@sentropic/h2a-cli 0.74.0 → 0.78.0

package/dist/runtime/mcp-http/oauth/config.js

@@ -1,69 +0,0 @@
-/**
- * EVO-12 hosted OAuth — runtime config (ported from mcp-wave; decoupled from
- * the Wave env type — takes a plain input object so it is unit-testable).
- *
- * Scope is read-only (`h2a:read`) — the hosted surface exposes only read tools
- * (DEC-116 key custody; see ../readonly-allowlist).
- */
-export const H2A_HOSTED_OAUTH_SCOPE = "h2a:read";
-export function parseOAuthCsv(value) {
-    return value
-        .split(",")
-        .map((item) => item.trim())
-        .filter((item) => item.length > 0);
-}
-export function parseHostedEnrollmentEnabled(value) {
-    if (value === undefined)
-        return false;
-    return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
-}
-export function oauthConfigFromEnv(env) {
-    const publicBaseUrl = new URL(env.PUBLIC_BASE_URL);
-    const issuerUrl = new URL(env.OAUTH_ISSUER_URL);
-    const enrollmentEnabled = parseHostedEnrollmentEnabled(env.H2A_HOSTED_ENROLLMENT_ENABLED);
-    if (enrollmentEnabled && !env.OAUTH_CONSENT_SECRET) {
-        throw new Error("OAUTH_CONSENT_SECRET is required when H2A_HOSTED_ENROLLMENT_ENABLED=true");
-    }
-    const brokerMode = env.H2A_BROKER_MODE === "true";
-    const upstream = brokerMode ? upstreamFromEnv(env) : undefined;
-    return {
-        issuerUrl,
-        publicBaseUrl,
-        resourceServerUrl: new URL("/mcp", publicBaseUrl),
-        resourceMetadataUrl: new URL("/.well-known/oauth-protected-resource/mcp", publicBaseUrl).href,
-        consentSecret: env.OAUTH_CONSENT_SECRET ?? "local-dev-consent",
-        enrollmentEnabled,
-        allowedRedirectUris: parseOAuthCsv(env.OAUTH_ALLOWED_REDIRECT_URIS),
-        accessTokenTtlSeconds: env.OAUTH_ACCESS_TOKEN_TTL_SECONDS,
-        refreshTokenTtlSeconds: env.OAUTH_REFRESH_TOKEN_TTL_SECONDS,
-        authCodeTtlSeconds: env.OAUTH_AUTH_CODE_TTL_SECONDS,
-        nodeEnv: env.NODE_ENV ?? "development",
-        brokerMode,
-        ...(upstream ? { upstream } : {})
-    };
-}
-/** Parse the seeded 39-auth RP config from env; throws if a field is missing. */
-function upstreamFromEnv(env) {
-    const required = {
-        issuer: env.H2A_UPSTREAM_ISSUER,
-        authorizeUrl: env.H2A_UPSTREAM_AUTHORIZE_URL,
-        tokenUrl: env.H2A_UPSTREAM_TOKEN_URL,
-        clientId: env.H2A_UPSTREAM_CLIENT_ID,
-        clientSecret: env.H2A_UPSTREAM_CLIENT_SECRET,
-        redirectUri: env.H2A_UPSTREAM_REDIRECT_URI
-    };
-    for (const [key, value] of Object.entries(required)) {
-        if (!value)
-            throw new Error(`H2A_BROKER_MODE=true requires H2A_UPSTREAM_* (missing ${key})`);
-    }
-    return {
-        issuer: required.issuer,
-        authorizeUrl: required.authorizeUrl,
-        tokenUrl: required.tokenUrl,
-        clientId: required.clientId,
-        clientSecret: required.clientSecret,
-        redirectUri: required.redirectUri,
-        scopes: env.H2A_UPSTREAM_SCOPES ? parseOAuthCsv(env.H2A_UPSTREAM_SCOPES) : ["openid", "profile", "email"]
-    };
-}
-//# sourceMappingURL=config.js.map

