@upload-post/mcp 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Upload-Post
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,225 @@
+# @upload-post/mcp
+
+Official **Model Context Protocol (MCP)** server for [Upload-Post](https://www.upload-post.com).
+
+Lets any MCP-compatible AI agent (Claude Desktop, Claude Code, Cursor, …) publish, schedule, analyze and manage social media across **TikTok, Instagram, YouTube, LinkedIn, Facebook, Pinterest, Threads, Reddit, Bluesky, X, Google Business, Discord, Telegram and more** with a single API key.
+
+> Built on top of the official [`upload-post`](https://www.npmjs.com/package/upload-post) SDK and the public Upload-Post REST API.
+
+---
+
+## Two ways to use it
+
+### A) Local stdio (single-user) — simplest
+
+The server runs on your machine, spawned by the MCP client. Add to `~/.claude/mcp.json` (or Cursor settings, etc.):
+
+```jsonc
+{
+  "mcpServers": {
+    "upload-post": {
+      "command": "npx",
+      "args": ["-y", "@upload-post/mcp"],
+      "env": { "UPLOAD_POST_API_KEY": "YOUR_API_KEY" }
+    }
+  }
+}
+```
+
+Get your API key at <https://app.upload-post.com> → *API Keys*. Restart the client — you should see 45 `upload-post` tools.
+
+### B) Hosted HTTP (multi-tenant) — share one server with many users
+
+Run the server on any Docker-capable host (Fly, Railway, Cloud Run, your own box…) and let each user connect with **their own** Upload-Post API key. The server stores nothing per user.
+
+```jsonc
+{
+  "mcpServers": {
+    "upload-post": {
+      "url": "https://mcp.your-domain.com/mcp",
+      "headers": {
+        "Authorization": "ApiKey YOUR_OWN_UPLOAD_POST_API_KEY"
+      }
+    }
+  }
+}
+```
+
+`Authorization: Bearer <key>` is also accepted, for clients that only allow Bearer.
+
+---
+
+## What can the agent do?
+
+The server exposes Upload-Post API tools plus one ChatGPT App UI launcher.
+
+| Group         | Tools |
+|---------------|-------|
+| Upload        | `upload_video`, `upload_photos`, `upload_text`, `upload_document`, `open_upload_studio` |
+| Media staging | `create_media_upload`, `complete_media_upload`, `get_media_upload`, `delete_media_upload` |
+| Status        | `get_status`, `get_job_status`, `get_history`, `get_media` |
+| Schedule      | `list_scheduled`, `cancel_scheduled`, `edit_scheduled` |
+| Analytics     | `get_analytics`, `get_total_impressions`, `get_post_analytics`, `get_platform_metrics` |
+| Users         | `get_account_info`, `list_users`, `create_user`, `delete_user`, `generate_jwt`, `validate_jwt` |
+| Pages/boards  | `get_facebook_pages`, `get_linkedin_pages`, `get_pinterest_boards`, `get_google_business_locations`, `select_google_business_location`, `get_reddit_detailed_posts` |
+| Comments      | `get_post_comments`, `reply_to_comment`, `public_reply_to_comment` |
+| DMs           | `send_dm`, `list_dm_conversations`, `manage_autodms` |
+| FFmpeg        | `submit_ffmpeg_job`, `get_ffmpeg_job`, `download_ffmpeg_result`, `get_ffmpeg_consumption` |
+| Queue         | `get_queue_settings`, `update_queue_settings`, `preview_queue` |
+
+Async uploads return a `request_id`. The agent should poll `get_status` until `success: true`.
+
+FFmpeg jobs accept one public URL through `input_url` or multiple URLs through `files`. Poll `get_ffmpeg_job` until completion, then call `download_ffmpeg_result`; it returns the result URL without streaming the processed binary through MCP.
+
+### ChatGPT video upload UI
+
+`open_upload_studio` renders a ChatGPT Apps component for file-based video publishing. The widget creates a short-lived Upload-Post/R2 staging upload, PUTs the local video directly to R2, completes the upload, then calls `upload_video` with the returned temporary media URL.
+
+The staging object is deleted after 24 hours whether it is used or not. Scheduled/queued posts remain safe because `upload_video` copies the temporary URL into the existing durable scheduler storage before execution.
