memory-journal-mcp 8.0.1 → 9.1.0

package/dist/auth/oauth-resource-server.d.ts

@@ -0,0 +1,73 @@
+/**
+ * memory-journal-mcp — OAuth Protected Resource Server (RFC 9728)
+ *
+ * Implements the OAuth 2.0 Protected Resource Metadata endpoint
+ * as specified in RFC 9728.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9728
+ */
+import type { RequestHandler } from 'express';
+import type { ProtectedResourceMetadata, ResourceServerConfig } from './types.js';
+/**
+ * OAuth 2.0 Protected Resource Server
+ *
+ * Provides Protected Resource Metadata (RFC 9728) for MCP authorization.
+ */
+export declare class OAuthResourceServer {
+    private readonly config;
+    private metadata;
+    constructor(config: ResourceServerConfig);
+    /**
+     * Get the Protected Resource Metadata document
+     *
+     * @returns RFC 9728 compliant metadata
+     */
+    getMetadata(): ProtectedResourceMetadata;
+    /**
+     * Build the Protected Resource Metadata document
+     */
+    private buildMetadata;
+    /**
+     * Get Express request handler for the metadata endpoint
+     *
+     * Serves: GET /.well-known/oauth-protected-resource
+     */
+    getMetadataHandler(): RequestHandler;
+    /**
+     * Generate WWW-Authenticate header for 401 responses
+     *
+     * @param error - Error type for the header
+     * @param errorDescription - Human-readable error description
+     * @returns WWW-Authenticate header value
+     */
+    getWWWAuthenticateHeader(error?: string, errorDescription?: string): string;
+    /**
+     * Get the resource URI
+     */
+    getResourceUri(): string;
+    /**
+     * Get the authorization servers
+     */
+    getAuthorizationServers(): string[];
+    /**
+     * Get supported scopes
+     */
+    getSupportedScopes(): string[];
+    /**
+     * Check if a scope is supported by this resource server.
+     */
+    isScopeSupported(scope: string): boolean;
+    /**
+     * Get the well-known metadata endpoint path
+     */
+    getWellKnownPath(): string;
+    /**
+     * Clear cached metadata (useful when configuration changes)
+     */
+    clearCache(): void;
+}
+/**
+ * Create an OAuth Resource Server instance
+ */
+export declare function createOAuthResourceServer(config: ResourceServerConfig): OAuthResourceServer;
+//# sourceMappingURL=oauth-resource-server.d.ts.map

package/dist/auth/oauth-resource-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resource-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-resource-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAQjF;;;;GAIG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAyC;gBAE7C,MAAM,EAAE,oBAAoB;IAexC;;;;OAIG;IACH,WAAW,IAAI,yBAAyB;IAKxC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;OAIG;IACH,kBAAkB,IAAI,cAAc;IAepC;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM;IAmB3E;;OAEG;IACH,cAAc,IAAI,MAAM;IAIxB;;OAEG;IACH,uBAAuB,IAAI,MAAM,EAAE;IAInC;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAcxC;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,UAAU,IAAI,IAAI;CAGrB;AAMD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAE3F"}

package/dist/auth/scope-map.d.ts

@@ -0,0 +1,14 @@
+/**
+ * memory-journal-mcp — Tool Scope Map
+ *
+ * Builds a reverse lookup from tool name to required OAuth scope
+ * by inverting TOOL_GROUPS × TOOL_GROUP_SCOPES. Computed once at
+ * module load for O(1) per-call lookup.
+ */
+import type { StandardScope } from './scopes.js';
+export declare function getRequiredScope(toolName: string): StandardScope;
+/**
+ * Get the full tool-to-scope map (for testing/debugging).
+ */
+export declare function getToolScopeMap(): ReadonlyMap<string, StandardScope>;
+//# sourceMappingURL=scope-map.d.ts.map

package/dist/auth/scope-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-map.d.ts","sourceRoot":"","sources":["../../src/auth/scope-map.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAyChD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAiChE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAEpE"}

