memory-journal-mcp 6.1.2 → 6.2.1

package/src/auth/types.ts

@@ -1,372 +0,0 @@
-/**
- * memory-journal-mcp — OAuth Types
- *
- * Type definitions for OAuth 2.0 components including
- * RFC 9728, RFC 8414, and RFC 7591 compliance.
- */
-
-// =============================================================================
-// RFC 9728 - Protected Resource Metadata
-// =============================================================================
-
-/**
- * OAuth 2.0 Protected Resource Metadata (RFC 9728)
- *
- * @see https://datatracker.ietf.org/doc/html/rfc9728
- */
-export interface ProtectedResourceMetadata {
-    /** Resource identifier (canonical URI) */
-    resource: string
-
-    /** Authorization servers that can issue tokens for this resource */
-    authorization_servers?: string[]
-
-    /** JWKS URI for token verification (optional, usually from auth server) */
-    jwks_uri?: string
-
-    /** Scopes supported by this resource */
-    scopes_supported?: string[]
-
-    /** Bearer token presentation methods supported */
-    bearer_methods_supported?: ('header' | 'body' | 'query')[]
-
-    /** Resource signing algorithms supported */
-    resource_signing_alg_values_supported?: string[]
-
-    /** Resource documentation URL */
-    resource_documentation?: string
-
-    /** Resource policy URI */
-    resource_policy_uri?: string
-
-    /** Resource terms of service URI */
-    resource_tos_uri?: string
-}
-
-// =============================================================================
-// RFC 8414 - Authorization Server Metadata
-// =============================================================================
-
-/**
- * OAuth 2.0 Authorization Server Metadata (RFC 8414)
- *
- * @see https://datatracker.ietf.org/doc/html/rfc8414
- */
-export interface AuthorizationServerMetadata {
-    /** Authorization server issuer identifier */
-    issuer: string
-
-    /** Authorization endpoint URL */
-    authorization_endpoint?: string
-
-    /** Token endpoint URL */
-    token_endpoint: string
-
-    /** JWKS URI */
-    jwks_uri?: string
-
-    /** Registration endpoint (RFC 7591) */
-    registration_endpoint?: string
-
-    /** Scopes supported */
-    scopes_supported?: string[]
-
-    /** Response types supported */
-    response_types_supported?: string[]
-
-    /** Response modes supported */
-    response_modes_supported?: string[]
-
-    /** Grant types supported */
-    grant_types_supported?: string[]
-
-    /** Token endpoint auth methods supported */
-    token_endpoint_auth_methods_supported?: string[]
-
-    /** Token endpoint auth signing algorithms */
-    token_endpoint_auth_signing_alg_values_supported?: string[]
-
-    /** Service documentation URL */
-    service_documentation?: string
-
-    /** UI locales supported */
-    ui_locales_supported?: string[]
-
-    /** OP policy URI */
-    op_policy_uri?: string
-
-    /** OP terms of service URI */
-    op_tos_uri?: string
-
-    /** Revocation endpoint */
-    revocation_endpoint?: string
-
-    /** Revocation endpoint auth methods */
-    revocation_endpoint_auth_methods_supported?: string[]
-
-    /** Introspection endpoint */
-    introspection_endpoint?: string
-
-    /** Introspection endpoint auth methods */
-    introspection_endpoint_auth_methods_supported?: string[]
-
-    /** Code challenge methods supported (PKCE) */
-    code_challenge_methods_supported?: string[]
-}
-
-// =============================================================================
-// RFC 7591 - Dynamic Client Registration
-// =============================================================================
-
-/**
- * OAuth 2.0 Dynamic Client Registration Request (RFC 7591)
- *
- * @see https://datatracker.ietf.org/doc/html/rfc7591
- */
-export interface ClientRegistrationRequest {
-    /** Redirect URIs */
-    redirect_uris?: string[]
-
-    /** Token endpoint auth method */
-    token_endpoint_auth_method?: string
-
-    /** Grant types requested */
-    grant_types?: string[]
-
-    /** Response types requested */
-    response_types?: string[]
-
-    /** Client name */
-    client_name?: string
-
-    /** Client URI */
-    client_uri?: string
-
-    /** Logo URI */
-    logo_uri?: string
-
-    /** Scopes requested */
-    scope?: string
-
-    /** Contacts */
-    contacts?: string[]
-
-    /** Terms of service URI */
-    tos_uri?: string
-
-    /** Policy URI */
