@studiometa/forge-mcp 0.2.2 → 0.2.3

package/dist/oauth.js

@@ -0,0 +1,571 @@
+import { createAuthCode, decodeAuthCode } from "./crypto.js";
+import { createHash } from "node:crypto";
+import { defineEventHandler, getQuery, getRequestHeader, readBody, sendRedirect, setResponseHeader, setResponseStatus } from "h3";
+/**
+* OAuth 2.1 endpoints for Claude Desktop integration
+*
+* Implements OAuth 2.1 with PKCE as specified in the MCP authorization spec.
+* Uses stateless encrypted tokens — no server-side storage required.
+*
+* Spec: https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization
+*
+* Flow:
+* 1. Claude redirects user to /authorize with OAuth params (including PKCE)
+* 2. User enters their Forge API token in a login form
+* 3. Server encrypts the token + PKCE challenge into an authorization code
+* 4. Redirects back to Claude with the code
+* 5. Claude exchanges code for access token via /token (with code_verifier)
+* 6. Server validates PKCE and returns base64-encoded access token
+*/
+/**
+* Create a base64-encoded access token from a Forge API token.
+* The access token is simply base64(apiToken) so that parseAuthHeader
+* can decode it on every request without any server-side lookup.
+*/
+function createAccessToken(apiToken) {
+	return Buffer.from(apiToken).toString("base64");
+}
+/**
+* OAuth metadata for discovery (RFC 8414)
+* GET /.well-known/oauth-authorization-server
+*
+* MCP clients MUST check this endpoint first for server capabilities.
+*/
+const oauthMetadataHandler = defineEventHandler((event) => {
+	const host = getRequestHeader(event, "host") || "localhost:3000";
+	const baseUrl = `${getRequestHeader(event, "x-forwarded-proto") || "http"}://${host}`;
+	setResponseHeader(event, "Content-Type", "application/json");
+	setResponseHeader(event, "Cache-Control", "public, max-age=3600");
+	return {
+		issuer: baseUrl,
+		authorization_endpoint: `${baseUrl}/authorize`,
+		token_endpoint: `${baseUrl}/token`,
+		response_types_supported: ["code"],
+		grant_types_supported: ["authorization_code", "refresh_token"],
+		code_challenge_methods_supported: ["S256"],
+		token_endpoint_auth_methods_supported: ["none"],
+		registration_endpoint: `${baseUrl}/register`,
+		scopes_supported: ["forge"],
+		service_documentation: "https://github.com/studiometa/forge-tools"
+	};
+});
+/**
+* Protected resource metadata (RFC 9728)
+* GET /.well-known/oauth-protected-resource
+*
+* Tells MCP clients where to find the OAuth authorization server.
+*/
+const protectedResourceHandler = defineEventHandler((event) => {
+	const host = getRequestHeader(event, "host") || "localhost:3000";
+	const baseUrl = `${getRequestHeader(event, "x-forwarded-proto") || "http"}://${host}`;
+	setResponseHeader(event, "Content-Type", "application/json");
+	setResponseHeader(event, "Cache-Control", "public, max-age=3600");
+	return {
+		resource: `${baseUrl}/mcp`,
+		authorization_servers: [baseUrl],
+		bearer_methods_supported: ["header"],
+		scopes_supported: ["forge"]
+	};
+});
+/**
+* Dynamic Client Registration endpoint (RFC 7591)
+* POST /register
+*
+* MCP servers SHOULD support DCR to allow clients to register automatically.
+* Since we use stateless tokens, we accept any registration and return
+* a generated client_id.
+*/
+const registerHandler = defineEventHandler(async (event) => {
+	setResponseHeader(event, "Content-Type", "application/json");
+	let body;
+	try {
+		body = await readBody(event);
+	} catch {
+		setResponseStatus(event, 400);
+		return {
+			error: "invalid_request",
+			error_description: "Invalid JSON body"
+		};
+	}
+	const clientName = body.client_name || "MCP Client";
+	const redirectUris = body.redirect_uris || [];
+	const clientId = Buffer.from(JSON.stringify({
+		name: clientName,
+		ts: Date.now()
+	})).toString("base64url");
+	setResponseStatus(event, 201);
+	return {
+		client_id: clientId,
+		client_name: clientName,
+		redirect_uris: redirectUris,
+		token_endpoint_auth_method: "none",
+		grant_types: ["authorization_code", "refresh_token"],
+		response_types: ["code"]
+	};
+});
+/**
+* Authorization endpoint — shows login form
+* GET /authorize
+*/
+const authorizeGetHandler = defineEventHandler((event) => {
+	const query = getQuery(event);
+	const redirectUri = query.redirect_uri;
+	const state = query.state;
+	const codeChallenge = query.code_challenge;
+	const codeChallengeMethod = query.code_challenge_method;
+	if (!redirectUri) {
+		setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+		setResponseStatus(event, 400);
+		return renderErrorPage("Missing required parameter: redirect_uri");
+	}
+	if (!codeChallenge) {
+		const errorUrl = new URL(redirectUri);
+		errorUrl.searchParams.set("error", "invalid_request");
+		errorUrl.searchParams.set("error_description", "code_challenge is required");
+		if (state) errorUrl.searchParams.set("state", state);
+		return sendRedirect(event, errorUrl.toString(), 302);
+	}
+	if (codeChallengeMethod && codeChallengeMethod !== "S256") {
+		const errorUrl = new URL(redirectUri);
+		errorUrl.searchParams.set("error", "invalid_request");
+		errorUrl.searchParams.set("error_description", "Only S256 code_challenge_method is supported");
+		if (state) errorUrl.searchParams.set("state", state);
+		return sendRedirect(event, errorUrl.toString(), 302);
+	}
+	setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+	return renderLoginForm({
+		redirectUri,
+		state,
+		codeChallenge,
+		codeChallengeMethod: codeChallengeMethod || "S256"
+	});
+});
+/**
+* Authorization endpoint — process login
+* POST /authorize
+*/
+const authorizePostHandler = defineEventHandler(async (event) => {
+	const { apiToken, redirectUri, state, codeChallenge, codeChallengeMethod } = await readBody(event);
+	if (!redirectUri) {
+		setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+		setResponseStatus(event, 400);
+		return renderErrorPage("Missing redirect_uri parameter");
+	}
+	try {
+		const uri = new URL(redirectUri);
+		const isLocalhost = uri.hostname === "localhost" || uri.hostname === "127.0.0.1";
+		const isHttps = uri.protocol === "https:";
+		if (!isLocalhost && !isHttps) {
+			setResponseStatus(event, 400);
+			return renderErrorPage("redirect_uri must be HTTPS or localhost");
+		}
+	} catch {
+		setResponseStatus(event, 400);
+		return renderErrorPage("Invalid redirect_uri format");
+	}
+	if (!apiToken) {
+		setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+		return renderLoginForm({
+			redirectUri,
+			state,
+			codeChallenge,
+			codeChallengeMethod,
+			error: "Forge API Token is required"
+		});
+	}
+	const code = createAuthCode({
+		apiToken,
+		codeChallenge,
+		codeChallengeMethod: codeChallengeMethod || "S256"
+	});
