cdk-serverless 3.2.1 → 3.3.1

package/lib/mcp-auth/handlers/authorize.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthorizeHandler = createAuthorizeHandler;
+/**
+ * Factory for the `/oauth/authorize` proxy endpoint.
+ * Strips configured parameters (default: 'resource') before redirecting
+ * to the upstream authorization endpoint.
+ */
+function createAuthorizeHandler(config) {
+    return async (event) => {
+        const params = new URLSearchParams(event.queryStringParameters);
+        // Strip unsupported parameters (e.g. RFC 8707 'resource')
+        const stripParams = config.stripParameters ?? ['resource'];
+        for (const param of stripParams) {
+            params.delete(param);
+        }
+        const upstreamUrl = `${config.authorizeEndpoint}?${params.toString()}`;
+        console.log(JSON.stringify({
+            event: 'oauth-authorize-proxy',
+            upstreamUrl,
+            strippedParams: stripParams.filter(p => event.queryStringParameters?.[p]),
+        }));
+        return {
+            statusCode: 302,
+            headers: {
+                'Location': upstreamUrl,
+                'Cache-Control': 'no-cache, no-store',
+            },
+        };
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21jcC1hdXRoL2hhbmRsZXJzL2F1dGhvcml6ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQVFBLHdEQTBCQztBQS9CRDs7OztHQUlHO0FBQ0gsU0FBZ0Isc0JBQXNCLENBQUMsTUFBcUI7SUFDMUQsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUE2QixFQUFFO1FBQ2hELE1BQU0sTUFBTSxHQUFHLElBQUksZUFBZSxDQUFDLEtBQUssQ0FBQyxxQkFBK0MsQ0FBQyxDQUFDO1FBRTFGLDBEQUEwRDtRQUMxRCxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsZUFBZSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDM0QsS0FBSyxNQUFNLEtBQUssSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNoQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7UUFFRCxNQUFNLFdBQVcsR0FBRyxHQUFHLE1BQU0sQ0FBQyxpQkFBaUIsSUFBSSxNQUFNLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQztRQUV2RSxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDekIsS0FBSyxFQUFFLHVCQUF1QjtZQUM5QixXQUFXO1lBQ1gsY0FBYyxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMscUJBQXFCLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztTQUMxRSxDQUFDLENBQUMsQ0FBQztRQUVKLE9BQU87WUFDTCxVQUFVLEVBQUUsR0FBRztZQUNmLE9BQU8sRUFBRTtnQkFDUCxVQUFVLEVBQUUsV0FBVztnQkFDdkIsZUFBZSxFQUFFLG9CQUFvQjthQUN0QztTQUNGLENBQUM7SUFDSixDQUFDLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHR5cGUgeyBNY3BBdXRoQ29uZmlnIH0gZnJvbSAnLi4vY29uZmlnJztcbmltcG9ydCB0eXBlIHsgTWNwT0F1dGhIYW5kbGVyLCBNY3BPQXV0aFJlc3BvbnNlIH0gZnJvbSAnLi90eXBlcyc7XG5cbi8qKlxuICogRmFjdG9yeSBmb3IgdGhlIGAvb2F1dGgvYXV0aG9yaXplYCBwcm94eSBlbmRwb2ludC5cbiAqIFN0cmlwcyBjb25maWd1cmVkIHBhcmFtZXRlcnMgKGRlZmF1bHQ6ICdyZXNvdXJjZScpIGJlZm9yZSByZWRpcmVjdGluZ1xuICogdG8gdGhlIHVwc3RyZWFtIGF1dGhvcml6YXRpb24gZW5kcG9pbnQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVBdXRob3JpemVIYW5kbGVyKGNvbmZpZzogTWNwQXV0aENvbmZpZyk6IE1jcE9BdXRoSGFuZGxlciB7XG4gIHJldHVybiBhc3luYyAoZXZlbnQpOiBQcm9taXNlPE1jcE9BdXRoUmVzcG9uc2U+ID0+IHtcbiAgICBjb25zdCBwYXJhbXMgPSBuZXcgVVJMU2VhcmNoUGFyYW1zKGV2ZW50LnF1ZXJ5U3RyaW5nUGFyYW1ldGVycyBhcyBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+KTtcblxuICAgIC8vIFN0cmlwIHVuc3VwcG9ydGVkIHBhcmFtZXRlcnMgKGUuZy4gUkZDIDg3MDcgJ3Jlc291cmNlJylcbiAgICBjb25zdCBzdHJpcFBhcmFtcyA9IGNvbmZpZy5zdHJpcFBhcmFtZXRlcnMgPz8gWydyZXNvdXJjZSddO1xuICAgIGZvciAoY29uc3QgcGFyYW0gb2Ygc3RyaXBQYXJhbXMpIHtcbiAgICAgIHBhcmFtcy5kZWxldGUocGFyYW0pO1xuICAgIH1cblxuICAgIGNvbnN0IHVwc3RyZWFtVXJsID0gYCR7Y29uZmlnLmF1dGhvcml6ZUVuZHBvaW50fT8ke3BhcmFtcy50b1N0cmluZygpfWA7XG5cbiAgICBjb25zb2xlLmxvZyhKU09OLnN0cmluZ2lmeSh7XG4gICAgICBldmVudDogJ29hdXRoLWF1dGhvcml6ZS1wcm94eScsXG4gICAgICB1cHN0cmVhbVVybCxcbiAgICAgIHN0cmlwcGVkUGFyYW1zOiBzdHJpcFBhcmFtcy5maWx0ZXIocCA9PiBldmVudC5xdWVyeVN0cmluZ1BhcmFtZXRlcnM/LltwXSksXG4gICAgfSkpO1xuXG4gICAgcmV0dXJuIHtcbiAgICAgIHN0YXR1c0NvZGU6IDMwMixcbiAgICAgIGhlYWRlcnM6IHtcbiAgICAgICAgJ0xvY2F0aW9uJzogdXBzdHJlYW1VcmwsXG4gICAgICAgICdDYWNoZS1Db250cm9sJzogJ25vLWNhY2hlLCBuby1zdG9yZScsXG4gICAgICB9LFxuICAgIH07XG4gIH07XG59XG4iXX0=

package/lib/mcp-auth/handlers/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types';
+export * from './authorize';
+export * from './authorization-server';
+export * from './protected-resource';
+export * from './register';
+export * from './token';
+export * from './validate-redirect-uris';

package/lib/mcp-auth/handlers/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./authorize"), exports);
+__exportStar(require("./authorization-server"), exports);
+__exportStar(require("./protected-resource"), exports);
+__exportStar(require("./register"), exports);
+__exportStar(require("./token"), exports);
+__exportStar(require("./validate-redirect-uris"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvaGFuZGxlcnMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDBDQUF3QjtBQUN4Qiw4Q0FBNEI7QUFDNUIseURBQXVDO0FBQ3ZDLHVEQUFxQztBQUNyQyw2Q0FBMkI7QUFDM0IsMENBQXdCO0FBQ3hCLDJEQUF5QyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vdHlwZXMnO1xuZXhwb3J0ICogZnJvbSAnLi9hdXRob3JpemUnO1xuZXhwb3J0ICogZnJvbSAnLi9hdXRob3JpemF0aW9uLXNlcnZlcic7XG5leHBvcnQgKiBmcm9tICcuL3Byb3RlY3RlZC1yZXNvdXJjZSc7XG5leHBvcnQgKiBmcm9tICcuL3JlZ2lzdGVyJztcbmV4cG9ydCAqIGZyb20gJy4vdG9rZW4nO1xuZXhwb3J0ICogZnJvbSAnLi92YWxpZGF0ZS1yZWRpcmVjdC11cmlzJztcbiJdfQ==

package/lib/mcp-auth/handlers/protected-resource.d.ts

@@ -0,0 +1,7 @@
+import type { McpAuthConfig } from '../config';
+import type { McpOAuthHandler } from './types';
+/**
+ * Factory for the `/.well-known/oauth-protected-resource` endpoint (RFC 9728).
+ * Returns the resource identifier and authorization servers.
+ */
+export declare function createProtectedResourceHandler(config: McpAuthConfig): McpOAuthHandler;

