@selvajs/selva 4.20.0-beta.14 → 4.20.0-beta.16

package/build/server/chunks/chunks/server2.js-zrAQqaix.js

@@ -0,0 +1,105 @@
+import { b as private_env } from './shared-server.js-CX8yV6G4.js';
+import { c as createOAuthServer, C as CODE_TTL_MS } from './oauth.js-DS-eyMD8.js';
+import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
+import { a as assertSafeRemoteDefinitionUrl } from './safe-url.js-CGp87nKy.js';
+import { r as readBodyWithCap } from './remote-definition.js-Bad5iO9R.js';
+import './access.js-BfMTTCTH.js';
+import './types.js-g5F0W_ER.js';
+import './context.js-DgF3EFGQ.js';
+import { json } from '@sveltejs/kit';
+
+// src/lib/server/oauth/server.ts
+/**
+* This instance's OAuth authorization server for MCP clients. The protocol lives
+* in `@selvajs/server/oauth`; this file supplies the secret, the SSRF-guarded
+* metadata fetch and the per-IP limit the endpoints share.
+*/
+var METADATA_TIMEOUT_MS = 5e3;
+var METADATA_MAX_BYTES = 65536;
+var cached = null;
+var redeemedCodes = /* @__PURE__ */ new Map();
+var ABANDON_AFTER_MS = CODE_TTL_MS + 6e4;
+var unredeemed = /* @__PURE__ */ new Map();
+/** Revoke `tokenId` with `revoke` unless its code is redeemed in time. */
+function expectRedemption(tokenId, revoke) {
+	const timer = setTimeout(() => {
+		unredeemed.delete(tokenId);
+		revoke().catch(() => {});
+	}, ABANDON_AFTER_MS);
+	timer.unref?.();
+	unredeemed.set(tokenId, timer);
+}
+function onRedeemed(tokenId) {
+	clearTimeout(unredeemed.get(tokenId));
+	unredeemed.delete(tokenId);
+}
+/** Whether `oauthServer` would build one, without building it. */
+function oauthConfigured() {
+	const secret = private_env.SELVA_HMAC_KEY;
+	return Boolean(secret && secret.length >= 32);
+}
+/** Undefined without a usable SELVA_HMAC_KEY: the endpoints then answer 503. */
+function oauthServer(origin) {
+	if (!oauthConfigured()) return void 0;
+	const secret = private_env.SELVA_HMAC_KEY;
+	if (cached?.origin !== origin || cached.secret !== secret) cached = {
+		origin,
+		secret,
+		server: createOAuthServer({
+			origin,
+			secret,
+			fetchClientMetadata,
+			redeemedCodes,
+			onRedeemed
+		})
+	};
+	return cached.server;
+}
+/** The URL is an unknown client's, so it goes through the same guard as remote definitions. */
+async function fetchClientMetadata(url) {
+	await assertSafeRemoteDefinitionUrl(url);
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), METADATA_TIMEOUT_MS);
+	try {
+		const res = await fetch(url, {
+			headers: { Accept: "application/json" },
+			redirect: "error",
+			signal: controller.signal
+		});
+		if (!res.ok) throw new Error(`HTTP ${res.status}`);
+		const bytes = await readBodyWithCap(res, METADATA_MAX_BYTES, controller);
+		return JSON.parse(new TextDecoder().decode(bytes));
+	} finally {
+		clearTimeout(timer);
+	}
+}
+var limiter = createComputeRateLimiter({
+	windowMs: 6e4,
+	maxPerWindow: 30
+});
+/** A 429 response when the caller's IP is over the limit, else undefined. */
+function oauthRateLimited(event) {
+	const verdict = limiter.check(`oauth:${event.getClientAddress()}`);
+	if (verdict.allowed) return void 0;
+	return json({
+		error: "slow_down",
+		error_description: "Too many requests. Try again shortly."
+	}, {
+		status: 429,
+		headers: { "Retry-After": String(verdict.retryAfter ?? 60) }
+	});
+}
+function oauthUnavailable() {
+	return json({
+		error: "temporarily_unavailable",
+		error_description: "OAuth is not configured here."
