paygate-mcp 2.9.0 → 3.1.0

package/dist/tokens.js

@@ -0,0 +1,244 @@
+"use strict";
+/**
+ * ScopedTokenManager — Issue and validate short-lived scoped tokens
+ * derived from API keys.
+ *
+ * Tokens are self-contained (no server-side state): the payload is
+ * HMAC-SHA256 signed and base64url-encoded. Validation is a pure
+ * crypto check — no DB lookup needed.
+ *
+ * Format: pgt_<base64url(JSON payload)>.<base64url(HMAC signature)>
+ *
+ * Use cases:
+ *   - Browser-based agents that shouldn't hold long-lived API keys
+ *   - Temporary scoped access (e.g., only allow specific tools)
+ *   - Token delegation from a master key to a downstream agent
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopedTokenManager = exports.TokenRevocationList = void 0;
+const crypto_1 = require("crypto");
+const TOKEN_PREFIX = 'pgt_';
+const MAX_TTL_SECONDS = 86400; // 24 hours
+const DEFAULT_TTL_SECONDS = 3600; // 1 hour
+const MAX_TOKEN_AGE_CHECK_MS = MAX_TTL_SECONDS * 1000;
+const CLEANUP_INTERVAL_MS = 60_000; // Clean expired entries every 60s
+// ─── Revocation List ──────────────────────────────────────────────────────────
+/**
+ * In-memory revocation list for scoped tokens.
+ *
+ * Stores SHA-256 fingerprints of revoked tokens with their natural expiry.
+ * Entries auto-purge once the original token would have expired anyway
+ * (max 24h), so the list never grows unbounded.
+ *
+ * O(1) lookup via Map. Periodic cleanup via timer.
+ */
+class TokenRevocationList {
+    entries = new Map();
+    cleanupTimer = null;
+    constructor() {
+        this.cleanupTimer = setInterval(() => this.purgeExpired(), CLEANUP_INTERVAL_MS);
+        if (this.cleanupTimer.unref)
+            this.cleanupTimer.unref();
+    }
+    /** Compute fingerprint for a token string. */
+    static fingerprint(token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    /** Revoke a token. Returns the entry created, or null if already revoked. */
+    revoke(token, expiresAt, reason) {
+        const fp = TokenRevocationList.fingerprint(token);
+        if (this.entries.has(fp))
+            return null; // Already revoked
+        const entry = {
+            fingerprint: fp,
+            expiresAt,
+            revokedAt: new Date().toISOString(),
+            ...(reason ? { reason } : {}),
+        };
+        this.entries.set(fp, entry);
+        return entry;
+    }
+    /** Add a pre-built entry (e.g., from Redis sync). */
+    addEntry(entry) {
+        this.entries.set(entry.fingerprint, entry);
+    }
+    /** Check if a token is revoked. O(1). */
+    isRevoked(token) {
+        return this.entries.has(TokenRevocationList.fingerprint(token));
+    }
+    /** Check by fingerprint directly. O(1). */
+    isRevokedByFingerprint(fingerprint) {
+        return this.entries.has(fingerprint);
+    }
+    /** Number of active revocation entries. */
+    get size() {
+        return this.entries.size;
+    }
+    /** List all current revocation entries. */
+    list() {
+        return Array.from(this.entries.values());
+    }
+    /** Remove expired entries (token has naturally expired, no need to track). */
+    purgeExpired() {
+        const now = Date.now();
+        let purged = 0;
+        for (const [fp, entry] of this.entries) {
+            if (new Date(entry.expiresAt).getTime() <= now) {
+                this.entries.delete(fp);
+                purged++;
+            }
+        }
+        return purged;
+    }
+    /** Destroy the cleanup timer. */
+    destroy() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+    }
+    /** Clear all entries. */
+    clear() {
+        this.entries.clear();
+    }
+}
+exports.TokenRevocationList = TokenRevocationList;
+// ─── Manager ──────────────────────────────────────────────────────────────────
+class ScopedTokenManager {
+    secret;
+    revocationList;
+    /**
+     * @param secret — Signing secret (the admin key is used by default)
+     */
+    constructor(secret) {
+        if (!secret || secret.length < 8) {
+            throw new Error('Token signing secret must be at least 8 characters');
+        }
+        this.secret = secret;
+        this.revocationList = new TokenRevocationList();
+    }
+    /**
+     * Issue a new scoped token.