+	const redirectUrl = new URL(redirectUri);
+	redirectUrl.searchParams.set("code", code);
+	if (state) redirectUrl.searchParams.set("state", state);
+	setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+	return renderSuccessPage(redirectUrl.toString());
+});
+/**
+* Token endpoint — exchange code for access token
+* POST /token
+*
+* Supports:
+* - authorization_code grant (with PKCE validation)
+* - refresh_token grant
+*/
+const tokenHandler = defineEventHandler(async (event) => {
+	setResponseHeader(event, "Content-Type", "application/json");
+	const { grant_type, code, code_verifier, refresh_token } = await readBody(event);
+	if (grant_type === "refresh_token") return handleRefreshToken(event, refresh_token);
+	if (grant_type !== "authorization_code") {
+		setResponseStatus(event, 400);
+		return {
+			error: "unsupported_grant_type",
+			error_description: "Supported grant types: authorization_code, refresh_token"
+		};
+	}
+	if (!code) {
+		setResponseStatus(event, 400);
+		return {
+			error: "invalid_request",
+			error_description: "Missing authorization code"
+		};
+	}
+	if (!code_verifier) {
+		setResponseStatus(event, 400);
+		return {
+			error: "invalid_request",
+			error_description: "Missing code_verifier (PKCE required)"
+		};
+	}
+	try {
+		const payload = decodeAuthCode(code);
+		if (payload.codeChallenge) {
+			if (createS256Challenge(code_verifier) !== payload.codeChallenge) {
+				setResponseStatus(event, 400);
+				return {
+					error: "invalid_grant",
+					error_description: "Invalid code_verifier"
+				};
+			}
+		}
+		return {
+			access_token: createAccessToken(payload.apiToken),
+			token_type: "Bearer",
+			expires_in: 3600,
+			refresh_token: createAuthCode({ apiToken: payload.apiToken }, 86400 * 30)
+		};
+	} catch (error) {
+		setResponseStatus(event, 400);
+		return {
+			error: "invalid_grant",
+			error_description: error instanceof Error ? error.message : "Invalid authorization code"
+		};
+	}
+});
+/**
+* Handle refresh token grant
+*/
+function handleRefreshToken(event, refreshToken) {
+	if (!refreshToken) {
+		setResponseStatus(event, 400);
+		return {
+			error: "invalid_request",
+			error_description: "Missing refresh_token"
+		};
+	}
+	try {
+		const payload = decodeAuthCode(refreshToken);
+		return {
+			access_token: createAccessToken(payload.apiToken),
+			token_type: "Bearer",
+			expires_in: 3600,
+			refresh_token: createAuthCode({ apiToken: payload.apiToken }, 86400 * 30)
+		};
+	} catch (error) {
+		setResponseStatus(event, 400);
+		return {
+			error: "invalid_grant",
+			error_description: error instanceof Error ? error.message : "Invalid refresh token"
+		};
+	}
+}
+/**
+* Create S256 PKCE challenge from verifier
+* SHA256(code_verifier) encoded as base64url
+*/
+function createS256Challenge(codeVerifier) {
+	return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+/**
+* Escape HTML special characters
+*/
+function escapeHtml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
+/**
+* Render the login form HTML
+*/
+function renderLoginForm(params) {
+	const { redirectUri, state, codeChallenge, codeChallengeMethod, error } = params;
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Connect to Laravel Forge</title>
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 20px;
+    }
+    .container {
+      background: white;
+      border-radius: 16px;
+      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);
+      padding: 40px;
+      width: 100%;
+      max-width: 420px;
+    }
+    .logo {
+      text-align: center;
+      margin-bottom: 24px;
+    }
+    .logo svg { width: 48px; height: 48px; }
+    h1 {
+      text-align: center;
+      color: #1a1a2e;
+      font-size: 24px;
+      margin-bottom: 8px;
+    }
+    .subtitle {
+      text-align: center;
+      color: #666;
+      font-size: 14px;
+      margin-bottom: 32px;
+    }
+    .error {
+      background: #fee2e2;
+      border: 1px solid #fecaca;
+      color: #dc2626;
+      padding: 12px 16px;
+      border-radius: 8px;
+      margin-bottom: 24px;
+      font-size: 14px;
+    }
+    .notice {
+      background: #f0fdf4;
+      border: 1px solid #bbf7d0;
+      color: #166534;
+      padding: 12px 16px;
+      border-radius: 8px;
+      margin-bottom: 24px;
+      font-size: 13px;
+      line-height: 1.4;
+    }
+    .form-group { margin-bottom: 20px; }
+    label {
+      display: block;
+      font-size: 14px;
+      font-weight: 500;
+      color: #374151;
+      margin-bottom: 6px;
+    }
+    input {
+      width: 100%;
+      padding: 12px 16px;
+      border: 1px solid #d1d5db;
+      border-radius: 8px;
+      font-size: 16px;
+      transition: border-color 0.2s, box-shadow 0.2s;
+    }
+    input:focus {
+      outline: none;
+      border-color: #18b69b;
+      box-shadow: 0 0 0 3px rgba(24, 182, 155, 0.2);
+    }
+    input::placeholder { color: #9ca3af; }
+    .help-text {
+      font-size: 12px;
+      color: #6b7280;
+      margin-top: 4px;
+    }
+    .help-text a { color: #18b69b; text-decoration: none; }
+    .help-text a:hover { text-decoration: underline; }
+    button {
+      width: 100%;
+      padding: 14px 24px;
+      background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);
+      color: white;
+      border: none;
+      border-radius: 8px;
+      font-size: 16px;
+      font-weight: 600;
+      cursor: pointer;
+      transition: transform 0.2s, box-shadow 0.2s;
+    }
+    button:hover {
+      transform: translateY(-1px);
+      box-shadow: 0 4px 12px rgba(24, 182, 155, 0.4);
+    }
+    button:active { transform: translateY(0); }
+    .footer {
+      text-align: center;
+      margin-top: 24px;
+      font-size: 12px;
+      color: #9ca3af;
+    }
+    .footer a { color: #18b69b; text-decoration: none; }
+    .footer a:hover { text-decoration: underline; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="logo">
+      <svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+        <path d="M12 2L2 7L12 12L22 7L12 2Z" stroke="#18b69b" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+        <path d="M2 17L12 22L22 17" stroke="#0e7460" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+        <path d="M2 12L12 17L22 12" stroke="#18b69b" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+      </svg>
+    </div>
+    <h1>Connect to Laravel Forge</h1>
+    <p class="subtitle">Enter your Forge API token to connect with Claude</p>
+
+    ${error ? `<div class="error">${escapeHtml(error)}</div>` : ""}
+
+    <div class="notice">
+      <strong>Your token is not stored on this server.</strong> It is encrypted into the authorization code and sent back to Claude Desktop, which holds it in its own secure storage.