package/dist/auth/scopes.d.ts

@@ -0,0 +1,112 @@
+/**
+ * memory-journal-mcp — OAuth Scopes
+ *
+ * Scope definitions and enforcement utilities for
+ * granular access control.
+ *
+ * Scope Hierarchy:  full ⊃ admin ⊃ write ⊃ read
+ *
+ * Note: memory-journal-mcp uses only base scopes (no wildcard patterns).
+ */
+import type { ToolGroup } from '../types/index.js';
+/**
+ * Standard OAuth scopes for memory-journal-mcp
+ */
+export declare const SCOPES: {
+    /** Read-only access */
+    readonly READ: "read";
+    /** Read and write access */
+    readonly WRITE: "write";
+    /** Administrative access */
+    readonly ADMIN: "admin";
+    /** Unrestricted access to all operations */
+    readonly FULL: "full";
+    /** Team operations access */
+    readonly TEAM: "team";
+    /** Audit log access */
+    readonly AUDIT: "audit";
+};
+export type StandardScope = (typeof SCOPES)[keyof typeof SCOPES];
+/**
+ * Base scopes supported by the server
+ */
+export declare const BASE_SCOPES: readonly ["read", "write", "admin", "full", "team", "audit"];
+/**
+ * All supported scope patterns for metadata
+ */
+export declare const SUPPORTED_SCOPES: readonly ["read", "write", "admin", "full", "team", "audit"];
+/**
+ * Declarative mapping from tool group to required minimum scope.
+ * Single source of truth — all other scope-group arrays derive from this.
+ */
+export declare const TOOL_GROUP_SCOPES: Record<ToolGroup, StandardScope>;
+/**
+ * Per-tool scope overrides. These tools require different scopes than their group default.
+ */
+export declare const TOOL_SCOPE_OVERRIDES: Record<string, StandardScope>;
+/**
+ * Get the required scope for a tool group.
+ */
+export declare function getScopeForToolGroup(group: ToolGroup): StandardScope;
+/**
+ * Tool groups accessible with read scope (read-only operations)
+ */
+export declare const READ_SCOPE_GROUPS: ToolGroup[];
+/**
+ * Tool groups accessible with write scope (read + write operations)
+ */
+export declare const WRITE_SCOPE_GROUPS: ToolGroup[];
+/**
+ * Tool groups accessible with admin scope (all operations)
+ */
+export declare const ADMIN_SCOPE_GROUPS: ToolGroup[];
+/**
+ * Parse a scope string (space-delimited) into an array
+ */
+export declare function parseScopes(scopeString: string): string[];
+/**
+ * Check if a scope is valid (matches known scopes)
+ */
+export declare function isValidScope(scope: string): boolean;
+/**
+ * Check if granted scopes include the required scope.
+ * Respects the scope hierarchy: full ⊃ admin ⊃ write ⊃ read
+ */
+export declare function hasScope(grantedScopes: string[], requiredScope: string): boolean;
+/**
+ * Check if granted scopes include any of the required scopes
+ */
+export declare function hasAnyScope(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Check if granted scopes include all of the required scopes
+ */
+export declare function hasAllScopes(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Check if scopes include admin access
+ */
+export declare function hasAdminScope(scopes: string[]): boolean;
+/**
+ * Check if scopes include write access
+ */
+export declare function hasWriteScope(scopes: string[]): boolean;
+/**
+ * Check if scopes include read access
+ */
+export declare function hasReadScope(scopes: string[]): boolean;
+/**
+ * Get the required minimum scope for a tool group
+ */
+export declare function getRequiredScopeForGroup(group: ToolGroup): string;
+/**
+ * Get tool groups accessible with given scopes
+ */
+export declare function getAccessibleToolGroups(scopes: string[]): ToolGroup[];
+/**
+ * Get all tools accessible with given scopes
+ */
+export declare function getAccessibleTools(scopes: string[]): string[];
+/**
+ * Get human-readable display name for a scope
+ */
+export declare function getScopeDisplayName(scope: string): string;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/auth/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAOlD;;GAEG;AACH,eAAO,MAAM,MAAM;IACf,uBAAuB;;IAEvB,4BAA4B;;IAE5B,4BAA4B;;IAE5B,4CAA4C;;IAE5C,6BAA6B;;IAE7B,uBAAuB;;CAEjB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,MAAM,CAAC,CAAA;AAEhE;;GAEG;AACH,eAAO,MAAM,WAAW,8DAA+D,CAAA;AAEvF;;GAEG;AACH,eAAO,MAAM,gBAAgB,8DAA+D,CAAA;AAM5F;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAe9D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAuD9D,CAAA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa,CAEpE;AAkBD;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,EAAgC,CAAA;AAEzE;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAAiC,CAAA;AAE3E;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAAiC,CAAA;AAM3E;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAKzD;AAMD;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CA+BhF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAEtF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAEvF;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAEtD;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEjE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAWrE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAU7D;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBzD"}

