cdk-serverless 3.2.0 → 3.3.0

package/lib/mcp-auth/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./config"), exports);
+__exportStar(require("./handlers"), exports);
+__exportStar(require("./mcp"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbWNwLWF1dGgvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDJDQUF5QjtBQUN6Qiw2Q0FBMkI7QUFDM0Isd0NBQXNCIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi9jb25maWcnO1xuZXhwb3J0ICogZnJvbSAnLi9oYW5kbGVycyc7XG5leHBvcnQgKiBmcm9tICcuL21jcCc7XG4iXX0=

package/lib/mcp-auth/lambda-handlers/authorization-server.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/authorization-server.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const authorization_server_1 = require("../handlers/authorization-server");
+const handler = (0, authorization_server_1.createAuthorizationServerHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXphdGlvbi1zZXJ2ZXIuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvYXV0aG9yaXphdGlvbi1zZXJ2ZXIuaGFuZGxlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUtBLHNDQWVDO0FBRXlCLGdDQUFPO0FBdEJqQyw2Q0FBZ0Q7QUFDaEQsMkVBQW9GO0FBRXBGLE1BQU0sT0FBTyxHQUFHLElBQUEsdURBQWdDLEVBQUMsSUFBQSw2QkFBZ0IsR0FBRSxDQUFDLENBQUM7QUFFOUQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFxQztJQUN2RSxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQztRQUMzQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7UUFDNUIsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1FBQ2hCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBNkM7UUFDNUQscUJBQXFCLEVBQUUsS0FBSyxDQUFDLHFCQUFrRTtRQUMvRixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0tBQ3ZDLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3ZCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLEVBQUU7S0FDeEIsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBnZXRDb25maWdGcm9tRW52IH0gZnJvbSAnLi9lbnYtY29uZmlnJztcbmltcG9ydCB7IGNyZWF0ZUF1dGhvcml6YXRpb25TZXJ2ZXJIYW5kbGVyIH0gZnJvbSAnLi4vaGFuZGxlcnMvYXV0aG9yaXphdGlvbi1zZXJ2ZXInO1xuXG5jb25zdCBoYW5kbGVyID0gY3JlYXRlQXV0aG9yaXphdGlvblNlcnZlckhhbmRsZXIoZ2V0Q29uZmlnRnJvbUVudigpKTtcblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGxhbWJkYUhhbmRsZXIoZXZlbnQ6IEFXU0xhbWJkYS5BUElHYXRld2F5UHJveHlFdmVudCk6IFByb21pc2U8QVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eVJlc3VsdD4ge1xuICBjb25zdCByZXN1bHQgPSBhd2FpdCBoYW5kbGVyKHtcbiAgICBodHRwTWV0aG9kOiBldmVudC5odHRwTWV0aG9kLFxuICAgIHBhdGg6IGV2ZW50LnBhdGgsXG4gICAgaGVhZGVyczogZXZlbnQuaGVhZGVycyBhcyBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+LFxuICAgIHF1ZXJ5U3RyaW5nUGFyYW1ldGVyczogZXZlbnQucXVlcnlTdHJpbmdQYXJhbWV0ZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4gfCBudWxsLFxuICAgIGJvZHk6IGV2ZW50LmJvZHksXG4gICAgaXNCYXNlNjRFbmNvZGVkOiBldmVudC5pc0Jhc2U2NEVuY29kZWQsXG4gIH0pO1xuXG4gIHJldHVybiB7XG4gICAgc3RhdHVzQ29kZTogcmVzdWx0LnN0YXR1c0NvZGUsXG4gICAgaGVhZGVyczogcmVzdWx0LmhlYWRlcnMsXG4gICAgYm9keTogcmVzdWx0LmJvZHkgPz8gJycsXG4gIH07XG59XG5cbmV4cG9ydCB7IGxhbWJkYUhhbmRsZXIgYXMgaGFuZGxlciB9O1xuIl19

package/lib/mcp-auth/lambda-handlers/authorize.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/authorize.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const authorize_1 = require("../handlers/authorize");
+const handler = (0, authorize_1.createAuthorizeHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplLmhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbGFtYmRhLWhhbmRsZXJzL2F1dGhvcml6ZS5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBS0Esc0NBZUM7QUFFeUIsZ0NBQU87QUF0QmpDLDZDQUFnRDtBQUNoRCxxREFBK0Q7QUFFL0QsTUFBTSxPQUFPLEdBQUcsSUFBQSxrQ0FBc0IsRUFBQyxJQUFBLDZCQUFnQixHQUFFLENBQUMsQ0FBQztBQUVwRCxLQUFLLFVBQVUsYUFBYSxDQUFDLEtBQXFDO0lBQ3ZFLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDO1FBQzNCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtRQUM1QixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUE2QztRQUM1RCxxQkFBcUIsRUFBRSxLQUFLLENBQUMscUJBQWtFO1FBQy9GLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSTtRQUNoQixlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsT0FBTztRQUNMLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtRQUM3QixPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDdkIsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLElBQUksRUFBRTtLQUN4QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGdldENvbmZpZ0Zyb21FbnYgfSBmcm9tICcuL2Vudi1jb25maWcnO1xuaW1wb3J0IHsgY3JlYXRlQXV0aG9yaXplSGFuZGxlciB9IGZyb20gJy4uL2hhbmRsZXJzL2F1dGhvcml6ZSc7XG5cbmNvbnN0IGhhbmRsZXIgPSBjcmVhdGVBdXRob3JpemVIYW5kbGVyKGdldENvbmZpZ0Zyb21FbnYoKSk7XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBsYW1iZGFIYW5kbGVyKGV2ZW50OiBBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5RXZlbnQpOiBQcm9taXNlPEFXU0xhbWJkYS5BUElHYXRld2F5UHJveHlSZXN1bHQ+IHtcbiAgY29uc3QgcmVzdWx0ID0gYXdhaXQgaGFuZGxlcih7XG4gICAgaHR0cE1ldGhvZDogZXZlbnQuaHR0cE1ldGhvZCxcbiAgICBwYXRoOiBldmVudC5wYXRoLFxuICAgIGhlYWRlcnM6IGV2ZW50LmhlYWRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPixcbiAgICBxdWVyeVN0cmluZ1BhcmFtZXRlcnM6IGV2ZW50LnF1ZXJ5U3RyaW5nUGFyYW1ldGVycyBhcyBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+IHwgbnVsbCxcbiAgICBib2R5OiBldmVudC5ib2R5LFxuICAgIGlzQmFzZTY0RW5jb2RlZDogZXZlbnQuaXNCYXNlNjRFbmNvZGVkLFxuICB9KTtcblxuICByZXR1cm4ge1xuICAgIHN0YXR1c0NvZGU6IHJlc3VsdC5zdGF0dXNDb2RlLFxuICAgIGhlYWRlcnM6IHJlc3VsdC5oZWFkZXJzLFxuICAgIGJvZHk6IHJlc3VsdC5ib2R5ID8/ICcnLFxuICB9O1xufVxuXG5leHBvcnQgeyBsYW1iZGFIYW5kbGVyIGFzIGhhbmRsZXIgfTtcbiJdfQ==

package/lib/mcp-auth/lambda-handlers/env-config.d.ts

@@ -0,0 +1,7 @@
+import type { McpAuthConfig } from '../config';
+/**
+ * Read MCP auth configuration from environment variables.
+ * Used by all Lambda handler entry points.
+ * Throws a descriptive error if any required env var is missing or empty.
+ */
+export declare function getConfigFromEnv(): McpAuthConfig;