+    </div>
+
+    <form method="POST" action="/authorize">
+      <input type="hidden" name="redirectUri" value="${escapeHtml(redirectUri || "")}">
+      <input type="hidden" name="state" value="${escapeHtml(state || "")}">
+      <input type="hidden" name="codeChallenge" value="${escapeHtml(codeChallenge || "")}">
+      <input type="hidden" name="codeChallengeMethod" value="${escapeHtml(codeChallengeMethod || "S256")}">
+
+      <div class="form-group">
+        <label for="apiToken">Forge API Token *</label>
+        <input type="password" id="apiToken" name="apiToken" required placeholder="Enter your Forge API token">
+        <p class="help-text">
+          Generate at <a href="https://forge.laravel.com/user-profile/api" target="_blank" rel="noopener">forge.laravel.com → API Tokens</a>
+        </p>
+      </div>
+
+      <button type="submit">Connect to Forge</button>
+    </form>
+
+    <p class="footer">
+      Powered by <a href="https://github.com/studiometa/forge-tools" target="_blank" rel="noopener">forge-tools</a>
+    </p>
+  </div>
+</body>
+</html>`;
+}
+/**
+* Render success page with auto-redirect
+*/
+function renderSuccessPage(redirectUrl) {
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="refresh" content="2;url=${escapeHtml(redirectUrl)}">
+  <title>Connected — Forge MCP</title>
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 20px;
+    }
+    .container {
+      background: white;
+      border-radius: 16px;
+      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);
+      padding: 40px;
+      width: 100%;
+      max-width: 420px;
+      text-align: center;
+    }
+    .success-icon {
+      width: 64px;
+      height: 64px;
+      margin: 0 auto 24px;
+      background: linear-gradient(135deg, #10b981 0%, #059669 100%);
+      border-radius: 50%;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+    .success-icon svg { width: 32px; height: 32px; stroke: white; }
+    h1 { color: #1a1a2e; font-size: 24px; margin-bottom: 8px; }
+    .message { color: #666; font-size: 14px; margin-bottom: 24px; }
+    .spinner {
+      width: 24px;
+      height: 24px;
+      border: 3px solid #e5e7eb;
+      border-top-color: #18b69b;
+      border-radius: 50%;
+      animation: spin 1s linear infinite;
+      margin: 0 auto 16px;
+    }
+    @keyframes spin { to { transform: rotate(360deg); } }
+    .redirect-text { color: #9ca3af; font-size: 13px; margin-bottom: 16px; }
+    .manual-link { color: #18b69b; text-decoration: none; font-size: 14px; }
+    .manual-link:hover { text-decoration: underline; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="success-icon">
+      <svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+        <path d="M20 6L9 17L4 12" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
+      </svg>
+    </div>
+    <h1>Successfully Connected!</h1>
+    <p class="message">Your Forge API token has been encrypted and transmitted securely.</p>
+    <div class="spinner"></div>
+    <p class="redirect-text">Redirecting to Claude Desktop...</p>
+    <a href="${escapeHtml(redirectUrl)}" class="manual-link">Click here if not redirected automatically</a>
+  </div>
+  <script>
+    setTimeout(function() {
+      window.location.href = ${JSON.stringify(redirectUrl)};
+    }, 2000);
+  <\/script>
+</body>
+</html>`;
+}
+/**
+* Render error page
+*/
+function renderErrorPage(message) {
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Error — Forge MCP</title>
+  <style>
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      background: #f3f4f6;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 20px;
+    }
+    .container {
+      background: white;
+      border-radius: 16px;
+      box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+      padding: 40px;
+      text-align: center;
+      max-width: 400px;
+    }
+    h1 { color: #dc2626; margin-bottom: 16px; }
+    p { color: #6b7280; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Error</h1>
+    <p>${escapeHtml(message)}</p>
+  </div>
+</body>
+</html>`;
+}
+export { authorizeGetHandler, authorizePostHandler, createAccessToken, createS256Challenge, oauthMetadataHandler, protectedResourceHandler, registerHandler, tokenHandler };
+
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","names":[],"sources":["../src/oauth.ts"],"sourcesContent":["/**\n * OAuth 2.1 endpoints for Claude Desktop integration\n *\n * Implements OAuth 2.1 with PKCE as specified in the MCP authorization spec.\n * Uses stateless encrypted tokens — no server-side storage required.\n *\n * Spec: https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization\n *\n * Flow:\n * 1. Claude redirects user to /authorize with OAuth params (including PKCE)\n * 2. User enters their Forge API token in a login form\n * 3. Server encrypts the token + PKCE challenge into an authorization code\n * 4. Redirects back to Claude with the code\n * 5. Claude exchanges code for access token via /token (with code_verifier)\n * 6. Server validates PKCE and returns base64-encoded access token\n */\n\nimport {\n  defineEventHandler,\n  getQuery,\n  getRequestHeader,\n  readBody,\n  sendRedirect,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { createHash } from \"node:crypto\";\n\nimport { createAuthCode, decodeAuthCode } from \"./crypto.ts\";\n\n/**\n * Create a base64-encoded access token from a Forge API token.