@sentropic/h2a-cli 0.32.0 → 0.33.0

package/dist/runtime/mcp-http/index.d.ts

@@ -10,5 +10,6 @@ export { startHostedServer, buildHostedConfigFromEnv, type HostedEnv, type Hoste
 export { FileOAuthStore } from "./oauth/file-store.js";
 export { SingleTenantOAuthProvider } from "./oauth/single-tenant-provider.js";
 export { buildOAuthRoutes } from "./oauth/hono-oauth-router.js";
+export { buildUpstreamAuthorizeUrl, exchangeUpstreamCode, type H2AUpstreamOidcConfig, type UpstreamFetch, type UpstreamLogin } from "./oauth/oidc-rp.js";
 export { oauthConfigFromEnv, H2A_HOSTED_OAUTH_SCOPE, type H2AHostedOAuthConfig, type H2AHostedOAuthEnv } from "./oauth/config.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/runtime/mcp-http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/mcp-http/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/mcp-http/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC"}

package/dist/runtime/mcp-http/index.js

@@ -10,5 +10,6 @@ export { startHostedServer, buildHostedConfigFromEnv } from "./serve.js";
 export { FileOAuthStore } from "./oauth/file-store.js";
 export { SingleTenantOAuthProvider } from "./oauth/single-tenant-provider.js";
 export { buildOAuthRoutes } from "./oauth/hono-oauth-router.js";
+export { buildUpstreamAuthorizeUrl, exchangeUpstreamCode } from "./oauth/oidc-rp.js";
 export { oauthConfigFromEnv, H2A_HOSTED_OAUTH_SCOPE } from "./oauth/config.js";
 //# sourceMappingURL=index.js.map

package/dist/runtime/mcp-http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/mcp-http/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EAIzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EAGvB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/mcp-http/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAsB,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EAIzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EAIrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EAGvB,MAAM,mBAAmB,CAAC"}

package/dist/runtime/mcp-http/oauth/oidc-rp.d.ts

@@ -0,0 +1,56 @@
+/**
+ * EVO-12 P2 (mode 3, gateway broker) — upstream OIDC Relying Party for 39-auth.
+ *
+ * The hosted shim keeps the DCR + token surface claude.ai needs (self-AS), but
+ * delegates the USER login to 39-auth (the sentropic OIDC IdP, live at
+ * `…/api/v1/auth/oauth/authorize`): redirect to its `/authorize`, then exchange
+ * the code at `/token` and read the authenticated `sub`. The `sub` is what the
+ * gateway maps to a per-user h2a root (multi-tenant).
+ *
+ * Pure + fetch-injected → unit-testable against a mock IdP. The real client
+ * (client_id/secret) is seeded operator-side in 39-auth (no DCR there); that
+ * seed is the live-integration point, not a code dependency.
+ */
+export interface H2AUpstreamOidcConfig {
+    /** 39-auth issuer (informational / id_token `iss` check later). */
+    readonly issuer: string;
+    /** 39-auth authorization endpoint (e.g. …/api/v1/auth/oauth/authorize). */
+    readonly authorizeUrl: string;
+    /** 39-auth token endpoint (e.g. …/api/v1/auth/oauth/token). */
+    readonly tokenUrl: string;
+    /** This gateway's seeded client id at 39-auth. */
+    readonly clientId: string;
+    /** This gateway's client secret (k8s Secret). */
+    readonly clientSecret: string;
+    /** The gateway's callback URL registered at 39-auth. */
+    readonly redirectUri: string;
+    /** Scopes to request (openid required for `sub`). */
+    readonly scopes: readonly string[];
+}
+/** Minimal fetch shape (injected for tests; global fetch satisfies it). */
+export type UpstreamFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<unknown>;
+}>;
+export interface UpstreamLogin {
+    /** The authenticated user — the gateway's per-tenant key. */
+    readonly sub: string;
+    readonly idToken: string;
+    readonly accessToken?: string;
+}
+/** Build the 39-auth `/authorize` URL to redirect the user to (authorization_code + PKCE). */
+export declare function buildUpstreamAuthorizeUrl(config: H2AUpstreamOidcConfig, params: {
+    state: string;
+    codeChallenge: string;
+}): string;
+/** Exchange an authorization_code (+ PKCE verifier) at 39-auth for the user's `sub`. */
+export declare function exchangeUpstreamCode(config: H2AUpstreamOidcConfig, params: {
+    code: string;
+    codeVerifier: string;
+}, fetchImpl: UpstreamFetch): Promise<UpstreamLogin>;
+//# sourceMappingURL=oidc-rp.d.ts.map