+     */
+    create(options) {
+        const ttl = Math.min(Math.max(1, options.ttlSeconds || DEFAULT_TTL_SECONDS), MAX_TTL_SECONDS);
+        const expiresAt = options.expiresAt || new Date(Date.now() + ttl * 1000).toISOString();
+        const payload = {
+            apiKey: options.apiKey,
+            expiresAt,
+            issuedAt: new Date().toISOString(),
+            ...(options.allowedTools?.length ? { allowedTools: options.allowedTools } : {}),
+            ...(options.label ? { label: options.label } : {}),
+        };
+        const payloadB64 = this.base64urlEncode(JSON.stringify(payload));
+        const signature = this.sign(payloadB64);
+        return `${TOKEN_PREFIX}${payloadB64}.${signature}`;
+    }
+    /**
+     * Validate a scoped token. Returns the payload if valid.
+     */
+    validate(token) {
+        if (!token.startsWith(TOKEN_PREFIX)) {
+            return { valid: false, reason: 'not_a_scoped_token' };
+        }
+        const body = token.slice(TOKEN_PREFIX.length);
+        const dotIdx = body.lastIndexOf('.');
+        if (dotIdx === -1) {
+            return { valid: false, reason: 'malformed_token' };
+        }
+        const payloadB64 = body.slice(0, dotIdx);
+        const signatureB64 = body.slice(dotIdx + 1);
+        // Verify HMAC
+        const expectedSig = this.sign(payloadB64);
+        if (!this.timingSafeCompare(signatureB64, expectedSig)) {
+            return { valid: false, reason: 'invalid_signature' };
+        }
+        // Check revocation list (before decoding payload — O(1) hash lookup)
+        if (this.revocationList.isRevoked(token)) {
+            return { valid: false, reason: 'token_revoked' };
+        }
+        // Decode payload
+        let payload;
+        try {
+            payload = JSON.parse(this.base64urlDecode(payloadB64));
+        }
+        catch {
+            return { valid: false, reason: 'malformed_payload' };
+        }
+        // Check required fields
+        if (!payload.apiKey || !payload.expiresAt || !payload.issuedAt) {
+            return { valid: false, reason: 'missing_required_fields' };
+        }
+        // Check expiry
+        const now = Date.now();
+        const expiresAtMs = new Date(payload.expiresAt).getTime();
+        if (isNaN(expiresAtMs) || expiresAtMs <= now) {
+            return { valid: false, reason: 'token_expired' };
+        }
+        // Sanity: token can't be valid for more than MAX_TTL
+        const issuedAtMs = new Date(payload.issuedAt).getTime();
+        if (expiresAtMs - issuedAtMs > MAX_TOKEN_AGE_CHECK_MS) {
+            return { valid: false, reason: 'token_ttl_exceeded' };
+        }
+        return { valid: true, payload };
+    }
+    /**
+     * Revoke a token so it can no longer be used, even before expiry.
+     * Returns the revocation entry, or null if already revoked or invalid.
+     */
+    revokeToken(token, reason) {
+        // First validate to extract the expiresAt
+        // Temporarily skip revocation check for this validation
+        if (!token.startsWith(TOKEN_PREFIX))
+            return null;
+        const body = token.slice(TOKEN_PREFIX.length);
+        const dotIdx = body.lastIndexOf('.');
+        if (dotIdx === -1)
+            return null;
+        const payloadB64 = body.slice(0, dotIdx);
+        const signatureB64 = body.slice(dotIdx + 1);
+        const expectedSig = this.sign(payloadB64);
+        if (!this.timingSafeCompare(signatureB64, expectedSig))
+            return null;
+        let payload;
+        try {
+            payload = JSON.parse(this.base64urlDecode(payloadB64));
+        }
+        catch {
+            return null;
+        }
+        return this.revocationList.revoke(token, payload.expiresAt, reason);
+    }
+    /**
+     * Check if a string looks like a scoped token (prefix check only).