package/dist/runtime/mcp-http/oauth/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AA2CjD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAyB;IACpE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACvD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChD,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC1F,IAAI,iBAAiB,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC;IAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,OAAO;QACL,SAAS;QACT,aAAa;QACb,iBAAiB,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;QACjD,mBAAmB,EAAE,IAAI,GAAG,CAAC,2CAA2C,EAAE,aAAa,CAAC,CAAC,IAAI;QAC7F,aAAa,EAAE,GAAG,CAAC,oBAAoB,IAAI,mBAAmB;QAC9D,iBAAiB;QACjB,mBAAmB,EAAE,aAAa,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACnE,qBAAqB,EAAE,GAAG,CAAC,8BAA8B;QACzD,sBAAsB,EAAE,GAAG,CAAC,+BAA+B;QAC3D,kBAAkB,EAAE,GAAG,CAAC,2BAA2B;QACnD,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,aAAa;QACtC,UAAU;QACV,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,GAAsB;IAC7C,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,mBAAmB;QAC/B,YAAY,EAAE,GAAG,CAAC,0BAA0B;QAC5C,QAAQ,EAAE,GAAG,CAAC,sBAAsB;QACpC,QAAQ,EAAE,GAAG,CAAC,sBAAsB;QACpC,YAAY,EAAE,GAAG,CAAC,0BAA0B;QAC5C,WAAW,EAAE,GAAG,CAAC,yBAAyB;KAC3C,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,GAAG,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAgB;QACjC,YAAY,EAAE,QAAQ,CAAC,YAAsB;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAkB;QACrC,QAAQ,EAAE,QAAQ,CAAC,QAAkB;QACrC,YAAY,EAAE,QAAQ,CAAC,YAAsB;QAC7C,WAAW,EAAE,QAAQ,CAAC,WAAqB;QAC3C,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KAC1G,CAAC;AACJ,CAAC"}

package/dist/runtime/mcp-http/oauth/crypto.d.ts

@@ -1,14 +0,0 @@
-export declare function randomToken(byteLength?: number): string;
-export declare function sha256Hex(value: string): string;
-export declare function tokenHashPrefix(tokenHash: string): string;
-export declare function timingSafeEqualString(a: string, b: string): boolean;
-/**
- * EVO-12 P2 (mode 3): a fresh PKCE pair for the gateway's upstream 39-auth leg.
- * The verifier is held server-side (broker pending state); the S256 challenge
- * goes on the wire to /authorize.
- */
-export declare function pkceS256(): {
-    verifier: string;
-    challenge: string;
-};
-//# sourceMappingURL=crypto.d.ts.map

package/dist/runtime/mcp-http/oauth/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/crypto.ts"],"names":[],"mappings":"AAKA,wBAAgB,WAAW,CAAC,UAAU,SAAK,GAAG,MAAM,CAEnD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlE"}

package/dist/runtime/mcp-http/oauth/crypto.js

@@ -1,29 +0,0 @@
-/**
- * EVO-12 hosted OAuth — token crypto helpers (ported from mcp-wave, generic).
- */
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-export function randomToken(byteLength = 32) {
-    return randomBytes(byteLength).toString("base64url");
-}
-export function sha256Hex(value) {
-    return createHash("sha256").update(value).digest("hex");
-}
-export function tokenHashPrefix(tokenHash) {
-    return tokenHash.slice(0, 12);
-}
-export function timingSafeEqualString(a, b) {
-    const left = Buffer.from(sha256Hex(a), "hex");
-    const right = Buffer.from(sha256Hex(b), "hex");
-    return timingSafeEqual(left, right);
-}
-/**
- * EVO-12 P2 (mode 3): a fresh PKCE pair for the gateway's upstream 39-auth leg.
- * The verifier is held server-side (broker pending state); the S256 challenge
- * goes on the wire to /authorize.
- */
-export function pkceS256() {
-    const verifier = randomBytes(32).toString("base64url");
-    const challenge = createHash("sha256").update(verifier).digest("base64url");
-    return { verifier, challenge };
-}
-//# sourceMappingURL=crypto.js.map

package/dist/runtime/mcp-http/oauth/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,UAAU,WAAW,CAAC,UAAU,GAAG,EAAE;IACzC,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/dist/runtime/mcp-http/oauth/file-store.d.ts

