@scavio/mcp-server 0.13.1 → 0.14.1

package/README.md

@@ -5,7 +5,7 @@
 
 [Scavio](https://scavio.dev) is a unified [Web Search API](https://scavio.dev/docs/search-api) and MCP server that gives AI agents web search, page extraction, and structured data from e-commerce, social, travel, jobs, real-estate, app-store, ad-library and company-filing sources. 191 tools across 31 platforms plus Extract, one API key.
 
-**The 22 platforms added in 0.13.0 are opt-in.** Registering all 191 tools puts 262KB of tool definitions — roughly 70k tokens — into every session before you type anything. So the default is the surface 0.12.x already had, plus Extract: 106 tools, 102KB. Upgrading never removes a tool you were using. Everything else is one env var away: see [Choosing which tools load](#choosing-which-tools-load).
+**The 22 platforms added in 0.13.0 are opt-in.** Registering all 191 tools puts 136KB of tool definitions — roughly 35k tokens — into every session before you type anything. So the default is the surface 0.12.x already had, plus Extract: 106 tools, 63KB. Upgrading never removes a tool you were using. Everything else is one env var away: see [Choosing which tools load](#choosing-which-tools-load).
 
 ## Remote MCP Server
 
@@ -15,7 +15,10 @@ Connect directly to Scavio's remote MCP server without any local installation:
 https://mcp.scavio.dev/mcp
 ```
 
-Pass your API key via the `x-api-key` header. Get your key at [scavio.dev](https://scavio.dev).
+Two ways to authenticate:
+
+- **Sign in with OAuth, no key to copy.** Claude Desktop, claude.ai and Claude Code sign in to your Scavio account through the server. In Claude Desktop or claude.ai: Settings > Connectors > Add custom connector, name it Scavio, paste the URL, then Connect and Authorize. In Claude Code: `claude mcp add --transport http scavio https://mcp.scavio.dev/mcp`, then run `/mcp` and choose Authenticate.
+- **API key.** Pass it in the `x-api-key` header. Get your key at [scavio.dev](https://scavio.dev).
 
 ---
 
@@ -53,13 +56,23 @@ Requires Node.js 20+. Get your API key at [scavio.dev](https://scavio.dev).
 
 ### Claude Code
 
+Sign in with OAuth, then run `/mcp` inside Claude Code and choose Authenticate:
+
 ```bash
-claude mcp add scavio --transport http --url https://mcp.scavio.dev/mcp --header "x-api-key: YOUR_SCAVIO_API_KEY"
+claude mcp add --transport http scavio https://mcp.scavio.dev/mcp
+```
+
+Or pass an API key:
+
+```bash
+claude mcp add --transport http scavio https://mcp.scavio.dev/mcp --header "x-api-key: YOUR_SCAVIO_API_KEY"
 ```
 
 ### Claude Desktop
 
-Add to `claude_desktop_config.json` (`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS, `%APPDATA%\Claude\claude_desktop_config.json` on Windows):
+No API key needed: Settings > Connectors > Add custom connector, name it Scavio, paste `https://mcp.scavio.dev/mcp`, then Connect and sign in to your Scavio account. The same steps work on claude.ai.
+
+Or run the server locally. Add to `claude_desktop_config.json` (`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS, `%APPDATA%\Claude\claude_desktop_config.json` on Windows):
 
 ```json
 {
@@ -194,8 +207,8 @@ Add to settings (`Cmd+,`):
 
 ## Choosing which tools load
 
-Scavio exposes 191 tools. Loading all of them costs 262KB of `tools/list` —
-roughly 70k tokens of context in every session before the user has said anything,
+Scavio exposes 191 tools. Loading all of them costs 136KB of `tools/list` —
+roughly 35k tokens of context in every session before the user has said anything,
 and more tools than some clients will accept at all. So the server registers a
 curated subset by default and lets you pick the rest. The sizes below are
 measured, not estimated: `npm run toolslist` reproduces them.
@@ -204,10 +217,10 @@ measured, not estimated: `npm run toolslist` reproduces them.
 
