mcp-auth-server 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,208 @@
-# Temporary Holding Version
+# mcp-auth-server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+OAuth 2.1 authorization server for MCP servers. It sits next to your app's existing users and SSO: MCP clients (Cursor, Claude Code, Codex, VS Code, MCP Inspector) sign in through your own identity provider, and your `/mcp` endpoint accepts only tokens this package issued.
+
+The core is runtime-agnostic. It uses only web-standard APIs (`fetch`, `URL`, `crypto.subtle`, `crypto.getRandomValues`, `TextEncoder`) and `jose`. It has no `node:*` imports, no `Buffer`, and reads nothing from `process.env`. Node-only helpers live in `mcp.auth.node`.
+
+## Supported MCP authorization spec versions
+
+| Spec | Status |
+| --- | --- |
+| 2026-07-28 | Supported: Client ID Metadata Documents (SHOULD), `iss` in authorization responses (RFC 9207), per-request authentication without sessions |
+| 2025-06-18 | Supported for existing clients through Dynamic Client Registration (`/register`, on by default) |
+
+Standards implemented: RFC 6750, RFC 7009, RFC 7591, RFC 8414, RFC 8707, RFC 9207, RFC 9728, OAuth Client ID Metadata Document draft-00, PKCE (S256 only).
+
+## Install
+
+```bash
+pnpm add mcp-auth-server
+```
+
+Frameworks and database drivers are optional peer dependencies. Install only the ones you use.
+
+Entry points (deep imports from `lib`, like the other packages in this family):
+
+| Import | Contents |
+| --- | --- |
+| `mcp-auth-server` | core: `createMcpAuth`, `oidcUpstream`, `appSessionUpstream`, types |
+| `mcp-auth-server/lib/mcp.auth.fetch` | Fetch adapter (Bun, Deno, Workers, Hono, Next.js App Router, Remix, SvelteKit, Astro, Elysia, h3 v2) |
+| `mcp-auth-server/lib/mcp.auth.node` | `node:http` adapter, Node SSRF guard |
+| `mcp-auth-server/lib/mcp.auth.express` | Express middleware |
+| `mcp-auth-server/lib/mcp.auth.fastify` | Fastify plugin |
+| `mcp-auth-server/lib/mcp.auth.koa` | Koa middleware |
+| `mcp-auth-server/lib/mcp.auth.memory` | in-memory storage |
+| `mcp-auth-server/lib/mcp.auth.mongodb` | MongoDB storage |
+| `mcp-auth-server/lib/mcp.auth.postgres` | Postgres storage (`pg`, `postgres.js`) |
+| `mcp-auth-server/lib/mcp.auth.sqlite` | SQLite storage (`better-sqlite3`, `node:sqlite`, `bun:sqlite`, Cloudflare D1) |
+| `mcp-auth-server/lib/mcp.auth.entra` | Entra ID preset |
+
+## Quick start (Express)
+
+```ts
+import express from 'express';
+import {createMcpAuth, oidcUpstream, signingKeyFromEnv} from 'mcp-auth-server';
+import {expressMiddleware} from 'mcp-auth-server/lib/mcp.auth.express';
+import {MemoryStorage} from 'mcp-auth-server/lib/mcp.auth.memory';
+
+const auth = createMcpAuth({
+	issuer: 'https://mcp.example.com',
+	resource: 'https://mcp.example.com/mcp',
+	signingKey: signingKeyFromEnv(process.env, 'MCP_OAUTH_SIGNING_KEY'),
+	storage: new MemoryStorage(),
+	upstream: oidcUpstream({discoveryUrl: 'https://idp.example.com/.well-known/openid-configuration', clientId: '...', clientSecret: '...'}),
+	resolveUser: async (claims) => ({id: String(claims.sub), displayName: String(claims.name)}),
+	loadActiveUser: async (id) => findActiveUser(id)
+});
+
+const app = express();
+app.use(expressMiddleware(auth));
+app.post('/mcp', express.json(), async (req, res) => {
+	const result = await auth.authenticate(req.headers, req.body);
+	if (!('user' in result)) return res.status(result.status).set(result.headers).json(result.body);
+	res.json(await handleMcp(result.user, req.body));
+});
+```
+
+Generate a signing key:
+
+```bash
+pnpm keygen
+pnpm keygen --out mcp-signing-key.pem
+```
+
+`signingKey` accepts a `CryptoKey` or a PEM string (PKCS8 or PKCS1). `signingKeyFromEnv(env, name)` reads a PEM from an environment object and accepts literal `\n` newlines. Pass `verificationKey` when the signing `CryptoKey` is not extractable.
+
+## Other frameworks
+
+Fetch (Bun, Deno, Workers, Hono, Next.js App Router, Remix, SvelteKit, Astro, Elysia, h3 v2):
+
+```ts
+import {createFetchHandler} from 'mcp-auth-server/lib/mcp.auth.fetch';
+
+const handle = createFetchHandler(auth);
+export default {
+	fetch: async (request: Request) => (await handle(request)) ?? mcpResponse(request)
+};
+```
+
+`createFetchHandler` returns `null` for paths it does not own, so your own routes keep working.
+
+Fastify:
+
+```ts
+import {fastifyPlugin} from 'mcp-auth-server/lib/mcp.auth.fastify';
+
+await app.register(fastifyPlugin(auth));
+```
+
+Koa:
+
+```ts
+import {koaMiddleware} from 'mcp-auth-server/lib/mcp.auth.koa';
+
+app.use(koaMiddleware(auth));
+```
+
+`node:http`:
+
+```ts
+import {createNodeHandler} from 'mcp-auth-server/lib/mcp.auth.node';
+
+const handle = createNodeHandler(auth);
+createServer(async (req, res) => {
+	if (await handle(req, res)) return;
+	res.writeHead(404).end();
+});
+```
+
+All adapters read both JSON and `application/x-www-form-urlencoded` bodies (`/token`, `/revoke` and the consent POST are form-encoded). Express and Koa reuse a body already parsed by `express.json()`, `express.urlencoded()` or `koa-bodyparser`.
+
+Hosts that mount routes themselves can use `auth.routes`, `auth.handle(request)` and the individual handlers with the plain-object contract `{method, path, query, headers, body, ip}` to `{status, headers, body}`.
+
+### Recipes
+
+- **NestJS**: Nest runs on Express or Fastify. Call `app.getHttpAdapter().getInstance()` and use `app.use(expressMiddleware(auth))` or `await instance.register(fastifyPlugin(auth))` before `app.listen`. Put your `/mcp` controller behind a guard that calls `auth.authenticate(req.headers, req.body)`.
+- **Hono**: `app.all('*', async (c, next) => (await handle(c.req.raw)) ?? next())` with `handle = createFetchHandler(auth)`.
+- **Next.js**: App Router: export `GET` and `POST` from catch-all route handlers that call `createFetchHandler(auth)`; mount the well-known routes at the root (see below). Pages Router: use `createNodeHandler(auth)` from an API route with `export const config = {api: {bodyParser: false}}`.
+
+## Mounting and well-known paths
+
+`issuer` and `resource` come from options only, never from request headers. If the issuer has a path (`https://example.com/auth`), the RFC 8414 metadata lives at `/.well-known/oauth-authorization-server/auth`. Hosts must mount the `/.well-known/*` routes at the origin root. The dispatcher serves the root and path forms.
