@qase/mcp-server 1.1.8 → 2.0.0

package/build/auth/client-context.js

@@ -0,0 +1,12 @@
+import { AsyncLocalStorage } from 'async_hooks';
+/**
+ * Per-request storage for the OAuth `/authorize` request's `redirect_uri`.
+ *
+ * The proxy is transparent: it echoes the incoming redirect_uri back through
+ * `getClient` so the MCP SDK's local redirect_uri check passes, then forwards
+ * the request to auth.qase.io, which is the authoritative validator of a
+ * client's registered redirect URIs. Empty/undefined when no redirect_uri is
+ * present on the request.
+ */
+export const authorizeRedirectUriStorage = new AsyncLocalStorage();
+//# sourceMappingURL=client-context.js.map

package/build/auth/client-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-context.js","sourceRoot":"","sources":["../../src/auth/client-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,iBAAiB,EAAsB,CAAC"}

package/build/auth/jwks-verifier.d.ts

@@ -0,0 +1,15 @@
+import { type JWTVerifyGetKey } from 'jose';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { OAuthConfig } from './oauth-config.js';
+export interface JwksVerifier {
+    verifyJwt(token: string): Promise<AuthInfo>;
+}
+/**
+ * Build a JWKS-backed access-token verifier. The remote key set is cached for
+ * one hour. `keyResolver` may be injected in tests (e.g. createLocalJWKSet).
+ *
+ * Signature, `exp`, `nbf`, `iss`, and `aud` are all validated by `jwtVerify`;
+ * it throws on any mismatch.
+ */
+export declare function createJwksVerifier(config: OAuthConfig, keyResolver?: JWTVerifyGetKey): JwksVerifier;
+//# sourceMappingURL=jwks-verifier.d.ts.map

package/build/auth/jwks-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-verifier.d.ts","sourceRoot":"","sources":["../../src/auth/jwks-verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,eAAe,GAC5B,YAAY,CAyBd"}

package/build/auth/jwks-verifier.js

@@ -0,0 +1,31 @@
+// src/auth/jwks-verifier.ts
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+/**
+ * Build a JWKS-backed access-token verifier. The remote key set is cached for
+ * one hour. `keyResolver` may be injected in tests (e.g. createLocalJWKSet).
+ *
+ * Signature, `exp`, `nbf`, `iss`, and `aud` are all validated by `jwtVerify`;
+ * it throws on any mismatch.
+ */
+export function createJwksVerifier(config, keyResolver) {
+    const resolve = keyResolver ?? createRemoteJWKSet(new URL(config.jwksUrl), { cacheMaxAge: 3600_000 });
+    return {
+        async verifyJwt(token) {
+            const { payload } = await jwtVerify(token, resolve, {
+                issuer: config.issuer,
+                audience: config.audience,
+                algorithms: config.jwtAlgorithms,
+            });
+            const scopes = typeof payload.scope === 'string' ? payload.scope.split(' ').filter(Boolean) : [];
+            return {
+                token,
+                clientId: payload.client_id ?? payload.azp ?? '',
+                scopes,
+                expiresAt: payload.exp,
+                resource: new URL(config.audience[0]),
+                extra: { sub: payload.sub },
+            };
+        },
+    };
+}
+//# sourceMappingURL=jwks-verifier.js.map

package/build/auth/jwks-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-verifier.js","sourceRoot":"","sources":["../../src/auth/jwks-verifier.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAQ3E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmB,EACnB,WAA6B;IAE7B,MAAM,OAAO,GACX,WAAW,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAExF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,KAAa;YAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE;gBAClD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,aAAa;aACjC,CAAC,CAAC;YAEH,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAEpF,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAG,OAAO,CAAC,SAAoB,IAAK,OAAO,CAAC,GAAc,IAAI,EAAE;gBACxE,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,GAAG;gBACtB,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACrC,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/build/auth/mcp-guard.d.ts

