thumbgate 1.27.17 → 1.27.18

package/scripts/hook-stop-anti-claim.js

@@ -1,301 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * Stop hook: anti-claim enforcement.
- *
- * Scans the assistant's most recent turn (assistant text + same-turn tool_use
- * blocks) and blocks the "deployed / live / done / fixed / ready" claim
- * unless that same turn included a proof tool call (curl / grep / test).
- *
- * Why: CLAUDE.md anti-lying directive ("Never claim fix done until
- * committed+pushed. Never claim 'ready' without running e2e.") was
- * aspirational, not enforced. Per CEO 2026-05-13 feedback after a session in
- * which 5+ unverified claims slipped through, this is the harness-level
- * enforcement that ends the recurring trust-burn pattern. ThumbGate-on-
- * ThumbGate dogfood — we are the prevention-rule generator and a perfect
- * customer for our own gate.
- *
- * Wires through .claude/settings.json Stop hooks list. Always exits 0
- * (informational): the goal is to surface a system reminder in the next
- * turn so the agent corrects mid-conversation rather than to hard-block
- * the turn that already happened.
- *
- * Stdin: Claude Code passes the hook payload as JSON on stdin. We read
- * `transcript_path` to locate the JSONL session log and scan the last
- * assistant message.
- *
- * Stdout: any text printed is shown to the agent on the next turn.
- */
-
-const fs = require('node:fs');
-
-// Lie-phrase patterns. These match common "claim of completion" wording
-// the agent emits without verification. Word-boundary anchored to avoid
-// false positives ("ready-made", "live-streaming", etc).
-const CLAIM_PATTERNS = [
-  /\bis\s+live\b/i,
-  /\bnow\s+live\b/i,
-  /\bgoing\s+live\b/i,
-  /\bdeployed\b(?!\s*(yet|to\s+staging|on\s+a\s+branch))/i,
-  /\b(?:is|are|it'?s)\s+(?:now\s+)?(?:fully\s+)?(?:fixed|resolved|merged|shipped)\b/i,
-  /\bproduction[-\s]ready\b/i,
-  /\beverything\s+(?:is\s+)?(?:done|working|ready)\b/i,
-  /\b(?:github|repo|repository)\s+(?:about|metadata|description|topics?)\b.*\b(?:updated|verified|fixed|match(?:es|ed)?)\b/i,
-  /\b(?:about|metadata|description|topics?)\b.*\b(?:updated|verified|fixed|match(?:es|ed)?)\b.*\b(?:github|repo|repository)\b/i,
-  // Added 2026-06-11 after a cross-project failure analysis: these completion
-  // claims ("all green / stable / verified / race over / tests pass") were
-  // asserted without proof and slipped past the original set. The proof-gate
-  // below suppresses them whenever the SAME turn ran a verification tool, so a
-  // "verified" claim backed by a test/curl/Read stays silent.
-  /\b(?:all\s+)?(?:tests?|checks?|ci)\s+(?:are\s+)?(?:now\s+)?passing\b/i,
-  /\ball\s+(?:tests?|checks?)\s+pass(?:ed)?\b/i,
-  /\bverified\b/i,
-  /\bconfirmed\b/i,
-  /\b(?:is|are|it'?s|now)\s+stable\b/i,
-  /\ball\s+clear\b/i,
-  /\bgood\s+to\s+go\b/i,
-  /\brace\s+(?:is\s+)?over\b/i,
-  /\bno\s+longer\s+racing\b/i,
-];
-
-// Proof-of-verification patterns. If the SAME turn included one of these
-// tool calls or shell command tokens, the claim is considered backed and
-// the hook stays silent.