 | Value | Registers |
 |-------|-----------|
-| *(unset)* | Everything 0.12.x had, plus `extract` — **106 tools, 102KB** |
-| `all` | every platform — **191 tools, 262KB** |
-| `extract,sec,g2` | just those platforms — 11 tools, 20KB |
-| `default,walmart,metaads` | the default set plus two more — 58 tools |
+| *(unset)* or `default` | Everything 0.12.x had, plus `extract` — **106 tools, 63KB** |
+| `all` | every platform — **191 tools, 136KB** |
+| `extract,sec,g2` | just those platforms — 11 tools, 10KB |
+| `default,zillow,metaads` | the default set plus two more — 112 tools, 70KB |
 | `none` | no platform tools, only `get_usage` |
 
 Keys are matched case- and punctuation-insensitively, so `meta-ads`, `metaads`

package/dist/auth/cimd.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
+export declare function fetchClientMetadata(clientIdUrl: string): Promise<OAuthClientInformationFull | null>;

package/dist/auth/cimd.js

@@ -0,0 +1,20 @@
+export async function fetchClientMetadata(clientIdUrl) {
+    try {
+        const res = await fetch(clientIdUrl, {
+            headers: { Accept: "application/json" },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!res.ok)
+            return null;
+        const meta = await res.json();
+        if (!meta.client_id || !Array.isArray(meta.redirect_uris))
+            return null;
+        if (meta.client_id !== clientIdUrl)
+            return null;
+        return meta;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=cimd.js.map

package/dist/auth/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../src/auth/cimd.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,IAAI,IAAI,CAAC,SAAS,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,IAAkC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,12 @@
+import { AuthCodeStore, PendingSessionStore, ClientStore } from "./stores.js";
+type SignedPayload = {
+    key: string;
+    sid: string;
+    exp: number;
+};
+export declare function verifySignedToken(token: string): SignedPayload | null;
+export declare function verifyApiKey(apiKey: string): Promise<boolean>;
+export declare const authCodeStore: AuthCodeStore;
+export declare const pendingSessionStore: PendingSessionStore;
+export declare const clientStore: ClientStore;
+export {};

package/dist/auth/provider.js

@@ -0,0 +1,43 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { env } from "../lib/env.js";
+import { ScavioClient } from "../lib/client.js";
+import { AuthCodeStore, PendingSessionStore, ClientStore } from "./stores.js";
+export function verifySignedToken(token) {
+    const secret = env.MCP_AUTH_SECRET;
+    if (!secret)
+        return null;
+    const dotIndex = token.indexOf(".");
+    if (dotIndex < 0)
+        return null;
+    const payloadB64 = token.slice(0, dotIndex);
+    const sigB64 = token.slice(dotIndex + 1);
+    const expectedSig = createHmac("sha256", secret)
+        .update(payloadB64)
+        .digest();
+    const actualSig = Buffer.from(sigB64, "base64url");
+    if (expectedSig.length !== actualSig.length || !timingSafeEqual(expectedSig, actualSig))
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+        if (payload.exp < Date.now())
+            return null;
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+export async function verifyApiKey(apiKey) {
+    try {
+        const client = new ScavioClient(apiKey);
+        await client.get("/api/v1/usage");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export const authCodeStore = new AuthCodeStore();
+export const pendingSessionStore = new PendingSessionStore();
+export const clientStore = new ClientStore();
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEzC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC7C,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,EAAE,CAAC;IACZ,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEnD,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAErG,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAC/B,CAAC;QACnB,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/auth/routes.d.ts

@@ -0,0 +1,2 @@
+import { Hono } from "hono";
+export declare const authApp: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;

