arc-1 0.7.2 → 0.8.0

package/dist/server/stateless-client-store.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Stateless OAuth Dynamic Client Registration store.
+ *
+ * MCP clients (Claude Desktop, Cursor, Copilot CLI…) register dynamically
+ * via RFC 7591 and cache the returned `client_id` locally. With an
+ * in-memory or local-disk store, every CF push / restart wipes the
+ * server-side registry — the cached `client_id` then fails with
+ * `invalid_client` and the user has to clear their MCP client's OAuth
+ * cache to recover.
+ *
+ * This store eliminates the storage problem entirely. Each `client_id`
+ * is a self-validating token: it carries the registration payload
+ * (redirect_uris, grant_types, …) plus an HMAC-SHA256 signature derived
+ * from a server-held key. `getClient` re-derives the payload by
+ * verifying the signature; no persistence is needed. Any process with
+ * the same signing key can validate any client_id ever issued.
+ *
+ * Tradeoffs vs the persisted in-memory store:
+ *   + Survives `cf push`, `cf restart`, cell moves, multi-instance scale-out
+ *   + No external dependency, no service binding, no native module
+ *   - Per-client revocation is impossible (only TTL or full key rotation)
+ *   - Rotating the signing key invalidates every outstanding registration
+ *
+ * The signing key is derived (via HKDF-style HMAC) from the XSUAA
+ * `clientsecret`, so it's already as stable as the service binding —
+ * service rebinding rotates both at once, which is the right boundary.
+ */
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+export interface StatelessDcrClientStoreOptions {
+    /**
+     * How long an issued client_id remains valid, in seconds. After this
+     * window `getClient()` returns undefined and clients re-register via
+     * `/register`. Default: 30 days. Lower values bound the blast radius if
+     * the signing key leaks; higher values reduce re-auth churn.
+     */
+    ttlSeconds?: number;
+    /** Clock injection point for tests. Default: `Date.now`. */
+    now?: () => number;
+}
+export declare class StatelessDcrClientStore implements OAuthRegisteredClientsStore {
+    private readonly xsuaaClient;
+    private readonly hmacKey;
+    private readonly ttlSeconds;
+    private readonly now;
+    constructor(xsuaaClientId: string, xsuaaClientSecret: string, signingSecret: string, options?: StatelessDcrClientStoreOptions);
+    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    registerClient(client: Omit<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'>): Promise<OAuthClientInformationFull>;
+    /**
+     * Called by the MCP SDK before redirect_uri validation on `/authorize`.
+     *
+     * For the pre-registered XSUAA client we mutate the in-memory list (XSUAA
+     * itself is the authoritative validator via `xs-security.json` wildcards,
+     * so the SDK's local list is decorative). The mutation is replayed on
+     * every `/authorize`, so it doesn't need to persist.
+     *
+     * For DCR (`arc1-…`) clients we are stateless by design: there's nothing
+     * to mutate. The previous in-memory store implemented a percent-encoding
+     * loose-match (BAS/Theia registers `?x=1` then authorizes with `%3Fx=1`).
+     * Reproducing that statelessly would require either bundling every
+     * encoding variant in the signed payload or keeping a per-process scratch
+     * map, both of which undermine the "no state" goal. We accept the
+     * regression: affected clients re-register on encoding-variant mismatch,
+     * which is exactly what they did under the old store after every restart.
+     */
+    ensureRedirectUri(clientId: string, uri: string): void;
+    private payloadToClientInfo;
+    private encode;
+    /**
+     * Decode and verify a `client_id`. Returns either the parsed payload or a
+     * structured failure reason — the caller emits the failure as an audit
+     * event with the right reason code (so probing attempts are observable).
+     */
+    private decodeAndVerify;
+    private verifySignature;
+    private sign;
+    /**
+     * The client_secret is derived deterministically from the client_id, so
+     * any instance with the same signing key can validate it. This is the
+     * core reason DCR survives container restarts and scales out horizontally
+     * with no shared state.
+     */
+    private deriveSecret;
+    private emitLookupFailed;
+}
+/**
+ * Validate a redirect URI against the allowed scheme/host policy.
+ *
+ * Allowed: `https://*`, `http://` to localhost / 127.0.0.1 / [::1], and known
+ * MCP-client custom schemes (`claude:`, `cursor:`, `vscode:`,
+ * `vscode-insiders:`).
+ *
+ * Rejected: `javascript:`, `data:`, `file:`, `ftp:`, and any `http://` to
+ * non-loopback hosts.