@@ -0,0 +1,15 @@
+import type { RequestHandler } from 'express';
+import type { JwksVerifier } from './jwks-verifier.js';
+import type { OAuthConfig } from './oauth-config.js';
+/**
+ * Dual-mode auth guard for the `/mcp` endpoint.
+ *
+ * - No bearer token        → 401 + WWW-Authenticate (triggers OAuth discovery).
+ * - JWT (3 segments)       → validated against JWKS; 401 on failure.
+ * - Opaque (legacy) token  → passed through unchanged (no JWKS validation).
+ *
+ * The token itself is forwarded by the existing transport handler, which reads
+ * the Authorization header and stores it in requestTokenStorage.
+ */
+export declare function createMcpGuard(verifier: JwksVerifier, config: OAuthConfig): RequestHandler;
+//# sourceMappingURL=mcp-guard.d.ts.map

package/build/auth/mcp-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-guard.d.ts","sourceRoot":"","sources":["../../src/auth/mcp-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,GAAG,cAAc,CAqC1F"}

package/build/auth/mcp-guard.js

@@ -0,0 +1,44 @@
+import { isJwt } from './token-type.js';
+/**
+ * Dual-mode auth guard for the `/mcp` endpoint.
+ *
+ * - No bearer token        → 401 + WWW-Authenticate (triggers OAuth discovery).
+ * - JWT (3 segments)       → validated against JWKS; 401 on failure.
+ * - Opaque (legacy) token  → passed through unchanged (no JWKS validation).
+ *
+ * The token itself is forwarded by the existing transport handler, which reads
+ * the Authorization header and stores it in requestTokenStorage.
+ */
+export function createMcpGuard(verifier, config) {
+    // RFC 9728 path-aware discovery: the metadata URL must carry the resource's
+    // path so clients that use the full endpoint URL as the resource identifier
+    // (e.g. VS Code) resolve the matching document. Origin comes from publicUrl
+    // (the reachable server), the path segment from resourceUrl (`/mcp`).
+    const origin = config.publicUrl.replace(/\/$/, '');
+    const resourcePath = new URL(config.resourceUrl).pathname;
+    const resourceMetadataUrl = `${origin}/.well-known/oauth-protected-resource${resourcePath === '/' ? '' : resourcePath}`;
+    const challenge = `Bearer resource_metadata="${resourceMetadataUrl}"`;
+    const unauthorized = (res, description) => {
+        res.set('WWW-Authenticate', challenge);
+        res.status(401).json({ error: 'invalid_token', error_description: description });
+    };
+    return async (req, res, next) => {
+        const authHeader = req.headers['authorization'] || '';
+        const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : '';
+        if (!token) {
+            unauthorized(res, 'Missing bearer token');
+            return;
+        }
+        if (isJwt(token)) {
+            try {
+                await verifier.verifyJwt(token);
+            }
+            catch {
+                unauthorized(res, 'JWT validation failed');
+                return;
+            }
+        }
+        next();
+    };
+}
+//# sourceMappingURL=mcp-guard.js.map

package/build/auth/mcp-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-guard.js","sourceRoot":"","sources":["../../src/auth/mcp-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAsB,EAAE,MAAmB;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,mBAAmB,GAAG,GAAG,MAAM,wCACnC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAC9B,EAAE,CAAC;IACH,MAAM,SAAS,GAAG,6BAA6B,mBAAmB,GAAG,CAAC;IAEtE,MAAM,YAAY,GAAG,CAAC,GAAa,EAAE,WAAmB,EAAQ,EAAE;QAChE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,MAAM,UAAU,GAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAY,IAAI,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/build/auth/oauth-config.d.ts