package/dist/auth/routes.js

@@ -0,0 +1,214 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { createHash } from "node:crypto";
+import { env } from "../lib/env.js";
+import { authCodeStore, pendingSessionStore, clientStore, verifySignedToken, } from "./provider.js";
+export const authApp = new Hono();
+// --- OAuth Metadata ---
+const buildOAuthMetadata = () => ({
+    issuer: env.ISSUER_URL,
+    authorization_endpoint: `${env.ISSUER_URL}/authorize`,
+    token_endpoint: `${env.ISSUER_URL}/token`,
+    registration_endpoint: `${env.ISSUER_URL}/register`,
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code"],
+    code_challenge_methods_supported: ["S256"],
+    token_endpoint_auth_methods_supported: ["none"],
+    client_id_metadata_document_supported: true,
+});
+const buildResourceMetadata = () => ({
+    resource: `${env.ISSUER_URL}/mcp`,
+    authorization_servers: [env.ISSUER_URL],
+    resource_name: "Scavio MCP Server",
+    resource_documentation: "https://scavio.dev/docs/mcp",
+});
+authApp.get("/.well-known/oauth-authorization-server", cors({ origin: "*" }), (c) => c.json(buildOAuthMetadata()));
+authApp.get("/.well-known/oauth-protected-resource/mcp", cors({ origin: "*" }), (c) => c.json(buildResourceMetadata()));
+// --- Dynamic Client Registration (RFC 7591) ---
+authApp.post("/register", cors({ origin: "*" }), async (c) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        return c.json({ error: "invalid_client_metadata", error_description: "Invalid JSON" }, 400);
+    }
+    if (!body.redirect_uris || !Array.isArray(body.redirect_uris)) {
+        return c.json({ error: "invalid_client_metadata", error_description: "redirect_uris required" }, 400);
+    }
+    const invalidScheme = body.redirect_uris.some((uri) => {
+        try {
+            const u = new URL(uri);
+            if (u.protocol === "https:")
+                return false;
+            if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1"))
+                return false;
+            return true;
+        }
+        catch {
+            return true;
+        }
+    });
+    if (invalidScheme) {
+        return c.json({ error: "invalid_client_metadata", error_description: "redirect_uris must use https (or http for localhost)" }, 400);
+    }
+    const client = await clientStore.registerClient(body);
+    return c.json(client, 201);
+});
+// --- Authorization Endpoint ---
+authApp.all("/authorize", async (c) => {
+    if (!env.MCP_AUTH_SECRET) {
+        return c.json({ error: "server_error", error_description: "OAuth not configured" }, 500);
+    }
+    const params = c.req.method === "GET" ? c.req.query() : await c.req.parseBody();
+    const clientId = params.client_id;
+    const redirectUri = params.redirect_uri;
+    const responseType = params.response_type;
+    const codeChallenge = params.code_challenge;
+    const codeChallengeMethod = params.code_challenge_method;
+    const state = params.state;
+    const scope = params.scope;
+    // Validate client
+    if (!clientId) {
+        return c.json({ error: "invalid_request", error_description: "client_id required" }, 400);
+    }
+    const client = await clientStore.getClient(clientId);
+    if (!client) {
+        return c.json({ error: "invalid_client", error_description: "Unknown client_id" }, 400);
+    }
+    // Resolve redirect_uri
+    let resolvedRedirect = redirectUri;
+    if (!resolvedRedirect) {
+        if (client.redirect_uris.length === 1) {
+            resolvedRedirect = client.redirect_uris[0].toString();
+        }
+        else {
+            return c.json({ error: "invalid_request", error_description: "redirect_uri required" }, 400);
+        }
+    }
+    // Validate redirect_uri against registered URIs
+    if (!client.redirect_uris.some(u => u.toString() === resolvedRedirect)) {
+        return c.json({ error: "invalid_request", error_description: "Unregistered redirect_uri" }, 400);
+    }
+    // Validate remaining params (errors redirect to client)
+    const errorRedirect = (error, desc) => {
+        const url = new URL(resolvedRedirect);
+        url.searchParams.set("error", error);
+        url.searchParams.set("error_description", desc);
+        if (state)
+            url.searchParams.set("state", state);
+        return c.redirect(url.toString(), 302);
+    };
+    if (responseType !== "code")
+        return errorRedirect("unsupported_response_type", "Only 'code' supported");
+    if (!codeChallenge)
+        return errorRedirect("invalid_request", "code_challenge required");
+    if (codeChallengeMethod !== "S256")
+        return errorRedirect("invalid_request", "Only S256 supported");
+    // Store pending session, redirect to dashboard consent page
+    const sessionId = pendingSessionStore.create({
+        clientId,
+        redirectUri: resolvedRedirect,
+        state,
+        codeChallenge,
+        scopes: scope ? scope.split(" ") : [],
+    });
+    const callbackUrl = `${env.ISSUER_URL}/oauth/callback`;
+    const dashboardUrl = new URL(`${env.DASHBOARD_URL}/mcp/authorize`);
+    dashboardUrl.searchParams.set("session", sessionId);
+    dashboardUrl.searchParams.set("callback", callbackUrl);
+    return c.redirect(dashboardUrl.toString(), 302);
+});
+// --- OAuth Callback (from dashboard consent page) ---
+authApp.get("/oauth/callback", async (c) => {
+    const token = c.req.query("token");
+    const sessionId = c.req.query("session");
+    const error = c.req.query("error");
+    if (!sessionId) {
+        return c.json({ error: "invalid_request", error_description: "Missing session" }, 400);
+    }
+    const session = pendingSessionStore.consume(sessionId);
+    if (!session) {
+        return c.json({ error: "invalid_request", error_description: "Invalid or expired session" }, 400);
+    }
+    const errorRedirect = (errCode, desc) => {
+        const url = new URL(session.redirectUri);
+        url.searchParams.set("error", errCode);
+        url.searchParams.set("error_description", desc);
+        if (session.state)
+            url.searchParams.set("state", session.state);
+        return c.redirect(url.toString(), 302);
+    };
+    // User denied
+    if (error === "access_denied") {
+        return errorRedirect("access_denied", "User denied authorization");
+    }
+    if (!token) {