+ */
+export declare function validateRedirectUri(uri: string): void;
+//# sourceMappingURL=stateless-client-store.d.ts.map

package/dist/server/stateless-client-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stateless-client-store.d.ts","sourceRoot":"","sources":["../../src/server/stateless-client-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAyE3F,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAuBD,qBAAa,uBAAwB,YAAW,2BAA2B;IACzE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGjC,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,8BAAmC;IAgBxC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IA0B5E,cAAc,CAClB,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC5E,OAAO,CAAC,0BAA0B,CAAC;IA8CtC;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAiBtD,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,MAAM;IAMd;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAsBvB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,IAAI;IAMZ;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,gBAAgB;CAczB;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA6BrD"}

package/dist/server/stateless-client-store.js

@@ -0,0 +1,334 @@
+/**
+ * Stateless OAuth Dynamic Client Registration store.
+ *
+ * MCP clients (Claude Desktop, Cursor, Copilot CLI…) register dynamically
+ * via RFC 7591 and cache the returned `client_id` locally. With an
+ * in-memory or local-disk store, every CF push / restart wipes the
+ * server-side registry — the cached `client_id` then fails with
+ * `invalid_client` and the user has to clear their MCP client's OAuth
+ * cache to recover.
+ *
+ * This store eliminates the storage problem entirely. Each `client_id`
+ * is a self-validating token: it carries the registration payload
+ * (redirect_uris, grant_types, …) plus an HMAC-SHA256 signature derived
+ * from a server-held key. `getClient` re-derives the payload by
+ * verifying the signature; no persistence is needed. Any process with
+ * the same signing key can validate any client_id ever issued.
+ *
+ * Tradeoffs vs the persisted in-memory store:
+ *   + Survives `cf push`, `cf restart`, cell moves, multi-instance scale-out
+ *   + No external dependency, no service binding, no native module
+ *   - Per-client revocation is impossible (only TTL or full key rotation)
+ *   - Rotating the signing key invalidates every outstanding registration
+ *
+ * The signing key is derived (via HKDF-style HMAC) from the XSUAA
+ * `clientsecret`, so it's already as stable as the service binding —
+ * service rebinding rotates both at once, which is the right boundary.
+ */
+import crypto from 'node:crypto';
+import { logger } from './logger.js';
+// ─── Constants ────────────────────────────────────────────────────────
+/** All DCR-issued client_ids start with this prefix. */
+const ID_PREFIX = 'arc1-';
+/**
+ * Domain-separation label bound into the HMAC key derivation. Bumping the
+ * suffix ("v1" → "v2") invalidates every previously-issued client_id without
+ * requiring a service-binding rotation, which is a useful escape hatch.
+ */
+const KDF_LABEL = 'arc1-dcr/v1';
+/** Schema version of the JSON payload embedded in the signed client_id. */
+const PAYLOAD_VERSION = 1;
+/**
+ * Truncated HMAC-SHA256 length in bytes. 16 bytes = 128 bits, which is well
+ * above the practical forgery threshold for opaque IDs (NIST SP 800-107
+ * acceptable for non-replayable identifiers).
+ */
+const SIG_BYTES = 16;
+/**
+ * Default lifetime of a DCR registration. Tunable via `ttlSeconds` so deployments
+ * with stricter compromise-window requirements can shorten it. 30 days matches
+ * typical OAuth refresh-token lifetimes — long enough that users don't see
+ * spurious "re-authenticate" prompts during normal use.
+ */
+const DEFAULT_TTL_SECONDS = 30 * 24 * 60 * 60;
+// Defaults applied when a registration omits these fields.
+const DEFAULT_GRANT_TYPES = ['authorization_code', 'refresh_token'];
+const DEFAULT_RESPONSE_TYPES = ['code'];
+const DEFAULT_TOKEN_AUTH_METHOD = 'client_secret_post';
+/**
+ * Built-in redirect_uris for the pre-registered XSUAA client. These cover the
+ * common MCP clients out of the box; additional URIs can be added at
+ * `/authorize` time via `ensureRedirectUri()`. The list MUST also be registered
+ * in `xs-security.json` — XSUAA is the authoritative validator for this client.
+ */
+const XSUAA_DEFAULT_REDIRECT_URIS = [
+    'http://localhost:6274/oauth/callback', // MCP Inspector
+    'http://localhost:3000/oauth/callback', // Local dev
+    'https://claude.ai/api/mcp/auth_callback', // Claude Desktop
+    'cursor://anysphere.cursor-retrieval/oauth/callback', // Cursor
+    'vscode://vscode.microsoft-authentication/callback', // VS Code
+];
+// ─── Default XSUAA client ─────────────────────────────────────────────
+/**
+ * Pre-registered XSUAA client config. MCP clients that hit the XSUAA
+ * `clientid` directly (Manual mode in Copilot Studio, etc.) resolve through
+ * this entry instead of going through DCR.
