mcp-local-tunnel 1.0.0

package/dist/agent.js

@@ -0,0 +1,184 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startAgent = void 0;
+const node_os_1 = __importDefault(require("node:os"));
+const ws_1 = __importDefault(require("ws"));
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/client/stdio.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+const agent_auth_js_1 = require("./agent-auth.js");
+const MAX_RECONNECT_DELAY_MS = 30_000;
+const INITIAL_RECONNECT_DELAY_MS = 1_000;
+const toWsUrl = (relay) => {
+    if (relay.startsWith('ws://') || relay.startsWith('wss://')) {
+        return relay.endsWith('/ws') ? relay : `${relay.replace(/\/$/, '')}/ws`;
+    }
+    if (relay.startsWith('http://') || relay.startsWith('https://')) {
+        const url = new URL(relay);
+        url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+        url.pathname = `${url.pathname.replace(/\/$/, '')}/ws`;
+        return url.toString();
+    }
+    return `wss://${relay}/ws`;
+};
+const startAgent = async (config) => {
+    const name = config.name ?? node_os_1.default.hostname();
+    const relayUrl = toWsUrl(config.relay);
+    let reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+    let shouldReconnect = true;
+    const spawnServers = async () => {
+        const servers = [];
+        const entries = Object.entries(config.servers);
+        // Spawn servers sequentially to avoid overwhelming the system
+        for (const [serverName, entry] of entries) {
+            try {
+                const client = new index_js_1.Client({ name: `agent-${serverName}`, version: '1.0.0' });
+                let transport;
+                if (entry.command) {
+                    const [cmd, ...args] = entry.command;
+                    transport = new stdio_js_1.StdioClientTransport({
+                        command: cmd,
+                        args,
+                        env: { ...process.env, ...entry.env },
+                    });
+                }
+                else if (entry.url) {
+                    transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(entry.url));
+                }
+                else {
+                    throw new Error(`Server "${serverName}" must have either "command" or "url"`);
+                }
+                // eslint-disable-next-line no-await-in-loop
+                await client.connect(transport);
+                servers.push({ name: serverName, client, transport });
+                console.log(`  Started local server: ${serverName}`);
+            }
+            catch (err) {
+                console.error(`  Failed to start server "${serverName}":`, err instanceof Error ? err.message : err);
+            }
+        }
+        return servers;
+    };
+    const collectTools = async (servers) => {
+        const tools = [];
+        for (const server of servers) {
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                const result = await server.client.listTools();
+                for (const tool of result.tools) {
+                    tools.push({
+                        name: `${server.name}__${tool.name}`,
+                        description: `[${server.name}] ${tool.description ?? ''}`,
+                        inputSchema: tool.inputSchema,
+                        ...(tool.annotations ? { annotations: tool.annotations } : {}),
+                    });
+                }
+            }
+            catch (err) {
+                console.error(`  Failed to list tools from "${server.name}":`, err instanceof Error ? err.message : err);
+            }
+        }
+        return tools;
+    };
+    const closeServers = async (servers) => {
+        for (const server of servers) {
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                await server.client.close();
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+        }
+    };
+    const handleToolCall = async (servers, toolName, args) => {
+        const separatorIndex = toolName.indexOf('__');
+        if (separatorIndex === -1) {
+            throw new Error(`Unknown tool: ${toolName}`);
+        }
+        const serverName = toolName.slice(0, separatorIndex);
+        const originalName = toolName.slice(separatorIndex + 2);
+        const server = servers.find((s) => s.name === serverName);
+        if (!server) {
+            throw new Error(`Unknown server: ${serverName}`);
+        }
+        const result = await server.client.callTool({ name: originalName, arguments: args });
+        return result;
+    };
+    const connect = async () => {
+        let servers = await spawnServers();
+        let tools = await collectTools(servers);
+        const token = await (0, agent_auth_js_1.getAccessToken)(config.relay);
+        const wsUrl = new URL(relayUrl);
+        wsUrl.searchParams.set('name', name);
+        wsUrl.searchParams.set('token', token);
+        console.log(`Connecting to ${config.relay} as "${name}"...`);
+        const ws = new ws_1.default(wsUrl.toString());
+        ws.on('open', () => {
+            reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+            console.log(`Connected to ${config.relay} as "${name}"`);
+            console.log(`Serving ${tools.length} tools: ${tools.map((t) => t.name).join(', ')}`);
+            const msg = { type: 'tools', tools };
+            ws.send(JSON.stringify(msg));
+        });
+        ws.on('message', async (data) => {
+            try {
+                const msg = JSON.parse(data.toString());
+                if (msg.type === 'request') {
+                    try {
+                        const result = await handleToolCall(servers, msg.method, msg.params);
+                        const response = { type: 'response', id: msg.id, result };
+                        ws.send(JSON.stringify(response));
+                    }
+                    catch (err) {
+                        const errMsg = {
+                            type: 'error',
+                            id: msg.id,
+                            message: err instanceof Error ? err.message : String(err),
+                        };
+                        ws.send(JSON.stringify(errMsg));
+                    }
+                }
+                else if (msg.type === 'restart') {
+                    console.log('Restart requested by relay, restarting servers...');
+                    await closeServers(servers);
+                    servers = await spawnServers();
+                    tools = await collectTools(servers);
+                    const toolsMsg = { type: 'tools', tools };
+                    ws.send(JSON.stringify(toolsMsg));
+                    console.log(`Restarted. Now serving ${tools.length} tools.`);
+                }
+            }
+            catch (err) {
+                console.error('Error handling message:', err);
+            }
+        });
+        ws.on('close', () => {
+            console.log('Disconnected from relay.');
+            void closeServers(servers);
+            if (shouldReconnect) {
+                console.log(`Reconnecting in ${reconnectDelay / 1000}s...`);
+                setTimeout(() => {
+                    void connect();
+                }, reconnectDelay);
+                reconnectDelay = Math.min(reconnectDelay * 2, MAX_RECONNECT_DELAY_MS);
+            }
+        });
+        ws.on('error', (err) => {
+            console.error('WebSocket error:', err.message);
+        });
+        const shutdown = () => {
+            shouldReconnect = false;
+            console.log('\nShutting down agent...');
+            ws.close();
+            void closeServers(servers).then(() => process.exit(0));
+        };
+        process.on('SIGINT', shutdown);
+        process.on('SIGTERM', shutdown);
+    };
+    await connect();
+};
+exports.startAgent = startAgent;