@@ -1,48 +0,0 @@
-import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
-import type { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
-export interface StoredAuthorizationCode {
-    codeHash: string;
-    clientId: string;
-    redirectUri: string;
-    codeChallenge: string;
-    scopes: string[];
-    resource: string;
-    createdAt: number;
-    expiresAt: number;
-    consumedAt?: number;
-    /**
-     * EVO-12 P2 (mode 3, multi-tenant): the upstream 39-auth subject this code was
-     * minted for. Threaded code→token so /mcp can serve the per-user root. Absent
-     * for single-tenant (consent-secret) codes.
-     */
-    sub?: string;
-}
-export interface StoredToken {
-    tokenHash: string;
-    tokenType: "access" | "refresh";
-    clientId: string;
-    scopes: string[];
-    resource: string;
-    issuedAt: number;
-    expiresAt: number;
-    revokedAt?: number;
-    parentRefreshTokenHash?: string;
-    /** EVO-12 P2: the 39-auth subject (see StoredAuthorizationCode.sub). */
-    sub?: string;
-}
-export declare class FileOAuthStore implements OAuthRegisteredClientsStore {
-    readonly path: string;
-    private snapshot;
-    constructor(path: string);
-    load(): Promise<void>;
-    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
-    registerClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
-    putAuthorizationCode(code: string, record: Omit<StoredAuthorizationCode, "codeHash" | "consumedAt">): Promise<void>;
-    getAuthorizationCode(code: string, nowSeconds: number): Promise<StoredAuthorizationCode | undefined>;
-    consumeAuthorizationCode(code: string, nowSeconds: number): Promise<StoredAuthorizationCode | undefined>;
-    putToken(token: string, record: Omit<StoredToken, "tokenHash" | "revokedAt">): Promise<StoredToken>;
-    findToken(token: string): Promise<StoredToken | undefined>;
-    revokeToken(token: string, nowSeconds: number): Promise<void>;
-    private persist;
-}
-//# sourceMappingURL=file-store.d.ts.map

package/dist/runtime/mcp-http/oauth/file-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-store.d.ts","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/file-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAI3F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,QAAQ,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AASD,qBAAa,cAAe,YAAW,2BAA2B;IAGpD,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFjC,OAAO,CAAC,QAAQ,CAA6E;gBAExE,IAAI,EAAE,MAAM;IAE3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBrB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAI5E,cAAc,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAMvF,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,IAAI,CAAC,uBAAuB,EAAE,UAAU,GAAG,YAAY,CAAC,GAC/D,OAAO,CAAC,IAAI,CAAC;IAMV,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAMpG,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IASxG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAQnG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAI1D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQrD,OAAO;CAmBtB"}