+
+## Hooks
+
+| Hook | Purpose |
+| --- | --- |
+| `resolveUser(claims)` | Called after upstream sign-in with the validated id token claims. Create or update your user and return `{id, displayName?}`. Defaults to `{id: sub, displayName: name}`. |
+| `loadActiveUser(id)` | Called on every `/mcp` request. Return `null` and the request fails with 401 `user_inactive`. |
+| `renderConsent(model)` | Return HTML for the consent page. A default page is provided. |
+| `rateLimit(key, route)` | Optional. Return `false` to answer 429. Called for `register`, `token` and `revoke` with the client IP as key. |
+| `logger` | Optional `{info, warn, error}`. |
+
+## Upstream login
+
+OIDC (any provider, PKCE S256, id token validated with JWKS):
+
+```ts
+oidcUpstream({discoveryUrl, clientId, clientSecret, scope: 'openid profile email'});
+```
+
+Entra ID preset:
+
+```ts
+import {entraUpstream} from 'mcp-auth-server/lib/mcp.auth.entra';
+
+entraUpstream({tenantId, clientId, clientSecret});
+```
+
+Set `callbackPath` (default `/oauth/callback`) to match the redirect URI registered at the provider, for example `/oauth/azure-callback`.
+
+App session, for apps that already have their own login:
+
+```ts
+appSessionUpstream({
+	getSignedInUser: async (request) => sessionUser(request.headers.cookie),
+	signInUrl: (returnTo) => `/login?returnTo=${encodeURIComponent(returnTo)}`
+});
+```
+
+At `/authorize`, a signed-in user goes straight to consent or the code. Otherwise the browser is sent to `signInUrl(returnTo)` where `returnTo` is always `{issuer}/oauth/resume?state=<stateId>` built by the package. `/oauth/resume` rechecks `getSignedInUser`, stores the user id on the pending authorization and continues exactly like the OIDC callback. The consent page and POST then require the same signed-in session, so the app cookie should be `SameSite=Lax` or stricter. The random `state` bound to the pending authorization protects the consent step against CSRF.
+
+## Client registration
+
+- **Client ID Metadata Documents** (recommended, advertised as `client_id_metadata_document_supported`): an `https` client_id URL with a path is fetched and validated (JSON with `client_id` equal to the URL, `client_name`, `redirect_uris`). The authorization request's `redirect_uri` must be listed. Responses are cached respecting `Cache-Control` up to `cimd.maxCacheSeconds`. Fetches use no redirects, a 5 s timeout and a 5 KiB limit by default. Private, loopback and link-local hosts are rejected for IP literals and internal names. On Node add DNS resolution checking: `cimd: {guard: nodeSsrfGuard}`. Inject `cimd.fetch` or `cimd.guard` on other runtimes. Use `cimd.trust: {allowHosts, denyHosts}` for a host policy (`*.example.com` patterns allowed). The consent page shows the client_id host next to the self-declared name. `private_key_jwt` client authentication is not supported; `token_endpoint_auth_method` stays `none`.
+- **Dynamic Client Registration** (deprecated by the spec, kept for 2025-06-18 clients): `POST /register`, public clients only, `application_type` is accepted and stored. Turn off with `registration: {enabled: false}`.
+
+Redirect URIs: `http://localhost` and `http://127.0.0.1` on any port, hosts from `redirects.httpsHosts`, schemes from `redirects.customSchemes` (`cursor://`, `vscode://`). Fragments are never allowed. `/authorize` and `/token` require an exact match.
+
+## Storage
+
+All five record types (clients, pending authorizations, authorization codes, refresh tokens, consents) go through one interface with atomic operations: `claimAuthorizationCode`, `claimRefreshToken`, `revokeRefreshTokenFamily`, `takePendingAuthorization`, `attachUserToPendingAuthorization`, `upsertConsent`, `deleteExpired`.
+
+- **Memory**: `new MemoryStorage()`.
+- **MongoDB**: `const storage = new MongoStorage(db, options); await storage.ensureIndexes();`. Defaults use the collection names `mcp_oauth_clients`, `mcp_oauth_pending_authorizations`, `mcp_oauth_authorization_codes`, `mcp_oauth_refresh_tokens`, `mcp_oauth_consents`, all configurable. `userIdField`, `userIdToDb` and `userIdFromDb` map an existing user key (for example a numeric `employeeId`) without a data migration. TTL indexes remove expired documents.
+- **Postgres and SQLite** share one SQL implementation that takes an executor `(sql, params) => rows` instead of a driver: `postgresStorage(fromPg(pool))`, `postgresStorage(fromPostgresJs(sql))`, `sqliteStorage(fromBetterSqlite3(db))`, `sqliteStorage(fromNodeSqlite(db))`, `sqliteStorage(fromBunSqlite(db))`, `sqliteStorage(fromD1(env.DB))`. Create tables with `await storage.migrate()` or run `sql/postgres.sql` / `sql/sqlite.sql`. SQLite needs 3.35 or newer (`RETURNING`). Call `auth.deleteExpired()` on a schedule (cron, Workers cron trigger).
+
+## Rate limits to apply
+
+Apply these in your host or through the `rateLimit` hook:
+
+| Route | Limit |
+| --- | --- |
+| `POST /register` | 20 per minute per IP |
+| `POST /token`, `POST /revoke` | 60 per minute per IP |
+| everything else | 200 per minute per IP |
+
+## Security notes
+
+- Authorization codes: 32 random bytes, only the SHA-256 hash is stored, 60 s TTL, single use (atomic claim before validation); client, redirect URI, PKCE verifier and resource are checked.
+- Access tokens: RS256 JWT with `iss`, `aud` = resource, `sub`, `client_id`, `jti`, 1 h. Refresh tokens are opaque, stored as hashes, single use, rotate within the same family and absolute expiry (30 d). Replaying a used or revoked refresh token revokes the whole family.
+- Public clients only: `/token` and `/revoke` answer 401 `invalid_client` when a secret or an `Authorization` header is sent.
+- Every redirect to the client carries `iss` (RFC 9207), including errors. Unknown clients and unregistered redirect URIs never redirect.
+- No MCP sessions: `auth.authenticate(headers, body)` validates every request on its own and never caches users. Signing keys are cached. A disabled user fails on the next request.
+- Consent page: `X-Frame-Options: DENY`, strict CSP, `Cache-Control: no-store`, all values escaped.
+
+## Scripts
+
+Same as the other packages in this family: `pnpm all`, `build`, `clean`, `format`, `test`, `quick`, `integration`, `docs`, and so on.