package/lib/mcp-auth/handlers/protected-resource.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProtectedResourceHandler = createProtectedResourceHandler;
+/**
+ * Factory for the `/.well-known/oauth-protected-resource` endpoint (RFC 9728).
+ * Returns the resource identifier and authorization servers.
+ */
+function createProtectedResourceHandler(config) {
+    return async (event) => {
+        console.log(JSON.stringify({
+            event: 'oauth-protected-resource',
+            method: event.httpMethod,
+            path: event.path,
+        }));
+        const body = {
+            resource: `https://${config.apiDomain}/mcp`,
+            authorization_servers: [`https://${config.apiDomain}`],
+        };
+        return {
+            statusCode: 200,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        };
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdGVjdGVkLXJlc291cmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21jcC1hdXRoL2hhbmRsZXJzL3Byb3RlY3RlZC1yZXNvdXJjZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQU9BLHdFQW1CQztBQXZCRDs7O0dBR0c7QUFDSCxTQUFnQiw4QkFBOEIsQ0FBQyxNQUFxQjtJQUNsRSxPQUFPLEtBQUssRUFBRSxLQUFLLEVBQTZCLEVBQUU7UUFDaEQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3pCLEtBQUssRUFBRSwwQkFBMEI7WUFDakMsTUFBTSxFQUFFLEtBQUssQ0FBQyxVQUFVO1lBQ3hCLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSTtTQUNqQixDQUFDLENBQUMsQ0FBQztRQUVKLE1BQU0sSUFBSSxHQUFHO1lBQ1gsUUFBUSxFQUFFLFdBQVcsTUFBTSxDQUFDLFNBQVMsTUFBTTtZQUMzQyxxQkFBcUIsRUFBRSxDQUFDLFdBQVcsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1NBQ3ZELENBQUM7UUFFRixPQUFPO1lBQ0wsVUFBVSxFQUFFLEdBQUc7WUFDZixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7WUFDL0MsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDO1NBQzNCLENBQUM7SUFDSixDQUFDLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHR5cGUgeyBNY3BBdXRoQ29uZmlnIH0gZnJvbSAnLi4vY29uZmlnJztcbmltcG9ydCB0eXBlIHsgTWNwT0F1dGhIYW5kbGVyLCBNY3BPQXV0aFJlc3BvbnNlIH0gZnJvbSAnLi90eXBlcyc7XG5cbi8qKlxuICogRmFjdG9yeSBmb3IgdGhlIGAvLndlbGwta25vd24vb2F1dGgtcHJvdGVjdGVkLXJlc291cmNlYCBlbmRwb2ludCAoUkZDIDk3MjgpLlxuICogUmV0dXJucyB0aGUgcmVzb3VyY2UgaWRlbnRpZmllciBhbmQgYXV0aG9yaXphdGlvbiBzZXJ2ZXJzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gY3JlYXRlUHJvdGVjdGVkUmVzb3VyY2VIYW5kbGVyKGNvbmZpZzogTWNwQXV0aENvbmZpZyk6IE1jcE9BdXRoSGFuZGxlciB7XG4gIHJldHVybiBhc3luYyAoZXZlbnQpOiBQcm9taXNlPE1jcE9BdXRoUmVzcG9uc2U+ID0+IHtcbiAgICBjb25zb2xlLmxvZyhKU09OLnN0cmluZ2lmeSh7XG4gICAgICBldmVudDogJ29hdXRoLXByb3RlY3RlZC1yZXNvdXJjZScsXG4gICAgICBtZXRob2Q6IGV2ZW50Lmh0dHBNZXRob2QsXG4gICAgICBwYXRoOiBldmVudC5wYXRoLFxuICAgIH0pKTtcblxuICAgIGNvbnN0IGJvZHkgPSB7XG4gICAgICByZXNvdXJjZTogYGh0dHBzOi8vJHtjb25maWcuYXBpRG9tYWlufS9tY3BgLFxuICAgICAgYXV0aG9yaXphdGlvbl9zZXJ2ZXJzOiBbYGh0dHBzOi8vJHtjb25maWcuYXBpRG9tYWlufWBdLFxuICAgIH07XG5cbiAgICByZXR1cm4ge1xuICAgICAgc3RhdHVzQ29kZTogMjAwLFxuICAgICAgaGVhZGVyczogeyAnQ29udGVudC1UeXBlJzogJ2FwcGxpY2F0aW9uL2pzb24nIH0sXG4gICAgICBib2R5OiBKU09OLnN0cmluZ2lmeShib2R5KSxcbiAgICB9O1xuICB9O1xufVxuIl19

package/lib/mcp-auth/handlers/register.d.ts

@@ -0,0 +1,7 @@
+import type { McpAuthConfig } from '../config';
+import type { McpOAuthHandler } from './types';
+/**
+ * Factory for the `/oauth/register` endpoint (RFC 7591 simplified).
+ * Validates redirect URIs against the allowlist and returns the pre-provisioned client_id.
+ */
+export declare function createRegisterHandler(config: McpAuthConfig): McpOAuthHandler;