@@ -0,0 +1,40 @@
+export interface OAuthConfig {
+    enabled: boolean;
+    authorizationUrl: string;
+    tokenUrl: string;
+    registrationUrl: string;
+    revocationUrl: string;
+    jwksUrl: string;
+    issuer: string;
+    /**
+     * Accepted JWT `aud` values. Multiple are supported because different MCP
+     * clients derive the RFC 8707 resource indicator differently (e.g. Claude
+     * sends `https://mcp.qase.io`, Codex sends the endpoint `https://mcp.qase.io/mcp`),
+     * and the AS mints the token audience from that resource. A token is accepted
+     * if its `aud` matches any entry. Configured via comma-separated QASE_OAUTH_AUDIENCE.
+     */
+    audience: string[];
+    jwtAlgorithms: string[];
+    /**
+     * The RFC 9728 resource identifier for the protected `/mcp` endpoint, e.g.
+     * `https://mcp.qase.io/mcp`. Modern clients (VS Code) use the FULL endpoint
+     * URL as the resource identifier and do path-aware metadata discovery, so
+     * this carries the `/mcp` path. Drives the path-aware protected-resource
+     * metadata document + the WWW-Authenticate challenge path.
+     */
+    resourceUrl: string;
+    /**
+     * The public ORIGIN the server is reached at, e.g. `https://mcp.qase.io`
+     * (no path). This is the OAuth proxy base — `/authorize`, `/token`,
+     * `/register` and the AS metadata are mounted here. Kept decoupled from
+     * `resourceUrl` so the `/mcp` path on the resource identifier never leaks
+     * into the proxy endpoint paths.
+     */
+    publicUrl: string;
+}
+/**
+ * Read OAuth configuration from the environment, falling back to Qase
+ * production defaults. OAuth is enabled unless explicitly disabled.
+ */
+export declare function getOAuthConfig(): OAuthConfig;
+//# sourceMappingURL=oauth-config.d.ts.map

package/build/auth/oauth-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-config.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CA4B5C"}

package/build/auth/oauth-config.js

@@ -0,0 +1,34 @@
+/**
+ * Read OAuth configuration from the environment, falling back to Qase
+ * production defaults. OAuth is enabled unless explicitly disabled.
+ */
+export function getOAuthConfig() {
+    const env = process.env;
+    const resourceUrl = env.QASE_OAUTH_RESOURCE_URL ?? 'https://mcp.qase.io/mcp';
+    return {
+        enabled: env.QASE_OAUTH_ENABLED !== 'false',
+        authorizationUrl: env.QASE_OAUTH_AUTHORIZATION_URL ?? 'https://auth.qase.io/oauth/authorize',
+        tokenUrl: env.QASE_OAUTH_TOKEN_URL ?? 'https://auth.qase.io/oauth/token',
+        registrationUrl: env.QASE_OAUTH_REGISTRATION_URL ?? 'https://auth.qase.io/oauth/register',
+        revocationUrl: env.QASE_OAUTH_REVOCATION_URL ?? '',
+        jwksUrl: env.QASE_OAUTH_JWKS_URL ?? 'https://auth.qase.io/oauth/jwks.json',
+        issuer: env.QASE_OAUTH_ISSUER ?? 'https://auth.qase.io',
+        // The AS canonicalizes the token audience to the origin WITH a trailing
+        // slash (`https://mcp.qase.io/`), regardless of which resource variant the
+        // client sent, so that value MUST be accepted. The `/mcp` form is kept for
+        // defense in depth. Override with comma-separated QASE_OAUTH_AUDIENCE.
+        audience: (env.QASE_OAUTH_AUDIENCE ?? 'https://mcp.qase.io/,https://mcp.qase.io/mcp')
+            .split(',')
+            .map((a) => a.trim())
+            .filter(Boolean),
+        jwtAlgorithms: (env.QASE_OAUTH_JWT_ALGORITHMS ?? 'RS256')
+            .split(',')
+            .map((a) => a.trim())
+            .filter(Boolean),
+        resourceUrl,
+        // Decoupled from resourceUrl: default to its ORIGIN so the proxy base never
+        // inherits the `/mcp` path. Override independently with QASE_OAUTH_PUBLIC_URL.
+        publicUrl: env.QASE_OAUTH_PUBLIC_URL ?? new URL(resourceUrl).origin,
+    };
+}
+//# sourceMappingURL=oauth-config.js.map