package/dist/runtime/mcp-http/oauth/oidc-rp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-rp.d.ts","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/oidc-rp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC/C,MAAM,CAUR;AAqBD,wFAAwF;AACxF,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC9C,SAAS,EAAE,aAAa,GACvB,OAAO,CAAC,aAAa,CAAC,CA0BxB"}

package/dist/runtime/mcp-http/oauth/oidc-rp.js

@@ -0,0 +1,63 @@
+/** Build the 39-auth `/authorize` URL to redirect the user to (authorization_code + PKCE). */
+export function buildUpstreamAuthorizeUrl(config, params) {
+    const url = new URL(config.authorizeUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", config.redirectUri);
+    url.searchParams.set("scope", config.scopes.join(" "));
+    url.searchParams.set("state", params.state);
+    url.searchParams.set("code_challenge", params.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    return url.href;
+}
+/** Read `sub` from an id_token payload. The token came from our authenticated
+ * server-to-server exchange with 39-auth (TLS + client_secret), so the payload
+ * is trusted here; verifying the EdDSA signature against 39-auth JWKS is the
+ * hardening step (needs JWKS publicly reachable). */
+function subFromIdToken(idToken) {
+    const parts = idToken.split(".");
+    if (parts.length < 2)
+        throw new Error("malformed id_token");
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    }
+    catch {
+        throw new Error("unparseable id_token payload");
+    }
+    if (typeof payload.sub !== "string" || payload.sub.length === 0) {
+        throw new Error("id_token has no sub");
+    }
+    return payload.sub;
+}
+/** Exchange an authorization_code (+ PKCE verifier) at 39-auth for the user's `sub`. */
+export async function exchangeUpstreamCode(config, params, fetchImpl) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: params.code,
+        redirect_uri: config.redirectUri,
+        client_id: config.clientId,
+        code_verifier: params.codeVerifier
+    }).toString();
+    const basic = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
+    const res = await fetchImpl(config.tokenUrl, {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+            authorization: `Basic ${basic}`
+        },
+        body
+    });
+    if (!res.ok)
+        throw new Error(`upstream token exchange failed: HTTP ${res.status}`);
+    const tok = (await res.json());
+    if (typeof tok.id_token !== "string")
+        throw new Error("upstream token response missing id_token");
+    return {
+        sub: subFromIdToken(tok.id_token),
+        idToken: tok.id_token,
+        ...(typeof tok.access_token === "string" ? { accessToken: tok.access_token } : {})
+    };
+}
+//# sourceMappingURL=oidc-rp.js.map

package/dist/runtime/mcp-http/oauth/oidc-rp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-rp.js","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/oidc-rp.ts"],"names":[],"mappings":"AA2CA,8FAA8F;AAC9F,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,MAAgD;IAEhD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;qDAGqD;AACrD,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC5D,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAA6B,EAC7B,MAA8C,EAC9C,SAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,SAAS,KAAK,EAAE;SAChC;QACD,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;IACjF,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAClG,OAAO;QACL,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,GAAG,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/h2a-cli",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Unified CLI surface for h2a hosts and MCP-oriented coordination flows.",
   "license": "MIT",
   "type": "module",
@@ -43,7 +43,7 @@
     "@hono/mcp": "^0.3.0",
     "@hono/node-server": "^2.0.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@sentropic/h2a": "^0.32.0",
+    "@sentropic/h2a": "^0.33.0",
     "hono": "^4.12.23"
   },
   "publishConfig": {