@sync.so/mcp-server 0.1.3 → 0.2.0

package/dist/app-upload-relay.js

@@ -0,0 +1,136 @@
+import { randomBytes } from 'node:crypto';
+import { request } from 'node:https';
+import { Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import cors from 'cors';
+import { z } from 'zod';
+import { uploadRuntime } from './upload-runtime.js';
+/** Browser origins are configured separately from storage destinations. Tickets remain required. */
+export function createAppUploadCors(origins) {
+    return cors({
+        origin: origins,
+        credentials: false,
+        methods: ['PUT'],
+        allowedHeaders: ['content-type'],
+    });
+}
+const grantSchema = z.object({
+    uploadUrl: z.url(),
+    url: z.url(),
+    expiresIn: z.number().positive().optional(),
+});
+const inputSchema = z.object({
+    contentType: z.string().regex(/^(video|audio|image)\/[\w.+-]+$/),
+    size: z.number().int().positive(),
+});
+const tickets = new Map();
+/** A ticket grants one bounded PUT to one server-issued storage URL, never arbitrary proxying. */
+export function relayUploadTool(tool, origin, storageOrigin) {
+    if (tool.name !== 'assets_create-upload-url')
+        return tool;
+    return {
+        ...tool,
+        handler: async (args, context) => {
+            const input = inputSchema.parse(args);
+            if (input.size > 5 * 1024 ** 3)
+                throw new Error(`This server supports uploads up to ${5 * 1024} MB.`);
+            for (const [key, ticket] of tickets)
+                if (ticket.expiresAt <= Date.now())
+                    tickets.delete(key);
+            if (tickets.size >= 128)
+                throw new Error('Upload capacity is full. Try again shortly.');
+            const signed = grantSchema.parse(await tool.handler(args, context));
+            const destination = new URL(signed.uploadUrl);
+            if (destination.protocol !== 'https:' ||
+                destination.origin !== storageOrigin ||
+                destination.username ||
+                destination.password)
+                throw new Error('Unexpected storage upload destination.');
+            const token = randomBytes(32).toString('hex');
+            const expiresIn = Math.min(signed.expiresIn ?? 300, 300);
+            process.stderr.write(JSON.stringify({
+                event: 'app_upload_grant',
+                storageOrigin: destination.origin,
+                bytes: input.size,
+            }) + '\n');
+            tickets.set(token, {
+                destination: signed.uploadUrl,
+                ...input,
+                expiresAt: Date.now() + expiresIn * 1000,
+            });
+            return { ...signed, expiresIn, uploadUrl: `${origin}/app-upload?ticket=${token}` };
+        },
+    };
+}
+export const appUploadHandler = async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+    const token = typeof req.query.ticket === 'string' ? req.query.ticket : '';
+    const ticket = tickets.get(token);
+    if (!ticket || ticket.expiresAt <= Date.now()) {
+        tickets.delete(token);
+        res.status(403).json({ error: 'Upload permission expired. Choose the file again.' });
+        return;
+    }
+    if (req.headers['content-type'] !== ticket.contentType ||
+        Number(req.headers['content-length']) !== ticket.size) {
+        res.status(400).json({ error: 'Upload size or content type did not match.' });
+        return;
+    }
+    tickets.delete(token);
+    const controller = new AbortController();
+    const abort = () => {
+        if (!res.writableFinished)
+            controller.abort();
+    };
+    res.once('close', abort);
+    try {
+        await uploadRuntime.run(async (signal) => {
+            let size = 0;
+            const bounded = new Transform({
+                transform(chunk, _encoding, callback) {
+                    size += chunk.length;
+                    if (size > ticket.size)
+                        callback(new Error('Upload exceeded its declared size.'));
+                    else
+                        callback(null, chunk);
+                },
+                flush(callback) {
+                    callback(size === ticket.size ? null : new Error('Incomplete upload.'));
+                },
+            });
+            let resolveResponse;
+            let rejectResponse;
+            const response = new Promise((resolve, reject) => {
+                resolveResponse = resolve;
+                rejectResponse = reject;
+            });
+            const upstream = request(ticket.destination, {
+                method: 'PUT',
+                signal,
+                headers: { 'Content-Type': ticket.contentType, 'Content-Length': ticket.size },
+            }, (incoming) => {
+                incoming.resume();
+                process.stderr.write(JSON.stringify({
+                    event: 'app_upload_storage_response',
+                    status: incoming.statusCode,
+                }) + '\n');
+                incoming.on('error', rejectResponse);
+                incoming.on('end', () => incoming.statusCode && incoming.statusCode >= 200 && incoming.statusCode < 300
+                    ? resolveResponse()
+                    : rejectResponse(new Error('Storage rejected the upload.')));
+            });
+            upstream.on('error', rejectResponse);
+            // Both promises have rejection handlers immediately; backpressure bounds memory.
+            await Promise.all([pipeline(req, bounded, upstream, { signal }), response]);
+            uploadRuntime.recordUploadedBytes(size);
+        }, { signal: controller.signal });
+        res.status(204).end();
+    }
+    catch {
+        if (!res.destroyed)
+            res.status(502).json({ error: 'Upload did not complete. Please retry.' });
+    }
+    finally {
+        res.off('close', abort);
+    }
+};