package/dist/runtime/mcp-http/oauth/file-store.js

@@ -1,101 +0,0 @@
-/**
- * EVO-12 hosted OAuth — file-backed store for DCR clients, auth codes, tokens
- * (ported from mcp-wave; generic, atomic-persist). Holds only OAuth artifacts
- * (hashed codes/tokens) — never an h2a ed25519 private key.
- */
-import { mkdir, open, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { sha256Hex } from "./crypto.js";
-export class FileOAuthStore {
-    path;
-    snapshot = { version: 1, clients: {}, authorizationCodes: {}, tokens: {} };
-    constructor(path) {
-        this.path = path;
-    }
-    async load() {
-        try {
-            const parsed = JSON.parse(await readFile(this.path, "utf8"));
-            this.snapshot = {
-                version: 1,
-                clients: parsed.clients ?? {},
-                authorizationCodes: parsed.authorizationCodes ?? {},
-                tokens: parsed.tokens ?? {}
-            };
-        }
-        catch (error) {
-            if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-                await this.persist();
-                return;
-            }
-            throw error;
-        }
-    }
-    async getClient(clientId) {
-        return this.snapshot.clients[clientId];
-    }
-    async registerClient(client) {
-        this.snapshot.clients[client.client_id] = client;
-        await this.persist();
-        return client;
-    }
-    async putAuthorizationCode(code, record) {
-        const codeHash = sha256Hex(code);
-        this.snapshot.authorizationCodes[codeHash] = { ...record, codeHash };
-        await this.persist();
-    }
-    async getAuthorizationCode(code, nowSeconds) {
-        const record = this.snapshot.authorizationCodes[sha256Hex(code)];
-        if (!record || record.consumedAt || record.expiresAt <= nowSeconds)
-            return undefined;
-        return record;
-    }
-    async consumeAuthorizationCode(code, nowSeconds) {
-        const codeHash = sha256Hex(code);
-        const record = this.snapshot.authorizationCodes[codeHash];
-        if (!record || record.consumedAt || record.expiresAt <= nowSeconds)
-            return undefined;
-        record.consumedAt = nowSeconds;
-        await this.persist();
-        return record;
-    }
-    async putToken(token, record) {
-        const tokenHash = sha256Hex(token);
-        const stored = { ...record, tokenHash };
-        this.snapshot.tokens[tokenHash] = stored;
-        await this.persist();
-        return stored;
-    }
-    async findToken(token) {
-        return this.snapshot.tokens[sha256Hex(token)];
-    }
-    async revokeToken(token, nowSeconds) {
-        const record = this.snapshot.tokens[sha256Hex(token)];
-        if (record && record.revokedAt === undefined) {
-            record.revokedAt = nowSeconds;
-            await this.persist();
-        }
-    }
-    async persist() {
-        await mkdir(dirname(this.path), { recursive: true });
-        const body = `${JSON.stringify(this.snapshot, null, 2)}\n`;
-        const tempPath = `${this.path}.${process.pid}.${Date.now()}.tmp`;
-        await writeFile(tempPath, body, { mode: 0o600 });
-        const handle = await open(tempPath, "r");
-        try {
-            await handle.sync();
-        }
-        catch (error) {
-            // Windows rejects fsync on some handles with EPERM, and exotic FUSE/CI
-            // filesystems return ENOSYS. The durability hint is best-effort; the
-            // rename below still provides atomic replace on every platform.
-            const code = error.code;
-            if (code !== "EPERM" && code !== "ENOSYS")
-                throw error;
-        }
-        finally {
-            await handle.close();
-        }
-        await rename(tempPath, this.path);
-    }
-}
-//# sourceMappingURL=file-store.js.map

package/dist/runtime/mcp-http/oauth/file-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-store.js","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/file-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAyCxC,MAAM,OAAO,cAAc;IAGJ;IAFb,QAAQ,GAAa,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE7F,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAa,CAAC;YACzE,IAAI,CAAC,QAAQ,GAAG;gBACd,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE;gBACnD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAkC;QACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;QACjD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAAY,EACZ,MAAgE;QAEhE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAAY,EAAE,UAAkB;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU;YAAE,OAAO,SAAS,CAAC;QACrF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,IAAY,EAAE,UAAkB;QAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU;YAAE,OAAO,SAAS,CAAC;QACrF,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,MAAoD;QAChF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;QACzC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,UAAkB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC3D,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACjE,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACzD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/runtime/mcp-http/oauth/hono-oauth-router.d.ts