+ */
+function buildXsuaaDefaultClient(clientId, clientSecret) {
+    return {
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uris: [...XSUAA_DEFAULT_REDIRECT_URIS],
+        grant_types: [...DEFAULT_GRANT_TYPES],
+        response_types: [...DEFAULT_RESPONSE_TYPES],
+        token_endpoint_auth_method: DEFAULT_TOKEN_AUTH_METHOD,
+        client_name: 'ARC-1 XSUAA Default Client',
+    };
+}
+// ─── Store ────────────────────────────────────────────────────────────
+export class StatelessDcrClientStore {
+    xsuaaClient;
+    hmacKey;
+    ttlSeconds;
+    now;
+    constructor(xsuaaClientId, xsuaaClientSecret, signingSecret, options = {}) {
+        if (!signingSecret) {
+            throw new Error('StatelessDcrClientStore requires a non-empty signingSecret');
+        }
+        // Derive a dedicated HMAC key so the raw service-binding secret is never
+        // used directly to sign client_ids. The KDF_LABEL doubles as a domain
+        // separator (see comment on the constant).
+        this.hmacKey = crypto.createHmac('sha256', signingSecret).update(KDF_LABEL).digest();
+        this.xsuaaClient = buildXsuaaDefaultClient(xsuaaClientId, xsuaaClientSecret);
+        this.ttlSeconds = options.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+        this.now = options.now ?? (() => Date.now());
+    }
+    // ── OAuthRegisteredClientsStore implementation ──
+    async getClient(clientId) {
+        if (clientId === this.xsuaaClient.client_id) {
+            return this.xsuaaClient;
+        }
+        if (!clientId.startsWith(ID_PREFIX)) {
+            this.emitLookupFailed(clientId, 'unknown_prefix');
+            return undefined;
+        }
+        const decoded = this.decodeAndVerify(clientId);
+        if (decoded.kind === 'error') {
+            this.emitLookupFailed(clientId, decoded.reason);
+            return undefined;
+        }
+        const ageSec = Math.floor(this.now() / 1000) - decoded.payload.iat;
+        if (ageSec > this.ttlSeconds) {
+            this.emitLookupFailed(clientId, 'expired');
+            logger.debug('OAuth client expired (TTL)', { clientId, ageSec, ttlSeconds: this.ttlSeconds });
+            return undefined;
+        }
+        return this.payloadToClientInfo(clientId, decoded.payload);
+    }
+    async registerClient(client) {
+        if (client.redirect_uris) {
+            for (const uri of client.redirect_uris) {
+                validateRedirectUri(uri);
+            }
+        }
+        const issuedAt = Math.floor(this.now() / 1000);
+        const payload = {
+            v: PAYLOAD_VERSION,
+            iat: issuedAt,
+            ru: client.redirect_uris ?? [],
+        };
+        if (client.grant_types)
+            payload.gt = client.grant_types;
+        if (client.response_types)
+            payload.rt = client.response_types;
+        if (client.token_endpoint_auth_method)
+            payload.am = client.token_endpoint_auth_method;
+        if (client.client_name)
+            payload.cn = client.client_name;
+        const clientId = this.encode(payload);
+        const clientSecret = this.deriveSecret(clientId);
+        logger.debug('OAuth client registered (stateless)', {
+            clientId,
+            clientName: client.client_name,
+            idBytes: clientId.length,
+        });
+        logger.emitAudit({
+            timestamp: new Date().toISOString(),
+            level: 'info',
+            event: 'oauth_client_registered',
+            registeredClientId: clientId,
+            clientName: client.client_name,
+            redirectUriCount: payload.ru.length,
+            idBytes: clientId.length,
+        });
+        return {
+            ...client,
+            client_id: clientId,
+            client_secret: clientSecret,
+            client_id_issued_at: issuedAt,
+        };
+    }
+    // ── SDK redirect_uri hook ──
+    /**
+     * Called by the MCP SDK before redirect_uri validation on `/authorize`.
+     *
+     * For the pre-registered XSUAA client we mutate the in-memory list (XSUAA
+     * itself is the authoritative validator via `xs-security.json` wildcards,
+     * so the SDK's local list is decorative). The mutation is replayed on
+     * every `/authorize`, so it doesn't need to persist.
+     *
+     * For DCR (`arc1-…`) clients we are stateless by design: there's nothing
+     * to mutate. The previous in-memory store implemented a percent-encoding
+     * loose-match (BAS/Theia registers `?x=1` then authorizes with `%3Fx=1`).