package/dist/asset-thumbnail.d.ts

@@ -0,0 +1,3 @@
+export declare const ASSET_THUMBNAIL_INSTRUCTIONS = "For asset previews, use only the exact thumbnailUrl returned by Sync for that same asset, preserving its URL and query string. Never search the web, generate an image, guess a URL, or substitute another asset, a stock image, a voice portrait, url or proxyPath as its thumbnail. If thumbnailUrl is missing or fails to load, use the black Sync-logo placeholder at https://mcp.sync.so/asset-placeholder.svg and label it \"Thumbnail unavailable\"; it is a placeholder, not a frame from the asset. If the host cannot display the placeholder, say \"Thumbnail unavailable\" without substituting an image. Actual playback still uses the asset media URL. ";
+export declare const ASSET_THUMBNAIL_PLACEHOLDER = "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"640\" height=\"360\" viewBox=\"0 0 640 360\"><title>Sync asset thumbnail unavailable</title><rect width=\"640\" height=\"360\" fill=\"black\"/><g transform=\"translate(296 149.28) scale(3)\" fill=\"white\"><path fill-rule=\"evenodd\" clip-rule=\"evenodd\" d=\"M7.99969 17.0347V13.6457C4.513 13.6457 1.54824 12.2179 0.452561 10.2309C0.804942 9.59381 1.34998 9.01497 2.04423 8.52279C1.35768 8.03061 0.816852 7.45312 0.46377 6.8208C0.163931 7.35631 0 7.9338 0 8.53565C0 9.12938 0.159727 9.7001 0.452561 10.2309C0.159727 10.761 0 11.3303 0 11.9247C0 14.7417 3.58126 17.0347 7.99969 17.0347ZM7.99969 3.44324V0C3.58126 0 0 2.28353 0 5.10122C0 5.70307 0.163931 6.28259 0.464471 6.82148C1.56925 4.85005 4.52561 3.44324 7.99969 3.44324ZM7.99969 6.83299C5.6346 6.83299 3.5091 7.48494 2.04423 8.52347C3.5091 9.57417 5.6339 10.2397 7.99969 10.2397V6.83299ZM13.9466 11.9653C14.6449 11.4711 15.1934 10.8889 15.5472 10.2485C15.84 10.7786 15.9997 11.3486 15.999 11.9424C15.999 12.5456 15.8351 13.123 15.5339 13.6592C15.1801 13.0276 14.6365 12.4542 13.9465 11.9655C12.4823 13.0026 10.3611 13.6457 8.00032 13.6457V10.239C10.3604 10.239 12.4824 10.9281 13.9466 11.9653ZM8.00032 20.478V17.0347C11.473 17.0347 14.4286 15.6293 15.5348 13.6592C15.8354 14.1961 16 14.7742 16 15.3768C16 18.1944 12.418 20.478 8.00032 20.478ZM8.00032 3.44327V6.83235C11.487 6.83235 14.4518 8.26353 15.5474 10.2478C15.8403 9.71773 16 9.14702 16 8.55329C16 5.73628 12.418 3.44327 8.00032 3.44327Z\"/></g></svg>";
+//# sourceMappingURL=asset-thumbnail.d.ts.map

package/dist/asset-thumbnail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-thumbnail.d.ts","sourceRoot":"","sources":["../src/asset-thumbnail.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,2oBAC6lB,CAAC;AAEvoB,eAAO,MAAM,2BAA2B,g/CAC+6C,CAAC"}