package/dist/config.d.ts

@@ -0,0 +1,2 @@
+import type { Config } from './types.js';
+export declare const loadConfig: (input?: string) => Config;

package/dist/config.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const types_js_1 = require("./types.js");
+const DEFAULT_CONFIG_PATH = 'mcp-local-tunnel.config.json';
+const loadConfig = (input) => {
+    const raw = input ?? process.env.MCP_LOCAL_TUNNEL_CONFIG;
+    let json;
+    if (!raw) {
+        if (node_fs_1.default.existsSync(DEFAULT_CONFIG_PATH)) {
+            json = JSON.parse(node_fs_1.default.readFileSync(DEFAULT_CONFIG_PATH, 'utf8'));
+        }
+        else {
+            throw new Error('No config found. Set MCP_LOCAL_TUNNEL_CONFIG or create mcp-local-tunnel.config.json');
+        }
+    }
+    else if (!raw.startsWith('{') && node_fs_1.default.existsSync(raw)) {
+        json = JSON.parse(node_fs_1.default.readFileSync(raw, 'utf8'));
+    }
+    else {
+        json = JSON.parse(raw);
+    }
+    const result = types_js_1.ConfigSchema.safeParse(json);
+    if (!result.success) {
+        const issues = result.error.issues.map((i) => `  ${i.path.join('.')}: ${i.message}`).join('\n');
+        throw new Error(`Invalid config:\n${issues}`);
+    }
+    return result.data;
+};
+exports.loadConfig = loadConfig;