package/lib/mcp-auth/handlers/register.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRegisterHandler = createRegisterHandler;
+const validate_redirect_uris_1 = require("./validate-redirect-uris");
+/**
+ * Factory for the `/oauth/register` endpoint (RFC 7591 simplified).
+ * Validates redirect URIs against the allowlist and returns the pre-provisioned client_id.
+ */
+function createRegisterHandler(config) {
+    return async (event) => {
+        console.log(JSON.stringify({
+            event: 'register-oauth-client',
+            method: event.httpMethod,
+            path: event.path,
+        }));
+        // Parse body
+        const rawBody = event.isBase64Encoded
+            ? Buffer.from(event.body ?? '', 'base64').toString('utf-8')
+            : (event.body ?? '');
+        let data;
+        try {
+            data = typeof rawBody === 'string' ? JSON.parse(rawBody) : rawBody;
+        }
+        catch {
+            return {
+                statusCode: 400,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: 'invalid_request', error_description: 'Malformed JSON body' }),
+            };
+        }
+        if (data === null || typeof data !== 'object' || Array.isArray(data)) {
+            return {
+                statusCode: 400,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: 'invalid_request', error_description: 'Request body must be a JSON object' }),
+            };
+        }
+        const redirectUris = data.redirect_uris;
+        const clientName = data.client_name ?? 'MCP Connector';
+        if (!redirectUris || !Array.isArray(redirectUris) || redirectUris.length === 0) {
+            return {
+                statusCode: 400,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: 'invalid_request', error_description: 'redirect_uris is required' }),
+            };
+        }
+        if (!(0, validate_redirect_uris_1.validateRedirectUris)(redirectUris, config.allowedRedirectUris)) {
+            return {
+                statusCode: 400,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: 'invalid_redirect_uri', error_description: 'One or more redirect_uris are not allowed' }),
+            };
+        }
+        const response = {
+            client_id: config.clientId,
+            client_name: clientName,
+            redirect_uris: redirectUris,
+            token_endpoint_auth_method: 'none',
+        };
+        console.log(JSON.stringify({ event: 'register-oauth-client-response', status: 201, body: response }));
+        return {
+            statusCode: 201,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(response),
+        };
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaXN0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvaGFuZGxlcnMvcmVnaXN0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFRQSxzREFrRUM7QUF4RUQscUVBQWdFO0FBRWhFOzs7R0FHRztBQUNILFNBQWdCLHFCQUFxQixDQUFDLE1BQXFCO0lBQ3pELE9BQU8sS0FBSyxFQUFFLEtBQUssRUFBNkIsRUFBRTtRQUNoRCxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDekIsS0FBSyxFQUFFLHVCQUF1QjtZQUM5QixNQUFNLEVBQUUsS0FBSyxDQUFDLFVBQVU7WUFDeEIsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1NBQ2pCLENBQUMsQ0FBQyxDQUFDO1FBRUosYUFBYTtRQUNiLE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxlQUFlO1lBQ25DLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLElBQUksRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7WUFDM0QsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztRQUV2QixJQUFJLElBQTZCLENBQUM7UUFDbEMsSUFBSSxDQUFDO1lBQ0gsSUFBSSxHQUFHLE9BQU8sT0FBTyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQ3JFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPO2dCQUNMLFVBQVUsRUFBRSxHQUFHO2dCQUNmLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRTtnQkFDL0MsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsaUJBQWlCLEVBQUUscUJBQXFCLEVBQUUsQ0FBQzthQUM3RixDQUFDO1FBQ0osQ0FBQztRQUVELElBQUksSUFBSSxLQUFLLElBQUksSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE9BQU87Z0JBQ0wsVUFBVSxFQUFFLEdBQUc7Z0JBQ2YsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO2dCQUMvQyxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxvQ0FBb0MsRUFBRSxDQUFDO2FBQzVHLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLGFBQXFDLENBQUM7UUFDaEUsTUFBTSxVQUFVLEdBQUksSUFBSSxDQUFDLFdBQXNCLElBQUksZUFBZSxDQUFDO1FBRW5FLElBQUksQ0FBQyxZQUFZLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDL0UsT0FBTztnQkFDTCxVQUFVLEVBQUUsR0FBRztnQkFDZixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7Z0JBQy9DLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLDJCQUEyQixFQUFFLENBQUM7YUFDbkcsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLENBQUMsSUFBQSw2Q0FBb0IsRUFBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztZQUNwRSxPQUFPO2dCQUNMLFVBQVUsRUFBRSxHQUFHO2dCQUNmLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRTtnQkFDL0MsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsc0JBQXNCLEVBQUUsaUJBQWlCLEVBQUUsMkNBQTJDLEVBQUUsQ0FBQzthQUN4SCxDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sUUFBUSxHQUFHO1lBQ2YsU0FBUyxFQUFFLE1BQU0sQ0FBQyxRQUFRO1lBQzFCLFdBQVcsRUFBRSxVQUFVO1lBQ3ZCLGFBQWEsRUFBRSxZQUFZO1lBQzNCLDBCQUEwQixFQUFFLE1BQU07U0FDbkMsQ0FBQztRQUVGLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxnQ0FBZ0MsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFFdEcsT0FBTztZQUNMLFVBQVUsRUFBRSxHQUFHO1lBQ2YsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO1lBQy9DLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQztTQUMvQixDQUFDO0lBQ0osQ0FBQyxDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgTWNwQXV0aENvbmZpZyB9IGZyb20gJy4uL2NvbmZpZyc7XG5pbXBvcnQgdHlwZSB7IE1jcE9BdXRoSGFuZGxlciwgTWNwT0F1dGhSZXNwb25zZSB9IGZyb20gJy4vdHlwZXMnO1xuaW1wb3J0IHsgdmFsaWRhdGVSZWRpcmVjdFVyaXMgfSBmcm9tICcuL3ZhbGlkYXRlLXJlZGlyZWN0LXVyaXMnO1xuXG4vKipcbiAqIEZhY3RvcnkgZm9yIHRoZSBgL29hdXRoL3JlZ2lzdGVyYCBlbmRwb2ludCAoUkZDIDc1OTEgc2ltcGxpZmllZCkuXG4gKiBWYWxpZGF0ZXMgcmVkaXJlY3QgVVJJcyBhZ2FpbnN0IHRoZSBhbGxvd2xpc3QgYW5kIHJldHVybnMgdGhlIHByZS1wcm92aXNpb25lZCBjbGllbnRfaWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVSZWdpc3RlckhhbmRsZXIoY29uZmlnOiBNY3BBdXRoQ29uZmlnKTogTWNwT0F1dGhIYW5kbGVyIHtcbiAgcmV0dXJuIGFzeW5jIChldmVudCk6IFByb21pc2U8TWNwT0F1dGhSZXNwb25zZT4gPT4ge1xuICAgIGNvbnNvbGUubG9nKEpTT04uc3RyaW5naWZ5KHtcbiAgICAgIGV2ZW50OiAncmVnaXN0ZXItb2F1dGgtY2xpZW50JyxcbiAgICAgIG1ldGhvZDogZXZlbnQuaHR0cE1ldGhvZCxcbiAgICAgIHBhdGg6IGV2ZW50LnBhdGgsXG4gICAgfSkpO1xuXG4gICAgLy8gUGFyc2UgYm9keVxuICAgIGNvbnN0IHJhd0JvZHkgPSBldmVudC5pc0Jhc2U2NEVuY29kZWRcbiAgICAgID8gQnVmZmVyLmZyb20oZXZlbnQuYm9keSA/PyAnJywgJ2Jhc2U2NCcpLnRvU3RyaW5nKCd1dGYtOCcpXG4gICAgICA6IChldmVudC5ib2R5ID8/ICcnKTtcblxuICAgIGxldCBkYXRhOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbiAgICB0cnkge1xuICAgICAgZGF0YSA9IHR5cGVvZiByYXdCb2R5ID09PSAnc3RyaW5nJyA/IEpTT04ucGFyc2UocmF3Qm9keSkgOiByYXdCb2R5O1xuICAgIH0gY2F0Y2gge1xuICAgICAgcmV0dXJuIHtcbiAgICAgICAgc3RhdHVzQ29kZTogNDAwLFxuICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgYm9keTogSlNPTi5zdHJpbmdpZnkoeyBlcnJvcjogJ2ludmFsaWRfcmVxdWVzdCcsIGVycm9yX2Rlc2NyaXB0aW9uOiAnTWFsZm9ybWVkIEpTT04gYm9keScgfSksXG4gICAgICB9O1xuICAgIH1cblxuICAgIGlmIChkYXRhID09PSBudWxsIHx8IHR5cGVvZiBkYXRhICE9PSAnb2JqZWN0JyB8fCBBcnJheS5pc0FycmF5KGRhdGEpKSB7XG4gICAgICByZXR1cm4ge1xuICAgICAgICBzdGF0dXNDb2RlOiA0MDAsXG4gICAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgICBib2R5OiBKU09OLnN0cmluZ2lmeSh7IGVycm9yOiAnaW52YWxpZF9yZXF1ZXN0JywgZXJyb3JfZGVzY3JpcHRpb246ICdSZXF1ZXN0IGJvZHkgbXVzdCBiZSBhIEpTT04gb2JqZWN0JyB9KSxcbiAgICAgIH07XG4gICAgfVxuXG4gICAgY29uc3QgcmVkaXJlY3RVcmlzID0gZGF0YS5yZWRpcmVjdF91cmlzIGFzIHN0cmluZ1tdIHwgdW5kZWZpbmVkO1xuICAgIGNvbnN0IGNsaWVudE5hbWUgPSAoZGF0YS5jbGllbnRfbmFtZSBhcyBzdHJpbmcpID8/ICdNQ1AgQ29ubmVjdG9yJztcblxuICAgIGlmICghcmVkaXJlY3RVcmlzIHx8ICFBcnJheS5pc0FycmF5KHJlZGlyZWN0VXJpcykgfHwgcmVkaXJlY3RVcmlzLmxlbmd0aCA9PT0gMCkge1xuICAgICAgcmV0dXJuIHtcbiAgICAgICAgc3RhdHVzQ29kZTogNDAwLFxuICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgYm9keTogSlNPTi5zdHJpbmdpZnkoeyBlcnJvcjogJ2ludmFsaWRfcmVxdWVzdCcsIGVycm9yX2Rlc2NyaXB0aW9uOiAncmVkaXJlY3RfdXJpcyBpcyByZXF1aXJlZCcgfSksXG4gICAgICB9O1xuICAgIH1cblxuICAgIGlmICghdmFsaWRhdGVSZWRpcmVjdFVyaXMocmVkaXJlY3RVcmlzLCBjb25maWcuYWxsb3dlZFJlZGlyZWN0VXJpcykpIHtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHN0YXR1c0NvZGU6IDQwMCxcbiAgICAgICAgaGVhZGVyczogeyAnQ29udGVudC1UeXBlJzogJ2FwcGxpY2F0aW9uL2pzb24nIH0sXG4gICAgICAgIGJvZHk6IEpTT04uc3RyaW5naWZ5KHsgZXJyb3I6ICdpbnZhbGlkX3JlZGlyZWN0X3VyaScsIGVycm9yX2Rlc2NyaXB0aW9uOiAnT25lIG9yIG1vcmUgcmVkaXJlY3RfdXJpcyBhcmUgbm90IGFsbG93ZWQnIH0pLFxuICAgICAgfTtcbiAgICB9XG5cbiAgICBjb25zdCByZXNwb25zZSA9IHtcbiAgICAgIGNsaWVudF9pZDogY29uZmlnLmNsaWVudElkLFxuICAgICAgY2xpZW50X25hbWU6IGNsaWVudE5hbWUsXG4gICAgICByZWRpcmVjdF91cmlzOiByZWRpcmVjdFVyaXMsXG4gICAgICB0b2tlbl9lbmRwb2ludF9hdXRoX21ldGhvZDogJ25vbmUnLFxuICAgIH07XG5cbiAgICBjb25zb2xlLmxvZyhKU09OLnN0cmluZ2lmeSh7IGV2ZW50OiAncmVnaXN0ZXItb2F1dGgtY2xpZW50LXJlc3BvbnNlJywgc3RhdHVzOiAyMDEsIGJvZHk6IHJlc3BvbnNlIH0pKTtcblxuICAgIHJldHVybiB7XG4gICAgICBzdGF0dXNDb2RlOiAyMDEsXG4gICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgIGJvZHk6IEpTT04uc3RyaW5naWZ5KHJlc3BvbnNlKSxcbiAgICB9O1xuICB9O1xufVxuIl19

package/lib/mcp-auth/handlers/token.d.ts

@@ -0,0 +1,8 @@
+import type { McpAuthConfig } from '../config';
+import type { McpOAuthHandler } from './types';
+/**
+ * Factory for the `/oauth/token` proxy endpoint.
+ * Forwards token exchange to the upstream token endpoint,
+ * stripping configured parameters from the request body.
+ */
+export declare function createTokenHandler(config: McpAuthConfig): McpOAuthHandler;