package/bin/keygen.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import {generateKeyPairSync} from 'node:crypto';
+import {writeFileSync} from 'node:fs';
+
+const args = process.argv.slice(2);
+const option = (name, fallback) => {
+	const index = args.indexOf(name);
+	return -1 === index ? fallback : args[index + 1];
+};
+
+if (args.includes('--help')) {
+	console.log('usage: mcp-auth-keygen [--bits 2048] [--env NAME] [--out file.pem]');
+	process.exit(0);
+}
+
+const {privateKey} = generateKeyPairSync('rsa', {modulusLength: Number(option('--bits', '2048'))});
+const pem = privateKey.export({type: 'pkcs8', format: 'pem'}).trim();
+const outFile = option('--out');
+
+if (outFile) {
+	writeFileSync(outFile, `${pem}\n`, {mode: 0o600});
+	console.log(`private key written to ${outFile}`);
+} else {
+	const envName = option('--env', 'MCP_OAUTH_SIGNING_KEY');
+	console.log(`${envName}=${pem.split('\n').join('\\n')}`);
+}

package/lib/adapters/express/express.middleware.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from 'express';
+import type McpAuthType from '../../types/mcp.auth.type';
+declare const expressMiddleware: (auth: McpAuthType<any>) => RequestHandler;
+export default expressMiddleware;