package/dist/connection-manager.d.ts

@@ -0,0 +1,23 @@
+import type WebSocket from 'ws';
+import type { ToolDef } from './types.js';
+export type AgentConnection = {
+    ws: WebSocket;
+    userId: string;
+    name: string;
+    connectedAt: number;
+    tools: ToolDef[];
+};
+export declare class ConnectionManager {
+    /** userId -> AgentConnection[] (one per device) */
+    private readonly connections;
+    private readonly pending;
+    addConnection(ws: WebSocket, userId: string, name: string): AgentConnection;
+    getConnectionsForUser(userId: string): AgentConnection[];
+    getToolsForUser(userId: string): (ToolDef & {
+        deviceName: string;
+    })[];
+    sendRequest(userId: string, deviceName: string, method: string, params: unknown): Promise<unknown>;
+    sendRestart(userId: string): void;
+    private removeConnection;
+    private handleMessage;
+}

package/dist/connection-manager.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectionManager = void 0;
+const node_crypto_1 = require("node:crypto");
+const REQUEST_TIMEOUT_MS = 120_000; // 2 minutes
+class ConnectionManager {
+    /** userId -> AgentConnection[] (one per device) */
+    connections = new Map();
+    pending = new Map();
+    addConnection(ws, userId, name) {
+        const conn = {
+            ws, userId, name, connectedAt: Date.now(), tools: [],
+        };
+        ws.on('message', (data) => {
+            try {
+                const msg = JSON.parse(data.toString());
+                this.handleMessage(conn, msg);
+            }
+            catch (err) {
+                console.error('Failed to parse WebSocket message:', err);
+            }
+        });
+        ws.on('close', () => {
+            this.removeConnection(conn);
+        });
+        ws.on('error', (err) => {
+            console.error(`WebSocket error for ${name} (${userId}):`, err.message);
+        });
+        const existing = this.connections.get(userId) ?? [];
+        // Replace existing connection with same name
+        const filtered = existing.filter((c) => c.name !== name);
+        filtered.push(conn);
+        this.connections.set(userId, filtered);
+        console.log(`Agent connected: "${name}" (user: ${userId})`);
+        return conn;
+    }
+    getConnectionsForUser(userId) {
+        return this.connections.get(userId) ?? [];
+    }
+    getToolsForUser(userId) {
+        const conns = this.getConnectionsForUser(userId);
+        const tools = [];
+        const multiDevice = conns.length > 1;
+        for (const conn of conns) {
+            for (const tool of conn.tools) {
+                const name = multiDevice
+                    ? `${conn.name}__${tool.name}`
+                    : tool.name;
+                const description = multiDevice
+                    ? `[${conn.name}] ${tool.description ?? ''}`
+                    : (tool.description ?? '');
+                tools.push({
+                    ...tool, name, description, deviceName: conn.name,
+                });
+            }
+        }
+        return tools;
+    }
+    async sendRequest(userId, deviceName, method, params) {
+        const conns = this.getConnectionsForUser(userId);
+        const conn = conns.find((c) => c.name === deviceName);
+        if (!conn) {
+            throw new Error(`No agent connected for device "${deviceName}"`);
+        }
+        const id = (0, node_crypto_1.randomUUID)();
+        const msg = {
+            type: 'request', id, method, params,
+        };
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error('Request timed out'));
+            }, REQUEST_TIMEOUT_MS);
+            this.pending.set(id, { resolve, reject, timer });
+            conn.ws.send(JSON.stringify(msg));
+        });
+    }
+    sendRestart(userId) {
+        const conns = this.getConnectionsForUser(userId);
+        const msg = { type: 'restart' };
+        for (const conn of conns) {
+            conn.ws.send(JSON.stringify(msg));
+        }
+    }
+    removeConnection(conn) {
+        const existing = this.connections.get(conn.userId);
+        if (!existing) {
+            return;
+        }
+        const filtered = existing.filter((c) => c !== conn);
+        if (filtered.length === 0) {
+            this.connections.delete(conn.userId);
+        }
+        else {
+            this.connections.set(conn.userId, filtered);
+        }
+        console.log(`Agent disconnected: "${conn.name}" (user: ${conn.userId})`);
+    }
+    handleMessage(conn, msg) {
+        if (msg.type === 'tools') {
+            conn.tools = msg.tools;
+            console.log(`Agent "${conn.name}" registered ${msg.tools.length} tools`);
+            return;
+        }
+        if (msg.type === 'response' || msg.type === 'error') {
+            const req = this.pending.get(msg.id);
+            if (!req) {
+                return;
+            }
+            this.pending.delete(msg.id);
+            clearTimeout(req.timer);
+            if (msg.type === 'response') {
+                req.resolve(msg.result);
+            }
+            else {
+                req.reject(new Error(msg.message));
+            }
+        }
+    }
+}
+exports.ConnectionManager = ConnectionManager;