package/dist/auth/token-validator.d.ts

@@ -0,0 +1,64 @@
+/**
+ * memory-journal-mcp — Token Validator
+ *
+ * JWT access token validation using JWKS for signature verification.
+ * Supports RSA and EC algorithms commonly used with OAuth 2.0.
+ */
+import type { TokenValidationResult, TokenValidatorConfig } from './types.js';
+import { InvalidTokenError, TokenExpiredError, InvalidSignatureError } from './errors.js';
+/**
+ * JWT Token Validator
+ *
+ * Validates OAuth 2.0 access tokens using JWKS for signature verification.
+ */
+export declare class TokenValidator {
+    /** Resolved configuration with all defaults applied */
+    private readonly jwksUri;
+    private readonly issuer;
+    private readonly audience;
+    private readonly clockTolerance;
+    private readonly jwksCacheTtl;
+    private jwks;
+    private jwksExpiry;
+    constructor(config: TokenValidatorConfig);
+    /**
+     * Validate an access token
+     *
+     * @param token - The JWT access token
+     * @returns Validation result with claims or error
+     */
+    validate(token: string): Promise<TokenValidationResult>;
+    /**
+     * Get or refresh the JWKS
+     */
+    private getJwks;
+    /**
+     * Extract and normalize token claims
+     */
+    private extractClaims;
+    /**
+     * Handle validation errors and convert to TokenValidationResult
+     */
+    private handleValidationError;
+    /**
+     * Refresh the JWKS cache
+     */
+    refreshJwks(): void;
+    /**
+     * Clear the JWKS cache
+     */
+    clearCache(): void;
+    /**
+     * Convert a validation error to the appropriate OAuth error class
+     */
+    static toOAuthError(result: TokenValidationResult): InvalidTokenError | TokenExpiredError | InvalidSignatureError;
+    /**
+     * Preload JWKS to validate availability at startup
+     */
+    preload(): Promise<void>;
+}
+/**
+ * Create a Token Validator instance
+ */
+export declare function createTokenValidator(config: TokenValidatorConfig): TokenValidator;
+//# sourceMappingURL=token-validator.d.ts.map

package/dist/auth/token-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-validator.d.ts","sourceRoot":"","sources":["../../src/auth/token-validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAe,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAC1F,OAAO,EACH,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EAGxB,MAAM,aAAa,CAAA;AAQpB;;;;GAIG;AACH,qBAAa,cAAc;IACvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IAErC,OAAO,CAAC,IAAI,CAAoC;IAChD,OAAO,CAAC,UAAU,CAAI;gBAEV,MAAM,EAAE,oBAAoB;IAsCxC;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkC7D;;OAEG;IACH,OAAO,CAAC,OAAO;IA+Cf;;OAEG;IACH,OAAO,CAAC,aAAa;IAuCrB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAqE7B;;OAEG;IACH,WAAW,IAAI,IAAI;IAOnB;;OAEG;IACH,UAAU,IAAI,IAAI;IAMlB;;OAEG;IACH,MAAM,CAAC,YAAY,CACf,MAAM,EAAE,qBAAqB,GAC9B,iBAAiB,GAAG,iBAAiB,GAAG,qBAAqB;IAYhE;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAiCjC;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAEjF"}

package/dist/auth/transport-agnostic.d.ts

@@ -0,0 +1,47 @@
+/**
+ * memory-journal-mcp — Transport-Agnostic Auth
+ *
+ * Authentication utilities that work across any transport layer
+ * (Express, Streamable HTTP, or future transports).
+ * Split from middleware.ts to keep files under ~500 lines.
+ */
+import type { TokenClaims } from './types.js';
+import type { TokenValidator } from './token-validator.js';
+/**
+ * Extract a Bearer token from an Authorization header.
+ */
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+/**
+ * Transport-agnostic authenticated request context.
+ * Usable by Express middleware, Streamable HTTP, or any future transport.
+ */
+export interface AuthenticatedContext {
+    /** Whether request is authenticated */
+    authenticated: boolean;
+    /** Token claims (if authenticated) */
+    claims?: TokenClaims;
+    /** Token scopes (convenience) */
+    scopes: string[];
+}
+/**
+ * Create authentication context from an Authorization header.
+ * Does not throw — returns unauthenticated context when token is missing/invalid.
+ */
+export declare function createAuthenticatedContext(authHeader: string | undefined, tokenValidator: TokenValidator): Promise<AuthenticatedContext>;
+/**
+ * Validate authentication and authorization.
+ * Throws OAuth errors when token missing, invalid, or insufficient scope.
+ */
+export declare function validateAuth(authHeader: string | undefined, tokenValidator: TokenValidator, options?: {
+    required?: boolean;
+    requiredScopes?: string[];
+}): Promise<AuthenticatedContext>;
+/**
+ * Format an OAuth error for HTTP response.
+ * Transport-agnostic — returns status and body without Express dependency.
+ */
+export declare function formatOAuthError(error: unknown): {
+    status: number;
+    body: object;
+};
+//# sourceMappingURL=transport-agnostic.d.ts.map