package/build/auth/oauth-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-config.js","sourceRoot":"","sources":["../../src/auth/oauth-config.ts"],"names":[],"mappings":"AAmCA;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,WAAW,GAAG,GAAG,CAAC,uBAAuB,IAAI,yBAAyB,CAAC;IAC7E,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,kBAAkB,KAAK,OAAO;QAC3C,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,IAAI,sCAAsC;QAC5F,QAAQ,EAAE,GAAG,CAAC,oBAAoB,IAAI,kCAAkC;QACxE,eAAe,EAAE,GAAG,CAAC,2BAA2B,IAAI,qCAAqC;QACzF,aAAa,EAAE,GAAG,CAAC,yBAAyB,IAAI,EAAE;QAClD,OAAO,EAAE,GAAG,CAAC,mBAAmB,IAAI,sCAAsC;QAC1E,MAAM,EAAE,GAAG,CAAC,iBAAiB,IAAI,sBAAsB;QACvD,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,IAAI,8CAA8C,CAAC;aAClF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QAClB,aAAa,EAAE,CAAC,GAAG,CAAC,yBAAyB,IAAI,OAAO,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QAClB,WAAW;QACX,4EAA4E;QAC5E,+EAA+E;QAC/E,SAAS,EAAE,GAAG,CAAC,qBAAqB,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM;KACpE,CAAC;AACJ,CAAC"}

package/build/auth/proxy-provider.d.ts

@@ -0,0 +1,31 @@
+import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { OAuthConfig } from './oauth-config.js';
+import type { JwksVerifier } from './jwks-verifier.js';
+/**
+ * Wraps fetch to adapt both the outgoing DCR request and the incoming registration
+ * response so they are compatible with the Qase AS and the SDK schema.
+ *
+ * Request side: the Qase AS only supports token_endpoint_auth_method "none" and
+ * "client_secret_basic". Claude registers with "client_secret_post", which the AS
+ * rejects (400 invalid_client_metadata). Rewrite it to "none" (public + PKCE) — the
+ * recommended model for browser MCP clients, and the proxy never uses HTTP Basic.
+ *
+ * Response side: the Qase AS returns `client_secret: null` for public clients, but the
+ * SDK's OAuthClientInformationFullSchema expects a string or an omitted field. Strip the
+ * null field (RFC 7591: client_secret is optional / omitted for public clients).
+ *
+ * Only the registration endpoint is touched; all other requests pass through unchanged.
+ */
+export declare function createRegistrationSanitizingFetch(registrationUrl: string, underlyingFetch?: FetchLike): FetchLike;
+/**
+ * Build a ProxyOAuthServerProvider that transparently forwards /authorize,
+ * /token, /register, and /revoke to auth.qase.io. Access tokens are verified
+ * locally with the JWKS verifier (defence-in-depth).
+ *
+ * Dynamic client registration is proxied upstream, so auth.qase.io is the
+ * source of truth for clients. `getClient` echoes a permissive record so the
+ * SDK's redirect-uri validation in /authorize passes for proxied clients.
+ */
+export declare function createProxyProvider(config: OAuthConfig, verifier: JwksVerifier): ProxyOAuthServerProvider;
+//# sourceMappingURL=proxy-provider.d.ts.map

package/build/auth/proxy-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-provider.d.ts","sourceRoot":"","sources":["../../src/auth/proxy-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAE5G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,CAC/C,eAAe,EAAE,MAAM,EACvB,eAAe,GAAE,SAA4B,GAC5C,SAAS,CAwCX;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,YAAY,GACrB,wBAAwB,CAoB1B"}