+	}, { status: 503 });
+}
+/** Discovery documents are read by browser-based clients too. */
+var DISCOVERY_HEADERS = {
+	"Access-Control-Allow-Origin": "*",
+	"Cache-Control": "public, max-age=3600"
+};
+
+export { DISCOVERY_HEADERS as D, oauthServer as a, oauthRateLimited as b, oauthUnavailable as c, expectRedemption as e, oauthConfigured as o };
+//# sourceMappingURL=server2.js-zrAQqaix.js.map

package/build/server/chunks/chunks/server2.js-zrAQqaix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server2.js-zrAQqaix.js","sources":["../../../../.svelte-kit/output/server/chunks/server2.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { s as createOAuthServer, t as CODE_TTL_MS } from \"./oauth.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport { t as assertSafeRemoteDefinitionUrl } from \"./safe-url.js\";\nimport { n as readBodyWithCap } from \"./remote-definition.js\";\nimport \"./compute.js\";\nimport \"./tokens.js\";\nimport { json } from \"@sveltejs/kit\";\n// src/lib/server/oauth/server.ts\n/**\n* This instance's OAuth authorization server for MCP clients. The protocol lives\n* in `@selvajs/server/oauth`; this file supplies the secret, the SSRF-guarded\n* metadata fetch and the per-IP limit the endpoints share.\n*/\nvar METADATA_TIMEOUT_MS = 5e3;\nvar METADATA_MAX_BYTES = 65536;\nvar cached = null;\nvar redeemedCodes = /* @__PURE__ */ new Map();\nvar ABANDON_AFTER_MS = CODE_TTL_MS + 6e4;\nvar unredeemed = /* @__PURE__ */ new Map();\n/** Revoke `tokenId` with `revoke` unless its code is redeemed in time. */\nfunction expectRedemption(tokenId, revoke) {\n\tconst timer = setTimeout(() => {\n\t\tunredeemed.delete(tokenId);\n\t\trevoke().catch(() => {});\n\t}, ABANDON_AFTER_MS);\n\ttimer.unref?.();\n\tunredeemed.set(tokenId, timer);\n}\nfunction onRedeemed(tokenId) {\n\tclearTimeout(unredeemed.get(tokenId));\n\tunredeemed.delete(tokenId);\n}\n/** Whether `oauthServer` would build one, without building it. */\nfunction oauthConfigured() {\n\tconst secret = private_env.SELVA_HMAC_KEY;\n\treturn Boolean(secret && secret.length >= 32);\n}\n/** Undefined without a usable SELVA_HMAC_KEY: the endpoints then answer 503. */\nfunction oauthServer(origin) {\n\tif (!oauthConfigured()) return void 0;\n\tconst secret = private_env.SELVA_HMAC_KEY;\n\tif (cached?.origin !== origin || cached.secret !== secret) cached = {\n\t\torigin,\n\t\tsecret,\n\t\tserver: createOAuthServer({\n\t\t\torigin,\n\t\t\tsecret,\n\t\t\tfetchClientMetadata,\n\t\t\tredeemedCodes,\n\t\t\tonRedeemed\n\t\t})\n\t};\n\treturn cached.server;\n}\n/** The URL is an unknown client's, so it goes through the same guard as remote definitions. */\nasync function fetchClientMetadata(url) {\n\tawait assertSafeRemoteDefinitionUrl(url);\n\tconst controller = new AbortController();\n\tconst timer = setTimeout(() => controller.abort(), METADATA_TIMEOUT_MS);\n\ttry {\n\t\tconst res = await fetch(url, {\n\t\t\theaders: { Accept: \"application/json\" },\n\t\t\tredirect: \"error\",\n\t\t\tsignal: controller.signal\n\t\t});\n\t\tif (!res.ok) throw new Error(`HTTP ${res.status}`);\n\t\tconst bytes = await readBodyWithCap(res, METADATA_MAX_BYTES, controller);\n\t\treturn JSON.parse(new TextDecoder().decode(bytes));\n\t} finally {\n\t\tclearTimeout(timer);\n\t}\n}\nvar limiter = createComputeRateLimiter({\n\twindowMs: 6e4,\n\tmaxPerWindow: 30\n});\n/** A 429 response when the caller's IP is over the limit, else undefined. */\nfunction oauthRateLimited(event) {\n\tconst verdict = limiter.check(`oauth:${event.getClientAddress()}`);\n\tif (verdict.allowed) return void 0;\n\treturn json({\n\t\terror: \"slow_down\",\n\t\terror_description: \"Too many requests. Try again shortly.