@@ -1,5 +0,0 @@
-import { Hono } from "hono";
-import { type H2AHostedOAuthConfig } from "./config.js";
-import type { SingleTenantOAuthProvider } from "./single-tenant-provider.js";
-export declare function buildOAuthRoutes(provider: SingleTenantOAuthProvider, oauth: H2AHostedOAuthConfig): Hono;
-//# sourceMappingURL=hono-oauth-router.d.ts.map

package/dist/runtime/mcp-http/oauth/hono-oauth-router.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hono-oauth-router.d.ts","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/hono-oauth-router.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAyC,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAY7E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,oBAAoB,GAAG,IAAI,CA2FvG"}

package/dist/runtime/mcp-http/oauth/hono-oauth-router.js

@@ -1,92 +0,0 @@
-/**
- * EVO-12 hosted OAuth — authorization-server + protected-resource routes
- * (ported from mcp-wave). Standard endpoints (DCR, token+PKCE, revoke,
- * well-known metadata) come from `@hono/mcp/auth`; only `/authorize` is custom
- * (operator consent secret gate, single-tenant). resourceName = "h2a".
- */
-import { authenticateClient, clientRegistrationHandler, createOAuthMetadata, revokeHandler, tokenHandler, wellKnownRouter } from "@hono/mcp/auth";
-import { OAuthError, ServerError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-import { Hono } from "hono";
-import { H2A_HOSTED_OAUTH_SCOPE as OAUTH_SCOPE } from "./config.js";
-function enrollmentDisabled(c) {
-    return c.json({
-        error: "enrollment_disabled",
-        error_description: "Remote h2a enrollment is disabled by default; enable it explicitly after multi-tenant policy is configured."
-    }, 403);
-}
-export function buildOAuthRoutes(provider, oauth) {
-    const sdkProvider = provider;
-    const clientsStore = provider.clientsStore;
-    const router = new Hono();
-    // RFC 8414: issuer identifier must equal the metadata-URL value (no trailing
-    // slash) — a URL object would normalize to a trailing slash that claude.ai rejects.
-    const issuer = oauth.issuerUrl.href.replace(/\/+$/, "");
-    const oauthMetadata = createOAuthMetadata({
-        provider: sdkProvider,
-        issuerUrl: issuer,
-        baseUrl: oauth.publicBaseUrl,
-        scopesSupported: [OAUTH_SCOPE]
-    });
-    router.route("/", wellKnownRouter({
-        oauthMetadata,
-        resourceServerUrl: oauth.resourceServerUrl,
-        scopesSupported: [OAUTH_SCOPE],
-        resourceName: "h2a"
-    }));
-    // Also serve PRM at the unsuffixed path (the bearerAuth 401 advertises it there).
-    router.get("/.well-known/oauth-protected-resource", (c) => c.json({
-        resource: oauth.resourceServerUrl.href,
-        authorization_servers: [issuer],
-        bearer_methods_supported: ["header"],
-        scopes_supported: [OAUTH_SCOPE],
-        resource_name: "h2a"
-    }));
-    router.post("/register", (c, next) => oauth.enrollmentEnabled ? next() : enrollmentDisabled(c));
-    router.post("/register", clientRegistrationHandler({ clientsStore }));
-    router.post("/token", authenticateClient({ clientsStore }), tokenHandler(sdkProvider));
-    router.post("/revoke", authenticateClient({ clientsStore }), revokeHandler(sdkProvider));
-    router.on(["GET", "POST"], "/authorize", async (c) => {
-        c.header("Cache-Control", "no-store");
-        if (!oauth.enrollmentEnabled)
-            return enrollmentDisabled(c);
-        const raw = c.req.method === "POST"
-            ? (await c.req.parseBody())
-            : c.req.query();
-        const clientId = raw["client_id"];
-        if (!clientId) {
-            return c.json({ error: "invalid_request", error_description: "missing client_id" }, 400);
-        }
-        const client = await provider.clientsStore.getClient(clientId);
-        if (!client) {
-            return c.json({ error: "invalid_client", error_description: "unknown client_id" }, 400);
-        }
-        const redirectUri = raw["redirect_uri"] ?? client.redirect_uris[0] ?? "";
-        const scopeRaw = raw["scope"];
-        const stateRaw = raw["state"];
-        const resourceRaw = raw["resource"];
-        const params = {
-            redirectUri,
-            codeChallenge: raw["code_challenge"] ?? "",
-            ...(scopeRaw !== undefined && { scopes: scopeRaw.split(" ") }),
-            ...(stateRaw !== undefined && { state: stateRaw }),
-            ...(resourceRaw !== undefined && { resource: new URL(resourceRaw) })
-        };
-        try {
-            const consentSecret = raw["consent_secret"];
-            const outcome = await provider.authorizeRequest(client, params, {
-                method: c.req.method,
-                ...(consentSecret !== undefined && { consentSecret })
-            });
-            if (outcome.kind === "consent") {
-                return c.html(outcome.html, outcome.status);
-            }
-            return c.redirect(outcome.location, 302);
-        }
-        catch (e) {
-            const err = e instanceof OAuthError ? e : new ServerError("Internal Server Error");
-            return c.json(err.toResponseObject(), err instanceof ServerError ? 500 : 400);
-        }
-    });
-    return router;
-}
-//# sourceMappingURL=hono-oauth-router.js.map