package/dist/asset-thumbnail.js

@@ -0,0 +1,2 @@
+export const ASSET_THUMBNAIL_INSTRUCTIONS = 'For asset previews, use only the exact thumbnailUrl returned by Sync for that same asset, preserving its URL and query string. Never search the web, generate an image, guess a URL, or substitute another asset, a stock image, a voice portrait, url or proxyPath as its thumbnail. If thumbnailUrl is missing or fails to load, use the black Sync-logo placeholder at https://mcp.sync.so/asset-placeholder.svg and label it "Thumbnail unavailable"; it is a placeholder, not a frame from the asset. If the host cannot display the placeholder, say "Thumbnail unavailable" without substituting an image. Actual playback still uses the asset media URL. ';
+export const ASSET_THUMBNAIL_PLACEHOLDER = '<svg xmlns="http://www.w3.org/2000/svg" width="640" height="360" viewBox="0 0 640 360"><title>Sync asset thumbnail unavailable</title><rect width="640" height="360" fill="black"/><g transform="translate(296 149.28) scale(3)" fill="white"><path fill-rule="evenodd" clip-rule="evenodd" d="M7.99969 17.0347V13.6457C4.513 13.6457 1.54824 12.2179 0.452561 10.2309C0.804942 9.59381 1.34998 9.01497 2.04423 8.52279C1.35768 8.03061 0.816852 7.45312 0.46377 6.8208C0.163931 7.35631 0 7.9338 0 8.53565C0 9.12938 0.159727 9.7001 0.452561 10.2309C0.159727 10.761 0 11.3303 0 11.9247C0 14.7417 3.58126 17.0347 7.99969 17.0347ZM7.99969 3.44324V0C3.58126 0 0 2.28353 0 5.10122C0 5.70307 0.163931 6.28259 0.464471 6.82148C1.56925 4.85005 4.52561 3.44324 7.99969 3.44324ZM7.99969 6.83299C5.6346 6.83299 3.5091 7.48494 2.04423 8.52347C3.5091 9.57417 5.6339 10.2397 7.99969 10.2397V6.83299ZM13.9466 11.9653C14.6449 11.4711 15.1934 10.8889 15.5472 10.2485C15.84 10.7786 15.9997 11.3486 15.999 11.9424C15.999 12.5456 15.8351 13.123 15.5339 13.6592C15.1801 13.0276 14.6365 12.4542 13.9465 11.9655C12.4823 13.0026 10.3611 13.6457 8.00032 13.6457V10.239C10.3604 10.239 12.4824 10.9281 13.9466 11.9653ZM8.00032 20.478V17.0347C11.473 17.0347 14.4286 15.6293 15.5348 13.6592C15.8354 14.1961 16 14.7742 16 15.3768C16 18.1944 12.418 20.478 8.00032 20.478ZM8.00032 3.44327V6.83235C11.487 6.83235 14.4518 8.26353 15.5474 10.2478C15.8403 9.71773 16 9.14702 16 8.55329C16 5.73628 12.418 3.44327 8.00032 3.44327Z"/></g></svg>';

package/dist/auth/async-context.d.ts

@@ -0,0 +1,5 @@
+export declare function runWithAuth<T>(token: string, clientName: string | undefined, fn: () => T, owner?: string): T;
+export declare function getAuthToken(): string | undefined;
+export declare function getAuthOwner(): string | undefined;
+export declare function getClientName(): string | undefined;
+//# sourceMappingURL=async-context.d.ts.map

package/dist/auth/async-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-context.d.ts","sourceRoot":"","sources":["../../src/auth/async-context.ts"],"names":[],"mappings":"AAWA,wBAAgB,WAAW,CAAC,CAAC,EAC3B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,EAAE,EAAE,MAAM,CAAC,EACX,KAAK,CAAC,EAAE,MAAM,GACb,CAAC,CAEH;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD"}

package/dist/auth/async-context.js

@@ -0,0 +1,14 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+const authContext = new AsyncLocalStorage();
+export function runWithAuth(token, clientName, fn, owner) {
+    return authContext.run({ token, clientName, owner }, fn);
+}
+export function getAuthToken() {
+    return authContext.getStore()?.token;
+}
+export function getAuthOwner() {
+    return authContext.getStore()?.owner;
+}
+export function getClientName() {
+    return authContext.getStore()?.clientName;
+}

