panoma 0.1.8 → 0.9.0

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/register.d.ts

@@ -1,29 +0,0 @@
-import { RequestHandler } from 'express';
-import { OAuthRegisteredClientsStore } from '../clients.js';
-import { Options as RateLimitOptions } from 'express-rate-limit';
-export type ClientRegistrationHandlerOptions = {
-    /**
-     * A store used to save information about dynamically registered OAuth clients.
-     */
-    clientsStore: OAuthRegisteredClientsStore;
-    /**
-     * The number of seconds after which to expire issued client secrets, or 0 to prevent expiration of client secrets (not recommended).
-     *
-     * If not set, defaults to 30 days.
-     */
-    clientSecretExpirySeconds?: number;
-    /**
-     * Rate limiting configuration for the client registration endpoint.
-     * Set to false to disable rate limiting for this endpoint.
-     * Registration endpoints are particularly sensitive to abuse and should be rate limited.
-     */
-    rateLimit?: Partial<RateLimitOptions> | false;
-    /**
-     * Whether to generate a client ID before calling the client registration endpoint.
-     *
-     * If not set, defaults to true.
-     */
-    clientIdGeneration?: boolean;
-};
-export declare function clientRegistrationHandler({ clientsStore, clientSecretExpirySeconds, rateLimit: rateLimitConfig, clientIdGeneration }: ClientRegistrationHandlerOptions): RequestHandler;
-//# sourceMappingURL=register.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/register.js

@@ -1,77 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.clientRegistrationHandler = clientRegistrationHandler;
-const express_1 = __importDefault(require("express"));
-const auth_js_1 = require("../../../shared/auth.js");
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const cors_1 = __importDefault(require("cors"));
-const express_rate_limit_1 = require("express-rate-limit");
-const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
-const errors_js_1 = require("../errors.js");
-const DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS = 30 * 24 * 60 * 60; // 30 days
-function clientRegistrationHandler({ clientsStore, clientSecretExpirySeconds = DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS, rateLimit: rateLimitConfig, clientIdGeneration = true }) {
-    if (!clientsStore.registerClient) {
-        throw new Error('Client registration store does not support registering clients');
-    }
-    // Nested router so we can configure middleware and restrict HTTP method
-    const router = express_1.default.Router();
-    // Configure CORS to allow any origin, to make accessible to web-based MCP clients
-    router.use((0, cors_1.default)());
-    router.use((0, allowedMethods_js_1.allowedMethods)(['POST']));
-    router.use(express_1.default.json());
-    // Apply rate limiting unless explicitly disabled - stricter limits for registration
-    if (rateLimitConfig !== false) {
-        router.use((0, express_rate_limit_1.rateLimit)({
-            windowMs: 60 * 60 * 1000, // 1 hour
-            max: 20, // 20 requests per hour - stricter as registration is sensitive
-            standardHeaders: true,
-            legacyHeaders: false,
-            message: new errors_js_1.TooManyRequestsError('You have exceeded the rate limit for client registration requests').toResponseObject(),
-            ...rateLimitConfig
-        }));
-    }
-    router.post('/', async (req, res) => {
-        res.setHeader('Cache-Control', 'no-store');
-        try {
-            const parseResult = auth_js_1.OAuthClientMetadataSchema.safeParse(req.body);
-            if (!parseResult.success) {
-                throw new errors_js_1.InvalidClientMetadataError(parseResult.error.message);
-            }
-            const clientMetadata = parseResult.data;
-            const isPublicClient = clientMetadata.token_endpoint_auth_method === 'none';
-            // Generate client credentials
-            const clientSecret = isPublicClient ? undefined : node_crypto_1.default.randomBytes(32).toString('hex');
-            const clientIdIssuedAt = Math.floor(Date.now() / 1000);
-            // Calculate client secret expiry time
-            const clientsDoExpire = clientSecretExpirySeconds > 0;
-            const secretExpiryTime = clientsDoExpire ? clientIdIssuedAt + clientSecretExpirySeconds : 0;
-            const clientSecretExpiresAt = isPublicClient ? undefined : secretExpiryTime;
-            let clientInfo = {
-                ...clientMetadata,
-                client_secret: clientSecret,
-                client_secret_expires_at: clientSecretExpiresAt
-            };
-            if (clientIdGeneration) {
-                clientInfo.client_id = node_crypto_1.default.randomUUID();
-                clientInfo.client_id_issued_at = clientIdIssuedAt;
-            }
-            clientInfo = await clientsStore.registerClient(clientInfo);
-            res.status(201).json(clientInfo);
-        }
-        catch (error) {
-            if (error instanceof errors_js_1.OAuthError) {
-                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
-                res.status(status).json(error.toResponseObject());
-            }
-            else {
-                const serverError = new errors_js_1.ServerError('Internal Server Error');
-                res.status(500).json(serverError.toResponseObject());
-            }
-        }
-    });
-    return router;
-}
-//# sourceMappingURL=register.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/revoke.d.ts