package/dist/auth/transport-agnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-agnostic.d.ts","sourceRoot":"","sources":["../../src/auth/transport-agnostic.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAI1D;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAShF;AAMD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACjC,uCAAuC;IACvC,aAAa,EAAE,OAAO,CAAA;IAEtB,sCAAsC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAA;IAEpB,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC5C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,cAAc,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAChE,OAAO,CAAC,oBAAoB,CAAC,CA+B/B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACf,CAyCA"}

package/dist/auth/types.d.ts

@@ -0,0 +1,256 @@
+/**
+ * memory-journal-mcp — OAuth Types
+ *
+ * Type definitions for OAuth 2.0 components including
+ * RFC 9728, RFC 8414, and RFC 7591 compliance.
+ */
+/**
+ * OAuth 2.0 Protected Resource Metadata (RFC 9728)
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9728
+ */
+export interface ProtectedResourceMetadata {
+    /** Resource identifier (canonical URI) */
+    resource: string;
+    /** Authorization servers that can issue tokens for this resource */
+    authorization_servers?: string[];
+    /** JWKS URI for token verification (optional, usually from auth server) */
+    jwks_uri?: string;
+    /** Scopes supported by this resource */
+    scopes_supported?: string[];
+    /** Bearer token presentation methods supported */
+    bearer_methods_supported?: ('header' | 'body' | 'query')[];
+    /** Resource signing algorithms supported */
+    resource_signing_alg_values_supported?: string[];
+    /** Resource documentation URL */
+    resource_documentation?: string;
+    /** Resource policy URI */
+    resource_policy_uri?: string;
+    /** Resource terms of service URI */
+    resource_tos_uri?: string;
+}
+/**
+ * OAuth 2.0 Authorization Server Metadata (RFC 8414)
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8414
+ */
+export interface AuthorizationServerMetadata {
+    /** Authorization server issuer identifier */
+    issuer: string;
+    /** Authorization endpoint URL */
+    authorization_endpoint?: string;
+    /** Token endpoint URL */
+    token_endpoint: string;
+    /** JWKS URI */
+    jwks_uri?: string;
+    /** Registration endpoint (RFC 7591) */
+    registration_endpoint?: string;
+    /** Scopes supported */
+    scopes_supported?: string[];
+    /** Response types supported */
+    response_types_supported?: string[];
+    /** Response modes supported */
+    response_modes_supported?: string[];
+    /** Grant types supported */
+    grant_types_supported?: string[];
+    /** Token endpoint auth methods supported */
+    token_endpoint_auth_methods_supported?: string[];
+    /** Token endpoint auth signing algorithms */
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    /** Service documentation URL */
+    service_documentation?: string;
+    /** UI locales supported */
+    ui_locales_supported?: string[];
+    /** OP policy URI */
+    op_policy_uri?: string;
+    /** OP terms of service URI */
+    op_tos_uri?: string;
+    /** Revocation endpoint */
+    revocation_endpoint?: string;
+    /** Revocation endpoint auth methods */
+    revocation_endpoint_auth_methods_supported?: string[];
+    /** Introspection endpoint */
+    introspection_endpoint?: string;
+    /** Introspection endpoint auth methods */
+    introspection_endpoint_auth_methods_supported?: string[];
+    /** Code challenge methods supported (PKCE) */
+    code_challenge_methods_supported?: string[];
+}
+/**
+ * OAuth 2.0 Dynamic Client Registration Request (RFC 7591)
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7591
+ */
+export interface ClientRegistrationRequest {
+    /** Redirect URIs */
+    redirect_uris?: string[];
+    /** Token endpoint auth method */
+    token_endpoint_auth_method?: string;
+    /** Grant types requested */
+    grant_types?: string[];
+    /** Response types requested */
+    response_types?: string[];
+    /** Client name */
+    client_name?: string;
+    /** Client URI */
+    client_uri?: string;
+    /** Logo URI */
+    logo_uri?: string;
+    /** Scopes requested */
+    scope?: string;
+    /** Contacts */
+    contacts?: string[];
+    /** Terms of service URI */
+    tos_uri?: string;
+    /** Policy URI */
+    policy_uri?: string;
+    /** JWKS URI for client authentication */
+    jwks_uri?: string;
+    /** JWKS document for client authentication */
+    jwks?: JWKSDocument;
+    /** Software ID */
+    software_id?: string;
+    /** Software version */
+    software_version?: string;
+    /** Software statement (signed JWT) */
+    software_statement?: string;
+}
+/**
+ * OAuth 2.0 Dynamic Client Registration Response (RFC 7591)
+ */
+export interface ClientRegistrationResponse {