-    policy_uri?: string
-
-    /** JWKS URI for client authentication */
-    jwks_uri?: string
-
-    /** JWKS document for client authentication */
-    jwks?: JWKSDocument
-
-    /** Software ID */
-    software_id?: string
-
-    /** Software version */
-    software_version?: string
-
-    /** Software statement (signed JWT) */
-    software_statement?: string
-}
-
-/**
- * OAuth 2.0 Dynamic Client Registration Response (RFC 7591)
- */
-export interface ClientRegistrationResponse {
-    /** Client identifier */
-    client_id: string
-
-    /** Client secret (for confidential clients) */
-    client_secret?: string
-
-    /** Client secret expiration timestamp */
-    client_secret_expires_at?: number
-
-    /** Registration access token */
-    registration_access_token?: string
-
-    /** Registration client URI */
-    registration_client_uri?: string
-
-    /** Client ID issued at timestamp */
-    client_id_issued_at?: number
-
-    /** All other fields from the request */
-    [key: string]: unknown
-}
-
-// =============================================================================
-// JWKS Types
-// =============================================================================
-
-/**
- * JSON Web Key (JWK)
- */
-export interface JWK {
-    /** Key type (e.g., 'RSA', 'EC') */
-    kty: string
-
-    /** Key use ('sig' for signature, 'enc' for encryption) */
-    use?: string
-
-    /** Key operations */
-    key_ops?: string[]
-
-    /** Algorithm */
-    alg?: string
-
-    /** Key ID */
-    kid?: string
-
-    /** X.509 URL */
-    x5u?: string
-
-    /** X.509 certificate chain */
-    x5c?: string[]
-
-    /** X.509 certificate SHA-1 thumbprint */
-    x5t?: string
-
-    /** X.509 certificate SHA-256 thumbprint */
-    'x5t#S256'?: string
-
-    // RSA-specific fields
-    /** RSA modulus */
-    n?: string
-    /** RSA public exponent */
-    e?: string
-
-    // EC-specific fields
-    /** EC curve */
-    crv?: string
-    /** EC x coordinate */
-    x?: string
-    /** EC y coordinate */
-    y?: string
-}
-
-/**
- * JSON Web Key Set (JWKS)
- */
-export interface JWKSDocument {
-    /** Array of JWK keys */
-    keys: JWK[]
-}
-
-// =============================================================================
-// Token Validation Types
-// =============================================================================
-
-/**
- * Result of token validation
- */
-export interface TokenValidationResult {
-    /** Whether the token is valid */
-    valid: boolean
-
-    /** Validated claims (if valid) */
-    claims?: TokenClaims
-
-    /** Error message (if invalid) */
-    error?: string
-
-    /** Error code (if invalid) */
-    errorCode?: string
-}
-
-/**
- * Validated token claims
- */
-export interface TokenClaims {
-    /** Subject (user ID) */
-    sub: string
-
-    /** Granted scopes (parsed from space-delimited string) */
-    scopes: string[]
-
-    /** Token expiration time (Unix timestamp) */
-    exp: number
-
-    /** Token issued at time (Unix timestamp) */
-    iat: number
-
-    /** Token issuer */
-    iss?: string | undefined
-
-    /** Token audience */
-    aud?: string | string[] | undefined
-
-    /** Not before time (Unix timestamp) */
-    nbf?: number | undefined
-
-    /** JWT ID */
-    jti?: string | undefined
-
-    /** Client ID */
-    client_id?: string | undefined
-
-    /** Additional claims */
-    [key: string]: unknown
-}
-
-// =============================================================================
-// Configuration Types
-// =============================================================================
-
-/**
- * Resource server configuration
- */
-export interface ResourceServerConfig {
-    /** Resource identifier (canonical server URI) */
-    resource: string
-
-    /** Authorization servers that can issue tokens */
-    authorizationServers: string[]
-
-    /** Scopes supported by this resource */
-    scopesSupported: string[]
-
-    /** Bearer token methods accepted (default: ['header']) */
-    bearerMethodsSupported?: ('header' | 'body' | 'query')[]
-}
-
-/**
- * Token validator configuration
- */
-export interface TokenValidatorConfig {
-    /** JWKS URI for key discovery */
-    jwksUri: string
-
-    /** Expected issuer */
-    issuer: string
-
-    /** Expected audience */
-    audience: string
-
-    /** Clock tolerance in seconds (default: 60) */