@@ -1,13 +0,0 @@
-import { OAuthServerProvider } from '../provider.js';
-import { RequestHandler } from 'express';
-import { Options as RateLimitOptions } from 'express-rate-limit';
-export type RevocationHandlerOptions = {
-    provider: OAuthServerProvider;
-    /**
-     * Rate limiting configuration for the token revocation endpoint.
-     * Set to false to disable rate limiting for this endpoint.
-     */
-    rateLimit?: Partial<RateLimitOptions> | false;
-};
-export declare function revocationHandler({ provider, rateLimit: rateLimitConfig }: RevocationHandlerOptions): RequestHandler;
-//# sourceMappingURL=revoke.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/revoke.js

@@ -1,65 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.revocationHandler = revocationHandler;
-const express_1 = __importDefault(require("express"));
-const cors_1 = __importDefault(require("cors"));
-const clientAuth_js_1 = require("../middleware/clientAuth.js");
-const auth_js_1 = require("../../../shared/auth.js");
-const express_rate_limit_1 = require("express-rate-limit");
-const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
-const errors_js_1 = require("../errors.js");
-function revocationHandler({ provider, rateLimit: rateLimitConfig }) {
-    if (!provider.revokeToken) {
-        throw new Error('Auth provider does not support revoking tokens');
-    }
-    // Nested router so we can configure middleware and restrict HTTP method
-    const router = express_1.default.Router();
-    // Configure CORS to allow any origin, to make accessible to web-based MCP clients
-    router.use((0, cors_1.default)());
-    router.use((0, allowedMethods_js_1.allowedMethods)(['POST']));
-    router.use(express_1.default.urlencoded({ extended: false }));
-    // Apply rate limiting unless explicitly disabled
-    if (rateLimitConfig !== false) {
-        router.use((0, express_rate_limit_1.rateLimit)({
-            windowMs: 15 * 60 * 1000, // 15 minutes
-            max: 50, // 50 requests per windowMs
-            standardHeaders: true,
-            legacyHeaders: false,
-            message: new errors_js_1.TooManyRequestsError('You have exceeded the rate limit for token revocation requests').toResponseObject(),
-            ...rateLimitConfig
-        }));
-    }
-    // Authenticate and extract client details
-    router.use((0, clientAuth_js_1.authenticateClient)({ clientsStore: provider.clientsStore }));
-    router.post('/', async (req, res) => {
-        res.setHeader('Cache-Control', 'no-store');
-        try {
-            const parseResult = auth_js_1.OAuthTokenRevocationRequestSchema.safeParse(req.body);
-            if (!parseResult.success) {
-                throw new errors_js_1.InvalidRequestError(parseResult.error.message);
-            }
-            const client = req.client;
-            if (!client) {
-                // This should never happen
-                throw new errors_js_1.ServerError('Internal Server Error');
-            }
-            await provider.revokeToken(client, parseResult.data);
-            res.status(200).json({});
-        }
-        catch (error) {
-            if (error instanceof errors_js_1.OAuthError) {
-                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
-                res.status(status).json(error.toResponseObject());
-            }
-            else {
-                const serverError = new errors_js_1.ServerError('Internal Server Error');
-                res.status(500).json(serverError.toResponseObject());
-            }
-        }
-    });
-    return router;
-}
-//# sourceMappingURL=revoke.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/token.d.ts