+
+Claude and other MCP clients can use the same flow without the ChatGPT UI: call `create_media_upload`, PUT the file to `upload_url`, call `complete_media_upload`, then pass `media_url` to `upload_video`.
+
+Set `UPLOAD_POST_R2_CONNECT_DOMAINS` on the MCP host to the comma-separated origins used by the backend's R2 signed URLs when they differ from the defaults (for example `https://<account>.r2.cloudflarestorage.com,https://<bucket>.<account>.r2.cloudflarestorage.com`) so the ChatGPT component CSP allows the browser PUT.
+
+The R2 bucket CORS policy must allow browser uploads. A restrictive policy can include your actual widget origin; for fastest validation, use:
+
+```json
+[
+  {
+    "AllowedOrigins": ["*"],
+    "AllowedMethods": ["PUT", "GET", "HEAD"],
+    "AllowedHeaders": ["*"],
+    "ExposeHeaders": ["ETag"],
+    "MaxAgeSeconds": 3600
+  }
+]
+```
+
+---
+
+## Local / development
+
+```bash
+git clone https://github.com/Upload-Post/upload-post-mcp.git
+cd upload-post-mcp
+npm install
+npm run build
+
+# stdio (default — used by Claude Desktop, Cursor)
+UPLOAD_POST_API_KEY=... node dist/index.js
+
+# HTTP streamable (for hosted deployments)
+UPLOAD_POST_API_KEY=... node dist/index.js --http --port 8080
+```
+
+Inspect the live tool surface with the official inspector:
+
+```bash
+npx @modelcontextprotocol/inspector node dist/index.js
+```
+
+---
+
+## Configuration
+
+| Env var                   | Mode    | Default                            | Description                              |
+|---------------------------|---------|------------------------------------|------------------------------------------|
+| `UPLOAD_POST_API_KEY`     | stdio   | — (required)                       | Single user's Upload-Post API key. **Ignored in `--http` mode** — keys come per request. |
+| `UPLOAD_POST_BASE_URL`    | both    | `https://api.upload-post.com/api`  | Override for self-hosted / staging.      |
+| `UPLOAD_POST_MCP_PORT`    | http    | `8080`                             | Port for `--http` mode.                  |
+| `OPENAI_APPS_CHALLENGE_TOKEN` | http | Current Upload-Post challenge token | Optional override for ChatGPT Apps domain verification at `/.well-known/openai-apps-challenge`. |
+
+CLI flags:
+
+- `--http` — start the streamable HTTP transport instead of stdio
+- `--port <n>` — port for HTTP mode
+
+HTTP endpoints:
+
+- `POST /mcp` — JSON-RPC over MCP streamable HTTP. **Requires `Authorization: ApiKey <key>` (or `Bearer <key>`)** on every request. The key is the user's own Upload-Post API key; the server uses it only for that session and stores nothing.
+- `GET /healthz` — liveness probe, always open. Returns `{"ok":true}`.
+
+Auth model in `--http` mode is the same pattern Resend, Tavily, Brave Search and other API-key-native services use for their hosted MCPs: the upstream key *is* the auth.
+
+---
+
+## Deploy with Docker
+
+The repo ships with a multi-stage `Dockerfile` and a `.dockerignore`. On any Docker-capable PaaS (Fly.io, Railway, Render, Cloud Run, fly machines, your own box…):
+
+1. Point the PaaS at this repo and select **Dockerfile** as the build pack.
+2. **Port: 8080** (matches `EXPOSE 8080`).
+3. **Environment variables**: none are required. Optionally set `UPLOAD_POST_BASE_URL` if you point at staging.
+4. **Health check path**: `/healthz` (HTTP, port 8080).
+5. **Domain**: attach a domain, e.g. `mcp.your-domain.com`, and provision TLS (most PaaS do this automatically via Let's Encrypt).
+
+Deploy. The server is now ready for any number of users. Each user adds the endpoint to their MCP client config with **their own** Upload-Post API key:
+
+```jsonc
+{
+  "mcpServers": {
+    "upload-post": {
+      "url": "https://mcp.your-domain.com/mcp",
+      "headers": {