+     * Reproducing that statelessly would require either bundling every
+     * encoding variant in the signed payload or keeping a per-process scratch
+     * map, both of which undermine the "no state" goal. We accept the
+     * regression: affected clients re-register on encoding-variant mismatch,
+     * which is exactly what they did under the old store after every restart.
+     */
+    ensureRedirectUri(clientId, uri) {
+        if (clientId !== this.xsuaaClient.client_id)
+            return;
+        if (this.xsuaaClient.redirect_uris.includes(uri))
+            return;
+        this.xsuaaClient.redirect_uris.push(uri);
+        logger.debug('Dynamic redirect_uri registered for XSUAA client', { clientId, uri });
+        logger.emitAudit({
+            timestamp: new Date().toISOString(),
+            level: 'info',
+            event: 'oauth_redirect_uri_registered',
+            registeredClientId: clientId,
+            redirectUri: uri,
+        });
+    }
+    // ── Internals: encode / decode / sign / verify ──
+    payloadToClientInfo(clientId, payload) {
+        return {
+            client_id: clientId,
+            client_secret: this.deriveSecret(clientId),
+            client_id_issued_at: payload.iat,
+            redirect_uris: payload.ru,
+            grant_types: payload.gt ?? [...DEFAULT_GRANT_TYPES],
+            response_types: payload.rt ?? [...DEFAULT_RESPONSE_TYPES],
+            token_endpoint_auth_method: payload.am ?? DEFAULT_TOKEN_AUTH_METHOD,
+            client_name: payload.cn,
+        };
+    }
+    encode(payload) {
+        const payloadB64 = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
+        const sig = this.sign(payloadB64);
+        return `${ID_PREFIX}${payloadB64}.${sig}`;
+    }
+    /**
+     * Decode and verify a `client_id`. Returns either the parsed payload or a
+     * structured failure reason — the caller emits the failure as an audit
+     * event with the right reason code (so probing attempts are observable).
+     */
+    decodeAndVerify(clientId) {
+        const stripped = clientId.slice(ID_PREFIX.length);
+        const dot = stripped.lastIndexOf('.');
+        if (dot < 0)
+            return { kind: 'error', reason: 'malformed' };
+        const payloadB64 = stripped.slice(0, dot);
+        const sigB64 = stripped.slice(dot + 1);
+        if (!this.verifySignature(payloadB64, sigB64)) {
+            return { kind: 'error', reason: 'bad_signature' };
+        }
+        const payload = parsePayload(payloadB64);
+        if (!payload)
+            return { kind: 'error', reason: 'invalid_payload' };
+        return { kind: 'ok', payload };
+    }
+    verifySignature(payloadB64, sigB64) {
+        const expected = Buffer.from(this.sign(payloadB64), 'base64url');
+        const actual = Buffer.from(sigB64, 'base64url');
+        if (actual.length !== expected.length || actual.length !== SIG_BYTES)
+            return false;
+        return crypto.timingSafeEqual(actual, expected);
+    }
+    sign(payloadB64) {
+        const fullDigest = crypto.createHmac('sha256', this.hmacKey).update(payloadB64).digest();
+        // Truncate to SIG_BYTES — see the comment on the constant for rationale.
+        return fullDigest.subarray(0, SIG_BYTES).toString('base64url');
+    }
+    /**
+     * The client_secret is derived deterministically from the client_id, so
+     * any instance with the same signing key can validate it. This is the
+     * core reason DCR survives container restarts and scales out horizontally
+     * with no shared state.
+     */
+    deriveSecret(clientId) {
+        return crypto.createHmac('sha256', this.hmacKey).update(`secret:${clientId}`).digest('base64url');
+    }
+    emitLookupFailed(clientId, reason) {
+        logger.debug('OAuth client lookup failed', { clientId, reason });
+        logger.emitAudit({
+            timestamp: new Date().toISOString(),
+            // 'expired' is normal-ish (TTL eviction); the rest are probing/forgery signals.
+            level: reason === 'expired' ? 'info' : 'warn',
+            event: 'oauth_client_lookup_failed',
+            registeredClientId: clientId,
+            reason,
+        });
+    }
+}
+// ─── Module-level helpers ─────────────────────────────────────────────
+/**
+ * Parse a base64url-encoded payload back into a typed `SignedPayload`. Returns
+ * `undefined` on any failure (decode error, JSON parse error, schema mismatch).
+ */
+function parsePayload(payloadB64) {
+    try {
+        const json = Buffer.from(payloadB64, 'base64url').toString('utf8');
+        const parsed = JSON.parse(json);
+        if (parsed.v !== PAYLOAD_VERSION)
+            return undefined;
+        if (typeof parsed.iat !== 'number' || !Array.isArray(parsed.ru))
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Validate a redirect URI against the allowed scheme/host policy.