@@ -1,13 +0,0 @@
-import { RequestHandler } from 'express';
-import { OAuthServerProvider } from '../provider.js';
-import { Options as RateLimitOptions } from 'express-rate-limit';
-export type TokenHandlerOptions = {
-    provider: OAuthServerProvider;
-    /**
-     * Rate limiting configuration for the token endpoint.
-     * Set to false to disable rate limiting for this endpoint.
-     */
-    rateLimit?: Partial<RateLimitOptions> | false;
-};
-export declare function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHandlerOptions): RequestHandler;
-//# sourceMappingURL=token.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/token.js

@@ -1,136 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.tokenHandler = tokenHandler;
-const z = __importStar(require("zod/v4"));
-const express_1 = __importDefault(require("express"));
-const cors_1 = __importDefault(require("cors"));
-const pkce_challenge_1 = require("pkce-challenge");
-const clientAuth_js_1 = require("../middleware/clientAuth.js");
-const express_rate_limit_1 = require("express-rate-limit");
-const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
-const errors_js_1 = require("../errors.js");
-const TokenRequestSchema = z.object({
-    grant_type: z.string()
-});
-const AuthorizationCodeGrantSchema = z.object({
-    code: z.string(),
-    code_verifier: z.string(),
-    redirect_uri: z.string().optional(),
-    resource: z.string().url().optional()
-});
-const RefreshTokenGrantSchema = z.object({
-    refresh_token: z.string(),
-    scope: z.string().optional(),
-    resource: z.string().url().optional()
-});
-function tokenHandler({ provider, rateLimit: rateLimitConfig }) {
-    // Nested router so we can configure middleware and restrict HTTP method
-    const router = express_1.default.Router();
-    // Configure CORS to allow any origin, to make accessible to web-based MCP clients
-    router.use((0, cors_1.default)());
-    router.use((0, allowedMethods_js_1.allowedMethods)(['POST']));
-    router.use(express_1.default.urlencoded({ extended: false }));
-    // Apply rate limiting unless explicitly disabled
-    if (rateLimitConfig !== false) {
-        router.use((0, express_rate_limit_1.rateLimit)({
-            windowMs: 15 * 60 * 1000, // 15 minutes
-            max: 50, // 50 requests per windowMs
-            standardHeaders: true,
-            legacyHeaders: false,
-            message: new errors_js_1.TooManyRequestsError('You have exceeded the rate limit for token requests').toResponseObject(),
-            ...rateLimitConfig
-        }));
-    }
-    // Authenticate and extract client details
-    router.use((0, clientAuth_js_1.authenticateClient)({ clientsStore: provider.clientsStore }));
-    router.post('/', async (req, res) => {
-        res.setHeader('Cache-Control', 'no-store');
-        try {
-            const parseResult = TokenRequestSchema.safeParse(req.body);
-            if (!parseResult.success) {
-                throw new errors_js_1.InvalidRequestError(parseResult.error.message);
-            }
-            const { grant_type } = parseResult.data;
-            const client = req.client;
-            if (!client) {
-                // This should never happen
-                throw new errors_js_1.ServerError('Internal Server Error');
-            }
-            switch (grant_type) {
-                case 'authorization_code': {
-                    const parseResult = AuthorizationCodeGrantSchema.safeParse(req.body);
-                    if (!parseResult.success) {
-                        throw new errors_js_1.InvalidRequestError(parseResult.error.message);
-                    }
-                    const { code, code_verifier, redirect_uri, resource } = parseResult.data;
-                    const skipLocalPkceValidation = provider.skipLocalPkceValidation;
-                    // Perform local PKCE validation unless explicitly skipped
-                    // (e.g. to validate code_verifier in upstream server)
-                    if (!skipLocalPkceValidation) {
-                        const codeChallenge = await provider.challengeForAuthorizationCode(client, code);
-                        if (!(await (0, pkce_challenge_1.verifyChallenge)(code_verifier, codeChallenge))) {
-                            throw new errors_js_1.InvalidGrantError('code_verifier does not match the challenge');
-                        }
-                    }
-                    // Passes the code_verifier to the provider if PKCE validation didn't occur locally
-                    const tokens = await provider.exchangeAuthorizationCode(client, code, skipLocalPkceValidation ? code_verifier : undefined, redirect_uri, resource ? new URL(resource) : undefined);
-                    res.status(200).json(tokens);
-                    break;
-                }
-                case 'refresh_token': {
-                    const parseResult = RefreshTokenGrantSchema.safeParse(req.body);
-                    if (!parseResult.success) {
-                        throw new errors_js_1.InvalidRequestError(parseResult.error.message);
-                    }
-                    const { refresh_token, scope, resource } = parseResult.data;
-                    const scopes = scope?.split(' ');
-                    const tokens = await provider.exchangeRefreshToken(client, refresh_token, scopes, resource ? new URL(resource) : undefined);
-                    res.status(200).json(tokens);
-                    break;
-                }
-                // Additional auth methods will not be added on the server side of the SDK.
-                case 'client_credentials':
-                default:
-                    throw new errors_js_1.UnsupportedGrantTypeError('The grant type is not supported by this authorization server.');
-            }
-        }
-        catch (error) {
-            if (error instanceof errors_js_1.OAuthError) {
-                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
-                res.status(status).json(error.toResponseObject());
-            }
-            else {
-                const serverError = new errors_js_1.ServerError('Internal Server Error');
-                res.status(500).json(serverError.toResponseObject());
-            }
-        }
-    });
-    return router;
-}
-//# sourceMappingURL=token.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/allowedMethods.d.ts