package/build/auth/proxy-provider.js

@@ -0,0 +1,87 @@
+// src/auth/proxy-provider.ts
+import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js';
+import { authorizeRedirectUriStorage } from './client-context.js';
+/**
+ * Wraps fetch to adapt both the outgoing DCR request and the incoming registration
+ * response so they are compatible with the Qase AS and the SDK schema.
+ *
+ * Request side: the Qase AS only supports token_endpoint_auth_method "none" and
+ * "client_secret_basic". Claude registers with "client_secret_post", which the AS
+ * rejects (400 invalid_client_metadata). Rewrite it to "none" (public + PKCE) — the
+ * recommended model for browser MCP clients, and the proxy never uses HTTP Basic.
+ *
+ * Response side: the Qase AS returns `client_secret: null` for public clients, but the
+ * SDK's OAuthClientInformationFullSchema expects a string or an omitted field. Strip the
+ * null field (RFC 7591: client_secret is optional / omitted for public clients).
+ *
+ * Only the registration endpoint is touched; all other requests pass through unchanged.
+ */
+export function createRegistrationSanitizingFetch(registrationUrl, underlyingFetch = globalThis.fetch) {
+    return async (url, init) => {
+        // Request side: rewrite unsupported token_endpoint_auth_method before forwarding.
+        let effectiveInit = init;
+        if (String(url) === registrationUrl && init?.body != null) {
+            try {
+                const reqBody = JSON.parse(String(init.body));
+                if (reqBody.token_endpoint_auth_method === 'client_secret_post') {
+                    reqBody.token_endpoint_auth_method = 'none';
+                    effectiveInit = { ...init, body: JSON.stringify(reqBody) };
+                }
+            }
+            catch {
+                // Non-JSON body — forward unchanged.
+            }
+        }
+        const res = await underlyingFetch(url, effectiveInit);
+        if (String(url) !== registrationUrl || !res.ok) {
+            return res;
+        }
+        // Response side: strip null client_secret so the SDK schema parses correctly.
+        const data = await res
+            .clone()
+            .json()
+            .catch(() => null);
+        if (data &&
+            typeof data === 'object' &&
+            data.client_secret === null) {
+            delete data.client_secret;
+            return new Response(JSON.stringify(data), {
+                status: res.status,
+                statusText: res.statusText,
+                headers: { 'content-type': 'application/json' },
+            });
+        }
+        return res;
+    };
+}
+/**
+ * Build a ProxyOAuthServerProvider that transparently forwards /authorize,
+ * /token, /register, and /revoke to auth.qase.io. Access tokens are verified
+ * locally with the JWKS verifier (defence-in-depth).
+ *
+ * Dynamic client registration is proxied upstream, so auth.qase.io is the
+ * source of truth for clients. `getClient` echoes a permissive record so the
+ * SDK's redirect-uri validation in /authorize passes for proxied clients.
+ */
+export function createProxyProvider(config, verifier) {
+    return new ProxyOAuthServerProvider({
+        endpoints: {
+            authorizationUrl: config.authorizationUrl,
+            tokenUrl: config.tokenUrl,
+            registrationUrl: config.registrationUrl,
+            revocationUrl: config.revocationUrl,
+        },
+        fetch: createRegistrationSanitizingFetch(config.registrationUrl),
+        verifyAccessToken: (token) => verifier.verifyJwt(token),
+        getClient: async (clientId) => {
+            // Transparent proxy: echo the request's redirect_uri so the SDK's local
+            // /authorize check passes. auth.qase.io is the authoritative validator.
+            const redirectUri = authorizeRedirectUriStorage.getStore();
+            return {
+                client_id: clientId,
+                redirect_uris: redirectUri ? [redirectUri] : [],
+            };
+        },
+    });
+}
+//# sourceMappingURL=proxy-provider.js.map