package/dist/auth/bearer-auth.d.ts

@@ -0,0 +1,16 @@
+import type { AuthInfo } from '@modelcontextprotocol/server';
+import type { BearerAuthMiddlewareOptions } from '@modelcontextprotocol/server-legacy/auth';
+import type { RequestHandler } from 'express';
+type Options = Omit<BearerAuthMiddlewareOptions, 'verifier'> & {
+    verifier: {
+        verifyAccessToken(token: string, signal?: AbortSignal): Promise<AuthInfo>;
+    };
+};
+/**
+ * Preserve SDK authentication checks; only translate dependency failures locally.
+ * Uses the frozen v1 middleware from server-legacy: the token verifier throws its
+ * error classes, and the challenge and status mapping in docs/ depend on it.
+ */
+export declare function requireBearerAuth(options: Options): RequestHandler;
+export {};
+//# sourceMappingURL=bearer-auth.d.ts.map

package/dist/auth/bearer-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-auth.d.ts","sourceRoot":"","sources":["../../src/auth/bearer-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,KAAK,OAAO,GAAG,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC,GAAG;IAC7D,QAAQ,EAAE;QAAE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACzF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAwClE"}

package/dist/auth/bearer-auth.js

@@ -0,0 +1,55 @@
+import { requireBearerAuth as sdkRequireBearerAuth } from '@modelcontextprotocol/server-legacy/auth';
+import { VerificationUnavailableError } from './token-verification.js';
+/**
+ * Preserve SDK authentication checks; only translate dependency failures locally.
+ * Uses the frozen v1 middleware from server-legacy: the token verifier throws its
+ * error classes, and the challenge and status mapping in docs/ depend on it.
+ */
+export function requireBearerAuth(options) {
+    return async (req, res, next) => {
+        const [scheme, token] = (req.headers.authorization ?? '').split(' ');
+        if (scheme?.toLowerCase() !== 'bearer' || !token) {
+            return sdkRequireBearerAuth(options)(req, res, next);
+        }
+        const controller = new AbortController();
+        const cancel = () => controller.abort();
+        req.once('aborted', cancel);
+        res.once('close', cancel);
+        if (req.aborted || res.destroyed)
+            cancel();
+        let auth;
+        let failure;
+        try {
+            auth = await options.verifier.verifyAccessToken(token, controller.signal);
+        }
+        catch (error) {
+            failure = error;
+        }
+        finally {
+            req.off('aborted', cancel);
+            res.off('close', cancel);
+        }
+        if (controller.signal.aborted || res.destroyed)
+            return;
+        if (failure instanceof VerificationUnavailableError) {
+            res.set('Cache-Control', 'no-store');
+            if (failure.retryAfter)
+                res.set('Retry-After', failure.retryAfter);
+            res.status(failure.status).json(failure.toResponseObject());
+            return;
+        }
+        // SDK still owns invalid-token challenges, expiration and scope enforcement.
+        return sdkRequireBearerAuth({
+            ...options,
+            verifier: {
+                verifyAccessToken: async () => {
+                    if (failure)
+                        throw failure;
+                    if (!auth)
+                        throw new Error('Token verification failed');
+                    return auth;
+                },
+            },
+        })(req, res, next);
+    };
+}

package/dist/auth/client-credentials.d.ts

@@ -0,0 +1,13 @@
+import { InvalidClientError } from '@modelcontextprotocol/server-legacy/auth';
+export declare const CLIENT_AUTH_METHODS: string[];
+export declare const BASIC_CHALLENGE = "Basic realm=\"oauth\"";
+export declare class ClientAuthenticationError extends InvalidClientError {
+    readonly status: 400 | 401;
+    constructor(status: 400 | 401);
+}
+export declare function extractBasicClientCredentials(authorization: string | undefined): {
+    clientId: string;
+    clientSecret: string;
+} | undefined;
+export declare function mergeBasicClientCredentials(body: Record<string, unknown>, authorization: string | undefined): Record<string, unknown>;
+//# sourceMappingURL=client-credentials.d.ts.map