package/lib/mcp-auth/handlers/token.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTokenHandler = createTokenHandler;
+const ALLOWED_GRANT_TYPES = ['authorization_code', 'refresh_token'];
+/**
+ * Factory for the `/oauth/token` proxy endpoint.
+ * Forwards token exchange to the upstream token endpoint,
+ * stripping configured parameters from the request body.
+ */
+function createTokenHandler(config) {
+    return async (event) => {
+        const tokenUrl = config.tokenEndpoint;
+        // Decode body if base64-encoded
+        const rawBody = event.isBase64Encoded
+            ? Buffer.from(event.body ?? '', 'base64').toString('utf-8')
+            : (event.body ?? '');
+        // Parse form-encoded body and strip unsupported parameters
+        const params = new URLSearchParams(rawBody);
+        const stripParamsList = config.stripParameters ?? ['resource'];
+        for (const param of stripParamsList) {
+            params.delete(param);
+        }
+        // Validate grant_type
+        const grantType = params.get('grant_type');
+        if (!grantType || !ALLOWED_GRANT_TYPES.includes(grantType)) {
+            return {
+                statusCode: 400,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: 'unsupported_grant_type', error_description: `grant_type must be one of: ${ALLOWED_GRANT_TYPES.join(', ')}` }),
+            };
+        }
+        const body = params.toString();
+        console.log(JSON.stringify({
+            event: 'oauth-token-proxy',
+            tokenUrl,
+            grantType,
+        }));
+        let responseBody;
+        let statusCode;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 10000);
+        try {
+            const response = await fetch(tokenUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body,
+                signal: controller.signal,
+            });
+            responseBody = await response.text();
+            statusCode = response.status;
+        }
+        catch (err) {
+            console.log(JSON.stringify({ event: 'oauth-token-proxy-error', error: err.message }));
+            return {
+                statusCode: 502,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: 'upstream_error', error_description: 'Token endpoint unreachable' }),
+            };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+        console.log(JSON.stringify({
+            event: 'oauth-token-proxy-response',
+            status: statusCode,
+        }));
+        return {
+            statusCode,
+            headers: { 'Content-Type': 'application/json' },
+            body: responseBody,
+        };
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvaGFuZGxlcnMvdG9rZW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFVQSxnREFxRUM7QUE1RUQsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLG9CQUFvQixFQUFFLGVBQWUsQ0FBQyxDQUFDO0FBRXBFOzs7O0dBSUc7QUFDSCxTQUFnQixrQkFBa0IsQ0FBQyxNQUFxQjtJQUN0RCxPQUFPLEtBQUssRUFBRSxLQUFLLEVBQTZCLEVBQUU7UUFDaEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLGFBQWEsQ0FBQztRQUV0QyxnQ0FBZ0M7UUFDaEMsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLGVBQWU7WUFDbkMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztZQUMzRCxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBRXZCLDJEQUEyRDtRQUMzRCxNQUFNLE1BQU0sR0FBRyxJQUFJLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM1QyxNQUFNLGVBQWUsR0FBRyxNQUFNLENBQUMsZUFBZSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDL0QsS0FBSyxNQUFNLEtBQUssSUFBSSxlQUFlLEVBQUUsQ0FBQztZQUNwQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7UUFFRCxzQkFBc0I7UUFDdEIsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUMzQyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsbUJBQW1CLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDM0QsT0FBTztnQkFDTCxVQUFVLEVBQUUsR0FBRztnQkFDZixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7Z0JBQy9DLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLHdCQUF3QixFQUFFLGlCQUFpQixFQUFFLDhCQUE4QixtQkFBbUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO2FBQzdJLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBRS9CLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN6QixLQUFLLEVBQUUsbUJBQW1CO1lBQzFCLFFBQVE7WUFDUixTQUFTO1NBQ1YsQ0FBQyxDQUFDLENBQUM7UUFFSixJQUFJLFlBQW9CLENBQUM7UUFDekIsSUFBSSxVQUFrQixDQUFDO1FBQ3ZCLE1BQU0sVUFBVSxHQUFHLElBQUksZUFBZSxFQUFFLENBQUM7UUFDekMsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxLQUFNLENBQUMsQ0FBQztRQUM3RCxJQUFJLENBQUM7WUFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxRQUFRLEVBQUU7Z0JBQ3JDLE1BQU0sRUFBRSxNQUFNO2dCQUNkLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxtQ0FBbUMsRUFBRTtnQkFDaEUsSUFBSTtnQkFDSixNQUFNLEVBQUUsVUFBVSxDQUFDLE1BQU07YUFDMUIsQ0FBQyxDQUFDO1lBQ0gsWUFBWSxHQUFHLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ3JDLFVBQVUsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDO1FBQy9CLENBQUM7UUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ2IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRyxHQUFhLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ2pHLE9BQU87Z0JBQ0wsVUFBVSxFQUFFLEdBQUc7Z0JBQ2YsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO2dCQUMvQyxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxnQkFBZ0IsRUFBRSxpQkFBaUIsRUFBRSw0QkFBNEIsRUFBRSxDQUFDO2FBQ25HLENBQUM7UUFDSixDQUFDO2dCQUFTLENBQUM7WUFDVCxZQUFZLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDeEIsQ0FBQztRQUVELE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN6QixLQUFLLEVBQUUsNEJBQTRCO1lBQ25DLE1BQU0sRUFBRSxVQUFVO1NBQ25CLENBQUMsQ0FBQyxDQUFDO1FBRUosT0FBTztZQUNMLFVBQVU7WUFDVixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7WUFDL0MsSUFBSSxFQUFFLFlBQVk7U0FDbkIsQ0FBQztJQUNKLENBQUMsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgdHlwZSB7IE1jcEF1dGhDb25maWcgfSBmcm9tICcuLi9jb25maWcnO1xuaW1wb3J0IHR5cGUgeyBNY3BPQXV0aEhhbmRsZXIsIE1jcE9BdXRoUmVzcG9uc2UgfSBmcm9tICcuL3R5cGVzJztcblxuY29uc3QgQUxMT1dFRF9HUkFOVF9UWVBFUyA9IFsnYXV0aG9yaXphdGlvbl9jb2RlJywgJ3JlZnJlc2hfdG9rZW4nXTtcblxuLyoqXG4gKiBGYWN0b3J5IGZvciB0aGUgYC9vYXV0aC90b2tlbmAgcHJveHkgZW5kcG9pbnQuXG4gKiBGb3J3YXJkcyB0b2tlbiBleGNoYW5nZSB0byB0aGUgdXBzdHJlYW0gdG9rZW4gZW5kcG9pbnQsXG4gKiBzdHJpcHBpbmcgY29uZmlndXJlZCBwYXJhbWV0ZXJzIGZyb20gdGhlIHJlcXVlc3QgYm9keS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZVRva2VuSGFuZGxlcihjb25maWc6IE1jcEF1dGhDb25maWcpOiBNY3BPQXV0aEhhbmRsZXIge1xuICByZXR1cm4gYXN5bmMgKGV2ZW50KTogUHJvbWlzZTxNY3BPQXV0aFJlc3BvbnNlPiA9PiB7XG4gICAgY29uc3QgdG9rZW5VcmwgPSBjb25maWcudG9rZW5FbmRwb2ludDtcblxuICAgIC8vIERlY29kZSBib2R5IGlmIGJhc2U2NC1lbmNvZGVkXG4gICAgY29uc3QgcmF3Qm9keSA9IGV2ZW50LmlzQmFzZTY0RW5jb2RlZFxuICAgICAgPyBCdWZmZXIuZnJvbShldmVudC5ib2R5ID8/ICcnLCAnYmFzZTY0JykudG9TdHJpbmcoJ3V0Zi04JylcbiAgICAgIDogKGV2ZW50LmJvZHkgPz8gJycpO1xuXG4gICAgLy8gUGFyc2UgZm9ybS1lbmNvZGVkIGJvZHkgYW5kIHN0cmlwIHVuc3VwcG9ydGVkIHBhcmFtZXRlcnNcbiAgICBjb25zdCBwYXJhbXMgPSBuZXcgVVJMU2VhcmNoUGFyYW1zKHJhd0JvZHkpO1xuICAgIGNvbnN0IHN0cmlwUGFyYW1zTGlzdCA9IGNvbmZpZy5zdHJpcFBhcmFtZXRlcnMgPz8gWydyZXNvdXJjZSddO1xuICAgIGZvciAoY29uc3QgcGFyYW0gb2Ygc3RyaXBQYXJhbXNMaXN0KSB7XG4gICAgICBwYXJhbXMuZGVsZXRlKHBhcmFtKTtcbiAgICB9XG5cbiAgICAvLyBWYWxpZGF0ZSBncmFudF90eXBlXG4gICAgY29uc3QgZ3JhbnRUeXBlID0gcGFyYW1zLmdldCgnZ3JhbnRfdHlwZScpO1xuICAgIGlmICghZ3JhbnRUeXBlIHx8ICFBTExPV0VEX0dSQU5UX1RZUEVTLmluY2x1ZGVzKGdyYW50VHlwZSkpIHtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHN0YXR1c0NvZGU6IDQwMCxcbiAgICAgICAgaGVhZGVyczogeyAnQ29udGVudC1UeXBlJzogJ2FwcGxpY2F0aW9uL2pzb24nIH0sXG4gICAgICAgIGJvZHk6IEpTT04uc3RyaW5naWZ5KHsgZXJyb3I6ICd1bnN1cHBvcnRlZF9ncmFudF90eXBlJywgZXJyb3JfZGVzY3JpcHRpb246IGBncmFudF90eXBlIG11c3QgYmUgb25lIG9mOiAke0FMTE9XRURfR1JBTlRfVFlQRVMuam9pbignLCAnKX1gIH0pLFxuICAgICAgfTtcbiAgICB9XG5cbiAgICBjb25zdCBib2R5ID0gcGFyYW1zLnRvU3RyaW5nKCk7XG5cbiAgICBjb25zb2xlLmxvZyhKU09OLnN0cmluZ2lmeSh7XG4gICAgICBldmVudDogJ29hdXRoLXRva2VuLXByb3h5JyxcbiAgICAgIHRva2VuVXJsLFxuICAgICAgZ3JhbnRUeXBlLFxuICAgIH0pKTtcblxuICAgIGxldCByZXNwb25zZUJvZHk6IHN0cmluZztcbiAgICBsZXQgc3RhdHVzQ29kZTogbnVtYmVyO1xuICAgIGNvbnN0IGNvbnRyb2xsZXIgPSBuZXcgQWJvcnRDb250cm9sbGVyKCk7XG4gICAgY29uc3QgdGltZW91dCA9IHNldFRpbWVvdXQoKCkgPT4gY29udHJvbGxlci5hYm9ydCgpLCAxMF8wMDApO1xuICAgIHRyeSB7XG4gICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZldGNoKHRva2VuVXJsLCB7XG4gICAgICAgIG1ldGhvZDogJ1BPU1QnLFxuICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkJyB9LFxuICAgICAgICBib2R5LFxuICAgICAgICBzaWduYWw6IGNvbnRyb2xsZXIuc2lnbmFsLFxuICAgICAgfSk7XG4gICAgICByZXNwb25zZUJvZHkgPSBhd2FpdCByZXNwb25zZS50ZXh0KCk7XG4gICAgICBzdGF0dXNDb2RlID0gcmVzcG9uc2Uuc3RhdHVzO1xuICAgIH0gY2F0Y2ggKGVycikge1xuICAgICAgY29uc29sZS5sb2coSlNPTi5zdHJpbmdpZnkoeyBldmVudDogJ29hdXRoLXRva2VuLXByb3h5LWVycm9yJywgZXJyb3I6IChlcnIgYXMgRXJyb3IpLm1lc3NhZ2UgfSkpO1xuICAgICAgcmV0dXJuIHtcbiAgICAgICAgc3RhdHVzQ29kZTogNTAyLFxuICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgICAgYm9keTogSlNPTi5zdHJpbmdpZnkoeyBlcnJvcjogJ3Vwc3RyZWFtX2Vycm9yJywgZXJyb3JfZGVzY3JpcHRpb246ICdUb2tlbiBlbmRwb2ludCB1bnJlYWNoYWJsZScgfSksXG4gICAgICB9O1xuICAgIH0gZmluYWxseSB7XG4gICAgICBjbGVhclRpbWVvdXQodGltZW91dCk7XG4gICAgfVxuXG4gICAgY29uc29sZS5sb2coSlNPTi5zdHJpbmdpZnkoe1xuICAgICAgZXZlbnQ6ICdvYXV0aC10b2tlbi1wcm94eS1yZXNwb25zZScsXG4gICAgICBzdGF0dXM6IHN0YXR1c0NvZGUsXG4gICAgfSkpO1xuXG4gICAgcmV0dXJuIHtcbiAgICAgIHN0YXR1c0NvZGUsXG4gICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICAgIGJvZHk6IHJlc3BvbnNlQm9keSxcbiAgICB9O1xuICB9O1xufVxuIl19