+ *
+ * Allowed: `https://*`, `http://` to localhost / 127.0.0.1 / [::1], and known
+ * MCP-client custom schemes (`claude:`, `cursor:`, `vscode:`,
+ * `vscode-insiders:`).
+ *
+ * Rejected: `javascript:`, `data:`, `file:`, `ftp:`, and any `http://` to
+ * non-loopback hosts.
+ */
+export function validateRedirectUri(uri) {
+    const ALLOWED_CUSTOM_SCHEMES = ['claude:', 'cursor:', 'vscode:', 'vscode-insiders:'];
+    const BLOCKED_SCHEMES = ['javascript:', 'data:', 'file:', 'ftp:'];
+    for (const scheme of BLOCKED_SCHEMES) {
+        if (uri.toLowerCase().startsWith(scheme)) {
+            throw new Error(`Redirect URI rejected: '${scheme}' scheme is not allowed. Use https:// or a registered custom scheme.`);
+        }
+    }
+    for (const scheme of ALLOWED_CUSTOM_SCHEMES) {
+        if (uri.toLowerCase().startsWith(scheme))
+            return;
+    }
+    try {
+        const parsed = new URL(uri);
+        if (parsed.protocol === 'https:')
+            return;
+        if (parsed.protocol === 'http:') {
+            const host = parsed.hostname.toLowerCase();
+            if (host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1')
+                return;
+            throw new Error(`Redirect URI rejected: http:// is only allowed for localhost/127.0.0.1. Got: '${uri}'`);
+        }
+        return;
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith('Redirect URI rejected'))
+            throw err;
+        // URL parsing failed for some other reason (unknown protocol etc.) — allow.
+    }
+}
+//# sourceMappingURL=stateless-client-store.js.map

package/dist/server/stateless-client-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stateless-client-store.js","sourceRoot":"","sources":["../../src/server/stateless-client-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,yEAAyE;AAEzE,wDAAwD;AACxD,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,2EAA2E;AAC3E,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE9C,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAU,CAAC;AAC7E,MAAM,sBAAsB,GAAG,CAAC,MAAM,CAAU,CAAC;AACjD,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG;IAClC,sCAAsC,EAAE,gBAAgB;IACxD,sCAAsC,EAAE,YAAY;IACpD,yCAAyC,EAAE,iBAAiB;IAC5D,oDAAoD,EAAE,SAAS;IAC/D,mDAAmD,EAAE,UAAU;CACvD,CAAC;AAoCX,yEAAyE;AAEzE;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,QAAgB,EAAE,YAAoB;IACrE,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,aAAa,EAAE,CAAC,GAAG,2BAA2B,CAAC;QAC/C,WAAW,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACrC,cAAc,EAAE,CAAC,GAAG,sBAAsB,CAAC;QAC3C,0BAA0B,EAAE,yBAAyB;QACrD,WAAW,EAAE,4BAA4B;KAC1C,CAAC;AACJ,CAAC;AAED,yEAAyE;AAEzE,MAAM,OAAO,uBAAuB;IACjB,WAAW,CAA6B;IACxC,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,GAAG,CAAe;IAEnC,YACE,aAAqB,EACrB,iBAAyB,EACzB,aAAqB,EACrB,UAA0C,EAAE;QAE5C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,2CAA2C;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;QACrF,IAAI,CAAC,WAAW,GAAG,uBAAuB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC5D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,mDAAmD;IAEnD,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QACnE,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9F,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAA6E;QAE7E,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACvC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAkB;YAC7B,CAAC,EAAE,eAAe;YAClB,GAAG,EAAE,QAAQ;YACb,EAAE,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;SAC/B,CAAC;QACF,IAAI,MAAM,CAAC,WAAW;YAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;QACxD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;QAC9D,IAAI,MAAM,CAAC,0BAA0B;YAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,0BAA0B,CAAC;QACtF,IAAI,MAAM,CAAC,WAAW;YAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;QAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAClD,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,OAAO,EAAE,QAAQ,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,yBAAyB;YAChC,kBAAkB,EAAE,QAAQ;YAC5B,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM;YACnC,OAAO,EAAE,QAAQ,CAAC,MAAM;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,mBAAmB,EAAE,QAAQ;SAC9B,CAAC;IACJ,CAAC;IAED,8BAA8B;IAE9B;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,QAAgB,EAAE,GAAW;QAC7C,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,SAAS;YAAE,OAAO;QACpD,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QAEzD,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,SAAS,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,+BAA+B;YACtC,kBAAkB,EAAE,QAAQ;YAC5B,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IAE3C,mBAAmB,CAAC,QAAgB,EAAE,OAAsB;QAClE,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC1C,mBAAmB,EAAE,OAAO,CAAC,GAAG;YAChC,aAAa,EAAE,OAAO,CAAC,EAAE;YACzB,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,mBAAmB,CAAC;YACnD,cAAc,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,sBAAsB,CAAC;YACzD,0BAA0B,EAAE,OAAO,CAAC,EAAE,IAAI,yBAAyB;YACnE,WAAW,EAAE,OAAO,CAAC,EAAE;SACxB