+    /** Client identifier */
+    client_id: string;
+    /** Client secret (for confidential clients) */
+    client_secret?: string;
+    /** Client secret expiration timestamp */
+    client_secret_expires_at?: number;
+    /** Registration access token */
+    registration_access_token?: string;
+    /** Registration client URI */
+    registration_client_uri?: string;
+    /** Client ID issued at timestamp */
+    client_id_issued_at?: number;
+    /** All other fields from the request */
+    [key: string]: unknown;
+}
+/**
+ * JSON Web Key (JWK)
+ */
+export interface JWK {
+    /** Key type (e.g., 'RSA', 'EC') */
+    kty: string;
+    /** Key use ('sig' for signature, 'enc' for encryption) */
+    use?: string;
+    /** Key operations */
+    key_ops?: string[];
+    /** Algorithm */
+    alg?: string;
+    /** Key ID */
+    kid?: string;
+    /** X.509 URL */
+    x5u?: string;
+    /** X.509 certificate chain */
+    x5c?: string[];
+    /** X.509 certificate SHA-1 thumbprint */
+    x5t?: string;
+    /** X.509 certificate SHA-256 thumbprint */
+    'x5t#S256'?: string;
+    /** RSA modulus */
+    n?: string;
+    /** RSA public exponent */
+    e?: string;
+    /** EC curve */
+    crv?: string;
+    /** EC x coordinate */
+    x?: string;
+    /** EC y coordinate */
+    y?: string;
+}
+/**
+ * JSON Web Key Set (JWKS)
+ */
+export interface JWKSDocument {
+    /** Array of JWK keys */
+    keys: JWK[];
+}
+/**
+ * Result of token validation
+ */
+export interface TokenValidationResult {
+    /** Whether the token is valid */
+    valid: boolean;
+    /** Validated claims (if valid) */
+    claims?: TokenClaims;
+    /** Error message (if invalid) */
+    error?: string;
+    /** Error code (if invalid) */
+    errorCode?: string;
+}
+/**
+ * Validated token claims
+ */
+export interface TokenClaims {
+    /** Subject (user ID) */
+    sub: string;
+    /** Granted scopes (parsed from space-delimited string) */
+    scopes: string[];
+    /** Token expiration time (Unix timestamp) */
+    exp: number;
+    /** Token issued at time (Unix timestamp) */
+    iat: number;
+    /** Token issuer */
+    iss?: string | undefined;
+    /** Token audience */
+    aud?: string | string[] | undefined;
+    /** Not before time (Unix timestamp) */
+    nbf?: number | undefined;
+    /** JWT ID */
+    jti?: string | undefined;
+    /** Client ID */
+    client_id?: string | undefined;
+    /** Additional claims */
+    [key: string]: unknown;
+}
+/**
+ * Resource server configuration
+ */
+export interface ResourceServerConfig {
+    /** Resource identifier (canonical server URI) */
+    resource: string;
+    /** Authorization servers that can issue tokens */
+    authorizationServers: string[];
+    /** Scopes supported by this resource */
+    scopesSupported: string[];
+    /** Bearer token methods accepted (default: ['header']) */
+    bearerMethodsSupported?: ('header' | 'body' | 'query')[];
+}
+/**
+ * Token validator configuration
+ */
+export interface TokenValidatorConfig {
+    /** JWKS URI for key discovery */
+    jwksUri: string;
+    /** Expected issuer */
+    issuer: string;
+    /** Expected audience */
+    audience: string;
+    /** Clock tolerance in seconds (default: 60) */
+    clockTolerance?: number | undefined;
+    /** JWKS cache TTL in seconds (default: 3600) */
+    jwksCacheTtl?: number | undefined;
+    /** Supported algorithms (default: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512']) */
+    algorithms?: string[] | undefined;
+}
+/**
+ * Authorization server discovery configuration
+ */
+export interface AuthServerDiscoveryConfig {
+    /** Authorization server URL (issuer) */
+    authServerUrl: string;
+    /** Cache TTL in seconds (default: 3600) */
+    cacheTtl?: number | undefined;
+    /** Request timeout in milliseconds (default: 5000) */
+    timeout?: number | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACtC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAEhB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE3B,kDAAkD;IAClD,wBAAwB,CAAC,EAAE,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAA;IAE1D,4CAA4C;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhD,iCAAiC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B,0BAA0B;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAMD;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IACxC,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAA;IAEd,iCAAiC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B,yBAAyB;IACzB,cAAc,EAAE,MAAM,CAAA;IAEtB,eAAe;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B,uBAAuB;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE3B,+BAA+B;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnC,+BAA+B;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnC,4BAA4B;IAC5B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhC,4CAA4C;