAI,IAAI,SAAS,SAAS,IAAI,SAAS,QAAQ;AAC7C,QAAI,IAAI,SAAS,QAAW;AAC1B,mBAAa,IAAI,MAAM,gBAAgB;AAAA,IACzC;AAEA,QAAI,IAAI,SAAS,QAAW;AAC1B,6BAAuB,IAAI,MAAM,gBAAgB;AAAA,IACnD;AAEA,QAAI,IAAI,aAAa,QAAW;AAC9B,6BAAuB,IAAI,UAAU,oBAAoB;AAEzD,YAAM,WAAW,IAAI;AACrB,UAAI,CAAC,SAAS,WAAW,GAAG,GAAG;AAC7B,cAAM,IAAI,gBAAgB,sCAAsC;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;AAKO,SAAS,wBAAwB,QAAuB;AAC7D,iBAAe,QAAQ,0BAA0B;AAEjD,QAAM,MAAM;AAEZ,yBAAuB,KAAK,CAAC,WAAW,eAAe,UAAU,GAAG,0BAA0B;AAE9F,MAAI,OAAO,IAAI,YAAY,WAAW;AACpC,UAAM,IAAI,gBAAgB,qCAAqC;AAAA,EACjE;AAEA,yBAAuB,IAAI,aAAa,uBAAuB;AAC/D,yBAAuB,IAAI,UAAU,oBAAoB;AAEzD,MAAI,IAAI,iBAAiB,QAAW;AAClC,qBAAiB,IAAI,cAAc,wBAAwB;AAAA,EAC7D;AACF;AAKO,SAAS,sBAAsB,QAAuB;AAC3D,iBAAe,QAAQ,uBAAuB;AAE9C,QAAM,MAAM;AAEZ,yBAAuB,KAAK,CAAC,WAAW,OAAO,GAAG,uBAAuB;AAEzE,MAAI,OAAO,IAAI,YAAY,WAAW;AACpC,UAAM,IAAI,gBAAgB,mCAAmC;AAAA,EAC/D;AAEA,eAAa,IAAI,OAAO,CAAC,SAAS,QAAQ,QAAQ,OAAO,GAAY,eAAe;AAEpF,MAAI,IAAI,WAAW,QAAW;AAC5B,iBAAa,IAAI,QAAQ,CAAC,QAAQ,MAAM,GAAY,gBAAgB;AAAA,EACtE;AAEA,MAAI,IAAI,cAAc,UAAa,OAAO,IAAI,cAAc,WAAW;AACrE,UAAM,IAAI,gBAAgB,qCAAqC;AAAA,EACjE;AACF;AAKO,SAAS,sBAAsB,QAAuB;AAC3D,iBAAe,QAAQ,uBAAuB;AAE9C,QAAM,MAAM;AAEZ,yBAAuB,KAAK,CAAC,SAAS,GAAG,uBAAuB;AAEhE,MAAI,OAAO,IAAI,YAAY,WAAW;AACpC,UAAM,IAAI,gBAAgB,mCAAmC;AAAA,EAC/D;AAEA,MAAI,IAAI,sBAAsB,QAAW;AACvC,2BAAuB,IAAI,mBAAmB,2BAA2B;AAAA,EAC3E;AAEA,MAAI,IAAI,kBAAkB,QAAW;AACnC,2BAAuB,IAAI,eAAe,uBAAuB;AAAA,EACnE;AAEA,MAAI,IAAI,oBAAoB,QAAW;AACrC,2BAAuB,IAAI,iBAAiB,yBAAyB;AAAA,EACvE;AACF;AAKO,SAAS,eAAe,OAAuB;AACpD,SAAO,MACJ,QAAQ,oBAAoB,EAAE,EAC9B,KAAK;AACV;AAKO,SAAS,eAAe,QAAyB;AACtD,yBAAuB,QAAQ,QAAQ;AAEvC,QAAM,YAAY,eAAe,MAAM;AAEvC,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI,gBAAgB,2CAA2C;AAAA,EACvE;AAEA,MAAI,UAAU,SAAS,KAAK;AAC1B,UAAM,IAAI,gBAAgB,uCAAuC;AAAA,EACnE;AAEA,SAAO;AACT;AAKO,SAAS,qBAAqB,cAA+B;AAClE,yBAAuB,cAAc,cAAc;AAEnD,QAAM,YAAY,eAAe,YAAY,EAAE,YAAY;AAE3D,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI,gBAAgB,iDAAiD;AAAA,EAC7E;AAEA,MAAI,CAAC,gBAAgB,KAAK,SAAS,GAAG;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,oBAAoB,OAAwB;AAC1D,yBAAuB,OAAO,aAAa;AAE3C,QAAM,YAAY,MAAM,KAAK;AAE7B,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI,gBAAgB,6BAA6B;AAAA,EACzD;AAEA,MAAI,UAAU,SAAS,MAAM;AAC3B,UAAM,IAAI,gBAAgB,+CAA+C;AAAA,EAC3E;AAEA,SAAO;AACT;",
+  "names": []
+}