@@ -1,9 +0,0 @@
-import { RequestHandler } from 'express';
-/**
- * Middleware to handle unsupported HTTP methods with a 405 Method Not Allowed response.
- *
- * @param allowedMethods Array of allowed HTTP methods for this endpoint (e.g., ['GET', 'POST'])
- * @returns Express middleware that returns a 405 error if method not in allowed list
- */
-export declare function allowedMethods(allowedMethods: string[]): RequestHandler;
-//# sourceMappingURL=allowedMethods.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/allowedMethods.js

@@ -1,21 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.allowedMethods = allowedMethods;
-const errors_js_1 = require("../errors.js");
-/**
- * Middleware to handle unsupported HTTP methods with a 405 Method Not Allowed response.
- *
- * @param allowedMethods Array of allowed HTTP methods for this endpoint (e.g., ['GET', 'POST'])
- * @returns Express middleware that returns a 405 error if method not in allowed list
- */
-function allowedMethods(allowedMethods) {
-    return (req, res, next) => {
-        if (allowedMethods.includes(req.method)) {
-            next();
-            return;
-        }
-        const error = new errors_js_1.MethodNotAllowedError(`The method ${req.method} is not allowed for this endpoint`);
-        res.status(405).set('Allow', allowedMethods.join(', ')).json(error.toResponseObject());
-    };
-}
-//# sourceMappingURL=allowedMethods.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/bearerAuth.d.ts

@@ -1,35 +0,0 @@
-import { RequestHandler } from 'express';
-import { OAuthTokenVerifier } from '../provider.js';
-import { AuthInfo } from '../types.js';
-export type BearerAuthMiddlewareOptions = {
-    /**
-     * A provider used to verify tokens.
-     */
-    verifier: OAuthTokenVerifier;
-    /**
-     * Optional scopes that the token must have.
-     */
-    requiredScopes?: string[];
-    /**
-     * Optional resource metadata URL to include in WWW-Authenticate header.
-     */
-    resourceMetadataUrl?: string;
-};
-declare module 'express-serve-static-core' {
-    interface Request {
-        /**
-         * Information about the validated access token, if the `requireBearerAuth` middleware was used.
-         */
-        auth?: AuthInfo;
-    }
-}
-/**
- * Middleware that requires a valid Bearer token in the Authorization header.
- *
- * This will validate the token with the auth provider and add the resulting auth info to the request object.
- *
- * If resourceMetadataUrl is provided, it will be included in the WWW-Authenticate header
- * for 401 responses as per the OAuth 2.0 Protected Resource Metadata spec.
- */
-export declare function requireBearerAuth({ verifier, requiredScopes, resourceMetadataUrl }: BearerAuthMiddlewareOptions): RequestHandler;
-//# sourceMappingURL=bearerAuth.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/bearerAuth.js