package/dist/runtime/mcp-http/oauth/hono-oauth-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hono-oauth-router.js","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/hono-oauth-router.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAC;AAK1F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,sBAAsB,IAAI,WAAW,EAA6B,MAAM,aAAa,CAAC;AAG/F,SAAS,kBAAkB,CAAC,CAAwD;IAClF,OAAO,CAAC,CAAC,IAAI,CACX;QACE,KAAK,EAAE,qBAAqB;QAC5B,iBAAiB,EAAE,6GAA6G;KACjI,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAmC,EAAE,KAA2B;IAC/F,MAAM,WAAW,GAAG,QAA0C,CAAC;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAsD,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,6EAA6E;IAC7E,oFAAoF;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,mBAAmB,CAAC;QACxC,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,KAAK,CAAC,aAAa;QAC5B,eAAe,EAAE,CAAC,WAAW,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CACV,GAAG,EACH,eAAe,CAAC;QACd,aAAa;QACb,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,eAAe,EAAE,CAAC,WAAW,CAAC;QAC9B,YAAY,EAAE,KAAK;KACpB,CAAC,CACH,CAAC;IAEF,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE,CACxD,CAAC,CAAC,IAAI,CAAC;QACL,QAAQ,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI;QACtC,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,CAAC,WAAW,CAAC;QAC/B,aAAa,EAAE,KAAK;KACrB,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACnC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACzD,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IAEzF,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,iBAAiB;YAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAE3D,MAAM,GAAG,GACP,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAA4B;YACvD,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAA6B,CAAC;QAEhD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,MAAM,GAAwB;YAClC,WAAW;YACX,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;YAC1C,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAClD,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;SACrE,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;gBAC9D,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpB,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,CAAC;aACtD,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAC;YACnF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/mcp-http/oauth/oidc-rp.d.ts