\n * The access token is simply base64(apiToken) so that parseAuthHeader\n * can decode it on every request without any server-side lookup.\n */\nexport function createAccessToken(apiToken: string): string {\n  return Buffer.from(apiToken).toString(\"base64\");\n}\n\n/**\n * OAuth metadata for discovery (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n *\n * MCP clients MUST check this endpoint first for server capabilities.\n */\nexport const oauthMetadataHandler = defineEventHandler((event: H3Event) => {\n  const host = getRequestHeader(event, \"host\") || \"localhost:3000\";\n  const protocol = getRequestHeader(event, \"x-forwarded-proto\") || \"http\";\n  const baseUrl = `${protocol}://${host}`;\n\n  setResponseHeader(event, \"Content-Type\", \"application/json\");\n  setResponseHeader(event, \"Cache-Control\", \"public, max-age=3600\");\n\n  return {\n    // Required fields per RFC 8414\n    issuer: baseUrl,\n    authorization_endpoint: `${baseUrl}/authorize`,\n    token_endpoint: `${baseUrl}/token`,\n    response_types_supported: [\"code\"],\n\n    // OAuth 2.1 / MCP requirements\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"], // Public client\n\n    // Optional but useful\n    registration_endpoint: `${baseUrl}/register`,\n    scopes_supported: [\"forge\"],\n    service_documentation: \"https://github.com/studiometa/forge-tools\",\n  };\n});\n\n/**\n * Protected resource metadata (RFC 9728)\n * GET /.well-known/oauth-protected-resource\n *\n * Tells MCP clients where to find the OAuth authorization server.\n */\nexport const protectedResourceHandler = defineEventHandler((event: H3Event) => {\n  const host = getRequestHeader(event, \"host\") || \"localhost:3000\";\n  const protocol = getRequestHeader(event, \"x-forwarded-proto\") || \"http\";\n  const baseUrl = `${protocol}://${host}`;\n\n  setResponseHeader(event, \"Content-Type\", \"application/json\");\n  setResponseHeader(event, \"Cache-Control\", \"public, max-age=3600\");\n\n  return {\n    resource: `${baseUrl}/mcp`,\n    authorization_servers: [baseUrl],\n    bearer_methods_supported: [\"header\"],\n    scopes_supported: [\"forge\"],\n  };\n});\n\n/**\n * Dynamic Client Registration endpoint (RFC 7591)\n * POST /register\n *\n * MCP servers SHOULD support DCR to allow clients to register automatically.\n * Since we use stateless tokens, we accept any registration and return\n * a generated client_id.\n */\nexport const registerHandler = defineEventHandler(async (event: H3Event) => {\n  setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n  let body: Record<string, unknown>;\n  try {\n    body = (await readBody(event)) as Record<string, unknown>;\n  } catch {\n    setResponseStatus(event, 400);\n    return {\n      error: \"invalid_request\",\n      error_description: \"Invalid JSON body\",\n    };\n  }\n\n  // Extract client metadata\n  const clientName = (body.client_name as string) || \"MCP Client\";\n  const redirectUris = (body.redirect_uris as string[]) || [];\n\n  // Generate a client_id based on the registration\n  // Since we're stateless, we encode minimal info in the client_id\n  const clientId = Buffer.from(\n    JSON.stringify({\n      name: clientName,\n      ts: Date.now(),\n    }),\n  ).toString(\"base64url\");\n\n  setResponseStatus(event, 201);\n  return {\n    client_id: clientId,\n    client_name: clientName,\n    redirect_uris: redirectUris,\n    token_endpoint_auth_method: \"none\",\n    grant_types: [\"authorization_code\", \"refresh_token\"],\n    response_types: [\"code\"],\n  };\n});\n\n/**\n * Authorization endpoint — shows login form\n * GET /authorize\n */\nexport const authorizeGetHandler = defineEventHandler((event: H3Event) => {\n  const query = getQuery(event);\n\n  // Extract OAuth parameters\n  const redirectUri = query.redirect_uri as string;\n  const state = query.state as string;\n  const codeChallenge = query.code_challenge as string;\n  const codeChallengeMethod = query.code_challenge_method as string;\n\n  // Validate required parameters per OAuth 2.1\n  if (!redirectUri) {\n    setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n    setResponseStatus(event, 400);\n    return renderErrorPage(\"Missing required parameter: redirect_uri\");\n  }\n\n  // PKCE is REQUIRED for public clients per MCP spec\n  if (!codeChallenge) {\n    const errorUrl = new URL(redirectUri);\n    errorUrl.searchParams.set(\"error\", \"invalid_request\");\n    errorUrl.searchParams.set(\"error_description\", \"code_challenge is required\");\n    if (state) errorUrl.searchParams.set(\"state\", state);\n    return sendRedirect(event, errorUrl.toString(), 302);\n  }\n\n  if (codeChallengeMethod && codeChallengeMethod !