@@ -1,75 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireBearerAuth = requireBearerAuth;
-const errors_js_1 = require("../errors.js");
-/**
- * Middleware that requires a valid Bearer token in the Authorization header.
- *
- * This will validate the token with the auth provider and add the resulting auth info to the request object.
- *
- * If resourceMetadataUrl is provided, it will be included in the WWW-Authenticate header
- * for 401 responses as per the OAuth 2.0 Protected Resource Metadata spec.
- */
-function requireBearerAuth({ verifier, requiredScopes = [], resourceMetadataUrl }) {
-    return async (req, res, next) => {
-        try {
-            const authHeader = req.headers.authorization;
-            if (!authHeader) {
-                throw new errors_js_1.InvalidTokenError('Missing Authorization header');
-            }
-            const [type, token] = authHeader.split(' ');
-            if (type.toLowerCase() !== 'bearer' || !token) {
-                throw new errors_js_1.InvalidTokenError("Invalid Authorization header format, expected 'Bearer TOKEN'");
-            }
-            const authInfo = await verifier.verifyAccessToken(token);
-            // Check if token has the required scopes (if any)
-            if (requiredScopes.length > 0) {
-                const hasAllScopes = requiredScopes.every(scope => authInfo.scopes.includes(scope));
-                if (!hasAllScopes) {
-                    throw new errors_js_1.InsufficientScopeError('Insufficient scope');
-                }
-            }
-            // Check if the token is set to expire or if it is expired
-            if (typeof authInfo.expiresAt !== 'number' || isNaN(authInfo.expiresAt)) {
-                throw new errors_js_1.InvalidTokenError('Token has no expiration time');
-            }
-            else if (authInfo.expiresAt < Date.now() / 1000) {
-                throw new errors_js_1.InvalidTokenError('Token has expired');
-            }
-            req.auth = authInfo;
-            next();
-        }
-        catch (error) {
-            // Build WWW-Authenticate header parts
-            const buildWwwAuthHeader = (errorCode, message) => {
-                let header = `Bearer error="${errorCode}", error_description="${message}"`;
-                if (requiredScopes.length > 0) {
-                    header += `, scope="${requiredScopes.join(' ')}"`;
-                }
-                if (resourceMetadataUrl) {
-                    header += `, resource_metadata="${resourceMetadataUrl}"`;
-                }
-                return header;
-            };
-            if (error instanceof errors_js_1.InvalidTokenError) {
-                res.set('WWW-Authenticate', buildWwwAuthHeader(error.errorCode, error.message));
-                res.status(401).json(error.toResponseObject());
-            }
-            else if (error instanceof errors_js_1.InsufficientScopeError) {
-                res.set('WWW-Authenticate', buildWwwAuthHeader(error.errorCode, error.message));
-                res.status(403).json(error.toResponseObject());
-            }
-            else if (error instanceof errors_js_1.ServerError) {
-                res.status(500).json(error.toResponseObject());
-            }
-            else if (error instanceof errors_js_1.OAuthError) {
-                res.status(400).json(error.toResponseObject());
-            }
-            else {
-                const serverError = new errors_js_1.ServerError('Internal Server Error');
-                res.status(500).json(serverError.toResponseObject());
-            }
-        }
-    };
-}
-//# sourceMappingURL=bearerAuth.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/clientAuth.d.ts

@@ -1,19 +0,0 @@
-import { RequestHandler } from 'express';
-import { OAuthRegisteredClientsStore } from '../clients.js';
-import { OAuthClientInformationFull } from '../../../shared/auth.js';
-export type ClientAuthenticationMiddlewareOptions = {
-    /**
-     * A store used to read information about registered OAuth clients.
-     */
-    clientsStore: OAuthRegisteredClientsStore;
-};
-declare module 'express-serve-static-core' {
-    interface Request {
-        /**
-         * The authenticated client for this request, if the `authenticateClient` middleware was used.
-         */
-        client?: OAuthClientInformationFull;
-    }
-}
-export declare function authenticateClient({ clientsStore }: ClientAuthenticationMiddlewareOptions): RequestHandler;
-//# sourceMappingURL=clientAuth.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/clientAuth.js