@@ -1,56 +0,0 @@
-/**
- * EVO-12 P2 (mode 3, gateway broker) — upstream OIDC Relying Party for 39-auth.
- *
- * The hosted shim keeps the DCR + token surface claude.ai needs (self-AS), but
- * delegates the USER login to 39-auth (the sentropic OIDC IdP, live at
- * `…/api/v1/auth/oauth/authorize`): redirect to its `/authorize`, then exchange
- * the code at `/token` and read the authenticated `sub`. The `sub` is what the
- * gateway maps to a per-user h2a root (multi-tenant).
- *
- * Pure + fetch-injected → unit-testable against a mock IdP. The real client
- * (client_id/secret) is seeded operator-side in 39-auth (no DCR there); that
- * seed is the live-integration point, not a code dependency.
- */
-export interface H2AUpstreamOidcConfig {
-    /** 39-auth issuer (informational / id_token `iss` check later). */
-    readonly issuer: string;
-    /** 39-auth authorization endpoint (e.g. …/api/v1/auth/oauth/authorize). */
-    readonly authorizeUrl: string;
-    /** 39-auth token endpoint (e.g. …/api/v1/auth/oauth/token). */
-    readonly tokenUrl: string;
-    /** This gateway's seeded client id at 39-auth. */
-    readonly clientId: string;
-    /** This gateway's client secret (k8s Secret). */
-    readonly clientSecret: string;
-    /** The gateway's callback URL registered at 39-auth. */
-    readonly redirectUri: string;
-    /** Scopes to request (openid required for `sub`). */
-    readonly scopes: readonly string[];
-}
-/** Minimal fetch shape (injected for tests; global fetch satisfies it). */
-export type UpstreamFetch = (url: string, init: {
-    method: string;
-    headers: Record<string, string>;
-    body: string;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    json: () => Promise<unknown>;
-}>;
-export interface UpstreamLogin {
-    /** The authenticated user — the gateway's per-tenant key. */
-    readonly sub: string;
-    readonly idToken: string;
-    readonly accessToken?: string;
-}
-/** Build the 39-auth `/authorize` URL to redirect the user to (authorization_code + PKCE). */
-export declare function buildUpstreamAuthorizeUrl(config: H2AUpstreamOidcConfig, params: {
-    state: string;
-    codeChallenge: string;
-}): string;
-/** Exchange an authorization_code (+ PKCE verifier) at 39-auth for the user's `sub`. */
-export declare function exchangeUpstreamCode(config: H2AUpstreamOidcConfig, params: {
-    code: string;
-    codeVerifier: string;
-}, fetchImpl: UpstreamFetch): Promise<UpstreamLogin>;
-//# sourceMappingURL=oidc-rp.d.ts.map

package/dist/runtime/mcp-http/oauth/oidc-rp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-rp.d.ts","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/oidc-rp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC/C,MAAM,CAUR;AAqBD,wFAAwF;AACxF,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC9C,SAAS,EAAE,aAAa,GACvB,OAAO,CAAC,aAAa,CAAC,CA0BxB"}

package/dist/runtime/mcp-http/oauth/oidc-rp.js

@@ -1,63 +0,0 @@
-/** Build the 39-auth `/authorize` URL to redirect the user to (authorization_code + PKCE). */
-export function buildUpstreamAuthorizeUrl(config, params) {
-    const url = new URL(config.authorizeUrl);
-    url.searchParams.set("response_type", "code");
-    url.searchParams.set("client_id", config.clientId);
-    url.searchParams.set("redirect_uri", config.redirectUri);
-    url.searchParams.set("scope", config.scopes.join(" "));
-    url.searchParams.set("state", params.state);
-    url.searchParams.set("code_challenge", params.codeChallenge);
-    url.searchParams.set("code_challenge_method", "S256");
-    return url.href;
-}
-/** Read `sub` from an id_token payload. The token came from our authenticated
- * server-to-server exchange with 39-auth (TLS + client_secret), so the payload
- * is trusted here; verifying the EdDSA signature against 39-auth JWKS is the
- * hardening step (needs JWKS publicly reachable). */
-function subFromIdToken(idToken) {
-    const parts = idToken.split(".");
-    if (parts.length < 2)
-        throw new Error("malformed id_token");
-    let payload;
-    try {
-        payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    }
-    catch {
-        throw new Error("unparseable id_token payload");
-    }
-    if (typeof payload.sub !== "string" || payload.sub.length === 0) {
-        throw new Error("id_token has no sub");
-    }
-    return payload.sub;
-}
-/** Exchange an authorization_code (+ PKCE verifier) at 39-auth for the user's `sub`. */
-export async function exchangeUpstreamCode(config, params, fetchImpl) {
-    const body = new URLSearchParams({
-        grant_type: "authorization_code",
-        code: params.code,
-        redirect_uri: config.redirectUri,
-        client_id: config.clientId,
-        code_verifier: params.codeVerifier
-    }).toString();
-    const basic = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-    const res = await fetchImpl(config.tokenUrl, {
-        method: "POST",
-        headers: {
-            "content-type": "application/x-www-form-urlencoded",
-            accept: "application/json",
-            authorization: `Basic ${basic}`
-        },
-        body
-    });
-    if (!res.ok)
-        throw new Error(`upstream token exchange failed: HTTP ${res.status}`);
-    const tok = (await res.json());
-    if (typeof tok.id_token !== "string")
-        throw new Error("upstream token response missing id_token");
-    return {
-        sub: subFromIdToken(tok.id_token),
-        idToken: tok.id_token,
-        ...(typeof tok.access_token === "string" ? { accessToken: tok.access_token } : {})
-    };
-}
-//# sourceMappingURL=oidc-rp.js.map