package/lib/mcp-auth/lambda-handlers/env-config.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getConfigFromEnv = getConfigFromEnv;
+const REQUIRED_ENV_VARS = [
+    'MCP_API_DOMAIN',
+    'MCP_AUTHORIZE_ENDPOINT',
+    'MCP_TOKEN_ENDPOINT',
+    'MCP_CLIENT_ID',
+    'MCP_SERVER_NAME',
+    'MCP_SERVER_VERSION',
+];
+/**
+ * Read MCP auth configuration from environment variables.
+ * Used by all Lambda handler entry points.
+ * Throws a descriptive error if any required env var is missing or empty.
+ */
+function getConfigFromEnv() {
+    const missing = REQUIRED_ENV_VARS.filter(name => !process.env[name]);
+    if (missing.length > 0) {
+        throw new Error(`MCP Auth: missing required environment variables: ${missing.join(', ')}`);
+    }
+    return {
+        apiDomain: process.env.MCP_API_DOMAIN,
+        authorizeEndpoint: process.env.MCP_AUTHORIZE_ENDPOINT,
+        tokenEndpoint: process.env.MCP_TOKEN_ENDPOINT,
+        clientId: process.env.MCP_CLIENT_ID,
+        allowedRedirectUris: (process.env.MCP_ALLOWED_REDIRECT_URIS ?? '').split(',').filter(Boolean),
+        serverInfo: {
+            name: process.env.MCP_SERVER_NAME,
+            version: process.env.MCP_SERVER_VERSION,
+        },
+        protocolVersions: (process.env.MCP_PROTOCOL_VERSIONS ?? '').split(',').filter(Boolean),
+        scopes: (process.env.MCP_SCOPES ?? '').split(',').filter(Boolean),
+        stripParameters: (process.env.MCP_STRIP_PARAMETERS ?? 'resource').split(',').filter(Boolean),
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW52LWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvZW52LWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWdCQSw0Q0FvQkM7QUFsQ0QsTUFBTSxpQkFBaUIsR0FBRztJQUN4QixnQkFBZ0I7SUFDaEIsd0JBQXdCO0lBQ3hCLG9CQUFvQjtJQUNwQixlQUFlO0lBQ2YsaUJBQWlCO0lBQ2pCLG9CQUFvQjtDQUNaLENBQUM7QUFFWDs7OztHQUlHO0FBQ0gsU0FBZ0IsZ0JBQWdCO0lBQzlCLE1BQU0sT0FBTyxHQUFHLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLHFEQUFxRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RixDQUFDO0lBRUQsT0FBTztRQUNMLFNBQVMsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWU7UUFDdEMsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxzQkFBdUI7UUFDdEQsYUFBYSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQW1CO1FBQzlDLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWM7UUFDcEMsbUJBQW1CLEVBQUUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHlCQUF5QixJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQzdGLFVBQVUsRUFBRTtZQUNWLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWdCO1lBQ2xDLE9BQU8sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGtCQUFtQjtTQUN6QztRQUNELGdCQUFnQixFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUN0RixNQUFNLEVBQUUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUNqRSxlQUFlLEVBQUUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLG9CQUFvQixJQUFJLFVBQVUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0tBQzdGLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHR5cGUgeyBNY3BBdXRoQ29uZmlnIH0gZnJvbSAnLi4vY29uZmlnJztcblxuY29uc3QgUkVRVUlSRURfRU5WX1ZBUlMgPSBbXG4gICdNQ1BfQVBJX0RPTUFJTicsXG4gICdNQ1BfQVVUSE9SSVpFX0VORFBPSU5UJyxcbiAgJ01DUF9UT0tFTl9FTkRQT0lOVCcsXG4gICdNQ1BfQ0xJRU5UX0lEJyxcbiAgJ01DUF9TRVJWRVJfTkFNRScsXG4gICdNQ1BfU0VSVkVSX1ZFUlNJT04nLFxuXSBhcyBjb25zdDtcblxuLyoqXG4gKiBSZWFkIE1DUCBhdXRoIGNvbmZpZ3VyYXRpb24gZnJvbSBlbnZpcm9ubWVudCB2YXJpYWJsZXMuXG4gKiBVc2VkIGJ5IGFsbCBMYW1iZGEgaGFuZGxlciBlbnRyeSBwb2ludHMuXG4gKiBUaHJvd3MgYSBkZXNjcmlwdGl2ZSBlcnJvciBpZiBhbnkgcmVxdWlyZWQgZW52IHZhciBpcyBtaXNzaW5nIG9yIGVtcHR5LlxuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0Q29uZmlnRnJvbUVudigpOiBNY3BBdXRoQ29uZmlnIHtcbiAgY29uc3QgbWlzc2luZyA9IFJFUVVJUkVEX0VOVl9WQVJTLmZpbHRlcihuYW1lID0+ICFwcm9jZXNzLmVudltuYW1lXSk7XG4gIGlmIChtaXNzaW5nLmxlbmd0aCA+IDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYE1DUCBBdXRoOiBtaXNzaW5nIHJlcXVpcmVkIGVudmlyb25tZW50IHZhcmlhYmxlczogJHttaXNzaW5nLmpvaW4oJywgJyl9YCk7XG4gIH1cblxuICByZXR1cm4ge1xuICAgIGFwaURvbWFpbjogcHJvY2Vzcy5lbnYuTUNQX0FQSV9ET01BSU4hLFxuICAgIGF1dGhvcml6ZUVuZHBvaW50OiBwcm9jZXNzLmVudi5NQ1BfQVVUSE9SSVpFX0VORFBPSU5UISxcbiAgICB0b2tlbkVuZHBvaW50OiBwcm9jZXNzLmVudi5NQ1BfVE9LRU5fRU5EUE9JTlQhLFxuICAgIGNsaWVudElkOiBwcm9jZXNzLmVudi5NQ1BfQ0xJRU5UX0lEISxcbiAgICBhbGxvd2VkUmVkaXJlY3RVcmlzOiAocHJvY2Vzcy5lbnYuTUNQX0FMTE9XRURfUkVESVJFQ1RfVVJJUyA/PyAnJykuc3BsaXQoJywnKS5maWx0ZXIoQm9vbGVhbiksXG4gICAgc2VydmVySW5mbzoge1xuICAgICAgbmFtZTogcHJvY2Vzcy5lbnYuTUNQX1NFUlZFUl9OQU1FISxcbiAgICAgIHZlcnNpb246IHByb2Nlc3MuZW52Lk1DUF9TRVJWRVJfVkVSU0lPTiEsXG4gICAgfSxcbiAgICBwcm90b2NvbFZlcnNpb25zOiAocHJvY2Vzcy5lbnYuTUNQX1BST1RPQ09MX1ZFUlNJT05TID8/ICcnKS5zcGxpdCgnLCcpLmZpbHRlcihCb29sZWFuKSxcbiAgICBzY29wZXM6IChwcm9jZXNzLmVudi5NQ1BfU0NPUEVTID8/ICcnKS5zcGxpdCgnLCcpLmZpbHRlcihCb29sZWFuKSxcbiAgICBzdHJpcFBhcmFtZXRlcnM6IChwcm9jZXNzLmVudi5NQ1BfU1RSSVBfUEFSQU1FVEVSUyA/PyAncmVzb3VyY2UnKS5zcGxpdCgnLCcpLmZpbHRlcihCb29sZWFuKSxcbiAgfTtcbn1cbiJdfQ==