== \"S256\") {\n    const errorUrl = new URL(redirectUri);\n    errorUrl.searchParams.set(\"error\", \"invalid_request\");\n    errorUrl.searchParams.set(\"error_description\", \"Only S256 code_challenge_method is supported\");\n    if (state) errorUrl.searchParams.set(\"state\", state);\n    return sendRedirect(event, errorUrl.toString(), 302);\n  }\n\n  setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n\n  return renderLoginForm({\n    redirectUri,\n    state,\n    codeChallenge,\n    codeChallengeMethod: codeChallengeMethod || \"S256\",\n  });\n});\n\n/**\n * Authorization endpoint — process login\n * POST /authorize\n */\nexport const authorizePostHandler = defineEventHandler(async (event: H3Event) => {\n  const body = (await readBody(event)) as Record<string, string>;\n\n  const { apiToken, redirectUri, state, codeChallenge, codeChallengeMethod } = body;\n\n  // Validate redirect URI first (security requirement)\n  if (!redirectUri) {\n    setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n    setResponseStatus(event, 400);\n    return renderErrorPage(\"Missing redirect_uri parameter\");\n  }\n\n  // Validate redirect URI format (must be HTTPS or localhost)\n  try {\n    const uri = new URL(redirectUri);\n    const isLocalhost = uri.hostname === \"localhost\" || uri.hostname === \"127.0.0.1\";\n    const isHttps = uri.protocol === \"https:\";\n    if (!isLocalhost && !isHttps) {\n      setResponseStatus(event, 400);\n      return renderErrorPage(\"redirect_uri must be HTTPS or localhost\");\n    }\n  } catch {\n    setResponseStatus(event, 400);\n    return renderErrorPage(\"Invalid redirect_uri format\");\n  }\n\n  // Validate required credentials\n  if (!apiToken) {\n    setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n    return renderLoginForm({\n      redirectUri,\n      state,\n      codeChallenge,\n      codeChallengeMethod,\n      error: \"Forge API Token is required\",\n    });\n  }\n\n  // Create encrypted authorization code with PKCE challenge\n  const code = createAuthCode({\n    apiToken,\n    codeChallenge,\n    codeChallengeMethod: codeChallengeMethod || \"S256\",\n  });\n\n  // Build redirect URL with authorization code\n  const redirectUrl = new URL(redirectUri);\n  redirectUrl.searchParams.set(\"code\", code);\n  if (state) {\n    redirectUrl.searchParams.set(\"state\", state);\n  }\n\n  // Show success page with auto-redirect\n  setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n  return renderSuccessPage(redirectUrl.toString());\n});\n\n/**\n * Token endpoint — exchange code for access token\n * POST /token\n *\n * Supports:\n * - authorization_code grant (with PKCE validation)\n * - refresh_token grant\n */\nexport const tokenHandler = defineEventHandler(async (event: H3Event) => {\n  setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n  // h3 auto-parses both JSON and URL-encoded bodies into objects\n  const body = (await readBody(event)) as Record<string, string>;\n\n  const { grant_type, code, code_verifier, refresh_token } = body;\n\n  // Handle refresh token grant\n  if (grant_type === \"refresh_token\") {\n    return handleRefreshToken(event, refresh_token);\n  }\n\n  // Validate authorization code grant\n  if (grant_type !== \"authorization_code\") {\n    setResponseStatus(event, 400);\n    return {\n      error: \"unsupported_grant_type\",\n      error_description: \"Supported grant types: authorization_code, refresh_token\",\n    };\n  }\n\n  if (!code) {\n    setResponseStatus(event, 400);\n    return {\n      error: \"invalid_request\",\n      error_description: \"Missing authorization code\",\n    };\n  }\n\n  if (!code_verifier) {\n    setResponseStatus(event, 400);\n    return {\n      error: \"invalid_request\",\n      error_description: \"Missing code_verifier (PKCE required)\",\n    };\n  }\n\n  try {\n    // Decode the authorization code\n    const payload = decodeAuthCode(code);\n\n    // Validate PKCE: SHA256(code_verifier) must equal code_challenge\n    if (payload.codeChallenge) {\n      const expectedChallenge = createS256Challenge(code_verifier);\n      if (expectedChallenge !== payload.codeChallenge) {\n        setResponseStatus(event, 400);\n        return {\n          error: \"invalid_grant\",\n          error_description: \"Invalid code_verifier\",\n        };\n      }\n    }\n\n    // Create access token: base64(apiToken) — decodable on every request\n    const accessToken = createAccessToken(payload.apiToken);\n\n    // Create refresh token (encrypted credentials, longer expiry)\n    const refreshToken = createAuthCode(\n      { apiToken: payload.apiToken },\n      86400 * 30, // 30 days\n    );\n\n    return {\n      access_token: accessToken,\n      token_type: \"Bearer\",\n      expires_in: 3600, // 1 hour\n      refresh_token: refreshToken,\n    };\n  } catch (error) {\n    setResponseStatus(event, 400);\n    return {\n      error: \"invalid_grant\",\n      error_description: error instanceof Error ? error.message : \"Invalid authorization code\",\n    };\n  }\n});\n\n/**\n * Handle refresh token grant\n */\nfunction handleRefreshToken(event: H3Event, refreshToken: string | undefined) {\n  if (!refreshToken) {\n    setResponseStatus(event, 400);\n    return {\n      error: \"invalid_request\",\n      error_description: \"Missing refresh_token\",\n    };\n  }\n\n  try {\n    // Decode refresh token (it's just an encrypted auth code with longer expiry)\n    const payload = decodeAuthCode(refreshToken);\n\n    // Create new access token\n    const accessToken = createAccessToken(payload.apiToken);\n\n    // Create new refresh token (rotate for security)\n    const newRefreshToken = createAuthCode(\n      { apiToken: payload.apiToken },\n      86400 * 30, // 30 days\n    );\n\n    return {\n      access_token: accessToken,\n      token_type: \"Bearer\",\n      expires_in: 3600,\n      refresh_token: newRefreshToken,\n    };\n  } catch (error) {\n    setResponseStatus(event, 400);\n    return {\n      error: \"invalid_grant\",\n      error_description: error instanceof Error ? error.message : \"Invalid refresh token\",\n    };\n  }\n}\n\n/**\n * Create S256 PKCE challenge from verifier\n * SHA256(code_verifier) encoded as base64url\n */\nexport function createS256Challenge(codeVerifier: string): string {\n  return createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n}\n\n/**\n * Escape HTML special characters\n */\nfunction escapeHtml(str: string): string {\n  return str\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#039;\");\n}\n\n/**\n * Render the login form HTML\n */\nfunction renderLoginForm(params: {\n  redirectUri?: string;\n  state?: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: string;\n  error?: string;\n}): string {\n  const { redirectUri, state, codeChallenge, codeChallengeMethod, error } = params;\n\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>Connect to Laravel Forge</title>\n  <style>\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n      padding: 40px;\n      width: 100%;\n      max-width: 420px;\n    }\n    .logo {\n      text-align: center;\n      margin-bottom: 24px;\n    }\n    .logo svg { width: 48px; height: 48px; }\n    h1 {\n      text-align: center;\n      color: #1a1a2e;\n      font-size: 24px;\n      margin-bottom: 8px;\n    }\n    .subtitle {\n      text-align: center;\n      color: #666;\n      font-size: 14px;\n      margin-bottom: 32px;\n    }\n    .error {\n      background: #fee2e2;\n      border: 1px solid #fecaca;\n      color: #dc2626;\n      padding: 12px 16px;\n      border-radius: 8px;\n      margin-bottom: 24px;\n      font-size: 14px;\n    }\n    .notice {\n      background: #f0fdf4;\n      border: 1px solid #bbf7d0;\n      color: #166534;\n      padding: 12px 16px;\n      border-radius: 8px;\n      margin-bottom: 24px;\n      font-size: 13px;\n      line-height: 1.4;\n    }\n    .form-group { margin-bottom: 20px; }\n    label {\n      display: block;\n      font-size: 14px;\n      font-weight: 500;\n      color: #374151;\n      margin-bottom: 6px;\n    }\n    input {\n      width: 100%;\n      padding: 12px 16px;\n      border: 1px solid #d1d5db;\n      border-radius: 8px;\n      font-size: 16px;\n      transition: border-color 0.2s, box-shadow 0.2s;\n    }\n    input:focus {\n      outline: none;\n      border-color: #18b69b;\n      box-shadow: 0 0 0 3px rgba(24, 182, 155, 0.2);\n    }\n    input::placeholder { color: #9ca3af; }\n    .help-text {\n      font-size: 12px;\n      color: #6b7280;\n      margin-top: 4px;\n    }\n    .help-text a { color: #18b69b; text-decoration: none; }\n    .help-text a:hover { text-decoration: underline; }\n    button {\n      width: 100%;\n      padding: 14px 24px;\n      background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);\n      color: white;\n      border: none;\n      border-radius: 8px;\n      font-size: 16px;\n      font-weight: 600;\n      cursor: pointer;\n      transition: transform 0.2s, box-shadow 0.2s;\n    }\n    button:hover {\n      transform: translateY(-1px);\n      box-shadow: 0 4px 12px rgba(24, 182, 155, 0.4);\n    }\n    button:active { transform: translateY(0); }\n    .footer {\n      text-align: center;\n      margin-top: 24px;\n      font-size: 12px;\n      color: #9ca3af;\n    }\n    .footer a { color: #18b69b; text-decoration: none; }\n    .footer a:hover { text-decoration: underline; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <div class=\"logo\">\n      <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n        <path d=\"M12 2L2 7L12 12L22 7L12 2Z\" stroke=\"#18b69b\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n        <path d=\"M2 17L12 22L22 17\" stroke=\"#0e7460\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n        <path d=\"M2 12L12 17L22 12\" stroke=\"#18b69b\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n      </svg>\n    </div>\n    <h1>Connect to Laravel Forge</h1>\n    <p class=\"subtitle\">Enter your Forge API token to connect with Claude</p>\n\n    ${error ? `<div class=\"error\">${escapeHtml(error)}</div>` : \"\"}\n\n    <div class=\"notice\">\n      <strong>Your token is not stored on this server.</strong> It is encrypted into the authorization code and sent back to Claude Desktop, which holds it in its own secure storage.