+        return errorRedirect("server_error", "Missing token");
+    }
+    // Verify the signed token from the backend
+    const payload = verifySignedToken(token);
+    if (!payload) {
+        return errorRedirect("server_error", "Invalid or expired token");
+    }
+    if (payload.sid !== sessionId) {
+        return errorRedirect("server_error", "Session mismatch");
+    }
+    // Generate auth code
+    const code = authCodeStore.generate({
+        apiKey: payload.key,
+        codeChallenge: session.codeChallenge,
+        redirectUri: session.redirectUri,
+        clientId: session.clientId,
+    });
+    const redirectUrl = new URL(session.redirectUri);
+    redirectUrl.searchParams.set("code", code);
+    if (session.state)
+        redirectUrl.searchParams.set("state", session.state);
+    return c.redirect(redirectUrl.toString(), 302);
+});
+// --- Token Endpoint ---
+authApp.post("/token", cors({ origin: "*" }), async (c) => {
+    const body = await c.req.parseBody();
+    const grantType = body.grant_type;
+    const code = body.code;
+    const codeVerifier = body.code_verifier;
+    const clientId = body.client_id;
+    const redirectUri = body.redirect_uri;
+    if (grantType !== "authorization_code") {
+        return c.json({ error: "unsupported_grant_type" }, 400);
+    }
+    if (!code || !codeVerifier || !clientId) {
+        return c.json({ error: "invalid_request", error_description: "code, code_verifier, client_id required" }, 400);
+    }
+    // Validate client
+    const client = await clientStore.getClient(clientId);
+    if (!client) {
+        return c.json({ error: "invalid_client" }, 401);
+    }
+    // Consume the auth code
+    const codeData = authCodeStore.consume(code);
+    if (!codeData) {
+        return c.json({ error: "invalid_grant", error_description: "Invalid or expired code" }, 400);
+    }
+    if (codeData.clientId !== clientId) {
+        return c.json({ error: "invalid_grant", error_description: "Client mismatch" }, 400);
+    }
+    if (redirectUri && codeData.redirectUri !== redirectUri) {
+        return c.json({ error: "invalid_grant", error_description: "redirect_uri mismatch" }, 400);
+    }
+    // PKCE: verify S256
+    const expectedChallenge = createHash("sha256")
+        .update(codeVerifier)
+        .digest("base64url");
+    if (expectedChallenge !== codeData.codeChallenge) {
+        return c.json({ error: "invalid_grant", error_description: "PKCE verification failed" }, 400);
+    }
+    // Issue the access token (the user's actual API key)
+    return c.json({
+        access_token: codeData.apiKey,
+        token_type: "Bearer",
+    });
+});
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;AAElC,yBAAyB;AAEzB,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,CAAC,UAAU;IACtB,sBAAsB,EAAE,GAAG,GAAG,CAAC,UAAU,YAAY;IACrD,cAAc,EAAE,GAAG,GAAG,CAAC,UAAU,QAAQ;IACzC,qBAAqB,EAAE,GAAG,GAAG,CAAC,UAAU,WAAW;IACnD,wBAAwB,EAAE,CAAC,MAAM,CAAC;IAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;IAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;IAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;IAC/C,qCAAqC,EAAE,IAAI;CAC5C,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,CAAC;IACnC,QAAQ,EAAE,GAAG,GAAG,CAAC,UAAU,MAAM;IACjC,qBAAqB,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;IACvC,aAAa,EAAE,mBAAmB;IAClC,sBAAsB,EAAE,6BAA6B;CACtD,CAAC,CAAC;AAEH,OAAO,CAAC,GAAG,CACT,yCAAyC,EACzC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CACpC,CAAC;AAEF,OAAO,CAAC,GAAG,CACT,2CAA2C,EAC3C,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CACvC,CAAC;AAEF,iDAAiD;AAEjD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3D,8DAA8D;IAC9D,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1C,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvG,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,sDAAsD,EAAE,EAAE,GAAG,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,iCAAiC;AAEjC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAmB,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,YAAkC,CAAC;IAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,aAAuB,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,CAAC,cAAwB,CAAC;IACtD,MAAM,mBAAmB,GAAG,MAAM,CAAC,qBAA+B,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,KAA2B,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAA2B,CAAC;IAEjD,kBAAkB;IAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,uBAAuB;IACvB,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;IACnG,CAAC;IAED,wDAAwD;IACxD,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAiB,CAAC,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,IAAI,YAAY,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,2BAA2B,EAAE,uBAAuB,CAAC,CAAC;IACxG,IAAI,CAAC,aAAa;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IACvF,IAAI,mBAAmB,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAEnG,4DAA4D;IAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC;QAC3C,QAAQ;QACR,WAAW,EAAE,gBAAgB;QAC7B,KAAK;QACL,aAAa;QACb,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;KACtC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,UAAU,iBAAiB,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,gBAAgB,CAAC,CAAC;IACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEvD,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,uDAAuD;AAEvD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,cAAc;IACd,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,2CAA2C;IAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK;QAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAExE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,yBAAyB;AAEzB,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAoB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,aAAuB,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAmB,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAkC,CAAC;IAE5D,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;IACjH,CAAC;IAED,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7F,CAAC;IAED,oBAAoB;IACpB,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3C,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,IAAI,iBAAiB,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;IAChG,CAAC;IAED,qDAAqD;IACrD,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,YAAY,EAAE,QAAQ,CAAC,MAAM;QAC7B,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/stores.d.ts