package/lib/mcp-auth/lambda-handlers/protected-resource.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/protected-resource.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const protected_resource_1 = require("../handlers/protected-resource");
+const handler = (0, protected_resource_1.createProtectedResourceHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdGVjdGVkLXJlc291cmNlLmhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbGFtYmRhLWhhbmRsZXJzL3Byb3RlY3RlZC1yZXNvdXJjZS5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBS0Esc0NBZUM7QUFFeUIsZ0NBQU87QUF0QmpDLDZDQUFnRDtBQUNoRCx1RUFBZ0Y7QUFFaEYsTUFBTSxPQUFPLEdBQUcsSUFBQSxtREFBOEIsRUFBQyxJQUFBLDZCQUFnQixHQUFFLENBQUMsQ0FBQztBQUU1RCxLQUFLLFVBQVUsYUFBYSxDQUFDLEtBQXFDO0lBQ3ZFLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDO1FBQzNCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtRQUM1QixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUE2QztRQUM1RCxxQkFBcUIsRUFBRSxLQUFLLENBQUMscUJBQWtFO1FBQy9GLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSTtRQUNoQixlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsT0FBTztRQUNMLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtRQUM3QixPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDdkIsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLElBQUksRUFBRTtLQUN4QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGdldENvbmZpZ0Zyb21FbnYgfSBmcm9tICcuL2Vudi1jb25maWcnO1xuaW1wb3J0IHsgY3JlYXRlUHJvdGVjdGVkUmVzb3VyY2VIYW5kbGVyIH0gZnJvbSAnLi4vaGFuZGxlcnMvcHJvdGVjdGVkLXJlc291cmNlJztcblxuY29uc3QgaGFuZGxlciA9IGNyZWF0ZVByb3RlY3RlZFJlc291cmNlSGFuZGxlcihnZXRDb25maWdGcm9tRW52KCkpO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbGFtYmRhSGFuZGxlcihldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50KTogUHJvbWlzZTxBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5UmVzdWx0PiB7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IGhhbmRsZXIoe1xuICAgIGh0dHBNZXRob2Q6IGV2ZW50Lmh0dHBNZXRob2QsXG4gICAgcGF0aDogZXZlbnQucGF0aCxcbiAgICBoZWFkZXJzOiBldmVudC5oZWFkZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4sXG4gICAgcXVlcnlTdHJpbmdQYXJhbWV0ZXJzOiBldmVudC5xdWVyeVN0cmluZ1BhcmFtZXRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPiB8IG51bGwsXG4gICAgYm9keTogZXZlbnQuYm9keSxcbiAgICBpc0Jhc2U2NEVuY29kZWQ6IGV2ZW50LmlzQmFzZTY0RW5jb2RlZCxcbiAgfSk7XG5cbiAgcmV0dXJuIHtcbiAgICBzdGF0dXNDb2RlOiByZXN1bHQuc3RhdHVzQ29kZSxcbiAgICBoZWFkZXJzOiByZXN1bHQuaGVhZGVycyxcbiAgICBib2R5OiByZXN1bHQuYm9keSA/PyAnJyxcbiAgfTtcbn1cblxuZXhwb3J0IHsgbGFtYmRhSGFuZGxlciBhcyBoYW5kbGVyIH07XG4iXX0=

package/lib/mcp-auth/lambda-handlers/register.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/register.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const register_1 = require("../handlers/register");
+const handler = (0, register_1.createRegisterHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaXN0ZXIuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvcmVnaXN0ZXIuaGFuZGxlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUtBLHNDQWVDO0FBRXlCLGdDQUFPO0FBdEJqQyw2Q0FBZ0Q7QUFDaEQsbURBQTZEO0FBRTdELE1BQU0sT0FBTyxHQUFHLElBQUEsZ0NBQXFCLEVBQUMsSUFBQSw2QkFBZ0IsR0FBRSxDQUFDLENBQUM7QUFFbkQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFxQztJQUN2RSxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQztRQUMzQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7UUFDNUIsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1FBQ2hCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBNkM7UUFDNUQscUJBQXFCLEVBQUUsS0FBSyxDQUFDLHFCQUFrRTtRQUMvRixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0tBQ3ZDLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3ZCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLEVBQUU7S0FDeEIsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBnZXRDb25maWdGcm9tRW52IH0gZnJvbSAnLi9lbnYtY29uZmlnJztcbmltcG9ydCB7IGNyZWF0ZVJlZ2lzdGVySGFuZGxlciB9IGZyb20gJy4uL2hhbmRsZXJzL3JlZ2lzdGVyJztcblxuY29uc3QgaGFuZGxlciA9IGNyZWF0ZVJlZ2lzdGVySGFuZGxlcihnZXRDb25maWdGcm9tRW52KCkpO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbGFtYmRhSGFuZGxlcihldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50KTogUHJvbWlzZTxBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5UmVzdWx0PiB7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IGhhbmRsZXIoe1xuICAgIGh0dHBNZXRob2Q6IGV2ZW50Lmh0dHBNZXRob2QsXG4gICAgcGF0aDogZXZlbnQucGF0aCxcbiAgICBoZWFkZXJzOiBldmVudC5oZWFkZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4sXG4gICAgcXVlcnlTdHJpbmdQYXJhbWV0ZXJzOiBldmVudC5xdWVyeVN0cmluZ1BhcmFtZXRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPiB8IG51bGwsXG4gICAgYm9keTogZXZlbnQuYm9keSxcbiAgICBpc0Jhc2U2NEVuY29kZWQ6IGV2ZW50LmlzQmFzZTY0RW5jb2RlZCxcbiAgfSk7XG5cbiAgcmV0dXJuIHtcbiAgICBzdGF0dXNDb2RlOiByZXN1bHQuc3RhdHVzQ29kZSxcbiAgICBoZWFkZXJzOiByZXN1bHQuaGVhZGVycyxcbiAgICBib2R5OiByZXN1bHQuYm9keSA/PyAnJyxcbiAgfTtcbn1cblxuZXhwb3J0IHsgbGFtYmRhSGFuZGxlciBhcyBoYW5kbGVyIH07XG4iXX0=

package/lib/mcp-auth/lambda-handlers/token.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/token.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const token_1 = require("../handlers/token");
+const handler = (0, token_1.createTokenHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4uaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvdG9rZW4uaGFuZGxlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUtBLHNDQWVDO0FBRXlCLGdDQUFPO0FBdEJqQyw2Q0FBZ0Q7QUFDaEQsNkNBQXVEO0FBRXZELE1BQU0sT0FBTyxHQUFHLElBQUEsMEJBQWtCLEVBQUMsSUFBQSw2QkFBZ0IsR0FBRSxDQUFDLENBQUM7QUFFaEQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFxQztJQUN2RSxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQztRQUMzQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7UUFDNUIsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1FBQ2hCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBNkM7UUFDNUQscUJBQXFCLEVBQUUsS0FBSyxDQUFDLHFCQUFrRTtRQUMvRixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0tBQ3ZDLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3ZCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLEVBQUU7S0FDeEIsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBnZXRDb25maWdGcm9tRW52IH0gZnJvbSAnLi9lbnYtY29uZmlnJztcbmltcG9ydCB7IGNyZWF0ZVRva2VuSGFuZGxlciB9IGZyb20gJy4uL2hhbmRsZXJzL3Rva2VuJztcblxuY29uc3QgaGFuZGxlciA9IGNyZWF0ZVRva2VuSGFuZGxlcihnZXRDb25maWdGcm9tRW52KCkpO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbGFtYmRhSGFuZGxlcihldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50KTogUHJvbWlzZTxBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5UmVzdWx0PiB7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IGhhbmRsZXIoe1xuICAgIGh0dHBNZXRob2Q6IGV2ZW50Lmh0dHBNZXRob2QsXG4gICAgcGF0aDogZXZlbnQucGF0aCxcbiAgICBoZWFkZXJzOiBldmVudC5oZWFkZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4sXG4gICAgcXVlcnlTdHJpbmdQYXJhbWV0ZXJzOiBldmVudC5xdWVyeVN0cmluZ1BhcmFtZXRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPiB8IG51bGwsXG4gICAgYm9keTogZXZlbnQuYm9keSxcbiAgICBpc0Jhc2U2NEVuY29kZWQ6IGV2ZW50LmlzQmFzZTY0RW5jb2RlZCxcbiAgfSk7XG5cbiAgcmV0dXJuIHtcbiAgICBzdGF0dXNDb2RlOiByZXN1bHQuc3RhdHVzQ29kZSxcbiAgICBoZWFkZXJzOiByZXN1bHQuaGVhZGVycyxcbiAgICBib2R5OiByZXN1bHQuYm9keSA/PyAnJyxcbiAgfTtcbn1cblxuZXhwb3J0IHsgbGFtYmRhSGFuZGxlciBhcyBoYW5kbGVyIH07XG4iXX0=

package/lib/mcp-auth/mcp/errors.d.ts

@@ -0,0 +1,8 @@
+export declare class McpUnauthorizedError extends Error {
+    readonly challenge: string;
+    constructor(challenge: string, message?: string);
+}
+export declare class McpProtocolError extends Error {
+    readonly code: number;
+    constructor(code: number, message: string);
+}