\n    </div>\n\n    <form method=\"POST\" action=\"/authorize\">\n      <input type=\"hidden\" name=\"redirectUri\" value=\"${escapeHtml(redirectUri || \"\")}\">\n      <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(state || \"\")}\">\n      <input type=\"hidden\" name=\"codeChallenge\" value=\"${escapeHtml(codeChallenge || \"\")}\">\n      <input type=\"hidden\" name=\"codeChallengeMethod\" value=\"${escapeHtml(codeChallengeMethod || \"S256\")}\">\n\n      <div class=\"form-group\">\n        <label for=\"apiToken\">Forge API Token *</label>\n        <input type=\"password\" id=\"apiToken\" name=\"apiToken\" required placeholder=\"Enter your Forge API token\">\n        <p class=\"help-text\">\n          Generate at <a href=\"https://forge.laravel.com/user-profile/api\" target=\"_blank\" rel=\"noopener\">forge.laravel.com → API Tokens</a>\n        </p>\n      </div>\n\n      <button type=\"submit\">Connect to Forge</button>\n    </form>\n\n    <p class=\"footer\">\n      Powered by <a href=\"https://github.com/studiometa/forge-tools\" target=\"_blank\" rel=\"noopener\">forge-tools</a>\n    </p>\n  </div>\n</body>\n</html>`;\n}\n\n/**\n * Render success page with auto-redirect\n */\nfunction renderSuccessPage(redirectUrl: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <meta http-equiv=\"refresh\" content=\"2;url=${escapeHtml(redirectUrl)}\">\n  <title>Connected — Forge MCP</title>\n  <style>\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: linear-gradient(135deg, #18b69b 0%, #0e7460 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n      padding: 40px;\n      width: 100%;\n      max-width: 420px;\n      text-align: center;\n    }\n    .success-icon {\n      width: 64px;\n      height: 64px;\n      margin: 0 auto 24px;\n      background: linear-gradient(135deg, #10b981 0%, #059669 100%);\n      border-radius: 50%;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n    }\n    .success-icon svg { width: 32px; height: 32px; stroke: white; }\n    h1 { color: #1a1a2e; font-size: 24px; margin-bottom: 8px; }\n    .message { color: #666; font-size: 14px; margin-bottom: 24px; }\n    .spinner {\n      width: 24px;\n      height: 24px;\n      border: 3px solid #e5e7eb;\n      border-top-color: #18b69b;\n      border-radius: 50%;\n      animation: spin 1s linear infinite;\n      margin: 0 auto 16px;\n    }\n    @keyframes spin { to { transform: rotate(360deg); } }\n    .redirect-text { color: #9ca3af; font-size: 13px; margin-bottom: 16px; }\n    .manual-link { color: #18b69b; text-decoration: none; font-size: 14px; }\n    .manual-link:hover { text-decoration: underline; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <div class=\"success-icon\">\n      <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n        <path d=\"M20 6L9 17L4 12\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n      </svg>\n    </div>\n    <h1>Successfully Connected!</h1>\n    <p class=\"message\">Your Forge API token has been encrypted and transmitted securely.</p>\n    <div class=\"spinner\"></div>\n    <p class=\"redirect-text\">Redirecting to Claude Desktop...</p>\n    <a href=\"${escapeHtml(redirectUrl)}\" class=\"manual-link\">Click here if not redirected automatically</a>\n  </div>\n  <script>\n    setTimeout(function() {\n      window.location.href = ${JSON.stringify(redirectUrl)};\n    }, 2000);\n  </script>\n</body>\n</html>`;\n}\n\n/**\n * Render error page\n */\nfunction renderErrorPage(message: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>Error — Forge MCP</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: #f3f4f6;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);\n      padding: 40px;\n      text-align: center;\n      max-width: 400px;\n    }\n    h1 { color: #dc2626; margin-bottom: 16px; }\n    p { color: #6b7280; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Error</h1>\n    <p>${escapeHtml(message)}</p>\n  </div>\n</body>\n</html>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,kBAAkB,UAA0B;AAC1D,QAAO,OAAO,KAAK,SAAS,CAAC,SAAS,SAAS;;;;;;;;AASjD,MAAa,uBAAuB,oBAAoB,UAAmB;CACzE,MAAM,OAAO,iBAAiB,OAAO,OAAO,IAAI;CAEhD,MAAM,UAAU,GADC,iBAAiB,OAAO,oBAAoB,IAAI,OACrC,KAAK;AAEjC,mBAAkB,OAAO,gBAAgB,mBAAmB;AAC5D,mBAAkB,OAAO,iBAAiB,uBAAuB;AAEjE,QAAO;EAEL,QAAQ;EACR,wBAAwB,GAAG,QAAQ;EACnC,gBAAgB,GAAG,QAAQ;EAC3B,0BAA0B,CAAC,OAAO;EAGlC,uBAAuB,CAAC,sBAAsB,gBAAgB;EAC9D,kCAAkC,CAAC,OAAO;EAC1C,uCAAuC,CAAC,OAAO;EAG/C,uBAAuB,GAAG,QAAQ;EAClC,kBAAkB,CAAC,QAAQ;EAC3B,uBAAuB;EACxB;EACD;;;;;;;AAQF,MAAa,2BAA2B,oBAAoB,UAAmB;CAC7E,MAAM,OAAO,iBAAiB,OAAO,OAAO,IAAI;CAEhD,MAAM,UAAU,GADC,iBAAiB,OAAO,oBAAoB,IAAI,OACrC,KAAK;AAEjC,mBAAkB,OAAO,gBAAgB,mBAAmB;AAC5D,mBAAkB,OAAO,iBAAiB,uBAAuB;AAEjE,QAAO;EACL,UAAU,GAAG,QAAQ;EACrB,uBAAuB,CAAC,QAAQ;EAChC,0BAA0B,CAAC,SAAS;EACpC,kBAAkB,CAAC,QAAQ;EAC5B;EACD;;;;;;;;;AAUF,MAAa,kBAAkB,mBAAmB,OAAO,UAAmB;AAC1E,mBAAkB,OAAO,gBAAgB,mBAAmB;CAE5D,IAAI;AACJ,KAAI;AACF,SAAQ,MAAM,SAAS,MAAM;SACvB;AACN,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;CAIH,MAAM,aAAc,KAAK,eAA0B;CACnD,MAAM,eAAgB,KAAK,iBAA8B,EAAE;CAI3D,MAAM,WAAW,OAAO,KACtB,KAAK,UAAU;EACb,MAAM;EACN,IAAI,KAAK,KAAK;EACf,CAAC,CACH,CAAC,SAAS,YAAY;AAEvB,mBAAkB,OAAO,IAAI;AAC7B,QAAO;EACL,WAAW;EACX,aAAa;EACb,eAAe;EACf,4BAA4B;EAC5B,aAAa,CAAC,sBAAsB,gBAAgB;EACpD,gBAAgB,CAAC,OAAO;EACzB;EACD;;;;;AAMF,MAAa,sBAAsB,oBAAoB,UAAmB;CACxE,MAAM,QAAQ,SAAS,MAAM;CAG7B,MAAM,cAAc,MAAM;CAC1B,MAAM,QAAQ,MAAM;CACpB,MAAM,gBAAgB,MAAM;CAC5B,MAAM,sBAAsB,MAAM;AAGlC,KAAI,CAAC,aAAa;AAChB,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,oBAAkB,OAAO,IAAI;AAC7B,SAAO,gBAAgB,2CAA2C;;AAIpE,KAAI,CAAC,eAAe;EAClB,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,WAAS,aAAa,IAAI,SAAS,kBAAkB;AACrD,WAAS,aAAa,IAAI,qBAAqB,6BAA6B;AAC5E,MAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,SAAO,aAAa,OAAO,SAAS,UAAU,EAAE,IAAI;;AAGtD,KAAI,uBAAuB,wBAAwB,QAAQ;EACzD,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,WAAS,aAAa,IAAI,SAAS,kBAAkB;AACrD,WAAS,aAAa,IAAI,qBAAqB,+CAA+C;AAC9F,MAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,SAAO,aAAa,OAAO,SAAS,UAAU,EAAE,IAAI;;AAGtD,mBAAkB,OAAO,gBAAgB,2BAA2B;AAEpE,QAAO,gBAAgB;EACrB;EACA;EACA;EACA,qBAAqB,uBAAuB;EAC7C,CAAC;EACF;;;;;AAMF,MAAa,uBAAuB,mBAAmB,OAAO,UAAmB;CAG/E,MAAM,EAAE,UAAU,aAAa,OAAO,eAAe,wBAFvC,MAAM,SAAS,MAAM;AAKnC,KAAI,CAAC,aAAa;AAChB,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,oBAAkB,OAAO,IAAI;AAC7B,SAAO,gBAAgB,iCAAiC;;AAI1D,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,YAAY;EAChC,MAAM,cAAc,IAAI,aAAa,eAAe,IAAI,aAAa;EACrE,MAAM,UAAU,IAAI,aAAa;AACjC,MAAI,CAAC,eAAe,CAAC,SAAS;AAC5B,qBAAkB,OAAO,IAAI;AAC7B,UAAO,gBAAgB,0CAA0C;;SAE7D;AACN,oBAAkB,OAAO,IAAI;AAC7B,SAAO,gBAAgB,8BAA8B;;AAIvD,KAAI,CAAC,UAAU;AACb,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,SAAO,gBAAgB;GACrB;GACA;GACA;GACA;GACA,OAAO;GACR,CAAC;;CAIJ,MAAM,OAAO,eAAe;EAC1B;EACA;EACA,qBAAqB,uBAAuB;EAC7C,CAAC;CAGF,MAAM,cAAc,IAAI,IAAI,YAAY;AACxC,aAAY,aAAa,IAAI,QAAQ,KAAK;AAC1C,KAAI,MACF,aAAY,aAAa,IAAI,SAAS,MAAM;AAI9C,mBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,QAAO,kBAAkB,YAAY,UAAU,CAAC;EAChD;;;;;;;;;AAUF,MAAa,eAAe,mBAAmB,OAAO,UAAmB;AACvE,mBAAkB,OAAO,gBAAgB,mBAAmB;CAK5D,MAAM,EAAE,YAAY,MAAM,eAAe,kBAF3B,MAAM,SAAS,MAAM;AAKnC,KAAI,eAAe,gBACjB,QAAO,mBAAmB,OAAO,cAAc;AAIjD,KAAI,eAAe,sBAAsB;AACvC,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI,CAAC,MAAM;AACT,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI,CAAC,eAAe;AAClB,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI;EAEF,MAAM,UAAU,eAAe,KAAK;AAGpC,MAAI,QAAQ;OACgB,oBAAoB,cAAc,KAClC,QAAQ,eAAe;AAC/C,sBAAkB,OAAO,IAAI;AAC7B,WAAO;KACL,OAAO;KACP,mBAAmB;KACpB;;;AAaL,SAAO;GACL,cATkB,kBAAkB,QAAQ,SAAS;GAUrD,YAAY;GACZ,YAAY;GACZ,eATmB,eACnB,EAAE,UAAU,QAAQ,UAAU,EAC9B,QAAQ,GACT;GAOA;UACM,OAAO;AACd,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;GAC7D;;EAEH;;;;AAKF,SAAS,mBAAmB,OAAgB,cAAkC;AAC5E,KAAI,CAAC,cAAc;AACjB,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI;EAEF,MAAM,UAAU,eAAe,aAAa;AAW5C,SAAO;GACL,cATkB,kBAAkB,QAAQ,SAAS;GAUrD,YAAY;GACZ,YAAY;GACZ,eATsB,eACtB,EAAE,UAAU,QAAQ,UAAU,EAC9B,QAAQ,GACT;GAOA;UACM,OAAO;AACd,oBAAkB,OAAO,IAAI;AAC7B,SAAO;GACL,OAAO;GACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;GAC7D;;;;;;;AAQL,SAAgB,oBAAoB,cAA8B;AAChE,QAAO,WAAW,SAAS,CAAC,OAAO,aAAa,CAAC,OAAO,YAAY;;;;;AAMtE,SAAS,WAAW,KAAqB;AACvC,QAAO,IACJ,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,SAAS,CACvB,QAAQ,MAAM,SAAS;;;;;AAM5B,SAAS,gBAAgB,QAMd;CACT,MAAM,EAAE,aAAa,OAAO,eAAe,qBAAqB,UAAU;AAE1E,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAiIH,QAAQ,sBAAsB,WAAW,MAAM,CAAC,UAAU,GAAG;;;;;;;uDAOZ,WAAW,eAAe,GAAG,CAAC;iDACpC,WAAW,SAAS,GAAG,CAAC;yDAChB,WAAW,iBAAiB,GAAG,CAAC;+DAC1B,WAAW,uBAAuB,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBzG,SAAS,kBAAkB,aAA6B;AACtD,QAAO;;;;;8CAKqC,WAAW,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6DvD,WAAW,YAAY,CAAC;;;;+BAIR,KAAK,UAAU,YAAY,CAAC;;;;;;;;;AAU3D,SAAS,gBAAgB,SAAyB;AAChD,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA+BA,WAAW,QAAQ,CAAC"}

package/dist/server.d.ts

@@ -3,22 +3,40 @@
  * Forge MCP Server - HTTP Transport (Streamable HTTP)
  *
  * Implements the official MCP Streamable HTTP transport specification.
- * Credentials are passed via Bearer token in the Authorization header.
+ * Supports both raw Bearer tokens and OAuth 2.1 with PKCE for
+ * Claude Desktop compatibility.
  *
- * Token format: raw Forge API token
+ * Token formats:
+ *   - Raw Forge API token (Bearer <token>)
+ *   - Base64-encoded token from OAuth flow (Bearer base64(<token>))
+ *
+ * Environment variables:
+ *   PORT          - HTTP port (default: 3000)
+ *   HOST          - Bind address (default: 0.0.0.0)
+ *   FORGE_READ_ONLY - Disable write operations (default: false)
+ *   OAUTH_SECRET  - AES-256-GCM encryption key for OAuth tokens.
+ *                   Required in production. A default is used if unset.
  *
  * Usage:
  *   forge-mcp-server
  *   forge-mcp-server --read-only
- *   FORGE_READ_ONLY=true forge-mcp-server
+ *   OAUTH_SECRET=my-secret forge-mcp-server
  *   PORT=3000 forge-mcp-server
  *
  * Endpoints:
- *   POST /mcp   - MCP Streamable HTTP (JSON-RPC messages)
- *   GET  /mcp   - MCP Streamable HTTP (SSE stream for server notifications)
- *   DELETE /mcp - MCP Streamable HTTP (session termination)
+ *   POST /mcp    - MCP Streamable HTTP (JSON-RPC messages)
+ *   GET  /mcp    - MCP Streamable HTTP (SSE stream for server notifications)
+ *   DELETE /mcp  - MCP Streamable HTTP (session termination)
  *   GET  /       - Service info
  *   GET  /health - Health check
+ *
+ * OAuth 2.1 endpoints (for Claude Desktop):
+ *   GET  /.well-known/oauth-authorization-server - OAuth metadata (RFC 8414)
+ *   GET  /.well-known/oauth-protected-resource   - Protected resource (RFC 9728)
+ *   POST /register  - Dynamic client registration (RFC 7591)
+ *   GET  /authorize - Login form
+ *   POST /authorize - Process login
+ *   POST /token     - Token exchange (PKCE)
  */
 import { type Server } from "node:http";
 /**