-    clockTolerance?: number | undefined
-
-    /** JWKS cache TTL in seconds (default: 3600) */
-    jwksCacheTtl?: number | undefined
-
-    /** Supported algorithms (default: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512']) */
-    algorithms?: string[] | undefined
-}
-
-/**
- * Authorization server discovery configuration
- */
-export interface AuthServerDiscoveryConfig {
-    /** Authorization server URL (issuer) */
-    authServerUrl: string
-
-    /** Cache TTL in seconds (default: 3600) */
-    cacheTtl?: number | undefined
-
-    /** Request timeout in milliseconds (default: 5000) */
-    timeout?: number | undefined
-}

package/src/cli.ts

@@ -1,279 +0,0 @@
-import { Command } from 'commander'
-import * as fs from 'node:fs'
-import { createServer } from './server/mcp-server.js'
-import { logger } from './utils/logger.js'
-import { VERSION } from './version.js'
-
-// Smart Database Resolution: Check root, then test-server, then default to root
-function resolveDbPath(envPath: string | undefined, defaultName: string, testName: string): string {
-    if (envPath) return envPath
-    const rootPath = `./${defaultName}`
-    const testPath = `./test-server/${testName}`
-    if (fs.existsSync(rootPath)) return rootPath
-    if (fs.existsSync(testPath)) return testPath
-    return rootPath // fallback to creating root if neither exist
-}
-
-const defaultDbPath = resolveDbPath(
-    process.env['DB_PATH'],
-    'memory_journal.db',
-    'test-memory-journal.db'
-)
-const defaultTeamDbPath = process.env['TEAM_DB_PATH'] ? process.env['TEAM_DB_PATH'] : undefined
-
-const program = new Command()
-
-program
-    .name('memory-journal-mcp')
-    .description('Project context management for AI-assisted development')
-    .version(VERSION)
-    .option('--transport <type>', 'Transport type: stdio or http', 'stdio')
-    .option('--port <number>', 'HTTP port (for http transport)', '3000')
-    .option('--server-host <host>', 'Server bind host for HTTP transport (default: localhost)')
-    .option('--stateless', 'Use stateless HTTP mode (no session management)')
-    .option('--db <path>', 'Database path (env: DB_PATH)', defaultDbPath)
-    .option('--team-db <path>', 'Team database path (env: TEAM_DB_PATH)', defaultTeamDbPath)
-    .option('--tool-filter <filter>', 'Tool filter string (e.g., "starter", "core,search")')
-    .option('--default-project <number>', 'Default GitHub Project number')
-    .option('--auto-rebuild-index', 'Rebuild vector index on server startup')
-    .option('--cors-origin <origin>', 'CORS allowed origin for HTTP transport (default: *)')
-    .option('--enable-hsts', 'Enable HSTS header for HTTP transport (use when behind HTTPS)')
-    .option(
-        '--auth-token <token>',
-        'Bearer token for HTTP transport authentication (env: MCP_AUTH_TOKEN)'
-    )
-    .option('--log-level <level>', 'Log level: debug, info, warning, error', 'info')
-    .option(
-        '--backup-interval <minutes>',
-        'Automated backup interval in minutes, HTTP only (0 = disabled)',
-        '0'
-    )
-    .option('--keep-backups <count>', 'Max backups to retain during automated cleanup', '5')
-    .option(
-        '--vacuum-interval <minutes>',
-        'Database optimize interval in minutes, HTTP only (0 = disabled)',
-        '0'
-    )
-    .option(
-        '--rebuild-index-interval <minutes>',
-        'Vector index rebuild interval in minutes, HTTP only (0 = disabled)',
-        '0'
-    )
-    .option(
-        '--sandbox-mode <mode>',
-        'Code Mode sandbox: "worker" (production, default) or "vm" (lightweight)',
-        'worker'
-    )
-    .option('--oauth-enabled', 'Enable OAuth 2.1 authentication (env: OAUTH_ENABLED)')
-    .option('--oauth-issuer <url>', 'OAuth issuer URL (env: OAUTH_ISSUER)')
-    .option('--oauth-audience <audience>', 'OAuth audience (env: OAUTH_AUDIENCE)')
-    .option('--oauth-jwks-uri <uri>', 'OAuth JWKS URI (env: OAUTH_JWKS_URI)')
-    .option(
-        '--oauth-clock-tolerance <seconds>',
-        'OAuth clock tolerance in seconds (default: 60)',
-        '60'
-    )
-    .option(
-        '--instruction-level <level>',
-        'Briefing depth: essential, standard, full (env: INSTRUCTION_LEVEL)',
-        'standard'
-    )
-    // Briefing configuration
-    .option(
-        '--briefing-entries <count>',