package/lib/mcp-auth/handlers/types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * A generic Lambda-like handler: receives an event (simplified) and returns
+ * a response with statusCode, headers, and body.
+ */
+export interface McpOAuthResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body?: string;
+}
+export interface McpOAuthEvent {
+    httpMethod: string;
+    path: string;
+    headers: Record<string, string | undefined>;
+    queryStringParameters: Record<string, string | undefined> | null;
+    body: string | null;
+    isBase64Encoded: boolean;
+}
+/**
+ * Handler function signature returned by all factories.
+ */
+export type McpOAuthHandler = (event: McpOAuthEvent) => Promise<McpOAuthResponse>;

package/lib/mcp-auth/handlers/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvaGFuZGxlcnMvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQSBnZW5lcmljIExhbWJkYS1saWtlIGhhbmRsZXI6IHJlY2VpdmVzIGFuIGV2ZW50IChzaW1wbGlmaWVkKSBhbmQgcmV0dXJuc1xuICogYSByZXNwb25zZSB3aXRoIHN0YXR1c0NvZGUsIGhlYWRlcnMsIGFuZCBib2R5LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIE1jcE9BdXRoUmVzcG9uc2Uge1xuICBzdGF0dXNDb2RlOiBudW1iZXI7XG4gIGhlYWRlcnM6IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG4gIGJvZHk/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgTWNwT0F1dGhFdmVudCB7XG4gIGh0dHBNZXRob2Q6IHN0cmluZztcbiAgcGF0aDogc3RyaW5nO1xuICBoZWFkZXJzOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+O1xuICBxdWVyeVN0cmluZ1BhcmFtZXRlcnM6IFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4gfCBudWxsO1xuICBib2R5OiBzdHJpbmcgfCBudWxsO1xuICBpc0Jhc2U2NEVuY29kZWQ6IGJvb2xlYW47XG59XG5cbi8qKlxuICogSGFuZGxlciBmdW5jdGlvbiBzaWduYXR1cmUgcmV0dXJuZWQgYnkgYWxsIGZhY3Rvcmllcy5cbiAqL1xuZXhwb3J0IHR5cGUgTWNwT0F1dGhIYW5kbGVyID0gKGV2ZW50OiBNY3BPQXV0aEV2ZW50KSA9PiBQcm9taXNlPE1jcE9BdXRoUmVzcG9uc2U+O1xuIl19

package/lib/mcp-auth/handlers/validate-redirect-uris.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Default allowlisted redirect URIs for MCP connector registration.
+ * These cover the most common MCP-compatible clients.
+ */
+export declare const DEFAULT_ALLOWED_REDIRECT_URIS: readonly string[];
+/**
+ * Returns true if every URI in the list is on the allowlist.
+ * Uses the provided allowlist or falls back to the default.
+ */
+export declare function validateRedirectUris(uris: string[], allowlist?: readonly string[]): boolean;

package/lib/mcp-auth/handlers/validate-redirect-uris.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ALLOWED_REDIRECT_URIS = void 0;
+exports.validateRedirectUris = validateRedirectUris;
+/**
+ * Default allowlisted redirect URIs for MCP connector registration.
+ * These cover the most common MCP-compatible clients.
+ */
+exports.DEFAULT_ALLOWED_REDIRECT_URIS = [
+    'https://claude.ai/oauth/callback',
+    'https://claude.ai/api/mcp/auth_callback',
+    'https://chatgpt.com/oauth/callback',
+];
+/**
+ * Returns true if every URI in the list is on the allowlist.
+ * Uses the provided allowlist or falls back to the default.
+ */
+function validateRedirectUris(uris, allowlist) {
+    const list = allowlist ?? exports.DEFAULT_ALLOWED_REDIRECT_URIS;
+    return uris.every(uri => list.includes(uri));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGUtcmVkaXJlY3QtdXJpcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9oYW5kbGVycy92YWxpZGF0ZS1yZWRpcmVjdC11cmlzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWNBLG9EQUdDO0FBakJEOzs7R0FHRztBQUNVLFFBQUEsNkJBQTZCLEdBQXNCO0lBQzlELGtDQUFrQztJQUNsQyx5Q0FBeUM7SUFDekMsb0NBQW9DO0NBQ3JDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxTQUFnQixvQkFBb0IsQ0FBQyxJQUFjLEVBQUUsU0FBNkI7SUFDaEYsTUFBTSxJQUFJLEdBQUcsU0FBUyxJQUFJLHFDQUE2QixDQUFDO0lBQ3hELE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztBQUMvQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBEZWZhdWx0IGFsbG93bGlzdGVkIHJlZGlyZWN0IFVSSXMgZm9yIE1DUCBjb25uZWN0b3IgcmVnaXN0cmF0aW9uLlxuICogVGhlc2UgY292ZXIgdGhlIG1vc3QgY29tbW9uIE1DUC1jb21wYXRpYmxlIGNsaWVudHMuXG4gKi9cbmV4cG9ydCBjb25zdCBERUZBVUxUX0FMTE9XRURfUkVESVJFQ1RfVVJJUzogcmVhZG9ubHkgc3RyaW5nW10gPSBbXG4gICdodHRwczovL2NsYXVkZS5haS9vYXV0aC9jYWxsYmFjaycsXG4gICdodHRwczovL2NsYXVkZS5haS9hcGkvbWNwL2F1dGhfY2FsbGJhY2snLFxuICAnaHR0cHM6Ly9jaGF0Z3B0LmNvbS9vYXV0aC9jYWxsYmFjaycsXG5dO1xuXG4vKipcbiAqIFJldHVybnMgdHJ1ZSBpZiBldmVyeSBVUkkgaW4gdGhlIGxpc3QgaXMgb24gdGhlIGFsbG93bGlzdC5cbiAqIFVzZXMgdGhlIHByb3ZpZGVkIGFsbG93bGlzdCBvciBmYWxscyBiYWNrIHRvIHRoZSBkZWZhdWx0LlxuICovXG5leHBvcnQgZnVuY3Rpb24gdmFsaWRhdGVSZWRpcmVjdFVyaXModXJpczogc3RyaW5nW10sIGFsbG93bGlzdD86IHJlYWRvbmx5IHN0cmluZ1tdKTogYm9vbGVhbiB7XG4gIGNvbnN0IGxpc3QgPSBhbGxvd2xpc3QgPz8gREVGQVVMVF9BTExPV0VEX1JFRElSRUNUX1VSSVM7XG4gIHJldHVybiB1cmlzLmV2ZXJ5KHVyaSA9PiBsaXN0LmluY2x1ZGVzKHVyaSkpO1xufVxuIl19