package/dist/crypto.d.ts

@@ -0,0 +1,9 @@
+/** Derive a 256-bit AES key from a secret string, or generate a random one. */
+export declare const deriveKey: (secret?: string) => Buffer;
+/** Encrypt + authenticate a JSON payload with AES-256-GCM. Returns a URL-safe base64 string. */
+export declare const seal: <T>(payload: T, key: Buffer) => string;
+/** Decrypt + verify a sealed payload. Returns undefined if tampered, expired, or wrong type. */
+export declare const unseal: <T extends {
+    type: string;
+    expiresAt: number;
+}>(sealed: string, key: Buffer, expectedType: T["type"]) => T | undefined;

package/dist/crypto.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unseal = exports.seal = exports.deriveKey = void 0;
+const node_crypto_1 = require("node:crypto");
+/** Derive a 256-bit AES key from a secret string, or generate a random one. */
+const deriveKey = (secret) => secret
+    ? (0, node_crypto_1.createHash)('sha256').update(secret).digest()
+    : (0, node_crypto_1.randomBytes)(32);
+exports.deriveKey = deriveKey;
+/** Encrypt + authenticate a JSON payload with AES-256-GCM. Returns a URL-safe base64 string. */
+const seal = (payload, key) => {
+    const iv = (0, node_crypto_1.randomBytes)(12);
+    const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', key, iv);
+    const plaintext = Buffer.from(JSON.stringify(payload));
+    const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, encrypted]).toString('base64url');
+};
+exports.seal = seal;
+/** Decrypt + verify a sealed payload. Returns undefined if tampered, expired, or wrong type. */
+const unseal = (sealed, key, expectedType) => {
+    try {
+        const buf = Buffer.from(sealed, 'base64url');
+        const iv = buf.subarray(0, 12);
+        const tag = buf.subarray(12, 28);
+        const encrypted = buf.subarray(28);
+        const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, iv);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        const payload = JSON.parse(decrypted.toString());
+        if (payload.type !== expectedType || payload.expiresAt < Date.now()) {
+            return undefined;
+        }
+        return payload;
+    }
+    catch {
+        return undefined;
+    }
+};
+exports.unseal = unseal;

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const config_js_1 = require("./config.js");
+const relay_js_1 = require("./relay.js");
+const agent_js_1 = require("./agent.js");
+const main = async () => {
+    const config = (0, config_js_1.loadConfig)();
+    if (config.mode === 'relay') {
+        (0, relay_js_1.startRelay)(config);
+    }
+    else {
+        await (0, agent_js_1.startAgent)(config);
+    }
+};
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/oauth-provider.d.ts