-        'Number of journal entries in briefing (env: BRIEFING_ENTRY_COUNT)',
-        '3'
-    )
-    .option(
-        '--briefing-include-team',
-        'Include team DB entries in briefing (env: BRIEFING_INCLUDE_TEAM)'
-    )
-    .option(
-        '--briefing-issues <count>',
-        'Number of issues to list in briefing; 0 = count only (env: BRIEFING_ISSUE_COUNT)',
-        '0'
-    )
-    .option(
-        '--briefing-prs <count>',
-        'Number of PRs to list in briefing; 0 = count only (env: BRIEFING_PR_COUNT)',
-        '0'
-    )
-    .option(
-        '--briefing-pr-status',
-        'Show PR status breakdown in briefing (env: BRIEFING_PR_STATUS)'
-    )
-    .option(
-        '--rules-file <path>',
-        'Path to user rules file for awareness in briefing (env: RULES_FILE_PATH)'
-    )
-    .option(
-        '--skills-dir <path>',
-        'Path to skills directory for awareness in briefing (env: SKILLS_DIR_PATH)'
-    )
-    .option(
-        '--briefing-workflows <count>',
-        'Number of workflow runs to list in briefing; 0 = status only (env: BRIEFING_WORKFLOW_COUNT)',
-        '0'
-    )
-    .option(
-        '--briefing-workflow-status',
-        'Show workflow run status breakdown in briefing (env: BRIEFING_WORKFLOW_STATUS)'
-    )
-    .option(
-        '--briefing-copilot',
-        'Aggregate Copilot review state across recent PRs in briefing (env: BRIEFING_COPILOT_REVIEWS)'
-    )
-    .option(
-        '--workflow-summary <text>',
-        'Workflow summary for memory://workflows resource (env: MEMORY_JOURNAL_WORKFLOW_SUMMARY)'
-    )
-    .action(
-        async (options: {
-            transport: string
-            port: string
-            serverHost?: string
-            stateless?: boolean
-            db: string
-            teamDb?: string
-            toolFilter?: string
-            defaultProject: string
-            autoRebuildIndex?: boolean
-            corsOrigin?: string
-            enableHsts?: boolean
-            authToken?: string
-            logLevel: string
-            backupInterval: string
-            keepBackups: string
-            vacuumInterval: string
-            rebuildIndexInterval: string
-            sandboxMode: string
-            oauthEnabled?: boolean
-            oauthIssuer?: string
-            oauthAudience?: string
-            oauthJwksUri?: string
-            oauthClockTolerance: string
-            briefingEntries: string
-            briefingIncludeTeam?: boolean
-            briefingIssues: string
-            briefingPrs: string
-            briefingPrStatus?: boolean
-            rulesFile?: string
-            skillsDir?: string
-            briefingWorkflows: string
-            briefingWorkflowStatus?: boolean
-            briefingCopilot?: boolean
-            workflowSummary?: string
-            instructionLevel: string
-        }) => {
-            // Set log level
-            logger.setLevel(options.logLevel as 'debug' | 'info' | 'warning' | 'error')
-
-            // Resolve host: CLI flag > env var > default (localhost)
-            const host =
-                options.serverHost ?? process.env['MCP_HOST'] ?? process.env['HOST'] ?? undefined
-
-            logger.info('Starting Memory Journal MCP Server', {
-                module: 'CLI',
-                transport: options.transport,
-                stateless: options.stateless ?? false,
-                db: options.db,
-                ...(options.teamDb ? { teamDb: options.teamDb } : {}),
-                ...(host ? { host } : {}),
-            })
-
-            try {
-                await createServer({
-                    transport: options.transport as 'stdio' | 'http',
-                    port: parseInt(options.port, 10),
-                    host,
-                    statelessHttp: options.stateless === true,
-                    dbPath: options.db,
-                    teamDbPath: options.teamDb,
-                    toolFilter: options.toolFilter,
-                    defaultProjectNumber: options.defaultProject
-                        ? parseInt(options.defaultProject, 10)
-                        : process.env['DEFAULT_PROJECT_NUMBER']
-                          ? parseInt(process.env['DEFAULT_PROJECT_NUMBER'], 10)
-                          : undefined,
-                    autoRebuildIndex:
-                        options.autoRebuildIndex ?? process.env['AUTO_REBUILD_INDEX'] === 'true',