@@ -0,0 +1,33 @@
+import type { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+type AuthCodeData = {
+    apiKey: string;
+    codeChallenge: string;
+    redirectUri: string;
+    clientId: string;
+    expiresAt: number;
+};
+type PendingSession = {
+    clientId: string;
+    redirectUri: string;
+    state?: string;
+    codeChallenge: string;
+    scopes: string[];
+    expiresAt: number;
+};
+export declare class AuthCodeStore {
+    private codes;
+    generate(data: Omit<AuthCodeData, "expiresAt">): string;
+    consume(code: string): AuthCodeData | null;
+}
+export declare class PendingSessionStore {
+    private sessions;
+    create(data: Omit<PendingSession, "expiresAt">): string;
+    consume(id: string): PendingSession | null;
+}
+export declare class ClientStore implements OAuthRegisteredClientsStore {
+    private clients;
+    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    registerClient(client: Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at">): Promise<OAuthClientInformationFull>;
+}
+export {};

package/dist/auth/stores.js

@@ -0,0 +1,69 @@
+import { randomBytes } from "node:crypto";
+import { fetchClientMetadata } from "./cimd.js";
+const AUTH_CODE_TTL = 5 * 60 * 1000; // 5 min
+const SESSION_TTL = 10 * 60 * 1000; // 10 min
+const CLIENT_CACHE_TTL = 60 * 60 * 1000; // 1 hour
+export class AuthCodeStore {
+    codes = new Map();
+    generate(data) {
+        const code = randomBytes(32).toString("hex");
+        this.codes.set(code, { ...data, expiresAt: Date.now() + AUTH_CODE_TTL });
+        return code;
+    }
+    consume(code) {
+        const data = this.codes.get(code);
+        if (!data)
+            return null;
+        this.codes.delete(code);
+        if (data.expiresAt < Date.now())
+            return null;
+        return data;
+    }
+}
+export class PendingSessionStore {
+    sessions = new Map();
+    create(data) {
+        const id = randomBytes(24).toString("hex");
+        this.sessions.set(id, { ...data, expiresAt: Date.now() + SESSION_TTL });
+        return id;
+    }
+    consume(id) {
+        const data = this.sessions.get(id);
+        if (!data)
+            return null;
+        this.sessions.delete(id);
+        if (data.expiresAt < Date.now())
+            return null;
+        return data;
+    }
+}
+export class ClientStore {
+    clients = new Map();
+    async getClient(clientId) {
+        // Check cache first
+        const cached = this.clients.get(clientId);
+        if (cached && cached.cachedAt + CLIENT_CACHE_TTL > Date.now()) {
+            return cached.client;
+        }
+        // CIMD: if client_id is a URL, fetch metadata from it
+        if (clientId.startsWith("https://")) {
+            const meta = await fetchClientMetadata(clientId);
+            if (meta) {
+                this.clients.set(clientId, { client: meta, cachedAt: Date.now() });
+                return meta;
+            }
+        }
+        return cached?.client;
+    }
+    async registerClient(client) {
+        const clientId = `scavio_${randomBytes(16).toString("hex")}`;
+        const full = {
+            ...client,
+            client_id: clientId,
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+        };
+        this.clients.set(clientId, { client: full, cachedAt: Date.now() });
+        return full;
+    }
+}
+//# sourceMappingURL=stores.js.map

package/dist/auth/stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.js","sourceRoot":"","sources":["../../src/auth/stores.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAmBhD,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAM,QAAQ;AAClD,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAO,SAAS;AACnD,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAE,SAAS;AAEnD,MAAM,OAAO,aAAa;IAChB,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEhD,QAAQ,CAAC,IAAqC;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IACtB,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAErD,MAAM,CAAC,IAAuC;QAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IACd,OAAO,GAAG,IAAI,GAAG,EAAoE,CAAC;IAE9F,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,sDAAsD;QACtD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,MAAM,EAAE,MAAM,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAA6E;QAE7E,MAAM,QAAQ,GAAG,UAAU,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAA+B;YACvC,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/index.js

@@ -39,7 +39,9 @@ async function startHttp() {
     const { Hono } = await import("hono");
     const { serve } = await import("@hono/node-server");
     const { WebStandardStreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