package/dist/auth/client-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../src/auth/client-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAuB,MAAM,0CAA0C,CAAC;AAInG,eAAO,MAAM,mBAAmB,UAAgD,CAAC;AACjF,eAAO,MAAM,eAAe,0BAAwB,CAAC;AAErD,qBAAa,yBAA0B,SAAQ,kBAAkB;IACnD,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IAAtC,YAAqB,MAAM,EAAE,GAAG,GAAG,GAAG,EAErC;CACF;AAED,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAyBxD;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BzB"}

package/dist/auth/client-credentials.js

@@ -0,0 +1,67 @@
+import { InvalidClientError, InvalidRequestError } from '@modelcontextprotocol/server-legacy/auth';
+// Basic is an existing ChatGPT compatibility path; both methods become a single
+// confidential body-secret request to Sync. Public clients are not supported.
+export const CLIENT_AUTH_METHODS = ['client_secret_post', 'client_secret_basic'];
+export const BASIC_CHALLENGE = 'Basic realm="oauth"';
+export class ClientAuthenticationError extends InvalidClientError {
+    status;
+    constructor(status) {
+        super('Invalid client authentication');
+        this.status = status;
+    }
+}
+export function extractBasicClientCredentials(authorization) {
+    if (authorization === undefined)
+        return undefined;
+    const match = /^Basic +([A-Za-z0-9+/]+={0,2})$/i.exec(authorization);
+    if (!match?.[1])
+        throw new ClientAuthenticationError(401);
+    try {
+        const bytes = Buffer.from(match[1], 'base64');
+        // Buffer's decoder otherwise ignores malformed input. Anchored parsing allows
+        // at most two padding characters; index/slice comparisons are linear.
+        const canonical = bytes.toString('base64');
+        const padding = canonical.indexOf('=');
+        const unpadded = padding < 0 ? canonical : canonical.slice(0, padding);
+        if (match[1] !== canonical && match[1] !== unpadded)
+            throw new Error('Basic credentials are not canonical base64');
+        const decoded = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        const colon = decoded.indexOf(':');
+        if (colon < 0)
+            throw new Error('Basic credentials are missing the client ID separator');
+        const decode = (value) => decodeURIComponent(value.replace(/\+/g, ' '));
+        const clientId = decode(decoded.slice(0, colon));
+        const clientSecret = decode(decoded.slice(colon + 1));
+        if (!clientId || !clientSecret)
+            throw new Error('Basic credentials need a client ID and secret');
+        return { clientId, clientSecret };
+    }
+    catch {
+        throw new ClientAuthenticationError(401);
+    }
+}
+export function mergeBasicClientCredentials(body, authorization) {
+    // RFC 6749 2.3: one authentication method per request, even if values match.
+    if (authorization !== undefined &&
+        (Object.hasOwn(body, 'client_id') || Object.hasOwn(body, 'client_secret'))) {
+        throw new InvalidRequestError('Multiple client authentication methods are not allowed');
+    }
+    if (Object.hasOwn(body, 'client_assertion') || Object.hasOwn(body, 'client_assertion_type')) {
+        throw new InvalidRequestError('Unsupported client authentication method');
+    }
+    for (const key of ['client_id', 'client_secret']) {
+        if (Object.hasOwn(body, key) && typeof body[key] !== 'string') {
+            throw new InvalidRequestError('Client credentials must be single strings');
+        }
+    }
+    const basic = extractBasicClientCredentials(authorization);
+    if (basic)
+        return { ...body, client_id: basic.clientId, client_secret: basic.clientSecret };
+    if (typeof body.client_id !== 'string' ||
+        !body.client_id ||
+        typeof body.client_secret !== 'string' ||
+        !body.client_secret) {
+        throw new ClientAuthenticationError(400);
+    }
+    return { ...body };
+}

package/dist/auth/device-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAgBF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,eAAe,CAAC,CA8B1B"}
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAgBF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,eAAe,CAAC,CA8B1B"}