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,OAAsB;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,GAAG,SAAS,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACK,eAAe,CACrB,QAAgB;QAIhB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAE3D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAElE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAEO,eAAe,CAAC,UAAkB,EAAE,MAAc;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACnF,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAEO,IAAI,CAAC,UAAkB;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;QACzF,yEAAyE;QACzE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,QAAgB;QACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpG,CAAC;IAEO,gBAAgB,CACtB,QAAgB,EAChB,MAAwF;QAExF,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,SAAS,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,gFAAgF;YAChF,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC7C,KAAK,EAAE,4BAA4B;YACnC,kBAAkB,EAAE,QAAQ;YAC5B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAED,yEAAyE;AAEzE;;;GAGG;AACH,SAAS,YAAY,CAAC,UAAkB;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QACjD,IAAI,MAAM,CAAC,CAAC,KAAK,eAAe;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,sEAAsE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO;IACnD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO;QACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO;YAC/F,MAAM,IAAI,KAAK,CAAC,iFAAiF,GAAG,GAAG,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC;YAAE,MAAM,GAAG,CAAC;QACvF,4EAA4E;IAC9E,CAAC;AACH,CAAC"}

package/dist/server/types.d.ts

@@ -61,6 +61,13 @@ export interface ServerConfig {
     /** Clock tolerance in seconds for JWT exp/nbf validation (default: 0 — no tolerance) */
     oidcClockTolerance?: number;
     xsuaaAuth: boolean;
+    /**
+     * Lifetime of an OAuth DCR registration (`client_id`) in seconds. Default:
+     * 30 days. Lower values bound the blast radius if the signing key leaks;
+     * higher values reduce re-auth churn. Hard-capped at 90 days — longer-lived
+     * credentials should use the pre-registered XSUAA client instead of DCR.
+     * Only consulted when XSUAA OAuth proxy mode is active. */
+    oauthDcrTtlSeconds: number;
     btpServiceKey?: string;
     btpServiceKeyFile?: string;
     btpOAuthCallbackPort: number;
@@ -99,6 +106,11 @@ export interface ServerConfig {
     cacheWarmupPackages: string;
     /** Maximum concurrent SAP HTTP requests (default: 10). Prevents work process exhaustion. */
     maxConcurrent: number;
+    /** Exact-match CORS allowlist. Empty array (the default) disables CORS entirely so that
+     *  browser-originated cross-origin requests are blocked. Native MCP clients
+     *  (Claude Desktop / Cursor / VS Code Copilot / Copilot Studio) do not need this — they
+     *  use native HTTP, not the browser fetch API, and never trigger CORS. */
+    allowedOrigins: string[];
     verbose: boolean;
 }
 /** Default configuration values — restrictive by default. */

package/dist/server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,yBAAyB;AACzB,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,iBAAiB,CAAC;AAExD,kEAAkE;AAClE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;AAElD,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAE3B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAGlB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,2FAA2F;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;IAGtB,cAAc,EAAE,aAAa,CAAC;IAC9B,WAAW,EAAE,aAAa,CAAC;IAC3B,UAAU,EAAE,aAAa,CAAC;IAC1B,WAAW,EAAE,aAAa,CAAC;IAC3B,UAAU,EAAE,aAAa,CAAC;IAC1B,gBAAgB,EAAE,aAAa,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC;IAC3B,cAAc,EAAE,aAAa,CAAC;IAC9B,UAAU,EAAE,aAAa,CAAC;IAG1B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAGtC,sHAAsH;IACtH,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IAGnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAG7B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,oBAAoB,EAAE,OAAO,CAAC;IAG9B,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IAGtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAG3B,0HAA0H;IAC1H,QAAQ,EAAE,UAAU,GAAG,cAAc,CAAC;IAGtC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;;;iDAQ6C;IAC7C,gBAAgB,EAAE,OAAO,CAAC;IAG1B,oGAAoG;IACpG,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,WAAW,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAG5B,4FAA4F;IAC5F,aAAa,EAAE,MAAM,CAAC;IAGtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,6DAA6D;AAC7D,eAAO,MAAM,cAAc,EAAE,YA4C5B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,yBAAyB;AACzB,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,iBAAiB,CAAC;AAExD,kEAAkE;AAClE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;AAElD,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAE3B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAGlB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,2FAA2F;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;IAGtB,cAAc,EAAE,aAAa,CAAC;IAC9B,WAAW,EAAE,aAAa,CAAC;IAC3B,UAAU,EAAE,aAAa,CAAC;IAC1B,WAAW,EAAE,aAAa,CAAC;IAC3B,UAAU,EAAE,aAAa,CAAC;IAC1B,gBAAgB,EAAE,aAAa,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC;IAC3B,cAAc,EAAE,aAAa,CAAC;IAC9B,UAAU,EAAE,aAAa,CAAC;IAG1B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAGtC,sHAAsH;IACtH,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IAEnB;;;;;+DAK2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAG3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAG7B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,oBAAoB,EAAE,OAAO,CAAC;IAG9B,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IAGtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAG3B,0HAA0H;IAC1H,QAAQ,EAAE,UAAU,GAAG,cAAc,CAAC;IAGtC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;;;iDAQ6C;IAC7C,gBAAgB,EAAE,OAAO,CAAC;IAG1B,oGAAoG;IACpG,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,WAAW,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAG5B,4FAA4F;IAC5F,aAAa,EAAE,MAAM,CAAC;IAGtB;;;8EAG0E;IAC1E,cAAc,EAAE,MAAM,EAAE,CAAC;IAGzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,6DAA6D;AAC7D,eAAO,MAAM,cAAc,EAAE,YA8C5B,CAAC"}

package/dist/server/types.js

@@ -36,6 +36,7 @@ export const DEFAULT_CONFIG = {
     featureFlp: 'auto',
     systemType: 'auto',
     xsuaaAuth: false,
+    oauthDcrTtlSeconds: 30 * 24 * 60 * 60, // 30 days
     btpOAuthCallbackPort: 0,
     ppEnabled: false,
     ppStrict: false,
@@ -49,6 +50,7 @@ export const DEFAULT_CONFIG = {
     cacheWarmup: false,
     cacheWarmupPackages: '',
     maxConcurrent: 10,
+    allowedOrigins: [],
     logLevel: 'info',
     logFormat: 'text',
     verbose: false,

package/dist/server/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0HH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,GAAG,EAAE,EAAE;IACP,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,KAAK;IAClB,gBAAgB,EAAE,KAAK;IACvB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,KAAK;IAC3B,cAAc,EAAE,KAAK;IACrB,eAAe,EAAE,CAAC,MAAM,CAAC;IACzB,iBAAiB,EAAE,EAAE;IACrB,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,MAAM;IACtB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,MAAM;IAClB,gBAAgB,EAAE,MAAM;IACxB,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,MAAM;IACtB,UAAU,EAAE,MAAM;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,oBAAoB,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK;IAChB,QAAQ,EAAE,KAAK;IACf,oBAAoB,EAAE,KAAK;IAC3B,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,KAAK;IACvB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,KAAK;IAClB,mBAAmB,EAAE,EAAE;IACvB,aAAa,EAAE,EAAE;IACjB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,KAAK;CACf,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyIH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,GAAG,EAAE,EAAE;IACP,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,KAAK;IAClB,gBAAgB,EAAE,KAAK;IACvB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,KAAK;IAC3B,cAAc,EAAE,KAAK;IACrB,eAAe,EAAE,CAAC,MAAM,CAAC;IACzB,iBAAiB,EAAE,EAAE;IACrB,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,MAAM;IACtB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,MAAM;IAClB,gBAAgB,EAAE,MAAM;IACxB,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,MAAM;IACtB,UAAU,EAAE,MAAM;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;IACjD,oBAAoB,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK;IAChB,QAAQ,EAAE,KAAK;IACf,oBAAoB,EAAE,KAAK;IAC3B,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,KAAK;IACvB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,KAAK;IAClB,mBAAmB,EAAE,EAAE;IACvB,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;IAClB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,KAAK;CACf,CAAC"}

package/dist/server/xsuaa.d.ts

@@ -15,19 +15,19 @@
  *    - Offline validation with automatic JWKS caching
  *    - checkLocalScope() for scope enforcement
  *
- * 2. In-memory client store for dynamic registration:
+ * 2. Stateless DCR client store (StatelessDcrClientStore):
  *    - MCP clients (Claude Desktop, Cursor) register dynamically via RFC 7591
- *    - Registrations are lost on restart — clients re-register on reconnect
+ *    - client_ids are HMAC-signed by the XSUAA clientsecret, so they
+ *      survive restarts / pushes / cell moves without any backing store
  *    - XSUAA clientId is pre-registered as the default client
  *
  * 3. Chained token verifier:
  *    - Tries XSUAA → Entra ID OIDC → API key in order
  *    - All three auth modes coexist on the same /mcp endpoint
  */
-import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
 import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js';
 import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
-import type { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { StatelessDcrClientStore } from './stateless-client-store.js';
 /** XSUAA credentials from VCAP_SERVICES */
 export interface XsuaaCredentials {
     url: string;
@@ -37,43 +37,6 @@ export interface XsuaaCredentials {
     uaadomain: string;
     verificationkey?: string;
 }
-/**
- * In-memory store for OAuth client registrations.