package/lib/adapters/express/express.middleware.js

@@ -0,0 +1,23 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const to_node_http_request_1 = __importDefault(require("../node/to.node.http.request"));
+const write_node_response_1 = __importDefault(require("../node/write.node.response"));
+const expressMiddleware = (auth) => async (req, res, next) => {
+    const originalUrl = req.originalUrl ?? req.url;
+    const path = new URL(originalUrl, 'http://localhost').pathname;
+    if (!auth.hasRoute({ method: req.method, path, query: {}, headers: {} }))
+        return next();
+    try {
+        const preParsed = req.body && 'object' === typeof req.body && Object.keys(req.body).length > 0 ? req.body : undefined;
+        const parsed = await (0, to_node_http_request_1.default)(Object.assign(req, { url: originalUrl }), preParsed);
+        (0, write_node_response_1.default)(res, await auth.handle(parsed));
+    }
+    catch (error) {
+        next(error);
+    }
+};
+exports.default = expressMiddleware;
+//# sourceMappingURL=express.middleware.js.map

package/lib/adapters/express/express.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.middleware.js","sourceRoot":"","sources":["../../../src/adapters/express/express.middleware.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,wFAA6D;AAC7D,sFAA4D;AAE5D,MAAM,iBAAiB,GACtB,CAAC,IAAsB,EAAkB,EAAE,CAC3C,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;IACxE,MAAM,WAAW,GAAW,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,CAAC;IACvD,MAAM,IAAI,GAAW,IAAI,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACtF,IAAI,CAAC;QACJ,MAAM,SAAS,GAAY,GAAG,CAAC,IAAI,IAAI,QAAQ,KAAK,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/H,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAiB,EAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAC,GAAG,EAAE,WAAW,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1F,IAAA,6BAAiB,EAAC,GAAG,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC,CAAC;IACb,CAAC;AACF,CAAC,CAAC;AACH,kBAAe,iBAAiB,CAAC"}

package/lib/adapters/fastify/fastify.plugin.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from 'fastify';
+import type McpAuthType from '../../types/mcp.auth.type';
+declare const fastifyPlugin: (auth: McpAuthType<any>) => (fastify: FastifyInstance) => Promise<void>;
+export default fastifyPlugin;