package/dist/auth/device-auth.js

@@ -1,10 +1,11 @@
+import { PACKAGE_VERSION } from '../version.js';
 import { saveToken } from './token-store.js';
 const POLL_INTERVAL_MS = 5000;
 const CLIENT_ID = 'sync-mcp-server';
 export async function performDeviceAuth(baseUrl, log) {
     const startResponse = await fetch(`${baseUrl}/v2/device-auth/start`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', 'x-sync-mcp-version': PACKAGE_VERSION },
         body: JSON.stringify({ clientId: CLIENT_ID }),
     });
     if (!startResponse.ok) {
@@ -26,7 +27,7 @@ export async function performDeviceAuth(baseUrl, log) {
 async function pollForToken(baseUrl, deviceCode) {
     while (true) {
         await sleep(POLL_INTERVAL_MS);
-        const pollResponse = await fetch(`${baseUrl}/v2/device-auth/poll?deviceCode=${encodeURIComponent(deviceCode)}`);
+        const pollResponse = await fetch(`${baseUrl}/v2/device-auth/poll?deviceCode=${encodeURIComponent(deviceCode)}`, { headers: { 'x-sync-mcp-version': PACKAGE_VERSION } });
         if (!pollResponse.ok) {
             if (pollResponse.status === 404) {
                 throw new Error('Device auth code expired. Please try again.');

package/dist/auth/fixture-cleanup.d.ts

@@ -0,0 +1,4 @@
+import type { Server } from 'node:http';
+/** Test fixture disposal also works after partial startup or repeated cleanup. */
+export declare function closeFixtureServers(...servers: Array<Server | undefined>): Promise<void>;
+//# sourceMappingURL=fixture-cleanup.d.ts.map

package/dist/auth/fixture-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture-cleanup.d.ts","sourceRoot":"","sources":["../../src/auth/fixture-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,kFAAkF;AAClF,wBAAsB,mBAAmB,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9F"}

package/dist/auth/fixture-cleanup.js

@@ -0,0 +1,9 @@
+/** Test fixture disposal also works after partial startup or repeated cleanup. */
+export async function closeFixtureServers(...servers) {
+    await Promise.all(servers.map(async (server) => {
+        if (!server)
+            return;
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(() => resolve()));
+    }));
+}

package/dist/auth/index.d.ts

@@ -1,6 +1,8 @@
 export type { ApiKeyAuth } from './api-key.js';
 export { createApiKeyAuth } from './api-key.js';
+export { getAuthToken, runWithAuth } from './async-context.js';
 export type { DeviceAuthToken } from './device-auth.js';
 export { performDeviceAuth } from './device-auth.js';
+export { createOAuthProvider } from './oauth-provider.js';
 export { clearToken, loadToken, saveToken } from './token-store.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/index.js

@@ -1,3 +1,5 @@
 export { createApiKeyAuth } from './api-key.js';
+export { getAuthToken, runWithAuth } from './async-context.js';
 export { performDeviceAuth } from './device-auth.js';
+export { createOAuthProvider } from './oauth-provider.js';
 export { clearToken, loadToken, saveToken } from './token-store.js';

package/dist/auth/oauth-diagnostics.d.ts

@@ -0,0 +1,11 @@
+export declare function oauthFailureDiagnostics(response: unknown): {
+    oauthError: string;
+    reason: string;
+};
+export declare function oauthGrantType(value: unknown): string;
+export declare function oauthRequestDiagnostics(body: Record<string, unknown>, authorization: string | undefined): {
+    bodyClientId: string;
+    bodyClientSecret: string;
+    authorizationScheme: string;
+};
+//# sourceMappingURL=oauth-diagnostics.d.ts.map

package/dist/auth/oauth-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-diagnostics.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-diagnostics.ts"],"names":[],"mappings":"AAoCA,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAmBA;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGrD;AAGD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,aAAa,EAAE,MAAM,GAAG,SAAS;;;;EAiBlC"}