package/lib/mcp-auth/index.d.ts

@@ -0,0 +1,3 @@
+export * from './config';
+export * from './handlers';
+export * from './mcp';

package/lib/mcp-auth/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./config"), exports);
+__exportStar(require("./handlers"), exports);
+__exportStar(require("./mcp"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbWNwLWF1dGgvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDJDQUF5QjtBQUN6Qiw2Q0FBMkI7QUFDM0Isd0NBQXNCIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi9jb25maWcnO1xuZXhwb3J0ICogZnJvbSAnLi9oYW5kbGVycyc7XG5leHBvcnQgKiBmcm9tICcuL21jcCc7XG4iXX0=

package/lib/mcp-auth/lambda-handlers/authorization-server.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/authorization-server.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const authorization_server_1 = require("../handlers/authorization-server");
+const handler = (0, authorization_server_1.createAuthorizationServerHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXphdGlvbi1zZXJ2ZXIuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvYXV0aG9yaXphdGlvbi1zZXJ2ZXIuaGFuZGxlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUtBLHNDQWVDO0FBRXlCLGdDQUFPO0FBdEJqQyw2Q0FBZ0Q7QUFDaEQsMkVBQW9GO0FBRXBGLE1BQU0sT0FBTyxHQUFHLElBQUEsdURBQWdDLEVBQUMsSUFBQSw2QkFBZ0IsR0FBRSxDQUFDLENBQUM7QUFFOUQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFxQztJQUN2RSxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQztRQUMzQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7UUFDNUIsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1FBQ2hCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBNkM7UUFDNUQscUJBQXFCLEVBQUUsS0FBSyxDQUFDLHFCQUFrRTtRQUMvRixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0tBQ3ZDLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3ZCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLEVBQUU7S0FDeEIsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBnZXRDb25maWdGcm9tRW52IH0gZnJvbSAnLi9lbnYtY29uZmlnJztcbmltcG9ydCB7IGNyZWF0ZUF1dGhvcml6YXRpb25TZXJ2ZXJIYW5kbGVyIH0gZnJvbSAnLi4vaGFuZGxlcnMvYXV0aG9yaXphdGlvbi1zZXJ2ZXInO1xuXG5jb25zdCBoYW5kbGVyID0gY3JlYXRlQXV0aG9yaXphdGlvblNlcnZlckhhbmRsZXIoZ2V0Q29uZmlnRnJvbUVudigpKTtcblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGxhbWJkYUhhbmRsZXIoZXZlbnQ6IEFXU0xhbWJkYS5BUElHYXRld2F5UHJveHlFdmVudCk6IFByb21pc2U8QVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eVJlc3VsdD4ge1xuICBjb25zdCByZXN1bHQgPSBhd2FpdCBoYW5kbGVyKHtcbiAgICBodHRwTWV0aG9kOiBldmVudC5odHRwTWV0aG9kLFxuICAgIHBhdGg6IGV2ZW50LnBhdGgsXG4gICAgaGVhZGVyczogZXZlbnQuaGVhZGVycyBhcyBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+LFxuICAgIHF1ZXJ5U3RyaW5nUGFyYW1ldGVyczogZXZlbnQucXVlcnlTdHJpbmdQYXJhbWV0ZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4gfCBudWxsLFxuICAgIGJvZHk6IGV2ZW50LmJvZHksXG4gICAgaXNCYXNlNjRFbmNvZGVkOiBldmVudC5pc0Jhc2U2NEVuY29kZWQsXG4gIH0pO1xuXG4gIHJldHVybiB7XG4gICAgc3RhdHVzQ29kZTogcmVzdWx0LnN0YXR1c0NvZGUsXG4gICAgaGVhZGVyczogcmVzdWx0LmhlYWRlcnMsXG4gICAgYm9keTogcmVzdWx0LmJvZHkgPz8gJycsXG4gIH07XG59XG5cbmV4cG9ydCB7IGxhbWJkYUhhbmRsZXIgYXMgaGFuZGxlciB9O1xuIl19

package/lib/mcp-auth/lambda-handlers/authorize.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/authorize.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const authorize_1 = require("../handlers/authorize");
+const handler = (0, authorize_1.createAuthorizeHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplLmhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbGFtYmRhLWhhbmRsZXJzL2F1dGhvcml6ZS5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBS0Esc0NBZUM7QUFFeUIsZ0NBQU87QUF0QmpDLDZDQUFnRDtBQUNoRCxxREFBK0Q7QUFFL0QsTUFBTSxPQUFPLEdBQUcsSUFBQSxrQ0FBc0IsRUFBQyxJQUFBLDZCQUFnQixHQUFFLENBQUMsQ0FBQztBQUVwRCxLQUFLLFVBQVUsYUFBYSxDQUFDLEtBQXFDO0lBQ3ZFLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDO1FBQzNCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtRQUM1QixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUE2QztRQUM1RCxxQkFBcUIsRUFBRSxLQUFLLENBQUMscUJBQWtFO1FBQy9GLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSTtRQUNoQixlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsT0FBTztRQUNMLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtRQUM3QixPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDdkIsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLElBQUksRUFBRTtLQUN4QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGdldENvbmZpZ0Zyb21FbnYgfSBmcm9tICcuL2Vudi1jb25maWcnO1xuaW1wb3J0IHsgY3JlYXRlQXV0aG9yaXplSGFuZGxlciB9IGZyb20gJy4uL2hhbmRsZXJzL2F1dGhvcml6ZSc7XG5cbmNvbnN0IGhhbmRsZXIgPSBjcmVhdGVBdXRob3JpemVIYW5kbGVyKGdldENvbmZpZ0Zyb21FbnYoKSk7XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBsYW1iZGFIYW5kbGVyKGV2ZW50OiBBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5RXZlbnQpOiBQcm9taXNlPEFXU0xhbWJkYS5BUElHYXRld2F5UHJveHlSZXN1bHQ+IHtcbiAgY29uc3QgcmVzdWx0ID0gYXdhaXQgaGFuZGxlcih7XG4gICAgaHR0cE1ldGhvZDogZXZlbnQuaHR0cE1ldGhvZCxcbiAgICBwYXRoOiBldmVudC5wYXRoLFxuICAgIGhlYWRlcnM6IGV2ZW50LmhlYWRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPixcbiAgICBxdWVyeVN0cmluZ1BhcmFtZXRlcnM6IGV2ZW50LnF1ZXJ5U3RyaW5nUGFyYW1ldGVycyBhcyBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+IHwgbnVsbCxcbiAgICBib2R5OiBldmVudC5ib2R5LFxuICAgIGlzQmFzZTY0RW5jb2RlZDogZXZlbnQuaXNCYXNlNjRFbmNvZGVkLFxuICB9KTtcblxuICByZXR1cm4ge1xuICAgIHN0YXR1c0NvZGU6IHJlc3VsdC5zdGF0dXNDb2RlLFxuICAgIGhlYWRlcnM6IHJlc3VsdC5oZWFkZXJzLFxuICAgIGJvZHk6IHJlc3VsdC5ib2R5ID8/ICcnLFxuICB9O1xufVxuXG5leHBvcnQgeyBsYW1iZGFIYW5kbGVyIGFzIGhhbmRsZXIgfTtcbiJdfQ==

package/lib/mcp-auth/lambda-handlers/env-config.d.ts

@@ -0,0 +1,7 @@
+import type { McpAuthConfig } from '../config';
+/**
+ * Read MCP auth configuration from environment variables.
+ * Used by all Lambda handler entry points.
+ * Throws a descriptive error if any required env var is missing or empty.
+ */
+export declare function getConfigFromEnv(): McpAuthConfig;