package/build/auth/proxy-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-provider.js","sourceRoot":"","sources":["../../src/auth/proxy-provider.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAK5G,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC,CAC/C,eAAuB,EACvB,kBAA6B,UAAU,CAAC,KAAK;IAE7C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,kFAAkF;QAClF,IAAI,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,eAAe,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAA4B,CAAC;gBACzE,IAAI,OAAO,CAAC,0BAA0B,KAAK,oBAAoB,EAAE,CAAC;oBAChE,OAAO,CAAC,0BAA0B,GAAG,MAAM,CAAC;oBAC5C,aAAa,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC;QAED,8EAA8E;QAC9E,MAAM,IAAI,GAAG,MAAM,GAAG;aACnB,KAAK,EAAE;aACP,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IACE,IAAI;YACJ,OAAO,IAAI,KAAK,QAAQ;YACvB,IAAgC,CAAC,aAAa,KAAK,IAAI,EACxD,CAAC;YACD,OAAQ,IAAgC,CAAC,aAAa,CAAC;YACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAmB,EACnB,QAAsB;IAEtB,OAAO,IAAI,wBAAwB,CAAC;QAClC,SAAS,EAAE;YACT,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC;QACD,KAAK,EAAE,iCAAiC,CAAC,MAAM,CAAC,eAAe,CAAC;QAChE,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;QACvD,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAuC,EAAE;YACjE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,WAAW,GAAG,2BAA2B,CAAC,QAAQ,EAAE,CAAC;YAC3D,OAAO;gBACL,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;aAChD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/build/auth/token-type.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A JWT has exactly three non-empty dot-separated segments
+ * (header.payload.signature). Anything else is treated as an opaque
+ * legacy api-token.
+ */
+export declare function isJwt(token: string): boolean;
+//# sourceMappingURL=token-type.d.ts.map

package/build/auth/token-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-type.d.ts","sourceRoot":"","sources":["../../src/auth/token-type.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAG5C"}

package/build/auth/token-type.js

@@ -0,0 +1,10 @@
+/**
+ * A JWT has exactly three non-empty dot-separated segments
+ * (header.payload.signature). Anything else is treated as an opaque
+ * legacy api-token.
+ */
+export function isJwt(token) {
+    const parts = token.split('.');
+    return parts.length === 3 && parts.every((p) => p.length > 0);
+}
+//# sourceMappingURL=token-type.js.map

package/build/auth/token-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-type.js","sourceRoot":"","sources":["../../src/auth/token-type.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/build/cache/circuit-breaker.d.ts

@@ -0,0 +1,33 @@
+export type CircuitState = 'closed' | 'open' | 'half_open';
+export interface CircuitBreakerOptions {
+    name: string;
+    /** Consecutive failures that flip the state from closed to open. */
+    failureThreshold: number;
+    /** Time in open state before transitioning to half-open. */
+    openDurationMs: number;
+    /** Optional callback invoked on every state transition. */
+    onStateChange?: (state: CircuitState) => void;
+}
+export declare class CircuitOpenError extends Error {
+    constructor(name: string);
+}
+/**
+ * Three-state circuit breaker: closed → open → half_open → closed/open.
+ *
+ * - closed: calls pass through; consecutive failures accumulate
+ * - open: calls short-circuit with CircuitOpenError until openDurationMs passes
+ * - half_open: the next call probes the upstream; success closes, failure reopens
+ */
+export declare class CircuitBreaker {
+    private _state;
+    private consecutiveFailures;
+    private openedAt;
+    private readonly opts;
+    constructor(opts: CircuitBreakerOptions);
+    get state(): CircuitState;
+    exec<T>(fn: () => Promise<T>): Promise<T>;
+    private onSuccess;
+    private onFailure;
+    private transition;
+}
+//# sourceMappingURL=circuit-breaker.d.ts.map

package/build/cache/circuit-breaker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../../src/cache/circuit-breaker.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;CAC/C;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,IAAI,EAAE,MAAM;CAKzB;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwB;gBAEjC,IAAI,EAAE,qBAAqB;IAIvC,IAAI,KAAK,IAAI,YAAY,CAKxB;IAEK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAe/C,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,SAAS;IAajB,OAAO,CAAC,UAAU;CAKnB"}