+        "Authorization": "ApiKey USER_OWN_UPLOAD_POST_API_KEY"
+      }
+    }
+  }
+}
+```
+
+> Without an `Authorization` header the server returns `401`. The header is the only credential — invalid Upload-Post keys will surface as upstream errors on the first tool call.
+
+Local test of the production image:
+
+```bash
+docker build -t upload-post-mcp .
+docker run --rm -p 8080:8080 upload-post-mcp
+curl http://localhost:8080/healthz   # → {"ok":true}
+curl -i -X POST http://localhost:8080/mcp \
+  -H "content-type: application/json" \
+  -d '{}'                               # → 401 (no Authorization)
+```
+
+---
+
+## Tips for prompting the agent
+
+- Prefer **public URLs** over local paths when uploading — local paths only work if the MCP server runs on the user's machine.
+- In ChatGPT Apps, prefer `open_upload_studio` for user-selected video files. It avoids local-path handoff issues by uploading to short-lived Upload-Post/R2 staging, then passing a temporary media URL to `upload_video`.
+- To send video **bytes directly** (a client that holds the file rather than a URL), pass `videoBase64` to `upload_video` instead of `videoPathOrUrl`. The server writes it to a temp file, uploads, then deletes it. Inline bytes are capped at `UPLOAD_POST_MAX_INLINE_MB` (default 100 MB) — for larger videos use a public URL.
+- Always create the profile first (`create_user`) and connect socials in the Upload-Post dashboard before publishing.
+- For scheduled posts, pass ISO 8601 dates with timezone, e.g. `"2026-12-25T10:00:00Z"` + `"timezone": "Europe/Madrid"`.
+
+---
+
+## Privacy & data handling
+
+This server is a **stateless proxy** to the Upload-Post API. Per request, the only data it processes is the user's API key (or OAuth access token resolved to one) and the arguments of the tool call being executed. No user data is persisted by the MCP container itself.
+
+- **What we receive per request**: the `Authorization` header, the MCP tool name + arguments, and any media URLs/paths the agent passes.
+- **What we forward**: the tool arguments to the Upload-Post API on behalf of the authenticated user.
+- **What we store**: nothing per-user. OAuth tokens are stored upstream in the Upload-Post backend, hashed (SHA-256), so a breach of token storage cannot impersonate users.
+- **What we log**: HTTP method, path, status code, and an opaque request ID. No tool arguments, no API keys, no tokens.
+
+Full Upload-Post privacy policy (data collection, retention, third-party sharing, contact, GDPR/CCPA): **https://upload-post.com/privacy**
+
+To revoke a connector's access at any time, open **Connected Apps** in [app.upload-post.com](https://app.upload-post.com).
+
+---
+
+## Security
+
+- All traffic is TLS-terminated at the edge (HTTPS only).
+- `/mcp` requires a valid `Authorization` header on every request; OAuth access tokens are short-lived (1 h access + 90 d refresh with rotation per RFC 6749 §10.4).
+- The server validates the `Origin` header against an allow-list (`claude.ai`, `claude.com`, `chatgpt.com`, `chat.openai.com`, `app.upload-post.com`, `localhost`) to mitigate DNS-rebinding attacks from browser-based clients. Extend with `OAUTH_EXTRA_ALLOWED_ORIGINS` (comma-separated) when self-hosting behind a custom dashboard.
+- If ChatGPT shows `redirect_uri not on allow-list` during OAuth, add the exact `redirect_uri` from the failing authorize request to the Upload-Post backend OAuth redirect allow-list. For ChatGPT clients this is typically on `https://chatgpt.com/.../oauth/callback` or `https://chat.openai.com/.../oauth/callback`.
+- All tools declare MCP `readOnlyHint`/`destructiveHint` annotations so clients can surface confirmation prompts for destructive operations.
+
+Report a security issue: **info@upload-post.com** (encrypted PGP available on request).
+
+---
+
+## License
+
+MIT © Upload-Post