+     */
+    static isToken(value) {
+        return value.startsWith(TOKEN_PREFIX);
+    }
+    /** Destroy timers. Call on server shutdown. */
+    destroy() {
+        this.revocationList.destroy();
+    }
+    // ─── Crypto helpers ───────────────────────────────────────────────────────
+    sign(data) {
+        const hmac = (0, crypto_1.createHmac)('sha256', this.secret);
+        hmac.update(data);
+        return this.base64urlEncode(hmac.digest());
+    }
+    timingSafeCompare(a, b) {
+        if (a.length !== b.length)
+            return false;
+        const bufA = Buffer.from(a);
+        const bufB = Buffer.from(b);
+        return (0, crypto_1.timingSafeEqual)(bufA, bufB);
+    }
+    base64urlEncode(input) {
+        const buf = typeof input === 'string' ? Buffer.from(input) : input;
+        return buf.toString('base64url');
+    }
+    base64urlDecode(input) {
+        return Buffer.from(input, 'base64url').toString('utf-8');
+    }
+}
+exports.ScopedTokenManager = ScopedTokenManager;
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,mCAAiE;AAoDjE,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,WAAW;AAC1C,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAC,SAAS;AAC3C,MAAM,sBAAsB,GAAG,eAAe,GAAG,IAAI,CAAC;AACtD,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,kCAAkC;AAEtE,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,MAAa,mBAAmB;IACb,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,YAAY,GAA0C,IAAI,CAAC;IAEnE;QACE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,8CAA8C;IAC9C,MAAM,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,KAAa,EAAE,SAAiB,EAAE,MAAe;QACtD,MAAM,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QAEzD,MAAM,KAAK,GAAsB;YAC/B,WAAW,EAAE,EAAE;YACf,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qDAAqD;IACrD,QAAQ,CAAC,KAAwB;QAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,yCAAyC;IACzC,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,2CAA2C;IAC3C,sBAAsB,CAAC,WAAmB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,2CAA2C;IAC3C,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,YAAY;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;gBAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iCAAiC;IACjC,OAAO;QACL,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AA/ED,kDA+EC;AAED,iFAAiF;AAEjF,MAAa,kBAAkB;IACZ,MAAM,CAAS;IACvB,cAAc,CAAsB;IAE7C;;OAEG;IACH,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA2B;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,EACtD,eAAe,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEvF,MAAM,OAAO,GAAiB;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS;YACT,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAExC,OAAO,GAAG,YAAY,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE5C,cAAc;QACd,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACvD,CAAC;QAED,qEAAqE;QACrE,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACvD,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC7D,CAAC;QAED,eAAe;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,qDAAqD;QACrD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,IAAI,WAAW,GAAG,UAAU,GAAG,sBAAsB,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,KAAa,EAAE,MAAe;QACxC,0CAA0C;QAC1C,wDAAwD;QACxD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpE,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED,+CAA+C;IAC/C,OAAO;QACL,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,6EAA6E;IAErE,IAAI,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,iBAAiB,CAAC,CAAS,EAAE,CAAS;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAEO,eAAe,CAAC,KAAsB;QAC5C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnE,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAEO,eAAe,CAAC,KAAa;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAhKD,gDAgKC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paygate-mcp",
-  "version": "2.9.0",
+  "version": "3.1.0",
   "description": "Pay-per-tool-call gating proxy for MCP servers. Wrap any MCP server with API key auth, per-tool pricing, rate limiting, and usage metering.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",