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAA;IAEhD,6CAA6C;IAC7C,gDAAgD,CAAC,EAAE,MAAM,EAAE,CAAA;IAE3D,gCAAgC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAE9B,2BAA2B;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE/B,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,0BAA0B;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,uCAAuC;IACvC,0CAA0C,CAAC,EAAE,MAAM,EAAE,CAAA;IAErD,6BAA6B;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAE/B,0CAA0C;IAC1C,6CAA6C,CAAC,EAAE,MAAM,EAAE,CAAA;IAExD,8CAA8C;IAC9C,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9C;AAMD;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACtC,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB,iCAAiC;IACjC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAEnC,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IAEzB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,iBAAiB;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,eAAe;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,eAAe;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,iBAAiB;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,YAAY,CAAA;IAEnB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,uBAAuB;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAA;IAEjB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB,yCAAyC;IACzC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAEjC,gCAAgC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAElC,8BAA8B;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC,oCAAoC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,wCAAwC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACzB;AAMD;;GAEG;AACH,MAAM,WAAW,GAAG;IAChB,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAA;IAEX,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,qBAAqB;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAElB,gBAAgB;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,gBAAgB;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IAEd,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IAGnB,kBAAkB;IAClB,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,0BAA0B;IAC1B,CAAC,CAAC,EAAE,MAAM,CAAA;IAGV,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sBAAsB;IACtB,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,sBAAsB;IACtB,CAAC,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB,wBAAwB;IACxB,IAAI,EAAE,GAAG,EAAE,CAAA;CACd;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAClC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAA;IAEd,kCAAkC;IAClC,MAAM,CAAC,EAAE,WAAW,CAAA;IAEpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAA;IAEX,0DAA0D;IAC1D,MAAM,EAAE,MAAM,EAAE,CAAA;IAEhB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAA;IAEX,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAA;IAEX,mBAAmB;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAExB,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IAEnC,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAExB,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAExB,gBAAgB;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAE9B,wBAAwB;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACzB;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAA;IAEhB,kDAAkD;IAClD,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAE9B,wCAAwC;IACxC,eAAe,EAAE,MAAM,EAAE,CAAA;IAEzB,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAA;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IAEf,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAA;IAEd,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAA;IAEhB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAEjC,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACtC,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAA;IAErB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B"}

package/dist/auth/validation.d.ts

@@ -0,0 +1,15 @@
+import type { AuditLogger } from '../audit/index.js';
+/**
+ * Enforces unified access boundaries for tools and resources.
+ *
+ * 1. Team Boundary Check (Fail-closed):
+ *    Requires either a TEAM_AUTHOR environment variable or an active, valid OAuth session.
+ * 2. Scope Validation:
+ *    Ensures the active session possesses the required scope for the target operation.
+ */
+export declare function enforceAccessBoundary(targetName: string, targetType: 'resource' | 'tool' | 'prompt', capabilities?: {
+    requiresTeamScope?: boolean;
+    requiresAdminScope?: boolean;
+    requiresAuditScope?: boolean;
+}, auditLogger?: AuditLogger | null): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/auth/validation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAGpD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACjC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,EAC1C,YAAY,CAAC,EAAE;IACX,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC/B,EACD,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,GACjC,IAAI,CA6EN"}