package/lib/adapters/fastify/fastify.plugin.js

@@ -0,0 +1,32 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const parse_body_1 = __importDefault(require("../../functions/body/parse.body"));
+const parse_query_1 = __importDefault(require("../../functions/body/parse.query"));
+const fastifyPlugin = (auth) => async (fastify) => {
+    if (!fastify.hasContentTypeParser('application/x-www-form-urlencoded')) {
+        fastify.addContentTypeParser('application/x-www-form-urlencoded', { parseAs: 'string' }, (_request, body, done) => done(null, (0, parse_body_1.default)('application/x-www-form-urlencoded', body)));
+    }
+    auth.routes.forEach((route) => {
+        fastify.route({
+            method: route.method,
+            url: route.path,
+            handler: async (request, reply) => {
+                const response = await auth.handle({
+                    method: request.method,
+                    path: route.path,
+                    query: (0, parse_query_1.default)(new URL(request.url, 'http://localhost').searchParams),
+                    headers: request.headers,
+                    body: request.body,
+                    ip: request.ip
+                });
+                reply.headers(response.headers);
+                return reply.status(response.status).send(response.body);
+            }
+        });
+    });
+};
+exports.default = fastifyPlugin;
+//# sourceMappingURL=fastify.plugin.js.map

package/lib/adapters/fastify/fastify.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.plugin.js","sourceRoot":"","sources":["../../../src/adapters/fastify/fastify.plugin.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,iFAAwD;AACxD,mFAA0D;AAI1D,MAAM,aAAa,GAClB,CAAC,IAAsB,EAAE,EAAE,CAC3B,KAAK,EAAE,OAAwB,EAAiB,EAAE;IACjD,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,EAAE,EAAC,OAAO,EAAE,QAAQ,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAQ,EAAE,CACrH,IAAI,CAAC,IAAI,EAAE,IAAA,oBAAS,EAAC,mCAAmC,EAAE,IAAc,CAAC,CAAC,CAC1E,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAgB,EAAQ,EAAE;QAC9C,OAAO,CAAC,KAAK,CAAC;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,IAAI;YACf,OAAO,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAyB,EAAE;gBACtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;oBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,IAAA,qBAAU,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC;oBACxE,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,EAAE,EAAE,OAAO,CAAC,EAAE;iBACd,CAAC,CAAC;gBACH,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAChC,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1D,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AACH,kBAAe,aAAa,CAAC"}

package/lib/adapters/fetch/create.fetch.handler.d.ts

@@ -0,0 +1,3 @@
+import type McpAuthType from '../../types/mcp.auth.type';
+declare const createFetchHandler: (auth: McpAuthType<any>) => (request: Request) => Promise<Response | null>;
+export default createFetchHandler;

package/lib/adapters/fetch/create.fetch.handler.js

@@ -0,0 +1,13 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const to_http_request_1 = __importDefault(require("./to.http.request"));
+const to_response_1 = __importDefault(require("./to.response"));
+const createFetchHandler = (auth) => async (request) => {
+    const parsed = await (0, to_http_request_1.default)(request);
+    return auth.hasRoute(parsed) ? (0, to_response_1.default)(await auth.handle(parsed)) : null;
+};
+exports.default = createFetchHandler;
+//# sourceMappingURL=create.fetch.handler.js.map

package/lib/adapters/fetch/create.fetch.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.fetch.handler.js","sourceRoot":"","sources":["../../../src/adapters/fetch/create.fetch.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAGb,wEAA8C;AAC9C,gEAAuC;AAEvC,MAAM,kBAAkB,GACvB,CAAC,IAAsB,EAAE,EAAE,CAC3B,KAAK,EAAE,OAAgB,EAA4B,EAAE;IACpD,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAa,EAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,qBAAU,EAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC,CAAC;AACH,kBAAe,kBAAkB,CAAC"}

package/lib/adapters/fetch/to.http.request.d.ts

@@ -0,0 +1,3 @@
+import type HttpRequestType from '../../types/http.request.type';
+declare const toHttpRequest: (request: Request) => Promise<HttpRequestType>;
+export default toHttpRequest;