package/dist/client.d.ts

@@ -0,0 +1,32 @@
+import { AxiosInstance } from "axios";
+import UploadPost from "upload-post";
+export declare const PACKAGE_VERSION = "0.1.1";
+export declare const DEFAULT_BASE_URL = "https://api.upload-post.com/api";
+export interface UploadPostMcpClientOptions {
+    apiKey: string;
+    baseUrl?: string;
+}
+/**
+ * Single facade used by every MCP tool.
+ *
+ * - `sdk` — the official `upload-post` npm SDK (typed methods for ~28 endpoints).
+ * - `http` — pre-configured axios instance for the ~20 endpoints not yet exposed
+ *   by the SDK (DMs, autodms, teams, queue, retry, FFmpeg jobs, status page,
+ *   AI rewrite, Reddit metadata, growth snapshots, …).
+ *
+ * The MCP layer never reaches Upload-Post by any other route.
+ */
+export declare class UploadPostMcpClient {
+    readonly sdk: UploadPost;
+    readonly http: AxiosInstance;
+    readonly baseUrl: string;
+    constructor(opts: UploadPostMcpClientOptions);
+    /** Thin wrapper that surfaces non-2xx as Errors carrying the API payload. */
+    request<T = unknown>(method: "GET" | "POST" | "DELETE" | "PATCH" | "PUT", path: string, options?: {
+        body?: unknown;
+        query?: Record<string, unknown>;
+    }): Promise<T>;
+}
+/** Strip undefined keys so we don't send `?foo=undefined` upstream. */
+export declare function compact<T extends Record<string, unknown>>(obj: T): Partial<T>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAc,EAAE,aAAa,EAAsB,MAAM,OAAO,CAAC;AACjE,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,eAAO,MAAM,eAAe,UAAU,CAAC;AACvC,eAAO,MAAM,gBAAgB,oCAAoC,CAAC;AAElE,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,0BAA0B;IAmB5C,6EAA6E;IACvE,OAAO,CAAC,CAAC,GAAG,OAAO,EACvB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,EACnD,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAO,GAChE,OAAO,CAAC,CAAC,CAAC;CAiBd;AAED,uEAAuE;AACvE,wBAAgB,OAAO,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAQ7E"}