@@ -1,71 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticateClient = authenticateClient;
-const z = __importStar(require("zod/v4"));
-const errors_js_1 = require("../errors.js");
-const ClientAuthenticatedRequestSchema = z.object({
-    client_id: z.string(),
-    client_secret: z.string().optional()
-});
-function authenticateClient({ clientsStore }) {
-    return async (req, res, next) => {
-        try {
-            const result = ClientAuthenticatedRequestSchema.safeParse(req.body);
-            if (!result.success) {
-                throw new errors_js_1.InvalidRequestError(String(result.error));
-            }
-            const { client_id, client_secret } = result.data;
-            const client = await clientsStore.getClient(client_id);
-            if (!client) {
-                throw new errors_js_1.InvalidClientError('Invalid client_id');
-            }
-            if (client.client_secret) {
-                if (!client_secret) {
-                    throw new errors_js_1.InvalidClientError('Client secret is required');
-                }
-                if (client.client_secret !== client_secret) {
-                    throw new errors_js_1.InvalidClientError('Invalid client_secret');
-                }
-                if (client.client_secret_expires_at && client.client_secret_expires_at < Math.floor(Date.now() / 1000)) {
-                    throw new errors_js_1.InvalidClientError('Client secret has expired');
-                }
-            }
-            req.client = client;
-            next();
-        }
-        catch (error) {
-            if (error instanceof errors_js_1.OAuthError) {
-                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
-                res.status(status).json(error.toResponseObject());
-            }
-            else {
-                const serverError = new errors_js_1.ServerError('Internal Server Error');
-                res.status(500).json(serverError.toResponseObject());
-            }
-        }
-    };
-}
-//# sourceMappingURL=clientAuth.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/provider.d.ts

@@ -1,68 +0,0 @@
-import { Response } from 'express';
-import { OAuthRegisteredClientsStore } from './clients.js';
-import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../shared/auth.js';
-import { AuthInfo } from './types.js';
-export type AuthorizationParams = {
-    state?: string;
-    scopes?: string[];
-    codeChallenge: string;
-    redirectUri: string;
-    resource?: URL;
-};
-/**
- * Implements an end-to-end OAuth server.
- */
-export interface OAuthServerProvider {
-    /**
-     * A store used to read information about registered OAuth clients.
-     */
-    get clientsStore(): OAuthRegisteredClientsStore;
-    /**
-     * Begins the authorization flow, which can either be implemented by this server itself or via redirection to a separate authorization server.
-     *
-     * This server must eventually issue a redirect with an authorization response or an error response to the given redirect URI. Per OAuth 2.1:
-     * - In the successful case, the redirect MUST include the `code` and `state` (if present) query parameters.
-     * - In the error case, the redirect MUST include the `error` query parameter, and MAY include an optional `error_description` query parameter.
-     */
-    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
-    /**
-     * Returns the `codeChallenge` that was used when the indicated authorization began.
-     */
-    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
-    /**
-     * Exchanges an authorization code for an access token.
-     */
-    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
-    /**
-     * Exchanges a refresh token for an access token.
-     */
-    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
-    /**
-     * Verifies an access token and returns information about it.
-     */
-    verifyAccessToken(token: string): Promise<AuthInfo>;
-    /**
-     * Revokes an access or refresh token. If unimplemented, token revocation is not supported (not recommended).
-     *
-     * If the given token is invalid or already revoked, this method should do nothing.
-     */
-    revokeToken?(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
-    /**
-     * Whether to skip local PKCE validation.
-     *
-     * If true, the server will not perform PKCE validation locally and will pass the code_verifier to the upstream server.
-     *
-     * NOTE: This should only be true if the upstream server is performing the actual PKCE validation.
-     */
-    skipLocalPkceValidation?: boolean;
-}
-/**
- * Slim implementation useful for token verification
- */
-export interface OAuthTokenVerifier {
-    /**
-     * Verifies an access token and returns information about it.
-     */
-    verifyAccessToken(token: string): Promise<AuthInfo>;
-}
-//# sourceMappingURL=provider.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/provider.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=provider.js.map