package/lib/mcp-auth/mcp/errors.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpProtocolError = exports.McpUnauthorizedError = void 0;
+class McpUnauthorizedError extends Error {
+    constructor(challenge, message = 'Unauthorized') {
+        super(message);
+        this.name = 'McpUnauthorizedError';
+        this.challenge = challenge;
+    }
+}
+exports.McpUnauthorizedError = McpUnauthorizedError;
+class McpProtocolError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'McpProtocolError';
+        this.code = code;
+    }
+}
+exports.McpProtocolError = McpProtocolError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21jcC1hdXRoL21jcC9lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsTUFBYSxvQkFBcUIsU0FBUSxLQUFLO0lBRTdDLFlBQVksU0FBaUIsRUFBRSxPQUFPLEdBQUcsY0FBYztRQUNyRCxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDZixJQUFJLENBQUMsSUFBSSxHQUFHLHNCQUFzQixDQUFDO1FBQ25DLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQVBELG9EQU9DO0FBRUQsTUFBYSxnQkFBaUIsU0FBUSxLQUFLO0lBRXpDLFlBQVksSUFBWSxFQUFFLE9BQWU7UUFDdkMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxrQkFBa0IsQ0FBQztRQUMvQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztJQUNuQixDQUFDO0NBQ0Y7QUFQRCw0Q0FPQyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCBjbGFzcyBNY3BVbmF1dGhvcml6ZWRFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgcHVibGljIHJlYWRvbmx5IGNoYWxsZW5nZTogc3RyaW5nO1xuICBjb25zdHJ1Y3RvcihjaGFsbGVuZ2U6IHN0cmluZywgbWVzc2FnZSA9ICdVbmF1dGhvcml6ZWQnKSB7XG4gICAgc3VwZXIobWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ01jcFVuYXV0aG9yaXplZEVycm9yJztcbiAgICB0aGlzLmNoYWxsZW5nZSA9IGNoYWxsZW5nZTtcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgTWNwUHJvdG9jb2xFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgcHVibGljIHJlYWRvbmx5IGNvZGU6IG51bWJlcjtcbiAgY29uc3RydWN0b3IoY29kZTogbnVtYmVyLCBtZXNzYWdlOiBzdHJpbmcpIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnTWNwUHJvdG9jb2xFcnJvcic7XG4gICAgdGhpcy5jb2RlID0gY29kZTtcbiAgfVxufVxuIl19

package/lib/mcp-auth/mcp/index.d.ts

@@ -0,0 +1,4 @@
+export * from './errors';
+export * from './jsonrpc';
+export * from './server';
+export * from './types';

package/lib/mcp-auth/mcp/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./errors"), exports);
+__exportStar(require("./jsonrpc"), exports);
+__exportStar(require("./server"), exports);
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbWNwL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyQ0FBeUI7QUFDekIsNENBQTBCO0FBQzFCLDJDQUF5QjtBQUN6QiwwQ0FBd0IiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2Vycm9ycyc7XG5leHBvcnQgKiBmcm9tICcuL2pzb25ycGMnO1xuZXhwb3J0ICogZnJvbSAnLi9zZXJ2ZXInO1xuZXhwb3J0ICogZnJvbSAnLi90eXBlcyc7XG4iXX0=

package/lib/mcp-auth/mcp/jsonrpc.d.ts

@@ -0,0 +1,21 @@
+/** Standard JSON-RPC error codes. */
+export declare const PARSE_ERROR = -32700;
+export declare const INVALID_REQUEST = -32600;
+export declare const METHOD_NOT_FOUND = -32601;
+export declare const INVALID_PARAMS = -32602;
+export declare const INTERNAL_ERROR = -32603;
+export interface JsonRpcRequest {
+    jsonrpc: '2.0';
+    id?: unknown;
+    method: string;
+    params?: unknown;
+}
+/**
+ * Validate and parse a JSON-RPC request from a raw body value.
+ * Throws McpProtocolError if the body is malformed.
+ */
+export declare function parseJsonRpcRequest(body: unknown): JsonRpcRequest;
+/** Build a JSON-RPC success response object. */
+export declare function jsonRpcSuccess(id: unknown, result: unknown): object;
+/** Build a JSON-RPC error response object. */
+export declare function jsonRpcError(id: unknown, code: number, message: string, data?: unknown): object;