package/dist/client.js

@@ -0,0 +1,61 @@
+import axios from "axios";
+import UploadPost from "upload-post";
+export const PACKAGE_VERSION = "0.1.1";
+export const DEFAULT_BASE_URL = "https://api.upload-post.com/api";
+/**
+ * Single facade used by every MCP tool.
+ *
+ * - `sdk` — the official `upload-post` npm SDK (typed methods for ~28 endpoints).
+ * - `http` — pre-configured axios instance for the ~20 endpoints not yet exposed
+ *   by the SDK (DMs, autodms, teams, queue, retry, FFmpeg jobs, status page,
+ *   AI rewrite, Reddit metadata, growth snapshots, …).
+ *
+ * The MCP layer never reaches Upload-Post by any other route.
+ */
+export class UploadPostMcpClient {
+    sdk;
+    http;
+    baseUrl;
+    constructor(opts) {
+        if (!opts.apiKey) {
+            throw new Error("UPLOAD_POST_API_KEY is required. Get one at https://app.upload-post.com");
+        }
+        this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+        this.sdk = new UploadPost(opts.apiKey);
+        this.http = axios.create({
+            baseURL: this.baseUrl,
+            headers: {
+                Authorization: `Apikey ${opts.apiKey}`,
+                "X-Upload-Post-Source": `mcp/${PACKAGE_VERSION}`,
+            },
+            timeout: 120_000,
+            validateStatus: () => true,
+        });
+    }
+    /** Thin wrapper that surfaces non-2xx as Errors carrying the API payload. */
+    async request(method, path, options = {}) {
+        const config = {
+            method,
+            url: path,
+            params: options.query,
+            data: options.body,
+        };
+        const res = await this.http.request(config);
+        if (res.status < 200 || res.status >= 300) {
+            const body = typeof res.data === "string" ? res.data : JSON.stringify(res.data);
+            throw new Error(`Upload-Post API ${method} ${path} failed (${res.status}): ${body}`);
+        }
+        return res.data;
+    }
+}
+/** Strip undefined keys so we don't send `?foo=undefined` upstream. */
+export function compact(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined && v !== null && v !== "") {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAA4C,MAAM,OAAO,CAAC;AACjE,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAOlE;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAmB;IACrB,GAAG,CAAa;IAChB,IAAI,CAAgB;IACpB,OAAO,CAAS;IAEzB,YAAY,IAAgC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;gBACtC,sBAAsB,EAAE,OAAO,eAAe,EAAE;aACjD;YACD,OAAO,EAAE,OAAO;YAChB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,OAAO,CACX,MAAmD,EACnD,IAAY,EACZ,UAA+D,EAAE;QAEjE,MAAM,MAAM,GAAuB;YACjC,MAAM;YACN,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAI,MAAM,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,UAAU,OAAO,CAAoC,GAAM;IAC/D,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7C,GAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { UploadPostMcpClient } from "./client.js";
+import { buildServer } from "./server.js";
+import { runStdio } from "./transport/stdio.js";
+import { runHttp } from "./transport/http.js";
+function parseArgs(argv) {
+    const out = {
+        http: false,
+        port: Number(process.env.UPLOAD_POST_MCP_PORT ?? 8080),
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--http")
+            out.http = true;
+        else if (arg === "--port")
+            out.port = Number(argv[++i]);
+        else if (arg === "--help" || arg === "-h") {
+            process.stdout.write([
+                "upload-post-mcp — Model Context Protocol server for Upload-Post",
+                "",
+                "Usage: upload-post-mcp [--http] [--port <n>]",
+                "",
+                "Modes:",
+                "  stdio (default)   single-user, API key from UPLOAD_POST_API_KEY env var",
+                "  --http            multi-tenant, API key per request via Authorization header",
+                "",
+                "Env:",
+                "  UPLOAD_POST_API_KEY    Required in stdio mode. Ignored in --http mode.",
+                "  UPLOAD_POST_BASE_URL   (optional) Override API base URL",
+                "  UPLOAD_POST_MCP_PORT   (optional) HTTP port (default 8080)",
+                "",
+            ].join("\n"));
+            process.exit(0);
+        }
+    }
+    return out;
+}
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    const baseUrl = process.env.UPLOAD_POST_BASE_URL;
+    if (args.http) {
+        // Multi-tenant: each request brings its own Upload-Post API key in the
+        // Authorization header. No shared key on the server.
+        await runHttp({
+            port: args.port,
+            baseUrl,
+            buildServer,
+        });
+        return;
+    }
+    // Single-user stdio: key comes from env, baked into one shared client.
+    const apiKey = process.env.UPLOAD_POST_API_KEY;
+    if (!apiKey) {
+        process.stderr.write("[upload-post-mcp] UPLOAD_POST_API_KEY env var is required in stdio mode.\n" +
+            "Set it in your MCP client config. Get one at https://app.upload-post.com\n");
+        process.exit(1);
+    }
+    const client = new UploadPostMcpClient({ apiKey, baseUrl });
+    const server = buildServer(client);
+    await runStdio(server);
+}
+main().catch((err) => {
+    process.stderr.write(`[upload-post-mcp] fatal: ${err?.stack ?? err}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAO9C,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAe;QACtB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC;KACvD,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACjC,IAAI,GAAG,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aACnD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;gBACE,iEAAiE;gBACjE,EAAE;gBACF,8CAA8C;gBAC9C,EAAE;gBACF,QAAQ;gBACR,2EAA2E;gBAC3E,gFAAgF;gBAChF,EAAE;gBACF,MAAM;gBACN,0EAA0E;gBAC1E,2DAA2D;gBAC3D,8DAA8D;gBAC9D,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAEjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,OAAO,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO;YACP,WAAW;SACZ,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E;YAC1E,4EAA4E,CAC/E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/oauth/auth_resolver.d.ts

@@ -0,0 +1,33 @@
+import type { OAuthConfig } from "./config.js";
+import type { UpstreamOAuthClient } from "./upstream_client.js";
+import type { IntrospectCache } from "./introspect_cache.js";
+/**
+ * The /mcp endpoint accepts THREE Authorization header shapes:
+ *
+ *   1. `Authorization: ApiKey <raw_upload_post_api_key>` — historical, used by
+ *      Claude Desktop / Code / Cursor with mcp.json. Returns the key verbatim.
+ *
+ *   2. `Authorization: Bearer up_oauth_<...>` — OAuth access token issued via
+ *      DCR + authorization-code+PKCE. Introspected against the Upload-Post
+ *      backend (cached ~60s) to recover the underlying API key.
+ *
+ *   3. `Authorization: Bearer <raw_upload_post_api_key>` — historical fallback
+ *      for clients that only allow Bearer. Returns the key verbatim.
+ *
+ * Any of these end with the same shape: `{ apiKey, source }`. The session-
+ * scoped UploadPostMcpClient is then built with that key. Existing clients
+ * see zero behavior change.
+ */
+export type AuthResolution = {
+    apiKey: string;
+    source: "apikey" | "bearer_raw" | "oauth";
+    email?: string;
+    clientId?: string;
+} | null;
+export interface AuthResolverDeps {
+    cfg: OAuthConfig;
+    upstream: UpstreamOAuthClient;
+    cache: IntrospectCache;
+}
+export declare function resolveAuth(header: string | string[] | undefined, deps: AuthResolverDeps): Promise<AuthResolution>;
+//# sourceMappingURL=auth_resolver.d.ts.map