-                    corsOrigins: options.corsOrigin
-                        ? options.corsOrigin.split(',').map((s) => s.trim())
-                        : undefined,
-                    enableHSTS: options.enableHsts ?? process.env['MCP_ENABLE_HSTS'] === 'true',
-                    authToken: options.authToken,
-                    scheduler: {
-                        backupIntervalMinutes: parseInt(options.backupInterval, 10),
-                        keepBackups: parseInt(options.keepBackups, 10),
-                        vacuumIntervalMinutes: parseInt(options.vacuumInterval, 10),
-                        rebuildIndexIntervalMinutes: parseInt(options.rebuildIndexInterval, 10),
-                    },
-                    sandboxMode: options.sandboxMode as 'vm' | 'worker',
-                    // OAuth 2.1
-                    oauthEnabled: options.oauthEnabled ?? process.env['OAUTH_ENABLED'] === 'true',
-                    oauthIssuer: options.oauthIssuer ?? process.env['OAUTH_ISSUER'],
-                    oauthAudience: options.oauthAudience ?? process.env['OAUTH_AUDIENCE'],
-                    oauthJwksUri: options.oauthJwksUri ?? process.env['OAUTH_JWKS_URI'],
-                    oauthClockTolerance: parseInt(options.oauthClockTolerance, 10),
-                    // Briefing configuration
-                    briefingConfig: {
-                        entryCount: parseInt(
-                            process.env['BRIEFING_ENTRY_COUNT'] ?? options.briefingEntries,
-                            10
-                        ),
-                        includeTeam:
-                            options.briefingIncludeTeam ??
-                            process.env['BRIEFING_INCLUDE_TEAM'] === 'true',
-                        issueCount: parseInt(
-                            process.env['BRIEFING_ISSUE_COUNT'] ?? options.briefingIssues,
-                            10
-                        ),
-                        prCount: parseInt(
-                            process.env['BRIEFING_PR_COUNT'] ?? options.briefingPrs,
-                            10
-                        ),
-                        prStatusBreakdown:
-                            options.briefingPrStatus ??
-                            process.env['BRIEFING_PR_STATUS'] === 'true',
-                        rulesFilePath:
-                            options.rulesFile ?? process.env['RULES_FILE_PATH'] ?? undefined,
-                        skillsDirPath:
-                            options.skillsDir ?? process.env['SKILLS_DIR_PATH'] ?? undefined,
-                        workflowCount: parseInt(
-                            process.env['BRIEFING_WORKFLOW_COUNT'] ?? options.briefingWorkflows,
-                            10
-                        ),
-                        workflowStatusBreakdown:
-                            options.briefingWorkflowStatus ??
-                            process.env['BRIEFING_WORKFLOW_STATUS'] === 'true',
-                        copilotReviews:
-                            options.briefingCopilot ??
-                            process.env['BRIEFING_COPILOT_REVIEWS'] === 'true',
-                        workflowSummary:
-                            options.workflowSummary ??
-                            process.env['MEMORY_JOURNAL_WORKFLOW_SUMMARY'] ??
-                            undefined,
-                        defaultProjectNumber: options.defaultProject
-                            ? parseInt(options.defaultProject, 10)
-                            : process.env['DEFAULT_PROJECT_NUMBER']
-                              ? parseInt(process.env['DEFAULT_PROJECT_NUMBER'], 10)
-                              : undefined,
-                    },
-                    instructionLevel: (options.instructionLevel !== 'standard'
-                        ? options.instructionLevel
-                        : (process.env['INSTRUCTION_LEVEL'] ?? 'standard')) as
-                        | 'essential'
-                        | 'standard'
-                        | 'full',
-                })
-            } catch (error) {
-                logger.error('Failed to start server', {
-                    module: 'CLI',
-                    error: error instanceof Error ? error.message : String(error),
-                })
-                process.exit(1)
-            }
-        }
-    )
-
-program.parse()