package/dist/auth/oauth-diagnostics.js

@@ -0,0 +1,78 @@
+// Diagnostics must never copy upstream text: OAuth errors can echo credentials.
+// Only exact, known values are converted to fixed labels.
+const OAUTH_ERRORS = new Set([
+    'invalid_request',
+    'invalid_client',
+    'invalid_grant',
+    'unauthorized_client',
+    'unsupported_grant_type',
+    'invalid_scope',
+    'access_denied',
+    'server_error',
+    'temporarily_unavailable',
+]);
+const KNOWN_REASONS = new Map([
+    ['Invalid, revoked, or expired refresh token', 'refresh_token_invalid_revoked_or_expired'],
+    ['Refresh token not found', 'refresh_token_not_found'],
+    ['Account no longer has access to this organization', 'organization_access_revoked'],
+    ['refresh_token and client_id are required', 'missing_refresh_parameters'],
+    ['Unknown client_id', 'unknown_client'],
+    ['Invalid client_secret', 'invalid_client_secret'],
+    ['client_secret is required', 'missing_client_secret'],
+    ['Invalid or expired authorization code', 'authorization_code_invalid_or_expired'],
+    ['code, client_id, and redirect_uri are required', 'missing_code_parameters'],
+    ['client_id mismatch', 'client_id_mismatch'],
+    ['redirect_uri mismatch', 'redirect_uri_mismatch'],
+    ['code_verifier required for PKCE challenge', 'missing_pkce_verifier'],
+    ['PKCE code_verifier mismatch', 'pkce_verifier_mismatch'],
+    ['Multiple Authorization headers are not allowed', 'duplicate_authorization_headers'],
+    ['OAuth parameters must be single strings', 'non_scalar_oauth_parameters'],
+    ['Multiple client authentication methods are not allowed', 'mixed_client_authentication'],
+    ['Unsupported client authentication method', 'unsupported_client_authentication'],
+    ['Client credentials must be single strings', 'non_scalar_client_credentials'],
+    ['Invalid client authentication', 'invalid_client_authentication'],
+]);
+export function oauthFailureDiagnostics(response) {
+    let value = response;
+    if (typeof value === 'string') {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return { oauthError: 'unknown', reason: 'unrecognized_response' };
+        }
+    }
+    const body = value && typeof value === 'object' ? value : {};
+    const reason = [body.message, body.error_description]
+        .filter((message) => typeof message === 'string')
+        .map((message) => KNOWN_REASONS.get(message))
+        .find((known) => known !== undefined);
+    return {
+        oauthError: typeof body.error === 'string' && OAUTH_ERRORS.has(body.error) ? body.error : 'unknown',
+        reason: reason ?? 'unrecognized_response',
+    };
+}
+export function oauthGrantType(value) {
+    if (value === 'authorization_code' || value === 'refresh_token')
+        return value;
+    return value === undefined ? 'missing' : 'other';
+}
+// Describe only presence and the scheme. Never decode or retain credential values.
+export function oauthRequestDiagnostics(body, authorization) {
+    const presence = (value) => {
+        if (value === undefined)
+            return 'missing';
+        if (typeof value !== 'string')
+            return 'non_string';
+        return value.length === 0 ? 'empty' : 'present';
+    };
+    return {
+        bodyClientId: presence(body.client_id),
+        bodyClientSecret: presence(body.client_secret),
+        authorizationScheme: authorization === undefined
+            ? 'none'
+            : /^Basic(?:\s|$)/i.test(authorization)
+                ? 'basic'
+                : 'other',
+    };
+}

package/dist/auth/oauth-provider.d.ts

@@ -0,0 +1,16 @@
+import type { AuthInfo } from '@modelcontextprotocol/server';
+import { ProxyOAuthServerProvider } from '@modelcontextprotocol/server-legacy/auth';
+/**
+ * Creates an OAuth provider that proxies to the Sync API's OAuth endpoints.
+ *
+ * Registered clients are cached in memory so the SDK's authorize handler can
+ * look them up (it calls getClient before proxying the authorize request). The
+ * cache doesn't survive a restart, so on a miss we read the client back from
+ * the API (RFC 7592) — otherwise every redeploy would invalidate every
+ * already-connected client with `invalid_client`.
+ */
+export declare function createOAuthProvider(apiBaseUrl: string, authorizationUrl?: string): ProxyOAuthServerProvider & {
+    verifyAccessToken(token: string, signal?: AbortSignal): Promise<AuthInfo>;
+    clearVerificationCache(): void;
+};
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/auth/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA8B,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAwBpF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAAqC,GACpD,wBAAwB,GAAG;IAC5B,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1E,sBAAsB,IAAI,IAAI,CAAC;CAChC,CAgGA"}