package/dist/oauth/auth_resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_resolver.d.ts","sourceRoot":"","sources":["../../src/oauth/auth_resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAChG,IAAI,CAAC;AAIT,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,eAAe,CAAC;CACxB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EACrC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,cAAc,CAAC,CA0BzB"}

package/dist/oauth/auth_resolver.js

@@ -0,0 +1,30 @@
+const OAUTH_ACCESS_PREFIX = "up_oauth_";
+export async function resolveAuth(header, deps) {
+    if (!header || Array.isArray(header))
+        return null;
+    const match = header.match(/^(ApiKey|Bearer)\s+(.+)$/i);
+    if (!match)
+        return null;
+    const scheme = match[1].toLowerCase();
+    const token = match[2].trim();
+    if (!token)
+        return null;
+    if (scheme === "apikey") {
+        return { apiKey: token, source: "apikey" };
+    }
+    // scheme === "bearer"
+    if (!token.startsWith(OAUTH_ACCESS_PREFIX) || !deps.cfg.enabled) {
+        return { apiKey: token, source: "bearer_raw" };
+    }
+    // OAuth opaque access token — introspect (with cache).
+    const cached = deps.cache.get(token);
+    if (cached) {
+        return { apiKey: cached.api_key, source: "oauth", email: cached.email, clientId: cached.client_id };
+    }
+    const fresh = await deps.upstream.introspect(token);
+    if (!fresh)
+        return null;
+    deps.cache.set(token, fresh);
+    return { apiKey: fresh.api_key, source: "oauth", email: fresh.email, clientId: fresh.client_id };
+}
+//# sourceMappingURL=auth_resolver.js.map

package/dist/oauth/auth_resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_resolver.js","sourceRoot":"","sources":["../../src/oauth/auth_resolver.ts"],"names":[],"mappings":"AA0BA,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAQxC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAqC,EACrC,IAAsB;IAEtB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACnG,CAAC"}

package/dist/oauth/authorize.d.ts

@@ -0,0 +1,18 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { OAuthConfig } from "./config.js";
+/**
+ * GET /authorize
+ *
+ * Pure redirect to the dashboard's consent page (app.upload-post.com/oauth/authorize),
+ * carrying all OAuth params verbatim. The dashboard is where the user actually logs
+ * in (if needed) and approves — it then calls back to the Upload-Post
+ * backend to mint an authorization code, and finally redirects the user
+ * agent to the client-provided `redirect_uri` with the code.
+ *
+ * Doing it as a 302 (instead of rendering the consent screen here) means:
+ *   - the user's existing app.upload-post.com session cookie/JWT is reachable
+ *   - we don't duplicate login UI in this Node server
+ *   - the MCP server stays purely API-shaped
+ */
+export declare function handleAuthorize(req: IncomingMessage, res: ServerResponse, cfg: OAuthConfig): void;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/oauth/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,WAAW,GACf,IAAI,CAQN"}

package/dist/oauth/authorize.js

@@ -0,0 +1,26 @@
+import { sendError, sendRedirect } from "./http_utils.js";
+/**
+ * GET /authorize
+ *
+ * Pure redirect to the dashboard's consent page (app.upload-post.com/oauth/authorize),
+ * carrying all OAuth params verbatim. The dashboard is where the user actually logs
+ * in (if needed) and approves — it then calls back to the Upload-Post
+ * backend to mint an authorization code, and finally redirects the user
+ * agent to the client-provided `redirect_uri` with the code.
+ *
+ * Doing it as a 302 (instead of rendering the consent screen here) means:
+ *   - the user's existing app.upload-post.com session cookie/JWT is reachable
+ *   - we don't duplicate login UI in this Node server
+ *   - the MCP server stays purely API-shaped
+ */
+export function handleAuthorize(req, res, cfg) {
+    if (!req.url)
+        return sendError(res, 400, "invalid_request", "Missing URL");
+    const incoming = new URL(req.url, `http://${req.headers.host ?? "localhost"}`);
+    const target = new URL(cfg.dashboardAuthorizeUrl);
+    // Forward all incoming query params (response_type, client_id, redirect_uri,
+    // state, scope, code_challenge, code_challenge_method, ...).
+    incoming.searchParams.forEach((value, key) => target.searchParams.set(key, value));
+    sendRedirect(res, target.toString());
+}
+//# sourceMappingURL=authorize.js.map