@@ -0,0 +1,35 @@
+import type { Response } from 'express';
+import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { OidcClient } from './oidc-client.js';
+import type { RelayConfig } from './types.js';
+type PendingAuthPayload = {
+    type: 'pending';
+    upstreamCodeVerifier: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    state?: string;
+    scopes: string[];
+    expiresAt: number;
+};
+export declare class TunnelOAuthProvider implements OAuthServerProvider {
+    private readonly oidcClient;
+    private readonly config;
+    readonly clientsStore: OAuthRegisteredClientsStore;
+    private readonly key;
+    constructor(oidcClient: OidcClient, config: RelayConfig);
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    unsealState(sealedState: string): PendingAuthPayload | undefined;
+    completeAuthorization(pending: PendingAuthPayload, userId: string): {
+        redirectUrl: string;
+    };
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+}
+export {};

package/dist/oauth-provider.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TunnelOAuthProvider = void 0;
+const node_crypto_1 = require("node:crypto");
+const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const crypto_js_1 = require("./crypto.js");
+const ACCESS_TOKEN_TTL_MS = 3_600_000; // 1 hour
+const REFRESH_TOKEN_TTL_MS = 30 * 24 * 3_600_000; // 30 days
+const AUTH_CODE_TTL_MS = 300_000; // 5 minutes
+const PENDING_AUTH_TTL_MS = 600_000; // 10 minutes
+class TunnelOAuthProvider {
+    oidcClient;
+    config;
+    clientsStore;
+    key;
+    constructor(oidcClient, config) {
+        this.oidcClient = oidcClient;
+        this.config = config;
+        this.key = (0, crypto_js_1.deriveKey)(config.secret);
+        this.clientsStore = {
+            getClient: (clientId) => ({
+                client_id: clientId,
+                redirect_uris: [],
+                token_endpoint_auth_method: 'none',
+            }),
+            registerClient: (metadata) => ({
+                ...metadata,
+                client_id: metadata.client_id || (0, node_crypto_1.randomUUID)(),
+                client_id_issued_at: Math.floor(Date.now() / 1000),
+            }),
+        };
+    }
+    async authorize(client, params, res) {
+        const { codeVerifier, codeChallenge } = this.oidcClient.generateCodeVerifierAndChallenge();
+        const payload = {
+            type: 'pending',
+            upstreamCodeVerifier: codeVerifier,
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            codeChallenge: params.codeChallenge,
+            scopes: params.scopes ?? [],
+            expiresAt: Date.now() + PENDING_AUTH_TTL_MS,
+        };
+        if (params.state) {
+            payload.state = params.state;
+        }
+        const sealedState = (0, crypto_js_1.seal)(payload, this.key);
+        const issuerUrl = this.config.issuerUrl ?? `http://localhost:${this.config.port ?? 3000}`;
+        const callbackUrl = `${issuerUrl}/callback`;
+        const url = await this.oidcClient.buildAuthorizeUrl({
+            redirectUri: callbackUrl,
+            state: sealedState,
+            codeChallenge,
+        });
+        res.redirect(url);
+    }
+    unsealState(sealedState) {
+        return (0, crypto_js_1.unseal)(sealedState, this.key, 'pending');
+    }
+    completeAuthorization(pending, userId) {
+        const code = (0, crypto_js_1.seal)({
+            type: 'auth_code',
+            clientId: pending.clientId,
+            userId,
+            codeChallenge: pending.codeChallenge,
+            redirectUri: pending.redirectUri,
+            scopes: pending.scopes,
+            expiresAt: Date.now() + AUTH_CODE_TTL_MS,
+        }, this.key);
+        const redirectUrl = new URL(pending.redirectUri);
+        redirectUrl.searchParams.set('code', code);
+        if (pending.state) {
+            redirectUrl.searchParams.set('state', pending.state);
+        }
+        return { redirectUrl: redirectUrl.toString() };
+    }
+    async challengeForAuthorizationCode(_client, authorizationCode) {