package/lib/adapters/fetch/to.http.request.js

@@ -0,0 +1,22 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const parse_body_1 = __importDefault(require("../../functions/body/parse.body"));
+const parse_query_1 = __importDefault(require("../../functions/body/parse.query"));
+const toHttpRequest = async (request) => {
+    const url = new URL(request.url);
+    const headers = Object.fromEntries(request.headers.entries());
+    const raw = 'GET' === request.method || 'HEAD' === request.method ? '' : await request.text();
+    return {
+        method: request.method,
+        path: url.pathname,
+        query: (0, parse_query_1.default)(url.searchParams),
+        headers,
+        body: (0, parse_body_1.default)(headers['content-type'], raw),
+        ip: headers['cf-connecting-ip'] ?? headers['x-real-ip'] ?? headers['x-forwarded-for']?.split(',')[0]?.trim()
+    };
+};
+exports.default = toHttpRequest;
+//# sourceMappingURL=to.http.request.js.map

package/lib/adapters/fetch/to.http.request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to.http.request.js","sourceRoot":"","sources":["../../../src/adapters/fetch/to.http.request.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,iFAAwD;AACxD,mFAA0D;AAG1D,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAA4B,EAAE;IAC1E,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAA2B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAW,KAAK,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACtG,OAAO;QACN,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,GAAG,CAAC,QAAQ;QAClB,KAAK,EAAE,IAAA,qBAAU,EAAC,GAAG,CAAC,YAAY,CAAC;QACnC,OAAO;QACP,IAAI,EAAE,IAAA,oBAAS,EAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC;QAC7C,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;KAC5G,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/adapters/fetch/to.response.d.ts

@@ -0,0 +1,3 @@
+import type HttpResponseType from '../../types/http.response.type';
+declare const toResponse: (response: HttpResponseType) => Response;
+export default toResponse;

package/lib/adapters/fetch/to.response.js

@@ -0,0 +1,10 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const toResponse = (response) => {
+    const body = response.body;
+    if (undefined === body)
+        return new Response(null, { status: response.status, headers: response.headers });
+    return new Response('string' === typeof body ? body : JSON.stringify(body), { status: response.status, headers: response.headers });
+};
+exports.default = toResponse;
+//# sourceMappingURL=to.response.js.map

package/lib/adapters/fetch/to.response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to.response.js","sourceRoot":"","sources":["../../../src/adapters/fetch/to.response.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,UAAU,GAAG,CAAC,QAA0B,EAAY,EAAE;IAC3D,MAAM,IAAI,GAAY,QAAQ,CAAC,IAAI,CAAC;IACpC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAC,CAAC,CAAC;IACxG,OAAO,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAC,CAAC,CAAC;AACnI,CAAC,CAAC;AACF,kBAAe,UAAU,CAAC"}

package/lib/adapters/koa/koa.middleware.d.ts

@@ -0,0 +1,4 @@
+import type { Context, Next } from 'koa';
+import type McpAuthType from '../../types/mcp.auth.type';
+declare const koaMiddleware: (auth: McpAuthType<any>) => (ctx: Context, next: Next) => Promise<void>;
+export default koaMiddleware;

package/lib/adapters/koa/koa.middleware.js

@@ -0,0 +1,19 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const to_node_http_request_1 = __importDefault(require("../node/to.node.http.request"));
+const koaMiddleware = (auth) => async (ctx, next) => {
+    if (!auth.hasRoute({ method: ctx.method, path: ctx.path, query: {}, headers: {} }))
+        return next();
+    const body = ctx.request.body;
+    const preParsed = body && 'object' === typeof body && Object.keys(body).length > 0 ? body : undefined;
+    const parsed = await (0, to_node_http_request_1.default)(ctx.req, preParsed);
+    const response = await auth.handle({ ...parsed, path: ctx.path });
+    ctx.status = response.status;
+    ctx.set(response.headers);
+    ctx.body = response.body ?? '';
+};
+exports.default = koaMiddleware;
+//# sourceMappingURL=koa.middleware.js.map

package/lib/adapters/koa/koa.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"koa.middleware.js","sourceRoot":"","sources":["../../../src/adapters/koa/koa.middleware.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,wFAA6D;AAE7D,MAAM,aAAa,GAClB,CAAC,IAAsB,EAAE,EAAE,CAC3B,KAAK,EAAE,GAAY,EAAE,IAAU,EAAiB,EAAE;IACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAChG,MAAM,IAAI,GAAa,GAAG,CAAC,OAA4B,CAAC,IAAI,CAAC;IAC7D,MAAM,SAAS,GAAY,IAAI,IAAI,QAAQ,KAAK,OAAO,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAiB,EAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAC,GAAG,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAC,CAAC,CAAC;IAChE,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;AAChC,CAAC,CAAC;AACH,kBAAe,aAAa,CAAC"}