package/lib/mcp-auth/mcp/jsonrpc.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL_ERROR = exports.INVALID_PARAMS = exports.METHOD_NOT_FOUND = exports.INVALID_REQUEST = exports.PARSE_ERROR = void 0;
+exports.parseJsonRpcRequest = parseJsonRpcRequest;
+exports.jsonRpcSuccess = jsonRpcSuccess;
+exports.jsonRpcError = jsonRpcError;
+const errors_1 = require("./errors");
+/** Standard JSON-RPC error codes. */
+exports.PARSE_ERROR = -32700;
+exports.INVALID_REQUEST = -32600;
+exports.METHOD_NOT_FOUND = -32601;
+exports.INVALID_PARAMS = -32602;
+exports.INTERNAL_ERROR = -32603;
+/**
+ * Validate and parse a JSON-RPC request from a raw body value.
+ * Throws McpProtocolError if the body is malformed.
+ */
+function parseJsonRpcRequest(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        throw new errors_1.McpProtocolError(exports.INVALID_REQUEST, 'Request body must be a JSON object');
+    }
+    const obj = body;
+    if (obj.jsonrpc !== '2.0') {
+        throw new errors_1.McpProtocolError(exports.INVALID_REQUEST, 'Invalid or missing jsonrpc version, must be "2.0"');
+    }
+    if (typeof obj.method !== 'string' || obj.method.length === 0) {
+        throw new errors_1.McpProtocolError(exports.INVALID_REQUEST, 'Missing or invalid method field');
+    }
+    return {
+        jsonrpc: '2.0',
+        id: obj.id,
+        method: obj.method,
+        params: obj.params,
+    };
+}
+/** Build a JSON-RPC success response object. */
+function jsonRpcSuccess(id, result) {
+    return {
+        jsonrpc: '2.0',
+        id: id ?? null,
+        result,
+    };
+}
+/** Build a JSON-RPC error response object. */
+function jsonRpcError(id, code, message, data) {
+    const error = { code, message };
+    if (data !== undefined) {
+        error.data = data;
+    }
+    return {
+        jsonrpc: '2.0',
+        id: id ?? null,
+        error,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoianNvbnJwYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9tY3AvanNvbnJwYy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFvQkEsa0RBcUJDO0FBR0Qsd0NBTUM7QUFHRCxvQ0FVQztBQS9ERCxxQ0FBNEM7QUFFNUMscUNBQXFDO0FBQ3hCLFFBQUEsV0FBVyxHQUFHLENBQUMsS0FBSyxDQUFDO0FBQ3JCLFFBQUEsZUFBZSxHQUFHLENBQUMsS0FBSyxDQUFDO0FBQ3pCLFFBQUEsZ0JBQWdCLEdBQUcsQ0FBQyxLQUFLLENBQUM7QUFDMUIsUUFBQSxjQUFjLEdBQUcsQ0FBQyxLQUFLLENBQUM7QUFDeEIsUUFBQSxjQUFjLEdBQUcsQ0FBQyxLQUFLLENBQUM7QUFTckM7OztHQUdHO0FBQ0gsU0FBZ0IsbUJBQW1CLENBQUMsSUFBYTtJQUMvQyxJQUFJLElBQUksS0FBSyxJQUFJLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNyRSxNQUFNLElBQUkseUJBQWdCLENBQUMsdUJBQWUsRUFBRSxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFFRCxNQUFNLEdBQUcsR0FBRyxJQUErQixDQUFDO0lBRTVDLElBQUksR0FBRyxDQUFDLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUMxQixNQUFNLElBQUkseUJBQWdCLENBQUMsdUJBQWUsRUFBRSxtREFBbUQsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFFRCxJQUFJLE9BQU8sR0FBRyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDOUQsTUFBTSxJQUFJLHlCQUFnQixDQUFDLHVCQUFlLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBRUQsT0FBTztRQUNMLE9BQU8sRUFBRSxLQUFLO1FBQ2QsRUFBRSxFQUFFLEdBQUcsQ0FBQyxFQUFFO1FBQ1YsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO1FBQ2xCLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtLQUNuQixDQUFDO0FBQ0osQ0FBQztBQUVELGdEQUFnRDtBQUNoRCxTQUFnQixjQUFjLENBQUMsRUFBVyxFQUFFLE1BQWU7SUFDekQsT0FBTztRQUNMLE9BQU8sRUFBRSxLQUFLO1FBQ2QsRUFBRSxFQUFFLEVBQUUsSUFBSSxJQUFJO1FBQ2QsTUFBTTtLQUNQLENBQUM7QUFDSixDQUFDO0FBRUQsOENBQThDO0FBQzlDLFNBQWdCLFlBQVksQ0FBQyxFQUFXLEVBQUUsSUFBWSxFQUFFLE9BQWUsRUFBRSxJQUFjO0lBQ3JGLE1BQU0sS0FBSyxHQUE0QixFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUN6RCxJQUFJLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN2QixLQUFLLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztJQUNwQixDQUFDO0lBQ0QsT0FBTztRQUNMLE9BQU8sRUFBRSxLQUFLO1FBQ2QsRUFBRSxFQUFFLEVBQUUsSUFBSSxJQUFJO1FBQ2QsS0FBSztLQUNOLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgTWNwUHJvdG9jb2xFcnJvciB9IGZyb20gJy4vZXJyb3JzJztcblxuLyoqIFN0YW5kYXJkIEpTT04tUlBDIGVycm9yIGNvZGVzLiAqL1xuZXhwb3J0IGNvbnN0IFBBUlNFX0VSUk9SID0gLTMyNzAwO1xuZXhwb3J0IGNvbnN0IElOVkFMSURfUkVRVUVTVCA9IC0zMjYwMDtcbmV4cG9ydCBjb25zdCBNRVRIT0RfTk9UX0ZPVU5EID0gLTMyNjAxO1xuZXhwb3J0IGNvbnN0IElOVkFMSURfUEFSQU1TID0gLTMyNjAyO1xuZXhwb3J0IGNvbnN0IElOVEVSTkFMX0VSUk9SID0gLTMyNjAzO1xuXG5leHBvcnQgaW50ZXJmYWNlIEpzb25ScGNSZXF1ZXN0IHtcbiAganNvbnJwYzogJzIuMCc7XG4gIGlkPzogdW5rbm93bjtcbiAgbWV0aG9kOiBzdHJpbmc7XG4gIHBhcmFtcz86IHVua25vd247XG59XG5cbi8qKlxuICogVmFsaWRhdGUgYW5kIHBhcnNlIGEgSlNPTi1SUEMgcmVxdWVzdCBmcm9tIGEgcmF3IGJvZHkgdmFsdWUuXG4gKiBUaHJvd3MgTWNwUHJvdG9jb2xFcnJvciBpZiB0aGUgYm9keSBpcyBtYWxmb3JtZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBwYXJzZUpzb25ScGNSZXF1ZXN0KGJvZHk6IHVua25vd24pOiBKc29uUnBjUmVxdWVzdCB7XG4gIGlmIChib2R5ID09PSBudWxsIHx8IHR5cGVvZiBib2R5ICE9PSAnb2JqZWN0JyB8fCBBcnJheS5pc0FycmF5KGJvZHkpKSB7XG4gICAgdGhyb3cgbmV3IE1jcFByb3RvY29sRXJyb3IoSU5WQUxJRF9SRVFVRVNULCAnUmVxdWVzdCBib2R5IG11c3QgYmUgYSBKU09OIG9iamVjdCcpO1xuICB9XG5cbiAgY29uc3Qgb2JqID0gYm9keSBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcblxuICBpZiAob2JqLmpzb25ycGMgIT09ICcyLjAnKSB7XG4gICAgdGhyb3cgbmV3IE1jcFByb3RvY29sRXJyb3IoSU5WQUxJRF9SRVFVRVNULCAnSW52YWxpZCBvciBtaXNzaW5nIGpzb25ycGMgdmVyc2lvbiwgbXVzdCBiZSBcIjIuMFwiJyk7XG4gIH1cblxuICBpZiAodHlwZW9mIG9iai5tZXRob2QgIT09ICdzdHJpbmcnIHx8IG9iai5tZXRob2QubGVuZ3RoID09PSAwKSB7XG4gICAgdGhyb3cgbmV3IE1jcFByb3RvY29sRXJyb3IoSU5WQUxJRF9SRVFVRVNULCAnTWlzc2luZyBvciBpbnZhbGlkIG1ldGhvZCBmaWVsZCcpO1xuICB9XG5cbiAgcmV0dXJuIHtcbiAgICBqc29ucnBjOiAnMi4wJyxcbiAgICBpZDogb2JqLmlkLFxuICAgIG1ldGhvZDogb2JqLm1ldGhvZCxcbiAgICBwYXJhbXM6IG9iai5wYXJhbXMsXG4gIH07XG59XG5cbi8qKiBCdWlsZCBhIEpTT04tUlBDIHN1Y2Nlc3MgcmVzcG9uc2Ugb2JqZWN0LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGpzb25ScGNTdWNjZXNzKGlkOiB1bmtub3duLCByZXN1bHQ6IHVua25vd24pOiBvYmplY3Qge1xuICByZXR1cm4ge1xuICAgIGpzb25ycGM6ICcyLjAnLFxuICAgIGlkOiBpZCA/PyBudWxsLFxuICAgIHJlc3VsdCxcbiAgfTtcbn1cblxuLyoqIEJ1aWxkIGEgSlNPTi1SUEMgZXJyb3IgcmVzcG9uc2Ugb2JqZWN0LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGpzb25ScGNFcnJvcihpZDogdW5rbm93biwgY29kZTogbnVtYmVyLCBtZXNzYWdlOiBzdHJpbmcsIGRhdGE/OiB1bmtub3duKTogb2JqZWN0IHtcbiAgY29uc3QgZXJyb3I6IFJlY29yZDxzdHJpbmcsIHVua25vd24+ID0geyBjb2RlLCBtZXNzYWdlIH07XG4gIGlmIChkYXRhICE9PSB1bmRlZmluZWQpIHtcbiAgICBlcnJvci5kYXRhID0gZGF0YTtcbiAgfVxuICByZXR1cm4ge1xuICAgIGpzb25ycGM6ICcyLjAnLFxuICAgIGlkOiBpZCA/PyBudWxsLFxuICAgIGVycm9yLFxuICB9O1xufVxuIl19

package/lib/mcp-auth/mcp/server.d.ts

@@ -0,0 +1,9 @@
+import type { McpResponse, McpServerOptions } from './types';
+export interface McpServerHandle {
+    handle(body: unknown, headers: Record<string, string | undefined>): Promise<McpResponse>;
+}
+/**
+ * Creates an MCP JSON-RPC server that authenticates callers,
+ * advertises tools, and dispatches tool invocations.
+ */
+export declare function createMcpServer<TPrincipal>(options: McpServerOptions<TPrincipal>): McpServerHandle;