+        const ac = (0, crypto_js_1.unseal)(authorizationCode, this.key, 'auth_code');
+        if (!ac) {
+            throw new Error('Invalid authorization code');
+        }
+        return ac.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode) {
+        const ac = (0, crypto_js_1.unseal)(authorizationCode, this.key, 'auth_code');
+        if (!ac) {
+            throw new Error('Invalid authorization code');
+        }
+        if (ac.clientId !== client.client_id) {
+            throw new Error('Authorization code was not issued to this client');
+        }
+        const accessToken = (0, crypto_js_1.seal)({
+            type: 'access',
+            clientId: client.client_id,
+            userId: ac.userId,
+            scopes: ac.scopes,
+            expiresAt: Date.now() + ACCESS_TOKEN_TTL_MS,
+        }, this.key);
+        const refreshToken = (0, crypto_js_1.seal)({
+            type: 'refresh',
+            clientId: client.client_id,
+            userId: ac.userId,
+            scopes: ac.scopes,
+            expiresAt: Date.now() + REFRESH_TOKEN_TTL_MS,
+        }, this.key);
+        return {
+            access_token: accessToken,
+            token_type: 'bearer',
+            expires_in: Math.floor(ACCESS_TOKEN_TTL_MS / 1000),
+            refresh_token: refreshToken,
+            scope: ac.scopes.join(' '),
+        };
+    }
+    async exchangeRefreshToken(client, refreshToken) {
+        const rt = (0, crypto_js_1.unseal)(refreshToken, this.key, 'refresh');
+        if (!rt) {
+            throw new Error('Invalid refresh token');
+        }
+        if (rt.clientId !== client.client_id) {
+            throw new Error('Refresh token was not issued to this client');
+        }
+        const newAccessToken = (0, crypto_js_1.seal)({
+            type: 'access',
+            clientId: client.client_id,
+            userId: rt.userId,
+            scopes: rt.scopes,
+            expiresAt: Date.now() + ACCESS_TOKEN_TTL_MS,
+        }, this.key);
+        const newRefreshToken = (0, crypto_js_1.seal)({
+            type: 'refresh',
+            clientId: client.client_id,
+            userId: rt.userId,
+            scopes: rt.scopes,
+            expiresAt: Date.now() + REFRESH_TOKEN_TTL_MS,
+        }, this.key);
+        return {
+            access_token: newAccessToken,
+            token_type: 'bearer',
+            expires_in: Math.floor(ACCESS_TOKEN_TTL_MS / 1000),
+            refresh_token: newRefreshToken,
+            scope: rt.scopes.join(' '),
+        };
+    }
+    async verifyAccessToken(token) {
+        const td = (0, crypto_js_1.unseal)(token, this.key, 'access');
+        if (!td) {
+            throw new errors_js_1.InvalidTokenError('Invalid or expired access token');
+        }
+        return {
+            token,
+            clientId: td.clientId,
+            scopes: td.scopes,
+            expiresAt: Math.floor(td.expiresAt / 1000),
+            extra: { userId: td.userId },
+        };
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars -- required by OAuthServerProvider interface
+    async revokeToken(client, request) {
+        // Tokens are stateless sealed blobs — revocation is a no-op.
+    }
+}
+exports.TunnelOAuthProvider = TunnelOAuthProvider;

package/dist/oidc-client.d.ts

@@ -0,0 +1,29 @@
+import type { AuthConfig } from './types.js';
+type OidcDiscovery = {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    issuer: string;
+};
+export declare class OidcClient {
+    private readonly config;
+    private discovery;
+    private discoveryExpiresAt;
+    private jwks;
+    constructor(config: AuthConfig);
+    getDiscovery(): Promise<OidcDiscovery>;
+    buildAuthorizeUrl(params: {
+        redirectUri: string;
+        state: string;
+        codeChallenge: string;
+    }): Promise<string>;
+    generateCodeVerifierAndChallenge(): {
+        codeVerifier: string;
+        codeChallenge: string;
+    };
+    exchangeCode(code: string, redirectUri: string, codeVerifier: string): Promise<{
+        claims: Record<string, unknown>;
+        userId: string;
+    }>;
+}
+export {};