package/lib/adapters/node/create.node.handler.d.ts

@@ -0,0 +1,4 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type McpAuthType from '../../types/mcp.auth.type';
+declare const createNodeHandler: (auth: McpAuthType<any>) => (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+export default createNodeHandler;

package/lib/adapters/node/create.node.handler.js

@@ -0,0 +1,16 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const to_node_http_request_1 = __importDefault(require("./to.node.http.request"));
+const write_node_response_1 = __importDefault(require("./write.node.response"));
+const createNodeHandler = (auth) => async (req, res) => {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    if (!auth.hasRoute({ method: req.method ?? 'GET', path: url.pathname, query: {}, headers: {} }))
+        return false;
+    (0, write_node_response_1.default)(res, await auth.handle(await (0, to_node_http_request_1.default)(req)));
+    return true;
+};
+exports.default = createNodeHandler;
+//# sourceMappingURL=create.node.handler.js.map

package/lib/adapters/node/create.node.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.node.handler.js","sourceRoot":"","sources":["../../../src/adapters/node/create.node.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,kFAAuD;AACvD,gFAAsD;AAEtD,MAAM,iBAAiB,GACtB,CAAC,IAAsB,EAAE,EAAE,CAC3B,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAoB,EAAE;IACrE,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5G,IAAA,6BAAiB,EAAC,GAAG,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AACH,kBAAe,iBAAiB,CAAC"}

package/lib/adapters/node/node.ssrf.guard.d.ts

@@ -0,0 +1,2 @@
+declare const nodeSsrfGuard: (url: URL) => Promise<void>;
+export default nodeSsrfGuard;

package/lib/adapters/node/node.ssrf.guard.js

@@ -0,0 +1,16 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:dns/promises");
+const assert_public_host_1 = __importDefault(require("../../functions/cimd/assert.public.host"));
+const nodeSsrfGuard = async (url) => {
+    const addresses = await (0, promises_1.lookup)(url.hostname.replace(/^\[|\]$/g, ''), { all: true });
+    for (const { address } of addresses) {
+        const host = address.includes(':') ? `[${address}]` : address;
+        (0, assert_public_host_1.default)(new URL(`https://${host}`));
+    }
+};
+exports.default = nodeSsrfGuard;
+//# sourceMappingURL=node.ssrf.guard.js.map

package/lib/adapters/node/node.ssrf.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.ssrf.guard.js","sourceRoot":"","sources":["../../../src/adapters/node/node.ssrf.guard.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,gDAAyC;AAEzC,iGAAuE;AAEvE,MAAM,aAAa,GAAG,KAAK,EAAE,GAAQ,EAAiB,EAAE;IACvD,MAAM,SAAS,GAAG,MAAM,IAAA,iBAAM,EAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAC,GAAG,EAAE,IAAI,EAAC,CAAC,CAAC;IAClF,KAAK,MAAM,EAAC,OAAO,EAAC,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAW,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,IAAA,4BAAgB,EAAC,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/adapters/node/parse.node.body.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage } from 'node:http';
+declare const parseNodeBody: (req: IncomingMessage, preParsedBody?: unknown) => Promise<unknown>;
+export default parseNodeBody;

package/lib/adapters/node/parse.node.body.js

@@ -0,0 +1,16 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const parse_body_1 = __importDefault(require("../../functions/body/parse.body"));
+const read_node_body_1 = __importDefault(require("./read.node.body"));
+const parseNodeBody = async (req, preParsedBody) => {
+    if (undefined !== preParsedBody)
+        return preParsedBody;
+    if ('GET' === req.method || 'HEAD' === req.method)
+        return undefined;
+    return (0, parse_body_1.default)(req.headers['content-type'], await (0, read_node_body_1.default)(req));
+};
+exports.default = parseNodeBody;
+//# sourceMappingURL=parse.node.body.js.map

package/lib/adapters/node/parse.node.body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.node.body.js","sourceRoot":"","sources":["../../../src/adapters/node/parse.node.body.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,iFAAwD;AACxD,sEAA4C;AAE5C,MAAM,aAAa,GAAG,KAAK,EAAE,GAAoB,EAAE,aAAuB,EAAoB,EAAE;IAC/F,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,IAAA,oBAAS,EAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/adapters/node/read.node.body.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage } from 'node:http';
+declare const readNodeBody: (req: IncomingMessage) => Promise<string>;
+export default readNodeBody;