package/dist/runtime/mcp-http/oauth/oidc-rp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-rp.js","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/oidc-rp.ts"],"names":[],"mappings":"AA2CA,8FAA8F;AAC9F,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,MAAgD;IAEhD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;qDAGqD;AACrD,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC5D,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAA6B,EAC7B,MAA8C,EAC9C,SAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,SAAS,KAAK,EAAE;SAChC;QACD,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;IACjF,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAClG,OAAO;QACL,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,GAAG,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC"}

package/dist/runtime/mcp-http/oauth/redirect-uri.d.ts

@@ -1,11 +0,0 @@
-/**
- * EVO-12 hosted OAuth — redirect-uri allow checks (ported from mcp-wave;
- * decoupled from the Wave env type — takes a plain nodeEnv string).
- *
- * claude.ai's connector uses fixed redirect URIs
- * (https://claude.ai|claude.com/api/mcp/auth_callback) — those must be in
- * `allowedRedirectUris`. Loopback is allowed only outside production (local dev).
- */
-export declare function redirectUriAllowed(redirectUri: string, allowedRedirectUris: readonly string[], nodeEnv: string): boolean;
-export declare function allRedirectUrisAllowed(redirectUris: readonly string[], allowedRedirectUris: readonly string[], nodeEnv: string): boolean;
-//# sourceMappingURL=redirect-uri.d.ts.map

package/dist/runtime/mcp-http/oauth/redirect-uri.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect-uri.d.ts","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/redirect-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAiBT;AAED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAET"}

package/dist/runtime/mcp-http/oauth/redirect-uri.js

@@ -1,29 +0,0 @@
-/**
- * EVO-12 hosted OAuth — redirect-uri allow checks (ported from mcp-wave;
- * decoupled from the Wave env type — takes a plain nodeEnv string).
- *
- * claude.ai's connector uses fixed redirect URIs
- * (https://claude.ai|claude.com/api/mcp/auth_callback) — those must be in
- * `allowedRedirectUris`. Loopback is allowed only outside production (local dev).
- */
-const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
-export function redirectUriAllowed(redirectUri, allowedRedirectUris, nodeEnv) {
-    let parsed;
-    try {
-        parsed = new URL(redirectUri);
-    }
-    catch {
-        return false;
-    }
-    if (allowedRedirectUris.includes(parsed.href)) {
-        return true;
-    }
-    if (nodeEnv !== "production" && LOOPBACK_HOSTS.has(parsed.hostname)) {
-        return parsed.protocol === "http:" || parsed.protocol === "https:";
-    }
-    return false;
-}
-export function allRedirectUrisAllowed(redirectUris, allowedRedirectUris, nodeEnv) {
-    return redirectUris.every((uri) => redirectUriAllowed(uri, allowedRedirectUris, nodeEnv));
-}
-//# sourceMappingURL=redirect-uri.js.map

package/dist/runtime/mcp-http/oauth/redirect-uri.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../../../../src/runtime/mcp-http/oauth/redirect-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAElE,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,mBAAsC,EACtC,OAAe;IAEf,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,KAAK,YAAY,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,YAA+B,EAC/B,mBAAsC,EACtC,OAAe;IAEf,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC"}