package/build/cache/circuit-breaker.js

@@ -0,0 +1,68 @@
+export class CircuitOpenError extends Error {
+    constructor(name) {
+        super(`CircuitBreaker[${name}] is open`);
+        this.name = 'CircuitOpenError';
+        Object.setPrototypeOf(this, CircuitOpenError.prototype);
+    }
+}
+/**
+ * Three-state circuit breaker: closed → open → half_open → closed/open.
+ *
+ * - closed: calls pass through; consecutive failures accumulate
+ * - open: calls short-circuit with CircuitOpenError until openDurationMs passes
+ * - half_open: the next call probes the upstream; success closes, failure reopens
+ */
+export class CircuitBreaker {
+    _state = 'closed';
+    consecutiveFailures = 0;
+    openedAt = 0;
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    get state() {
+        if (this._state === 'open' && Date.now() - this.openedAt >= this.opts.openDurationMs) {
+            this.transition('half_open');
+        }
+        return this._state;
+    }
+    async exec(fn) {
+        const s = this.state;
+        if (s === 'open') {
+            throw new CircuitOpenError(this.opts.name);
+        }
+        try {
+            const result = await fn();
+            this.onSuccess();
+            return result;
+        }
+        catch (err) {
+            this.onFailure();
+            throw err;
+        }
+    }
+    onSuccess() {
+        this.consecutiveFailures = 0;
+        if (this._state === 'half_open')
+            this.transition('closed');
+    }
+    onFailure() {
+        if (this._state === 'half_open') {
+            this.openedAt = Date.now();
+            this.transition('open');
+            return;
+        }
+        this.consecutiveFailures += 1;
+        if (this.consecutiveFailures >= this.opts.failureThreshold) {
+            this.openedAt = Date.now();
+            this.transition('open');
+        }
+    }
+    transition(next) {
+        if (this._state === next)
+            return;
+        this._state = next;
+        this.opts.onStateChange?.(next);
+    }
+}
+//# sourceMappingURL=circuit-breaker.js.map

package/build/cache/circuit-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuit-breaker.js","sourceRoot":"","sources":["../../src/cache/circuit-breaker.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,IAAY;QACtB,KAAK,CAAC,kBAAkB,IAAI,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,GAAiB,QAAQ,CAAC;IAChC,mBAAmB,GAAG,CAAC,CAAC;IACxB,QAAQ,GAAG,CAAC,CAAC;IACJ,IAAI,CAAwB;IAE7C,YAAY,IAA2B;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACrF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,EAAoB;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;YAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAkB;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF"}

package/build/cache/index.d.ts

@@ -0,0 +1,24 @@
+import { CacheBackend } from './types.js';
+export { hashToken, buildCacheKey } from './keys.js';
+export type { CacheBackend, InvalidationBus } from './types.js';
+export { InMemoryCache } from './memory.js';
+export { RedisCache } from './redis.js';
+export { RedisInvalidationBus } from './redis-bus.js';
+export { LayeredCache } from './layered.js';
+export { getMetrics, resetMetricsForTest } from './metrics.js';
+/**
+ * Build the process-wide cache backend.
+ *
+ * If QASE_MCP_REDIS_URL is set, compose LayeredCache(L1 in-memory, L2 Redis,
+ * pub/sub bus). Otherwise return plain InMemoryCache. The ioredis module is
+ * dynamically imported only when the URL is present — stdio users never load it.
+ */
+export declare function buildCache(): Promise<CacheBackend>;
+/**
+ * Lazy async singleton. First call triggers buildCache(); concurrent callers
+ * share the same promise so we build exactly once.
+ */
+export declare function getCache(): Promise<CacheBackend>;
+/** @internal */
+export declare function resetCacheForTest(): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/build/cache/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM1C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACrD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAM/D;;;;;;GAMG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CA4CxD;AAKD;;;GAGG;AACH,wBAAsB,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,CAUtD;AAED,gBAAgB;AAChB,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAMvD"}