package/dist/auth/oauth-provider.js

@@ -0,0 +1,107 @@
+import { ProxyOAuthServerProvider } from '@modelcontextprotocol/server-legacy/auth';
+import { createTokenVerifier } from './verification-cache.js';
+const CONFIDENTIAL_CLIENT_AUTH_METHOD = 'client_secret_post';
+const NON_EXPIRING_CLIENT_SECRET = 0;
+function normalizeClientInfo(client) {
+    return {
+        ...client,
+        response_types: client.response_types ?? ['code'],
+        token_endpoint_auth_method: CONFIDENTIAL_CLIENT_AUTH_METHOD,
+        ...(client.client_secret && client.client_secret_expires_at == null
+            ? { client_secret_expires_at: NON_EXPIRING_CLIENT_SECRET }
+            : {}),
+    };
+}
+function asConfidentialClient(client) {
+    return {
+        ...client,
+        token_endpoint_auth_method: CONFIDENTIAL_CLIENT_AUTH_METHOD,
+    };
+}
+/**
+ * Creates an OAuth provider that proxies to the Sync API's OAuth endpoints.
+ *
+ * Registered clients are cached in memory so the SDK's authorize handler can
+ * look them up (it calls getClient before proxying the authorize request). The
+ * cache doesn't survive a restart, so on a miss we read the client back from
+ * the API (RFC 7592) — otherwise every redeploy would invalidate every
+ * already-connected client with `invalid_client`.
+ */
+export function createOAuthProvider(apiBaseUrl, authorizationUrl = `${apiBaseUrl}/v2/oauth/authorize`) {
+    const verifier = createTokenVerifier(apiBaseUrl);
+    const clientCache = new Map();
+    const registrationSecret = process.env.OAUTH_REGISTRATION_SECRET;
+    const registrationUrl = `${apiBaseUrl}/v2/oauth/register`;
+    // Cache-first client lookup with an API fallback. The API persists clients;
+    // the in-memory cache is only a fast path that's empty after a restart.
+    async function resolveClient(clientId) {
+        const cached = clientCache.get(clientId);
+        if (cached)
+            return cached;
+        try {
+            const res = await fetch(`${registrationUrl}/${encodeURIComponent(clientId)}`, {
+                headers: registrationSecret ? { Authorization: `Bearer ${registrationSecret}` } : {},
+            });
+            if (!res.ok)
+                return undefined;
+            const info = (await res.json());
+            const client = normalizeClientInfo({
+                client_id: info.client_id,
+                client_secret: info.client_secret,
+                client_secret_expires_at: info.client_secret_expires_at,
+                redirect_uris: info.redirect_uris,
+                client_name: info.client_name,
+                grant_types: info.grant_types,
+                response_types: info.response_types,
+                scope: info.scope,
+                token_endpoint_auth_method: info.token_endpoint_auth_method,
+            });
+            clientCache.set(client.client_id, client);
+            return client;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const provider = new ProxyOAuthServerProvider({
+        endpoints: {
+            authorizationUrl,
+            tokenUrl: `${apiBaseUrl}/v2/oauth/token`,
+            revocationUrl: `${apiBaseUrl}/v2/oauth/revoke`,
+            registrationUrl,
+        },
+        verifyAccessToken: verifier.verify,
+        getClient: resolveClient,
+        // Custom fetch that adds the registration secret header
+        fetch: async (url, init) => {
+            const headers = new Headers(init?.headers);
+            if (typeof url === 'string' && url === registrationUrl && registrationSecret) {
+                headers.set('Authorization', `Bearer ${registrationSecret}`);
+            }
+            return fetch(url, { ...init, headers });
+        },
+    });
+    // Wrap the clientsStore so a freshly registered client is cached (fast path)
+    // and lookups go through the cache-then-API resolver.
+    const originalStore = provider.clientsStore;
+    const originalRegister = originalStore.registerClient?.bind(originalStore);
+    Object.defineProperty(provider, 'clientsStore', {
+        get() {
+            return {
+                ...originalStore,
+                getClient: resolveClient,
+                ...(originalRegister && {
+                    registerClient: async (client) => {
+                        const registered = normalizeClientInfo(await originalRegister(asConfidentialClient(client)));
+                        clientCache.set(registered.client_id, registered);
+                        return registered;
+                    },
+                }),
+            };
+        },
+    });
+    return Object.assign(provider, {
+        verifyAccessToken: verifier.verify,
+        clearVerificationCache: verifier.clear,
+    });
+}

package/dist/auth/resource-metadata.d.ts

@@ -0,0 +1,2 @@
+export declare function resourceMetadataUrl(port: number): string;
+//# sourceMappingURL=resource-metadata.d.ts.map