package/dist/wrapper/config.js

@@ -0,0 +1 @@
+//# sourceMappingURL=config.js.map

package/dist/wrapper/config.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/wrapper/index.js

@@ -0,0 +1,10 @@
+import { AuthenticatedServerWrapper } from "./server-wrapper.js";
+import { AuthenticatedServerWrapper as AuthenticatedServerWrapper2 } from "./server-wrapper.js";
+function wrapServer(config) {
+  return new AuthenticatedServerWrapper(config);
+}
+export {
+  AuthenticatedServerWrapper2 as AuthenticatedServerWrapper,
+  wrapServer
+};
+//# sourceMappingURL=index.js.map

package/dist/wrapper/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/wrapper/index.ts"],
+  "sourcesContent": ["/**\n * Server wrapper module exports\n * \n * Provides the main wrapServer() function for wrapping MCP servers with authentication.\n */\n\nimport { AuthenticatedServerWrapper } from './server-wrapper.js';\nimport type { ServerWrapperConfig, MCPServerFactory } from './config.js';\n\n// Export types\nexport type { ServerWrapperConfig, MCPServerFactory, NormalizedServerWrapperConfig } from './config.js';\n\n// Export wrapper class\nexport { AuthenticatedServerWrapper } from './server-wrapper.js';\n\n/**\n * Wrap an MCP server with authentication and multi-tenancy support\n * \n * This is the main entry point for the server wrapping pattern.\n * It creates an authenticated wrapper around your MCP server factory function.\n * \n * @param config - Server wrapper configuration\n * @returns Authenticated server wrapper instance\n * \n * @example\n * ```typescript\n * import { wrapServer } from '@prmichaelsen/mcp-auth';\n * import { createServer } from '@myorg/my-mcp-server';\n * \n * const wrapped = wrapServer({\n *   serverFactory: (accessToken, userId) => createServer(accessToken, userId),\n *   authProvider: new JWTAuthProvider({ ... }),\n *   tokenResolver: new DatabaseTokenResolver({ ... }),\n *   resourceType: 'myapi',\n *   transport: { type: 'sse', port: 3000 }\n * });\n * \n * await wrapped.start();\n * ```\n */\nexport function wrapServer(config: ServerWrapperConfig): AuthenticatedServerWrapper {\n  return new AuthenticatedServerWrapper(config);\n}\n"],
+  "mappings": "AAMA,SAAS,kCAAkC;AAO3C,SAAS,8BAAAA,mCAAkC;AA2BpC,SAAS,WAAW,QAAyD;AAClF,SAAO,IAAI,2BAA2B,MAAM;AAC9C;",
+  "names": ["AuthenticatedServerWrapper"]
+}