package/build/cache/index.js

@@ -0,0 +1,86 @@
+import { InMemoryCache } from './memory.js';
+import { RedisCache } from './redis.js';
+import { RedisInvalidationBus } from './redis-bus.js';
+import { LayeredCache } from './layered.js';
+export { hashToken, buildCacheKey } from './keys.js';
+export { InMemoryCache } from './memory.js';
+export { RedisCache } from './redis.js';
+export { RedisInvalidationBus } from './redis-bus.js';
+export { LayeredCache } from './layered.js';
+export { getMetrics, resetMetricsForTest } from './metrics.js';
+const DEFAULT_MAX_ENTRIES = 1000;
+const DEFAULT_MAX_PER_TENANT = 50;
+const INVALIDATION_CHANNEL = 'qase-mcp:invalidations';
+/**
+ * Build the process-wide cache backend.
+ *
+ * If QASE_MCP_REDIS_URL is set, compose LayeredCache(L1 in-memory, L2 Redis,
+ * pub/sub bus). Otherwise return plain InMemoryCache. The ioredis module is
+ * dynamically imported only when the URL is present — stdio users never load it.
+ */
+export async function buildCache() {
+    const l1 = new InMemoryCache({
+        maxEntries: DEFAULT_MAX_ENTRIES,
+        maxPerTenant: DEFAULT_MAX_PER_TENANT,
+    });
+    const redisUrl = process.env.QASE_MCP_REDIS_URL;
+    if (!redisUrl)
+        return l1;
+    let Redis;
+    try {
+        const mod = await import('ioredis');
+        Redis = mod.default ?? mod.Redis;
+    }
+    catch (err) {
+        console.error('[cache] QASE_MCP_REDIS_URL is set but the optional `ioredis` dependency is not installed. ' +
+            'Falling back to in-memory cache only.', err);
+        return l1;
+    }
+    // Fail fast when Redis is unreachable so cache ops degrade to L1 instead of
+    // hanging the request. Without enableOfflineQueue:false + timeouts, ioredis
+    // queues commands until (re)connect, which blocks getCache()/get()/set() and
+    // times out the whole tool call when Redis is misconfigured or down.
+    const commandOpts = {
+        maxRetriesPerRequest: 1,
+        enableReadyCheck: true,
+        enableOfflineQueue: false,
+        connectTimeout: 3000,
+        commandTimeout: 2000,
+    };
+    // The subscriber keeps its offline queue so the (re)subscribe survives
+    // reconnects and cross-instance invalidation resumes once Redis is back.
+    const subOpts = { maxRetriesPerRequest: 1, enableReadyCheck: true, connectTimeout: 3000 };
+    const l2Client = new Redis(redisUrl, commandOpts);
+    const pubClient = new Redis(redisUrl, commandOpts);
+    const subClient = new Redis(redisUrl, subOpts);
+    const l2 = new RedisCache(l2Client);
+    const bus = new RedisInvalidationBus(pubClient, subClient, INVALIDATION_CHANNEL);
+    return new LayeredCache(l1, l2, bus);
+}
+let instance = null;
+let pending = null;
+/**
+ * Lazy async singleton. First call triggers buildCache(); concurrent callers
+ * share the same promise so we build exactly once.
+ */
+export async function getCache() {
+    if (instance)
+        return instance;
+    if (!pending) {
+        pending = buildCache().then((c) => {
+            instance = c;
+            pending = null;
+            return c;
+        });
+    }
+    return pending;
+}
+/** @internal */
+export async function resetCacheForTest() {
+    if (instance) {
+        await instance.close();
+        instance = null;
+    }
+    pending = null;
+}
+//# sourceMappingURL=index.js.map

package/build/cache/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,UAAU,EAAE,mBAAmB;QAC/B,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,KAAK,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,4FAA4F;YAC1F,uCAAuC,EACzC,GAAG,CACJ,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,WAAW,GAAG;QAClB,oBAAoB,EAAE,CAAC;QACvB,gBAAgB,EAAE,IAAI;QACtB,kBAAkB,EAAE,KAAK;QACzB,cAAc,EAAE,IAAI;QACpB,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,OAAO,GAAG,EAAE,oBAAoB,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE/C,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAEjF,OAAO,IAAI,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,IAAI,QAAQ,GAAwB,IAAI,CAAC;AACzC,IAAI,OAAO,GAAiC,IAAI,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,QAAQ,GAAG,CAAC,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC"}