+    const { authApp } = await import("./auth/routes.js");
     const app = new Hono();
+    // Health / info endpoints
     app.get("/", (c) => c.json({
         status: "ok",
         server: SERVER_NAME,
@@ -48,12 +50,18 @@ async function startHttp() {
         default_platforms: DEFAULT_PLATFORMS,
     }));
     app.get("/health", (c) => c.json({ status: "ok" }));
+    // Mount OAuth routes (well-known, authorize, token, register, callback)
+    app.route("/", authApp);
+    // MCP endpoint with dual auth: OAuth bearer or legacy API key
     app.post("/mcp", async (c) => {
         const apiKey = c.req.header("x-api-key") ??
             c.req.header("authorization")?.replace("Bearer ", "") ??
             c.req.query("api_key");
         if (!apiKey) {
-            return c.json({ error: "Missing SCAVIO_API_KEY. Provide x-api-key or Authorization: Bearer header." }, 401);
+            // Return 401 with OAuth discovery for OAuth-capable clients
+            const resourceMetadataUrl = `${env.ISSUER_URL}/.well-known/oauth-protected-resource/mcp`;
+            c.header("WWW-Authenticate", `Bearer resource_metadata="${resourceMetadataUrl}"`);
+            return c.json({ error: "Unauthorized" }, 401);
         }
         // A hosted remote has no per-user env var, so the allowlist is selectable
         // per connection. Falls back to SCAVIO_PLATFORMS, then to the default set.
@@ -67,6 +75,12 @@ async function startHttp() {
     });
     serve({ fetch: app.fetch, port: env.PORT }, (info) => {
         console.error(`${SERVER_NAME} v${SERVER_VERSION} started (http) on port ${info.port}`);
+        if (env.MCP_AUTH_SECRET) {
+            console.error(`OAuth enabled (issuer: ${env.ISSUER_URL})`);
+        }
+        else {
+            console.error("OAuth disabled (MCP_AUTH_SECRET not set)");
+        }
     });
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEtF,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,cAAc,GAClB,IAAI,CAAC,KAAK,CACR,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAE5F,CAAC,OAAO,CAAC;AAEV,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;IAC9B,MAAM,UAAU,EAAE,CAAC;AACrB,CAAC;KAAM,CAAC;IACN,MAAM,SAAS,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAC3C,2CAA2C,CAC5C,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CACX,GAAG,WAAW,KAAK,cAAc,iCAAiC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;QAChG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6DAA6D,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,EAAE,wCAAwC,EAAE,GAAG,MAAM,MAAM,CAC/D,+DAA+D,CAChE,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,IAAI,CAAC;QACL,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,aAAa;QACxB,iBAAiB,EAAE,iBAAiB;KACrC,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GACV,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4EAA4E,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9G,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC;QAEzF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAClG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,KAAK,cAAc,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEtF,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,cAAc,GAClB,IAAI,CAAC,KAAK,CACR,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAE5F,CAAC,OAAO,CAAC;AAEV,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;IAC9B,MAAM,UAAU,EAAE,CAAC;AACrB,CAAC;KAAM,CAAC;IACN,MAAM,SAAS,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAC3C,2CAA2C,CAC5C,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CACX,GAAG,WAAW,KAAK,cAAc,iCAAiC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;QAChG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6DAA6D,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,EAAE,wCAAwC,EAAE,GAAG,MAAM,MAAM,CAC/D,+DAA+D,CAChE,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAErD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0BAA0B;IAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,IAAI,CAAC;QACL,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,aAAa;QACxB,iBAAiB,EAAE,iBAAiB;KACrC,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpD,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAExB,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GACV,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4DAA4D;YAC5D,MAAM,mBAAmB,GAAG,GAAG,GAAG,CAAC,UAAU,2CAA2C,CAAC;YACzF,CAAC,CAAC,MAAM,CACN,kBAAkB,EAClB,6BAA6B,mBAAmB,GAAG,CACpD,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC;QAEzF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAClG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,KAAK,cAAc,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/client.js