package/lib/mcp-auth/lambda-handlers/env-config.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getConfigFromEnv = getConfigFromEnv;
+const REQUIRED_ENV_VARS = [
+    'MCP_API_DOMAIN',
+    'MCP_AUTHORIZE_ENDPOINT',
+    'MCP_TOKEN_ENDPOINT',
+    'MCP_CLIENT_ID',
+    'MCP_SERVER_NAME',
+    'MCP_SERVER_VERSION',
+];
+/**
+ * Read MCP auth configuration from environment variables.
+ * Used by all Lambda handler entry points.
+ * Throws a descriptive error if any required env var is missing or empty.
+ */
+function getConfigFromEnv() {
+    const missing = REQUIRED_ENV_VARS.filter(name => !process.env[name]);
+    if (missing.length > 0) {
+        throw new Error(`MCP Auth: missing required environment variables: ${missing.join(', ')}`);
+    }
+    return {
+        apiDomain: process.env.MCP_API_DOMAIN,
+        authorizeEndpoint: process.env.MCP_AUTHORIZE_ENDPOINT,
+        tokenEndpoint: process.env.MCP_TOKEN_ENDPOINT,
+        clientId: process.env.MCP_CLIENT_ID,
+        allowedRedirectUris: (process.env.MCP_ALLOWED_REDIRECT_URIS ?? '').split(',').filter(Boolean),
+        serverInfo: {
+            name: process.env.MCP_SERVER_NAME,
+            version: process.env.MCP_SERVER_VERSION,
+        },
+        protocolVersions: (process.env.MCP_PROTOCOL_VERSIONS ?? '').split(',').filter(Boolean),
+        scopes: (process.env.MCP_SCOPES ?? '').split(',').filter(Boolean),
+        stripParameters: (process.env.MCP_STRIP_PARAMETERS ?? 'resource').split(',').filter(Boolean),
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW52LWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvZW52LWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWdCQSw0Q0FvQkM7QUFsQ0QsTUFBTSxpQkFBaUIsR0FBRztJQUN4QixnQkFBZ0I7SUFDaEIsd0JBQXdCO0lBQ3hCLG9CQUFvQjtJQUNwQixlQUFlO0lBQ2YsaUJBQWlCO0lBQ2pCLG9CQUFvQjtDQUNaLENBQUM7QUFFWDs7OztHQUlHO0FBQ0gsU0FBZ0IsZ0JBQWdCO0lBQzlCLE1BQU0sT0FBTyxHQUFHLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLHFEQUFxRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RixDQUFDO0lBRUQsT0FBTztRQUNMLFNBQVMsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWU7UUFDdEMsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxzQkFBdUI7UUFDdEQsYUFBYSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQW1CO1FBQzlDLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWM7UUFDcEMsbUJBQW1CLEVBQUUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHlCQUF5QixJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQzdGLFVBQVUsRUFBRTtZQUNWLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWdCO1lBQ2xDLE9BQU8sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGtCQUFtQjtTQUN6QztRQUNELGdCQUFnQixFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUN0RixNQUFNLEVBQUUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUNqRSxlQUFlLEVBQUUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLG9CQUFvQixJQUFJLFVBQVUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0tBQzdGLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHR5cGUgeyBNY3BBdXRoQ29uZmlnIH0gZnJvbSAnLi4vY29uZmlnJztcblxuY29uc3QgUkVRVUlSRURfRU5WX1ZBUlMgPSBbXG4gICdNQ1BfQVBJX0RPTUFJTicsXG4gICdNQ1BfQVVUSE9SSVpFX0VORFBPSU5UJyxcbiAgJ01DUF9UT0tFTl9FTkRQT0lOVCcsXG4gICdNQ1BfQ0xJRU5UX0lEJyxcbiAgJ01DUF9TRVJWRVJfTkFNRScsXG4gICdNQ1BfU0VSVkVSX1ZFUlNJT04nLFxuXSBhcyBjb25zdDtcblxuLyoqXG4gKiBSZWFkIE1DUCBhdXRoIGNvbmZpZ3VyYXRpb24gZnJvbSBlbnZpcm9ubWVudCB2YXJpYWJsZXMuXG4gKiBVc2VkIGJ5IGFsbCBMYW1iZGEgaGFuZGxlciBlbnRyeSBwb2ludHMuXG4gKiBUaHJvd3MgYSBkZXNjcmlwdGl2ZSBlcnJvciBpZiBhbnkgcmVxdWlyZWQgZW52IHZhciBpcyBtaXNzaW5nIG9yIGVtcHR5LlxuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0Q29uZmlnRnJvbUVudigpOiBNY3BBdXRoQ29uZmlnIHtcbiAgY29uc3QgbWlzc2luZyA9IFJFUVVJUkVEX0VOVl9WQVJTLmZpbHRlcihuYW1lID0+ICFwcm9jZXNzLmVudltuYW1lXSk7XG4gIGlmIChtaXNzaW5nLmxlbmd0aCA+IDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYE1DUCBBdXRoOiBtaXNzaW5nIHJlcXVpcmVkIGVudmlyb25tZW50IHZhcmlhYmxlczogJHttaXNzaW5nLmpvaW4oJywgJyl9YCk7XG4gIH1cblxuICByZXR1cm4ge1xuICAgIGFwaURvbWFpbjogcHJvY2Vzcy5lbnYuTUNQX0FQSV9ET01BSU4hLFxuICAgIGF1dGhvcml6ZUVuZHBvaW50OiBwcm9jZXNzLmVudi5NQ1BfQVVUSE9SSVpFX0VORFBPSU5UISxcbiAgICB0b2tlbkVuZHBvaW50OiBwcm9jZXNzLmVudi5NQ1BfVE9LRU5fRU5EUE9JTlQhLFxuICAgIGNsaWVudElkOiBwcm9jZXNzLmVudi5NQ1BfQ0xJRU5UX0lEISxcbiAgICBhbGxvd2VkUmVkaXJlY3RVcmlzOiAocHJvY2Vzcy5lbnYuTUNQX0FMTE9XRURfUkVESVJFQ1RfVVJJUyA/PyAnJykuc3BsaXQoJywnKS5maWx0ZXIoQm9vbGVhbiksXG4gICAgc2VydmVySW5mbzoge1xuICAgICAgbmFtZTogcHJvY2Vzcy5lbnYuTUNQX1NFUlZFUl9OQU1FISxcbiAgICAgIHZlcnNpb246IHByb2Nlc3MuZW52Lk1DUF9TRVJWRVJfVkVSU0lPTiEsXG4gICAgfSxcbiAgICBwcm90b2NvbFZlcnNpb25zOiAocHJvY2Vzcy5lbnYuTUNQX1BST1RPQ09MX1ZFUlNJT05TID8/ICcnKS5zcGxpdCgnLCcpLmZpbHRlcihCb29sZWFuKSxcbiAgICBzY29wZXM6IChwcm9jZXNzLmVudi5NQ1BfU0NPUEVTID8/ICcnKS5zcGxpdCgnLCcpLmZpbHRlcihCb29sZWFuKSxcbiAgICBzdHJpcFBhcmFtZXRlcnM6IChwcm9jZXNzLmVudi5NQ1BfU1RSSVBfUEFSQU1FVEVSUyA/PyAncmVzb3VyY2UnKS5zcGxpdCgnLCcpLmZpbHRlcihCb29sZWFuKSxcbiAgfTtcbn1cbiJdfQ==