\"\n\t}, {\n\t\tstatus: 429,\n\t\theaders: { \"Retry-After\": String(verdict.retryAfter ?? 60) }\n\t});\n}\nfunction oauthUnavailable() {\n\treturn json({\n\t\terror: \"temporarily_unavailable\",\n\t\terror_description: \"OAuth is not configured here.\"\n\t}, { status: 503 });\n}\n/** Discovery documents are read by browser-based clients too. */\nvar DISCOVERY_HEADERS = {\n\t\"Access-Control-Allow-Origin\": \"*\",\n\t\"Cache-Control\": \"public, max-age=3600\"\n};\nexport { oauthServer as a, oauthRateLimited as i, expectRedemption as n, oauthUnavailable as o, oauthConfigured as r, DISCOVERY_HEADERS as t };\n"],"names":[],"mappings":";;;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG,GAAG;AAC7B,IAAI,kBAAkB,GAAG,KAAK;AAC9B,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,aAAa,mBAAmB,IAAI,GAAG,EAAE;AAC7C,IAAI,gBAAgB,GAAG,WAAW,GAAG,GAAG;AACxC,IAAI,UAAU,mBAAmB,IAAI,GAAG,EAAE;AAC1C;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM;AAChC,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;AAC5B,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1B,CAAC,CAAC,EAAE,gBAAgB,CAAC;AACrB,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC/B;AACA,SAAS,UAAU,CAAC,OAAO,EAAE;AAC7B,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;AAC3B;AACA;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc;AAC1C,CAAC,OAAO,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;AAC9C;AACA;AACA,SAAS,WAAW,CAAC,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,MAAM;AACtC,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc;AAC1C,CAAC,IAAI,MAAM,EAAE,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,MAAM,GAAG;AACrE,EAAE,MAAM;AACR,EAAE,MAAM;AACR,EAAE,MAAM,EAAE,iBAAiB,CAAC;AAC5B,GAAG,MAAM;AACT,GAAG,MAAM;AACT,GAAG,mBAAmB;AACtB,GAAG,aAAa;AAChB,GAAG;AACH,GAAG;AACH,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,MAAM;AACrB;AACA;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE;AACxC,CAAC,MAAM,6BAA6B,CAAC,GAAG,CAAC;AACzC,CAAC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AACzC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,mBAAmB,CAAC;AACxE,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;AAC/B,GAAG,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;AAC1C,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG,MAAM,EAAE,UAAU,CAAC;AACtB,GAAG,CAAC;AACJ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,EAAE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC;AAC1E,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC,CAAC,SAAS;AACX,EAAE,YAAY,CAAC,KAAK,CAAC;AACrB,CAAC;AACD;AACA,IAAI,OAAO,GAAG,wBAAwB,CAAC;AACvC,CAAC,QAAQ,EAAE,GAAG;AACd,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,MAAM;AACnC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,WAAW;AACpB,EAAE,iBAAiB,EAAE;AACrB,EAAE,EAAE;AACJ,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,EAAE,CAAC;AACH;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,yBAAyB;AAClC,EAAE,iBAAiB,EAAE;AACrB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACpB;AACA;AACG,IAAC,iBAAiB,GAAG;AACxB,CAAC,6BAA6B,EAAE,GAAG;AACnC,CAAC,eAAe,EAAE;AAClB;;;;"}