package/lib/mcp-auth/mcp/server.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpServer = createMcpServer;
+const errors_1 = require("./errors");
+const jsonrpc_1 = require("./jsonrpc");
+/**
+ * Creates an MCP JSON-RPC server that authenticates callers,
+ * advertises tools, and dispatches tool invocations.
+ */
+function createMcpServer(options) {
+    return { handle };
+    async function handle(body, headers) {
+        // 1. Resolve credentials
+        let principal;
+        try {
+            principal = await options.resolver.resolve(headers);
+        }
+        catch (err) {
+            if (err instanceof errors_1.McpUnauthorizedError) {
+                return {
+                    statusCode: 401,
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'WWW-Authenticate': err.challenge,
+                    },
+                    body: JSON.stringify({ error: err.message }),
+                };
+            }
+            throw err;
+        }
+        // 2. Parse JSON-RPC request
+        let request;
+        try {
+            request = (0, jsonrpc_1.parseJsonRpcRequest)(body);
+        }
+        catch (err) {
+            const code = err.code ?? -32600;
+            const message = err.message ?? 'Invalid request';
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(null, code, message));
+        }
+        // 3. Dispatch on method
+        const { id, method, params } = request;
+        switch (method) {
+            case 'initialize':
+                return handleInitialize(id, params);
+            case 'notifications/initialized':
+                return { statusCode: 202, headers: { 'Content-Type': 'application/json' }, body: '' };
+            case 'tools/list':
+                return handleToolsList(id, principal);
+            case 'tools/call':
+                return handleToolsCall(id, principal, params);
+            default:
+                return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.METHOD_NOT_FOUND, `Method not found: ${method}`));
+        }
+    }
+    function handleInitialize(id, params) {
+        const clientVersion = params?.protocolVersion;
+        if (!clientVersion || !options.protocolVersions.includes(clientVersion)) {
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INVALID_PARAMS, `Unsupported protocol version. Supported: ${options.protocolVersions.join(', ')}`));
+        }
+        return jsonResponse(200, (0, jsonrpc_1.jsonRpcSuccess)(id, {
+            protocolVersion: clientVersion,
+            capabilities: { tools: {} },
+            serverInfo: options.serverInfo,
+        }));
+    }
+    async function handleToolsList(id, principal) {
+        const tools = await Promise.all(options.tools.map(async (tool) => {
+            const description = typeof tool.description === 'function'
+                ? await tool.description(principal)
+                : tool.description;
+            return {
+                name: tool.name,
+                description,
+                inputSchema: tool.inputSchema,
+            };
+        }));
+        return jsonResponse(200, (0, jsonrpc_1.jsonRpcSuccess)(id, { tools }));
+    }
+    async function handleToolsCall(id, principal, params) {
+        const p = params;
+        const toolName = p?.name;
+        if (!toolName) {
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INVALID_PARAMS, 'Missing params.name'));
+        }
+        const tool = options.tools.find((t) => t.name === toolName);
+        if (!tool) {
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INVALID_PARAMS, `Unknown tool: ${toolName}`));
+        }
+        try {
+            const result = await tool.invoke(principal, p?.arguments);
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcSuccess)(id, result));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Internal error';
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INTERNAL_ERROR, message));
+        }
+    }
+    function jsonResponse(statusCode, body) {
+        return {
+            statusCode,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21jcC1hdXRoL21jcC9zZXJ2ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFZQSwwQ0E2R0M7QUF6SEQscUNBQWdEO0FBQ2hELHVDQUFnSTtBQU9oSTs7O0dBR0c7QUFDSCxTQUFnQixlQUFlLENBQWEsT0FBcUM7SUFDL0UsT0FBTyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBRWxCLEtBQUssVUFBVSxNQUFNLENBQUMsSUFBYSxFQUFFLE9BQTJDO1FBQzlFLHlCQUF5QjtRQUN6QixJQUFJLFNBQXFCLENBQUM7UUFDMUIsSUFBSSxDQUFDO1lBQ0gsU0FBUyxHQUFHLE1BQU0sT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixJQUFJLEdBQUcsWUFBWSw2QkFBb0IsRUFBRSxDQUFDO2dCQUN4QyxPQUFPO29CQUNMLFVBQVUsRUFBRSxHQUFHO29CQUNmLE9BQU8sRUFBRTt3QkFDUCxjQUFjLEVBQUUsa0JBQWtCO3dCQUNsQyxrQkFBa0IsRUFBRSxHQUFHLENBQUMsU0FBUztxQkFDbEM7b0JBQ0QsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDO2lCQUM3QyxDQUFDO1lBQ0osQ0FBQztZQUNELE1BQU0sR0FBRyxDQUFDO1FBQ1osQ0FBQztRQUVELDRCQUE0QjtRQUM1QixJQUFJLE9BQU8sQ0FBQztRQUNaLElBQUksQ0FBQztZQUNILE9BQU8sR0FBRyxJQUFBLDZCQUFtQixFQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFBQyxPQUFPLEdBQVksRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxHQUFJLEdBQXlCLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDO1lBQ3ZELE1BQU0sT0FBTyxHQUFJLEdBQTRCLENBQUMsT0FBTyxJQUFJLGlCQUFpQixDQUFDO1lBQzNFLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFFRCx3QkFBd0I7UUFDeEIsTUFBTSxFQUFFLEVBQUUsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsT0FBTyxDQUFDO1FBRXZDLFFBQVEsTUFBTSxFQUFFLENBQUM7WUFDZixLQUFLLFlBQVk7Z0JBQ2YsT0FBTyxnQkFBZ0IsQ0FBQyxFQUFFLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDdEMsS0FBSywyQkFBMkI7Z0JBQzlCLE9BQU8sRUFBRSxVQUFVLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUN4RixLQUFLLFlBQVk7Z0JBQ2YsT0FBTyxlQUFlLENBQUMsRUFBRSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1lBQ3hDLEtBQUssWUFBWTtnQkFDZixPQUFPLGVBQWUsQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2hEO2dCQUNFLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsRUFBRSxFQUFFLDBCQUFnQixFQUFFLHFCQUFxQixNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDaEcsQ0FBQztJQUNILENBQUM7SUFFRCxTQUFTLGdCQUFnQixDQUFDLEVBQVcsRUFBRSxNQUFlO1FBQ3BELE1BQU0sYUFBYSxHQUFJLE1BQThDLEVBQUUsZUFBcUMsQ0FBQztRQUU3RyxJQUFJLENBQUMsYUFBYSxJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1lBQ3hFLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsRUFBRSxFQUFFLHdCQUFjLEVBQUUsNENBQTRDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDaEosQ0FBQztRQUVELE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHdCQUFjLEVBQUMsRUFBRSxFQUFFO1lBQzFDLGVBQWUsRUFBRSxhQUFhO1lBQzlCLFlBQVksRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDM0IsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO1NBQy9CLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVELEtBQUssVUFBVSxlQUFlLENBQUMsRUFBVyxFQUFFLFNBQXFCO1FBQy9ELE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FDN0IsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQy9CLE1BQU0sV0FBVyxHQUFHLE9BQU8sSUFBSSxDQUFDLFdBQVcsS0FBSyxVQUFVO2dCQUN4RCxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQztnQkFDbkMsQ0FBQyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUM7WUFDckIsT0FBTztnQkFDTCxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsV0FBVztnQkFDWCxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7YUFDOUIsQ0FBQztRQUNKLENBQUMsQ0FBQyxDQUNILENBQUM7UUFFRixPQUFPLFlBQVksQ0FBQyxHQUFHLEVBQUUsSUFBQSx3QkFBYyxFQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBRUQsS0FBSyxVQUFVLGVBQWUsQ0FBQyxFQUFXLEVBQUUsU0FBcUIsRUFBRSxNQUFlO1FBQ2hGLE1BQU0sQ0FBQyxHQUFHLE1BQTZDLENBQUM7UUFDeEQsTUFBTSxRQUFRLEdBQUcsQ0FBQyxFQUFFLElBQTBCLENBQUM7UUFFL0MsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2QsT0FBTyxZQUFZLENBQUMsR0FBRyxFQUFFLElBQUEsc0JBQVksRUFBQyxFQUFFLEVBQUUsd0JBQWMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUVELE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxDQUFDO1FBQzVELElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNWLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsRUFBRSxFQUFFLHdCQUFjLEVBQUUsaUJBQWlCLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBRUQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDMUQsT0FBTyxZQUFZLENBQUMsR0FBRyxFQUFFLElBQUEsd0JBQWMsRUFBQyxFQUFFLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztZQUN0QixNQUFNLE9BQU8sR0FBRyxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQztZQUN0RSxPQUFPLFlBQVksQ0FBQyxHQUFHLEVBQUUsSUFBQSxzQkFBWSxFQUFDLEVBQUUsRUFBRSx3QkFBYyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDdEUsQ0FBQztJQUNILENBQUM7SUFFRCxTQUFTLFlBQVksQ0FBQyxVQUFrQixFQUFFLElBQVk7UUFDcEQsT0FBTztZQUNMLFVBQVU7WUFDVixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7WUFDL0MsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDO1NBQzNCLENBQUM7SUFDSixDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IE1jcFVuYXV0aG9yaXplZEVycm9yIH0gZnJvbSAnLi9lcnJvcnMnO1xuaW1wb3J0IHsganNvblJwY0Vycm9yLCBqc29uUnBjU3VjY2VzcywgSU5URVJOQUxfRVJST1IsIElOVkFMSURfUEFSQU1TLCBNRVRIT0RfTk9UX0ZPVU5ELCBwYXJzZUpzb25ScGNSZXF1ZXN0IH0gZnJvbSAnLi9qc29ucnBjJztcbmltcG9ydCB0eXBlIHsgTWNwUmVzcG9uc2UsIE1jcFNlcnZlck9wdGlvbnMgfSBmcm9tICcuL3R5cGVzJztcblxuZXhwb3J0IGludGVyZmFjZSBNY3BTZXJ2ZXJIYW5kbGUge1xuICBoYW5kbGUoYm9keTogdW5rbm93biwgaGVhZGVyczogUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPik6IFByb21pc2U8TWNwUmVzcG9uc2U+O1xufVxuXG4vKipcbiAqIENyZWF0ZXMgYW4gTUNQIEpTT04tUlBDIHNlcnZlciB0aGF0IGF1dGhlbnRpY2F0ZXMgY2FsbGVycyxcbiAqIGFkdmVydGlzZXMgdG9vbHMsIGFuZCBkaXNwYXRjaGVzIHRvb2wgaW52b2NhdGlvbnMuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVNY3BTZXJ2ZXI8VFByaW5jaXBhbD4ob3B0aW9uczogTWNwU2VydmVyT3B0aW9uczxUUHJpbmNpcGFsPik6IE1jcFNlcnZlckhhbmRsZSB7XG4gIHJldHVybiB7IGhhbmRsZSB9O1xuXG4gIGFzeW5jIGZ1bmN0aW9uIGhhbmRsZShib2R5OiB1bmtub3duLCBoZWFkZXJzOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+KTogUHJvbWlzZTxNY3BSZXNwb25zZT4ge1xuICAgIC8vIDEuIFJlc29sdmUgY3JlZGVudGlhbHNcbiAgICBsZXQgcHJpbmNpcGFsOiBUUHJpbmNpcGFsO1xuICAgIHRyeSB7XG4gICAgICBwcmluY2lwYWwgPSBhd2FpdCBvcHRpb25zLnJlc29sdmVyLnJlc29sdmUoaGVhZGVycyk7XG4gICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICBpZiAoZXJyIGluc3RhbmNlb2YgTWNwVW5hdXRob3JpemVkRXJyb3IpIHtcbiAgICAgICAgcmV0dXJuIHtcbiAgICAgICAgICBzdGF0dXNDb2RlOiA0MDEsXG4gICAgICAgICAgaGVhZGVyczoge1xuICAgICAgICAgICAgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyxcbiAgICAgICAgICAgICdXV1ctQXV0aGVudGljYXRlJzogZXJyLmNoYWxsZW5nZSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIGJvZHk6IEpTT04uc3RyaW5naWZ5KHsgZXJyb3I6IGVyci5tZXNzYWdlIH0pLFxuICAgICAgICB9O1xuICAgICAgfVxuICAgICAgdGhyb3cgZXJyO1xuICAgIH1cblxuICAgIC8vIDIuIFBhcnNlIEpTT04tUlBDIHJlcXVlc3RcbiAgICBsZXQgcmVxdWVzdDtcbiAgICB0cnkge1xuICAgICAgcmVxdWVzdCA9IHBhcnNlSnNvblJwY1JlcXVlc3QoYm9keSk7XG4gICAgfSBjYXRjaCAoZXJyOiB1bmtub3duKSB7XG4gICAgICBjb25zdCBjb2RlID0gKGVyciBhcyB7IGNvZGU/OiBudW1iZXIgfSkuY29kZSA/PyAtMzI2MDA7XG4gICAgICBjb25zdCBtZXNzYWdlID0gKGVyciBhcyB7IG1lc3NhZ2U/OiBzdHJpbmcgfSkubWVzc2FnZSA/PyAnSW52YWxpZCByZXF1ZXN0JztcbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoMjAwLCBqc29uUnBjRXJyb3IobnVsbCwgY29kZSwgbWVzc2FnZSkpO1xuICAgIH1cblxuICAgIC8vIDMuIERpc3BhdGNoIG9uIG1ldGhvZFxuICAgIGNvbnN0IHsgaWQsIG1ldGhvZCwgcGFyYW1zIH0gPSByZXF1ZXN0O1xuXG4gICAgc3dpdGNoIChtZXRob2QpIHtcbiAgICAgIGNhc2UgJ2luaXRpYWxpemUnOlxuICAgICAgICByZXR1cm4gaGFuZGxlSW5pdGlhbGl6ZShpZCwgcGFyYW1zKTtcbiAgICAgIGNhc2UgJ25vdGlmaWNhdGlvbnMvaW5pdGlhbGl6ZWQnOlxuICAgICAgICByZXR1cm4geyBzdGF0dXNDb2RlOiAyMDIsIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LCBib2R5OiAnJyB9O1xuICAgICAgY2FzZSAndG9vbHMvbGlzdCc6XG4gICAgICAgIHJldHVybiBoYW5kbGVUb29sc0xpc3QoaWQsIHByaW5jaXBhbCk7XG4gICAgICBjYXNlICd0b29scy9jYWxsJzpcbiAgICAgICAgcmV0dXJuIGhhbmRsZVRvb2xzQ2FsbChpZCwgcHJpbmNpcGFsLCBwYXJhbXMpO1xuICAgICAgZGVmYXVsdDpcbiAgICAgICAgcmV0dXJuIGpzb25SZXNwb25zZSgyMDAsIGpzb25ScGNFcnJvcihpZCwgTUVUSE9EX05PVF9GT1VORCwgYE1ldGhvZCBub3QgZm91bmQ6ICR7bWV0aG9kfWApKTtcbiAgICB9XG4gIH1cblxuICBmdW5jdGlvbiBoYW5kbGVJbml0aWFsaXplKGlkOiB1bmtub3duLCBwYXJhbXM6IHVua25vd24pOiBNY3BSZXNwb25zZSB7XG4gICAgY29uc3QgY2xpZW50VmVyc2lvbiA9IChwYXJhbXMgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj4gfCB1bmRlZmluZWQpPy5wcm90b2NvbFZlcnNpb24gYXMgc3RyaW5nIHwgdW5kZWZpbmVkO1xuXG4gICAgaWYgKCFjbGllbnRWZXJzaW9uIHx8ICFvcHRpb25zLnByb3RvY29sVmVyc2lvbnMuaW5jbHVkZXMoY2xpZW50VmVyc2lvbikpIHtcbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoMjAwLCBqc29uUnBjRXJyb3IoaWQsIElOVkFMSURfUEFSQU1TLCBgVW5zdXBwb3J0ZWQgcHJvdG9jb2wgdmVyc2lvbi4gU3VwcG9ydGVkOiAke29wdGlvbnMucHJvdG9jb2xWZXJzaW9ucy5qb2luKCcsICcpfWApKTtcbiAgICB9XG5cbiAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY1N1Y2Nlc3MoaWQsIHtcbiAgICAgIHByb3RvY29sVmVyc2lvbjogY2xpZW50VmVyc2lvbixcbiAgICAgIGNhcGFiaWxpdGllczogeyB0b29sczoge30gfSxcbiAgICAgIHNlcnZlckluZm86IG9wdGlvbnMuc2VydmVySW5mbyxcbiAgICB9KSk7XG4gIH1cblxuICBhc3luYyBmdW5jdGlvbiBoYW5kbGVUb29sc0xpc3QoaWQ6IHVua25vd24sIHByaW5jaXBhbDogVFByaW5jaXBhbCk6IFByb21pc2U8TWNwUmVzcG9uc2U+IHtcbiAgICBjb25zdCB0b29scyA9IGF3YWl0IFByb21pc2UuYWxsKFxuICAgICAgb3B0aW9ucy50b29scy5tYXAoYXN5bmMgKHRvb2wpID0+IHtcbiAgICAgICAgY29uc3QgZGVzY3JpcHRpb24gPSB0eXBlb2YgdG9vbC5kZXNjcmlwdGlvbiA9PT0gJ2Z1bmN0aW9uJ1xuICAgICAgICAgID8gYXdhaXQgdG9vbC5kZXNjcmlwdGlvbihwcmluY2lwYWwpXG4gICAgICAgICAgOiB0b29sLmRlc2NyaXB0aW9uO1xuICAgICAgICByZXR1cm4ge1xuICAgICAgICAgIG5hbWU6IHRvb2wubmFtZSxcbiAgICAgICAgICBkZXNjcmlwdGlvbixcbiAgICAgICAgICBpbnB1dFNjaGVtYTogdG9vbC5pbnB1dFNjaGVtYSxcbiAgICAgICAgfTtcbiAgICAgIH0pLFxuICAgICk7XG5cbiAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY1N1Y2Nlc3MoaWQsIHsgdG9vbHMgfSkpO1xuICB9XG5cbiAgYXN5bmMgZnVuY3Rpb24gaGFuZGxlVG9vbHNDYWxsKGlkOiB1bmtub3duLCBwcmluY2lwYWw6IFRQcmluY2lwYWwsIHBhcmFtczogdW5rbm93bik6IFByb21pc2U8TWNwUmVzcG9uc2U+IHtcbiAgICBjb25zdCBwID0gcGFyYW1zIGFzIFJlY29yZDxzdHJpbmcsIHVua25vd24+IHwgdW5kZWZpbmVkO1xuICAgIGNvbnN0IHRvb2xOYW1lID0gcD8ubmFtZSBhcyBzdHJpbmcgfCB1bmRlZmluZWQ7XG5cbiAgICBpZiAoIXRvb2xOYW1lKSB7XG4gICAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY0Vycm9yKGlkLCBJTlZBTElEX1BBUkFNUywgJ01pc3NpbmcgcGFyYW1zLm5hbWUnKSk7XG4gICAgfVxuXG4gICAgY29uc3QgdG9vbCA9IG9wdGlvbnMudG9vbHMuZmluZCgodCkgPT4gdC5uYW1lID09PSB0b29sTmFtZSk7XG4gICAgaWYgKCF0b29sKSB7XG4gICAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY0Vycm9yKGlkLCBJTlZBTElEX1BBUkFNUywgYFVua25vd24gdG9vbDogJHt0b29sTmFtZX1gKSk7XG4gICAgfVxuXG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHRvb2wuaW52b2tlKHByaW5jaXBhbCwgcD8uYXJndW1lbnRzKTtcbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoMjAwLCBqc29uUnBjU3VjY2VzcyhpZCwgcmVzdWx0KSk7XG4gICAgfSBjYXRjaCAoZXJyOiB1bmtub3duKSB7XG4gICAgICBjb25zdCBtZXNzYWdlID0gZXJyIGluc3RhbmNlb2YgRXJyb3IgPyBlcnIubWVzc2FnZSA6ICdJbnRlcm5hbCBlcnJvcic7XG4gICAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY0Vycm9yKGlkLCBJTlRFUk5BTF9FUlJPUiwgbWVzc2FnZSkpO1xuICAgIH1cbiAgfVxuXG4gIGZ1bmN0aW9uIGpzb25SZXNwb25zZShzdGF0dXNDb2RlOiBudW1iZXIsIGJvZHk6IG9iamVjdCk6IE1jcFJlc3BvbnNlIHtcbiAgICByZXR1cm4ge1xuICAgICAgc3RhdHVzQ29kZSxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgYm9keTogSlNPTi5zdHJpbmdpZnkoYm9keSksXG4gICAgfTtcbiAgfVxufVxuIl19