@@ -19,14 +19,17 @@ export class ScavioClient {
         if (!response.ok) {
             const text = await response.text();
             let message;
+            let billingUrl;
             try {
                 const json = JSON.parse(text);
                 message = json.error ?? json.message ?? text;
+                if (typeof json.billing_url === "string")
+                    billingUrl = json.billing_url;
             }
             catch {
                 message = text;
             }
-            throw new ApiError(response.status, message);
+            throw new ApiError(response.status, message, undefined, billingUrl);
         }
         return response.json();
     }

package/dist/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,OAAO,YAAY;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IAEvB,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACrD,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACzC;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc;QACxC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,OAAO,YAAY;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IAEvB,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACrD,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACzC;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAAe,CAAC;YACpB,IAAI,UAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;gBAC7C,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;oBAAE,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;YAC1E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc;QACxC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/lib/env.d.ts

@@ -2,6 +2,9 @@ export declare const env: {
     SCAVIO_API_BASE_URL: string;
     PORT: number;
     TRANSPORT: "http" | "stdio";
+    ISSUER_URL: string;
+    DASHBOARD_URL: string;
     SCAVIO_API_KEY?: string | undefined;
     SCAVIO_PLATFORMS?: string | undefined;
+    MCP_AUTH_SECRET?: string | undefined;
 };

package/dist/lib/env.js

@@ -11,6 +11,10 @@ const envSchema = z.object({
         .default(3000),
     TRANSPORT: z.enum(["http", "stdio"])
         .default("stdio"),
+    // OAuth
+    MCP_AUTH_SECRET: z.string().min(32).optional(),
+    ISSUER_URL: z.string().url().default("https://mcp.scavio.dev"),
+    DASHBOARD_URL: z.string().url().default("https://dashboard.scavio.dev"),
 });
 export const env = envSchema.parse(process.env);
 //# sourceMappingURL=env.js.map

package/dist/lib/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/lib/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;SAClC,OAAO,CAAC,wBAAwB,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,mFAAmF;IACnF,+EAA+E;IAC/E,8EAA8E;IAC9E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SAC5C,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,OAAO,CAAC,OAAO,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/lib/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;SAClC,OAAO,CAAC,wBAAwB,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,mFAAmF;IACnF,+EAA+E;IAC/E,8EAA8E;IAC9E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SAC5C,OAAO,CAAC,IAAI,CAAC;IAChB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,OAAO,CAAC,OAAO,CAAC;IACnB,QAAQ;IACR,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC;CACxE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC"}