package/dist/oauth/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,GAAmB,EACnB,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,6EAA6E;IAC7E,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/oauth/config.d.ts

@@ -0,0 +1,19 @@
+/**
+ * OAuth configuration. Read once at startup from env vars.
+ *
+ * Required for OAuth to work:
+ *   OAUTH_ISSUER                  = https://mcp.upload-post.com
+ *   OAUTH_DASHBOARD_AUTHORIZE_URL = https://app.upload-post.com/oauth/authorize
+ *   OAUTH_UPSTREAM_BASE_URL       = https://api.upload-post.com (or staging equivalent)
+ *   OAUTH_INTERNAL_SECRET         = shared secret with the Upload-Post backend
+ */
+export interface OAuthConfig {
+    enabled: boolean;
+    issuer: string;
+    dashboardAuthorizeUrl: string;
+    upstreamBaseUrl: string;
+    internalSecret: string;
+    introspectCacheTtlMs: number;
+}
+export declare function loadOAuthConfig(): OAuthConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/oauth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,eAAe,IAAI,WAAW,CAkB7C"}

package/dist/oauth/config.js

@@ -0,0 +1,28 @@
+/**
+ * OAuth configuration. Read once at startup from env vars.
+ *
+ * Required for OAuth to work:
+ *   OAUTH_ISSUER                  = https://mcp.upload-post.com
+ *   OAUTH_DASHBOARD_AUTHORIZE_URL = https://app.upload-post.com/oauth/authorize
+ *   OAUTH_UPSTREAM_BASE_URL       = https://api.upload-post.com (or staging equivalent)
+ *   OAUTH_INTERNAL_SECRET         = shared secret with the Upload-Post backend
+ */
+export function loadOAuthConfig() {
+    const issuer = (process.env.OAUTH_ISSUER ?? "").replace(/\/$/, "");
+    const dashboardAuthorizeUrl = process.env.OAUTH_DASHBOARD_AUTHORIZE_URL ?? "";
+    const upstreamBaseUrl = (process.env.OAUTH_UPSTREAM_BASE_URL ?? "").replace(/\/$/, "");
+    const internalSecret = process.env.OAUTH_INTERNAL_SECRET ?? "";
+    const enabled = issuer.length > 0 &&
+        dashboardAuthorizeUrl.length > 0 &&
+        upstreamBaseUrl.length > 0 &&
+        internalSecret.length > 0;
+    return {
+        enabled,
+        issuer,
+        dashboardAuthorizeUrl,
+        upstreamBaseUrl,
+        internalSecret,
+        introspectCacheTtlMs: Number(process.env.OAUTH_INTROSPECT_CACHE_MS ?? 60_000),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/oauth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC;IAC9E,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAC/D,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,qBAAqB,CAAC,MAAM,GAAG,CAAC;QAChC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC1B,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,OAAO;QACL,OAAO;QACP,MAAM;QACN,qBAAqB;QACrB,eAAe;QACf,cAAc;QACd,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,MAAM,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/oauth/http_utils.d.ts

@@ -0,0 +1,8 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+export declare function readBuffer(req: IncomingMessage): Promise<Buffer>;
+export declare function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown> | null>;
+export declare function readFormBody(req: IncomingMessage): Promise<Record<string, string>>;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
+export declare function sendError(res: ServerResponse, status: number, error: string, description?: string): void;
+export declare function sendRedirect(res: ServerResponse, url: string): void;
+//# sourceMappingURL=http_utils.d.ts.map

package/dist/oauth/http_utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http_utils.d.ts","sourceRoot":"","sources":["../../src/oauth/http_utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,wBAAsB,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAUtE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAIhG;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOxF;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAKjF;AAED,wBAAgB,SAAS,CACvB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,IAAI,CAIN;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAKnE"}