poe-code 3.0.450 → 3.0.451-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.450",
+  "version": "3.0.451-beta.1",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",
@@ -277,6 +277,7 @@
     "globals": "^17.3.0",
     "husky": "^9.1.7",
     "mcp-oauth": "*",
+    "mcp-oauth-server": "*",
     "memfs": "^4.56.10",
     "opencode-poe-auth": "*",
     "poe-oauth": "*",

package/packages/toolcraft/dist/http.d.ts

@@ -1,6 +1,7 @@
 import "./node-require-shim.js";
 import { type HttpListenOptions, type HttpServer, type HttpServerHandle, type HttpToolContext, type HttpTransportOptions } from "../../tiny-http-mcp-server/dist/server.js";
 import type { Group } from "./index.js";
+import type { OAuthAuthorizationServer } from "../../mcp-oauth-server/dist/index.js";
 import { type RunMCPOptions } from "./mcp.js";
 export type ToolcraftHTTPContext = HttpToolContext;
 export type ToolcraftHTTPServer = HttpServer;
@@ -13,7 +14,16 @@ export interface RunHTTPMCPOptions<TServices extends object = Record<string, unk
     path?: string;
     requestServices?(context: ToolcraftHTTPContext): Partial<TServices> | Promise<Partial<TServices>>;
 }
+export interface HTTPMCPAuthorizationOptions {
+    authorizationServer: Pick<OAuthAuthorizationServer, "issuer" | "verifyAccessToken">;
+    resource: string;
+    requiredScopes?: readonly string[];
+    scopesSupported?: readonly string[];
+}
+export declare function createHTTPMCPAuthorization(options: HTTPMCPAuthorizationOptions): import("../../tiny-http-mcp-server/dist/server.js").TinyHttpMcpServerOAuthOptions;
 export declare function createHTTPMCPServer<TServices extends object = Record<string, unknown>>(roots: Group<TServices> | Group<TServices>[], options: RunHTTPMCPOptions<TServices>): Promise<ToolcraftHTTPServer>;
 export declare function runHTTPMCP<TServices extends object = Record<string, unknown>>(roots: Group<TServices> | Group<TServices>[], options: RunHTTPMCPOptions<TServices>): Promise<ToolcraftHTTPServerHandle>;
 export type { HttpListenOptions, HttpObservabilityEvent, HttpObservabilityOptions, RequestAuthInfo, Session, SessionStore, StreamableHttpTransportOptions, TinyHttpMcpServerOAuthOptions, TokenVerifier, VerifiedAccessToken } from "../../tiny-http-mcp-server/dist/server.js";
 export { createJwksTokenVerifier, TokenVerificationError } from "../../tiny-http-mcp-server/dist/server.js";
+export { createAuthorizationInteractionSecurity, createInMemoryAuthorizationServerStore, createOAuthAuthorizationServer, verifyAuthorizationInteractionCsrf } from "../../mcp-oauth-server/dist/index.js";
+export type { AuthorizationInteraction, AuthorizationInteractionSecurity, AuthorizationServerStore, OAuthAuthorizationServer, OAuthAuthorizationServerOptions, VerifiedAuthorizationServerToken } from "../../mcp-oauth-server/dist/index.js";

package/packages/toolcraft/dist/http.js

@@ -2,6 +2,45 @@ import "./node-require-shim.js";
 import { createHttpServer } from "tiny-http-mcp-server/server";
 import { createMCPServerForTransport } from "./mcp.js";
 import { enableSourceMaps } from "./stack-trim.js";
+function toVerifiedAccessToken(token, issuer, verified) {
+    return {
+        token,
+        issuer,
+        audience: [verified.resource],
+        scopes: [...verified.scopes],
+        expiresAt: verified.expiresAt,
+        claims: {
+            sub: verified.subject,
+            client_id: verified.clientId,
+            aud: verified.resource,
+            jti: verified.tokenId
+        },
+        subject: verified.subject,
+        clientId: verified.clientId
+    };
+}
+export function createHTTPMCPAuthorization(options) {
+    const issuer = options.authorizationServer.issuer;
+    const resource = new URL(options.resource).href;
+    return {
+        resource,
+        authorizationServers: [issuer],
+        requiredScopes: options.requiredScopes,
+        scopesSupported: options.scopesSupported ?? options.requiredScopes,
+        verifier: {
+            async verify(input) {
+                if (input.authorizationServers.length !== 1 || input.authorizationServers[0] !== issuer) {
+                    throw new Error("authorization server issuer does not match");
+                }
+                if (new URL(input.resource).href !== resource) {
+                    throw new Error("protected resource does not match");
+                }
+                const verified = await options.authorizationServer.verifyAccessToken(input.token, resource);
+                return toVerifiedAccessToken(input.token, issuer, verified);
+            }
+        }
+    };
+}
 function createTransportOptions(options, serverOptions) {
     return {
         ...serverOptions,
@@ -60,3 +99,4 @@ export async function runHTTPMCP(roots, options) {
     return server.listenHttp(createListenOptions(options));
 }
 export { createJwksTokenVerifier, TokenVerificationError } from "tiny-http-mcp-server/server";
+export { createAuthorizationInteractionSecurity, createInMemoryAuthorizationServerStore, createOAuthAuthorizationServer, verifyAuthorizationInteractionCsrf } from "mcp-oauth-server";