package/lib/adapters/node/read.node.body.js

@@ -0,0 +1,10 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const readNodeBody = async (req) => {
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf8');
+};
+exports.default = readNodeBody;
+//# sourceMappingURL=read.node.body.js.map

package/lib/adapters/node/read.node.body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.node.body.js","sourceRoot":"","sources":["../../../src/adapters/node/read.node.body.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,YAAY,GAAG,KAAK,EAAE,GAAoB,EAAmB,EAAE;IACpE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AACF,kBAAe,YAAY,CAAC"}

package/lib/adapters/node/to.node.http.request.d.ts

@@ -0,0 +1,4 @@
+import type { IncomingMessage } from 'node:http';
+import type HttpRequestType from '../../types/http.request.type';
+declare const toNodeHttpRequest: (req: IncomingMessage, preParsedBody?: unknown) => Promise<HttpRequestType>;
+export default toNodeHttpRequest;

package/lib/adapters/node/to.node.http.request.js

@@ -0,0 +1,20 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const parse_query_1 = __importDefault(require("../../functions/body/parse.query"));
+const parse_node_body_1 = __importDefault(require("./parse.node.body"));
+const toNodeHttpRequest = async (req, preParsedBody) => {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    return {
+        method: req.method ?? 'GET',
+        path: url.pathname,
+        query: (0, parse_query_1.default)(url.searchParams),
+        headers: { ...req.headers },
+        body: await (0, parse_node_body_1.default)(req, preParsedBody),
+        ip: req.socket?.remoteAddress
+    };
+};
+exports.default = toNodeHttpRequest;
+//# sourceMappingURL=to.node.http.request.js.map

package/lib/adapters/node/to.node.http.request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to.node.http.request.js","sourceRoot":"","sources":["../../../src/adapters/node/to.node.http.request.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,mFAA0D;AAE1D,wEAA8C;AAE9C,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAoB,EAAE,aAAuB,EAA4B,EAAE;IAC3G,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC7D,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;QAC3B,IAAI,EAAE,GAAG,CAAC,QAAQ;QAClB,KAAK,EAAE,IAAA,qBAAU,EAAC,GAAG,CAAC,YAAY,CAAC;QACnC,OAAO,EAAE,EAAC,GAAG,GAAG,CAAC,OAAO,EAAC;QACzB,IAAI,EAAE,MAAM,IAAA,yBAAa,EAAC,GAAG,EAAE,aAAa,CAAC;QAC7C,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa;KAC7B,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,iBAAiB,CAAC"}

package/lib/adapters/node/write.node.response.d.ts

@@ -0,0 +1,4 @@
+import type { ServerResponse } from 'node:http';
+import type HttpResponseType from '../../types/http.response.type';
+declare const writeNodeResponse: (res: ServerResponse, response: HttpResponseType) => void;
+export default writeNodeResponse;

package/lib/adapters/node/write.node.response.js

@@ -0,0 +1,10 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const writeNodeResponse = (res, response) => {
+    const body = response.body;
+    const payload = undefined === body || 'string' === typeof body ? body : JSON.stringify(body);
+    res.writeHead(response.status, response.headers);
+    res.end(payload);
+};
+exports.default = writeNodeResponse;
+//# sourceMappingURL=write.node.response.js.map

package/lib/adapters/node/write.node.response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.node.response.js","sourceRoot":"","sources":["../../../src/adapters/node/write.node.response.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAMb,MAAM,iBAAiB,GAAG,CAAC,GAAmB,EAAE,QAA0B,EAAQ,EAAE;IACnF,MAAM,IAAI,GAAY,QAAQ,CAAC,IAAI,CAAC;IACpC,MAAM,OAAO,GAAuB,SAAS,KAAK,IAAI,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAE,IAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC,CAAC;AACF,kBAAe,iBAAiB,CAAC"}

package/lib/cache/lru.metadata.cache.d.ts

@@ -0,0 +1,10 @@
+import type ClientMetadataType from '../types/client.metadata.type';
+import type IMetadataCache from '../types/i.metadata.cache';
+export default class LruMetadataCache implements IMetadataCache {
+    private readonly maxEntries;
+    private readonly now;
+    private entries;
+    constructor(maxEntries?: number, now?: () => number);
+    get(url: string): Promise<ClientMetadataType | undefined>;
+    set(url: string, value: ClientMetadataType, ttlSeconds: number): Promise<void>;
+}