package/lib/mcp-auth/mcp/types.d.ts

@@ -0,0 +1,32 @@
+export interface McpToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}
+export interface McpToolDefinition<TPrincipal> {
+    name: string;
+    /** Static text, or resolved per-caller (e.g., personalized source hints). */
+    description: string | ((principal: TPrincipal) => Promise<string>);
+    inputSchema: object;
+    invoke(principal: TPrincipal, args: unknown): Promise<McpToolResult>;
+}
+export interface McpCredentialResolver<TPrincipal> {
+    /** Throws McpUnauthorizedError when credentials are missing/invalid. */
+    resolve(headers: Record<string, string | undefined>): Promise<TPrincipal>;
+}
+export interface McpServerOptions<TPrincipal> {
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+    protocolVersions: string[];
+    resolver: McpCredentialResolver<TPrincipal>;
+    tools: Array<McpToolDefinition<TPrincipal>>;
+}
+export interface McpResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+}

package/lib/mcp-auth/mcp/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbWNwL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgaW50ZXJmYWNlIE1jcFRvb2xSZXN1bHQge1xuICBjb250ZW50OiBBcnJheTx7IHR5cGU6ICd0ZXh0JzsgdGV4dDogc3RyaW5nIH0+O1xuICBpc0Vycm9yPzogYm9vbGVhbjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BUb29sRGVmaW5pdGlvbjxUUHJpbmNpcGFsPiB7XG4gIG5hbWU6IHN0cmluZztcbiAgLyoqIFN0YXRpYyB0ZXh0LCBvciByZXNvbHZlZCBwZXItY2FsbGVyIChlLmcuLCBwZXJzb25hbGl6ZWQgc291cmNlIGhpbnRzKS4gKi9cbiAgZGVzY3JpcHRpb246IHN0cmluZyB8ICgocHJpbmNpcGFsOiBUUHJpbmNpcGFsKSA9PiBQcm9taXNlPHN0cmluZz4pO1xuICBpbnB1dFNjaGVtYTogb2JqZWN0OyAvLyBKU09OIFNjaGVtYVxuICBpbnZva2UocHJpbmNpcGFsOiBUUHJpbmNpcGFsLCBhcmdzOiB1bmtub3duKTogUHJvbWlzZTxNY3BUb29sUmVzdWx0Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BDcmVkZW50aWFsUmVzb2x2ZXI8VFByaW5jaXBhbD4ge1xuICAvKiogVGhyb3dzIE1jcFVuYXV0aG9yaXplZEVycm9yIHdoZW4gY3JlZGVudGlhbHMgYXJlIG1pc3NpbmcvaW52YWxpZC4gKi9cbiAgcmVzb2x2ZShoZWFkZXJzOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+KTogUHJvbWlzZTxUUHJpbmNpcGFsPjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BTZXJ2ZXJPcHRpb25zPFRQcmluY2lwYWw+IHtcbiAgc2VydmVySW5mbzogeyBuYW1lOiBzdHJpbmc7IHZlcnNpb246IHN0cmluZyB9O1xuICBwcm90b2NvbFZlcnNpb25zOiBzdHJpbmdbXTsgLy8gU3VwcG9ydGVkIHZlcnNpb25zLCBuZXdlc3QgZmlyc3RcbiAgcmVzb2x2ZXI6IE1jcENyZWRlbnRpYWxSZXNvbHZlcjxUUHJpbmNpcGFsPjtcbiAgdG9vbHM6IEFycmF5PE1jcFRvb2xEZWZpbml0aW9uPFRQcmluY2lwYWw+Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BSZXNwb25zZSB7XG4gIHN0YXR1c0NvZGU6IG51bWJlcjtcbiAgaGVhZGVyczogUmVjb3JkPHN0cmluZywgc3RyaW5nPjtcbiAgYm9keTogc3RyaW5nO1xufVxuIl19