package/lib/mcp-auth/lambda-handlers/protected-resource.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/protected-resource.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const protected_resource_1 = require("../handlers/protected-resource");
+const handler = (0, protected_resource_1.createProtectedResourceHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdGVjdGVkLXJlc291cmNlLmhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbGFtYmRhLWhhbmRsZXJzL3Byb3RlY3RlZC1yZXNvdXJjZS5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBS0Esc0NBZUM7QUFFeUIsZ0NBQU87QUF0QmpDLDZDQUFnRDtBQUNoRCx1RUFBZ0Y7QUFFaEYsTUFBTSxPQUFPLEdBQUcsSUFBQSxtREFBOEIsRUFBQyxJQUFBLDZCQUFnQixHQUFFLENBQUMsQ0FBQztBQUU1RCxLQUFLLFVBQVUsYUFBYSxDQUFDLEtBQXFDO0lBQ3ZFLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDO1FBQzNCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtRQUM1QixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUE2QztRQUM1RCxxQkFBcUIsRUFBRSxLQUFLLENBQUMscUJBQWtFO1FBQy9GLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSTtRQUNoQixlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsT0FBTztRQUNMLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtRQUM3QixPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDdkIsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLElBQUksRUFBRTtLQUN4QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGdldENvbmZpZ0Zyb21FbnYgfSBmcm9tICcuL2Vudi1jb25maWcnO1xuaW1wb3J0IHsgY3JlYXRlUHJvdGVjdGVkUmVzb3VyY2VIYW5kbGVyIH0gZnJvbSAnLi4vaGFuZGxlcnMvcHJvdGVjdGVkLXJlc291cmNlJztcblxuY29uc3QgaGFuZGxlciA9IGNyZWF0ZVByb3RlY3RlZFJlc291cmNlSGFuZGxlcihnZXRDb25maWdGcm9tRW52KCkpO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbGFtYmRhSGFuZGxlcihldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50KTogUHJvbWlzZTxBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5UmVzdWx0PiB7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IGhhbmRsZXIoe1xuICAgIGh0dHBNZXRob2Q6IGV2ZW50Lmh0dHBNZXRob2QsXG4gICAgcGF0aDogZXZlbnQucGF0aCxcbiAgICBoZWFkZXJzOiBldmVudC5oZWFkZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4sXG4gICAgcXVlcnlTdHJpbmdQYXJhbWV0ZXJzOiBldmVudC5xdWVyeVN0cmluZ1BhcmFtZXRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPiB8IG51bGwsXG4gICAgYm9keTogZXZlbnQuYm9keSxcbiAgICBpc0Jhc2U2NEVuY29kZWQ6IGV2ZW50LmlzQmFzZTY0RW5jb2RlZCxcbiAgfSk7XG5cbiAgcmV0dXJuIHtcbiAgICBzdGF0dXNDb2RlOiByZXN1bHQuc3RhdHVzQ29kZSxcbiAgICBoZWFkZXJzOiByZXN1bHQuaGVhZGVycyxcbiAgICBib2R5OiByZXN1bHQuYm9keSA/PyAnJyxcbiAgfTtcbn1cblxuZXhwb3J0IHsgbGFtYmRhSGFuZGxlciBhcyBoYW5kbGVyIH07XG4iXX0=

package/lib/mcp-auth/lambda-handlers/register.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/register.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const register_1 = require("../handlers/register");
+const handler = (0, register_1.createRegisterHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaXN0ZXIuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvcmVnaXN0ZXIuaGFuZGxlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUtBLHNDQWVDO0FBRXlCLGdDQUFPO0FBdEJqQyw2Q0FBZ0Q7QUFDaEQsbURBQTZEO0FBRTdELE1BQU0sT0FBTyxHQUFHLElBQUEsZ0NBQXFCLEVBQUMsSUFBQSw2QkFBZ0IsR0FBRSxDQUFDLENBQUM7QUFFbkQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFxQztJQUN2RSxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQztRQUMzQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7UUFDNUIsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1FBQ2hCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBNkM7UUFDNUQscUJBQXFCLEVBQUUsS0FBSyxDQUFDLHFCQUFrRTtRQUMvRixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0tBQ3ZDLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3ZCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLEVBQUU7S0FDeEIsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBnZXRDb25maWdGcm9tRW52IH0gZnJvbSAnLi9lbnYtY29uZmlnJztcbmltcG9ydCB7IGNyZWF0ZVJlZ2lzdGVySGFuZGxlciB9IGZyb20gJy4uL2hhbmRsZXJzL3JlZ2lzdGVyJztcblxuY29uc3QgaGFuZGxlciA9IGNyZWF0ZVJlZ2lzdGVySGFuZGxlcihnZXRDb25maWdGcm9tRW52KCkpO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbGFtYmRhSGFuZGxlcihldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50KTogUHJvbWlzZTxBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5UmVzdWx0PiB7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IGhhbmRsZXIoe1xuICAgIGh0dHBNZXRob2Q6IGV2ZW50Lmh0dHBNZXRob2QsXG4gICAgcGF0aDogZXZlbnQucGF0aCxcbiAgICBoZWFkZXJzOiBldmVudC5oZWFkZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4sXG4gICAgcXVlcnlTdHJpbmdQYXJhbWV0ZXJzOiBldmVudC5xdWVyeVN0cmluZ1BhcmFtZXRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPiB8IG51bGwsXG4gICAgYm9keTogZXZlbnQuYm9keSxcbiAgICBpc0Jhc2U2NEVuY29kZWQ6IGV2ZW50LmlzQmFzZTY0RW5jb2RlZCxcbiAgfSk7XG5cbiAgcmV0dXJuIHtcbiAgICBzdGF0dXNDb2RlOiByZXN1bHQuc3RhdHVzQ29kZSxcbiAgICBoZWFkZXJzOiByZXN1bHQuaGVhZGVycyxcbiAgICBib2R5OiByZXN1bHQuYm9keSA/PyAnJyxcbiAgfTtcbn1cblxuZXhwb3J0IHsgbGFtYmRhSGFuZGxlciBhcyBoYW5kbGVyIH07XG4iXX0=

package/lib/mcp-auth/lambda-handlers/token.handler.d.ts

@@ -0,0 +1,2 @@
+export declare function lambdaHandler(event: AWSLambda.APIGatewayProxyEvent): Promise<AWSLambda.APIGatewayProxyResult>;
+export { lambdaHandler as handler };

package/lib/mcp-auth/lambda-handlers/token.handler.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaHandler = lambdaHandler;
+exports.handler = lambdaHandler;
+const env_config_1 = require("./env-config");
+const token_1 = require("../handlers/token");
+const handler = (0, token_1.createTokenHandler)((0, env_config_1.getConfigFromEnv)());
+async function lambdaHandler(event) {
+    const result = await handler({
+        httpMethod: event.httpMethod,
+        path: event.path,
+        headers: event.headers,
+        queryStringParameters: event.queryStringParameters,
+        body: event.body,
+        isBase64Encoded: event.isBase64Encoded,
+    });
+    return {
+        statusCode: result.statusCode,
+        headers: result.headers,
+        body: result.body ?? '',
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4uaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9sYW1iZGEtaGFuZGxlcnMvdG9rZW4uaGFuZGxlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUtBLHNDQWVDO0FBRXlCLGdDQUFPO0FBdEJqQyw2Q0FBZ0Q7QUFDaEQsNkNBQXVEO0FBRXZELE1BQU0sT0FBTyxHQUFHLElBQUEsMEJBQWtCLEVBQUMsSUFBQSw2QkFBZ0IsR0FBRSxDQUFDLENBQUM7QUFFaEQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFxQztJQUN2RSxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQztRQUMzQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7UUFDNUIsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1FBQ2hCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBNkM7UUFDNUQscUJBQXFCLEVBQUUsS0FBSyxDQUFDLHFCQUFrRTtRQUMvRixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7UUFDaEIsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0tBQ3ZDLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3ZCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLEVBQUU7S0FDeEIsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBnZXRDb25maWdGcm9tRW52IH0gZnJvbSAnLi9lbnYtY29uZmlnJztcbmltcG9ydCB7IGNyZWF0ZVRva2VuSGFuZGxlciB9IGZyb20gJy4uL2hhbmRsZXJzL3Rva2VuJztcblxuY29uc3QgaGFuZGxlciA9IGNyZWF0ZVRva2VuSGFuZGxlcihnZXRDb25maWdGcm9tRW52KCkpO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbGFtYmRhSGFuZGxlcihldmVudDogQVdTTGFtYmRhLkFQSUdhdGV3YXlQcm94eUV2ZW50KTogUHJvbWlzZTxBV1NMYW1iZGEuQVBJR2F0ZXdheVByb3h5UmVzdWx0PiB7XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IGhhbmRsZXIoe1xuICAgIGh0dHBNZXRob2Q6IGV2ZW50Lmh0dHBNZXRob2QsXG4gICAgcGF0aDogZXZlbnQucGF0aCxcbiAgICBoZWFkZXJzOiBldmVudC5oZWFkZXJzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IHVuZGVmaW5lZD4sXG4gICAgcXVlcnlTdHJpbmdQYXJhbWV0ZXJzOiBldmVudC5xdWVyeVN0cmluZ1BhcmFtZXRlcnMgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPiB8IG51bGwsXG4gICAgYm9keTogZXZlbnQuYm9keSxcbiAgICBpc0Jhc2U2NEVuY29kZWQ6IGV2ZW50LmlzQmFzZTY0RW5jb2RlZCxcbiAgfSk7XG5cbiAgcmV0dXJuIHtcbiAgICBzdGF0dXNDb2RlOiByZXN1bHQuc3RhdHVzQ29kZSxcbiAgICBoZWFkZXJzOiByZXN1bHQuaGVhZGVycyxcbiAgICBib2R5OiByZXN1bHQuYm9keSA/PyAnJyxcbiAgfTtcbn1cblxuZXhwb3J0IHsgbGFtYmRhSGFuZGxlciBhcyBoYW5kbGVyIH07XG4iXX0=

package/lib/mcp-auth/mcp/errors.d.ts

@@ -0,0 +1,8 @@
+export declare class McpUnauthorizedError extends Error {
+    readonly challenge: string;
+    constructor(challenge: string, message?: string);
+}
+export declare class McpProtocolError extends Error {
+    readonly code: number;
+    constructor(code: number, message: string);
+}