- *
- * MCP clients dynamically register via RFC 7591. The XSUAA service binding
- * clientId is pre-registered as the default client so that clients can
- * use it directly without registration.
- */
-export declare class InMemoryClientStore implements OAuthRegisteredClientsStore {
-    private clients;
-    constructor(xsuaaClientId: string, xsuaaClientSecret: string);
-    /**
-     * Dynamically add a redirect URI to a client's allow list.
-     *
-     * The MCP SDK validates redirect_uri with byte-exact matching for
-     * non-loopback HTTPS URIs, but two classes of clients need relaxation:
-     *
-     * 1. Pre-registered XSUAA client: XSUAA itself is the authoritative
-     *    redirect-URI validator (via xs-security.json wildcard patterns),
-     *    so any URI is accepted here and forwarded.
-     *
-     * 2. DCR clients (arc1-*): only accept URIs that are semantically
-     *    equivalent to one the client registered. This handles clients that
-     *    use different percent-encoding at /register vs /authorize — notably
-     *    BAS/Cline via Theia's OAuth proxy, which registers `/callback?x=1`
-     *    but requests with `/callback%3Fx=1`. Security: hostname, port, and
-     *    decoded path/query must all match a previously-registered URI.
-     */
-    ensureRedirectUri(clientId: string, uri: string): void;
-    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
-    registerClient(client: Omit<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'>): Promise<OAuthClientInformationFull>;
-    /**
-     * Validate a redirect URI against allowed scheme/host policy.
-     * Allowed: https://* , http://localhost or 127.0.0.1 or [::1], custom MCP client schemes.
-     * Rejected: javascript:, data:, file:, ftp:, and any http:// to non-loopback hosts.
-     */
-    private validateRedirectUri;
-}
 /**
  * Verify a JWT token using @sap/xssec.
  *
@@ -97,8 +60,13 @@ export declare function createChainedTokenVerifier(config: {
     oidcIssuer?: string;
     oidcAudience?: string;
 }, xsuaaVerifier?: (token: string) => Promise<AuthInfo>, oidcVerifier?: (token: string) => Promise<AuthInfo>): (token: string) => Promise<AuthInfo>;
-export declare function createXsuaaOAuthProvider(credentials: XsuaaCredentials, appUrl: string): {
+export interface CreateXsuaaOAuthProviderOptions {
+    /** Lifetime of issued DCR client_ids in seconds. Falls back to the store's
+     *  built-in default (30 days) when omitted. */
+    dcrTtlSeconds?: number;
+}
+export declare function createXsuaaOAuthProvider(credentials: XsuaaCredentials, appUrl: string, options?: CreateXsuaaOAuthProviderOptions): {
     provider: ProxyOAuthServerProvider;
-    clientStore: InMemoryClientStore;
+    clientStore: StatelessDcrClientStore;
 };
 //# sourceMappingURL=xsuaa.d.ts.map

package/dist/server/xsuaa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xsuaa.d.ts","sourceRoot":"","sources":["../../src/server/xsuaa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAEpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAiB3F,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAuBD;;;;;;GAMG;AACH,qBAAa,mBAAoB,YAAW,2BAA2B;IACrE,OAAO,CAAC,OAAO,CAAiD;gBAEpD,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM;IAsB5D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAwBhD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAoB5E,cAAc,CAClB,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC5E,OAAO,CAAC,0BAA0B,CAAC;IA4BtC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CAgC5B;AAID;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CA6C5G;AA2BD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE;IACN,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,EACpD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,GAClD,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAuDtC;AAiPD,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,gBAAgB,EAC7B,MAAM,EAAE,MAAM,GACb;IAAE,QAAQ,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,CAa1E"}
+{"version":3,"file":"xsuaa.d.ts","sourceRoot":"","sources":["../../src/server/xsuaa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAM/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAatE,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CA6C5G;AA2BD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE;IACN,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,EACpD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,GAClD,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAuDtC;AAiPD,MAAM,WAAW,+BAA+B;IAC9C;mDAC+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,gBAAgB,EAC7B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,+BAAoC,GAC5C;IAAE,QAAQ,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,CAuB9E"}