-const PROOF_PATTERNS = [
-  /\bcurl\b/,
-  /\bgh\s+pr\s+(?:view|checks|status)\b/,
-  /\bgh\s+run\s+view\b/,
-  /\bgh\s+api\b/,
-  /\bnode\s+--test\b/,
-  /\bnpm\s+(?:run\s+)?test\b/,
-  /\bnpm\s+pack\b/,
-  /\bjest\b/,
-  /\bmocha\b/,
-  /\bpytest\b/,
-  /\bplaywright\b/,
-  /\bgrep\b/,
-  /\bstripe\b/,
-  /\bplaid\b/,
-  /\bshopify\b/,
-  /\bsquare\b/,
-  /\bquickbooks\b/,
-  /Read\s*\(/, // Claude Code Read tool call
-  /Bash\s*\(/, // Claude Code Bash tool call
-];
-
-const COMMERCIAL_CLAIM_SUBJECTS = [
-  'money',
-  'payment',
-  'charge',
-  'checkout',
-  'revenue',
-  'price',
-  'pricing',
-  'invoice',
-  'billing',
-  'tax',
-  'sales tax',
-  'inventory',
-  'stock',
-  'permission',
-  'access',
-  'customer facing',
-];
-
-const COMMERCIAL_CLAIM_STATES = [
-  'correct',
-  'accurate',
-  'verified',
-  'valid',
-  'matches',
-  'working',
-  'fixed',
-  'resolved',
-  'calculated',
-  'configured',
-];
-
-const GREEN_CLAIM_PHRASES = [
-  'all green',
-  'all tests green',
-  'all checks green',
-  'all the tests green',
-  'all the checks green',
-  'all tests are green',
-  'all checks are green',
-];
-
-function normalizeClaimText(text) {
-  return String(text || '')
-    .toLowerCase()
-    .replace(/[-_]+/g, ' ')
-    .replace(/[^a-z0-9]+/g, ' ')
-    .replace(/\s+/g, ' ')
-    .trim();
-}
-
-function containsPhrase(normalizedText, phrase) {
-  return ` ${normalizedText} `.includes(` ${phrase} `);
-}
-
-function findTokenListClaim(text, subjects, states, label) {
-  const normalized = normalizeClaimText(text);
-  if (!normalized) return null;
-  const subject = subjects.find((candidate) => containsPhrase(normalized, candidate));
-  const state = states.find((candidate) => containsPhrase(normalized, candidate));
-  return subject && state ? `${label}: ${subject} ${state}` : null;
-}
-
-function findGreenClaim(text) {
-  const normalized = normalizeClaimText(text);
-  return GREEN_CLAIM_PHRASES.find((phrase) => containsPhrase(normalized, phrase)) || null;
-}
-
-function readLastAssistantTurn(transcriptPath) {
-  if (!transcriptPath || !fs.existsSync(transcriptPath)) return null;
-  let content;
-  try {
-    content = fs.readFileSync(transcriptPath, 'utf8');
-  } catch {
-    return null;
-  }
-  const lines = content.trim().split('\n');
-  // Walk backwards to find the last assistant message
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const raw = lines[i].trim();
-    if (!raw) continue;
-    let entry;
-    try {
-      entry = JSON.parse(raw);
-    } catch {
-      continue;
-    }
-    if (entry.type === 'assistant' && entry.message) {
-      return entry.message;
-    }
-  }
-  return null;
-}
-
-function extractText(message) {
-  if (!message || !Array.isArray(message.content)) return '';
-  return message.content
-    .filter((b) => b && typeof b.text === 'string')
-    .map((b) => b.text)
-    .join('\n');
-}
-
-function extractToolUseSummary(message) {
-  if (!message || !Array.isArray(message.content)) return '';
-  return message.content
-    .filter((b) => b?.type === 'tool_use')
-    .map((b) => {
-      const name = b.name || 'tool';
-      let summary = '';
-      if (b.input && typeof b.input === 'object') {
-        if (typeof b.input.command === 'string') summary = b.input.command;
-        else if (typeof b.input.file_path === 'string') summary = b.input.file_path;
-        else if (typeof b.input.query === 'string') summary = b.input.query;
-        else summary = JSON.stringify(b.input).slice(0, 200);
-      }
-      return `${name}: ${summary}`;
-    })
-    .join('\n');
-}
-
-function findClaim(text) {
-  const commercialClaim = findTokenListClaim(
-    text,
-    COMMERCIAL_CLAIM_SUBJECTS,
-    COMMERCIAL_CLAIM_STATES,
-    'commercial truth',
-  );
-  if (commercialClaim) return commercialClaim;
-  const greenClaim = findGreenClaim(text);
-  if (greenClaim) return greenClaim;
-  for (const p of CLAIM_PATTERNS) {
-    const m = text.match(p);
-    if (m) return m[0];
-  }
-  return null;
-}
-
-function hasProof(combined) {
-  return PROOF_PATTERNS.some((p) => p.test(combined));
-}
-
-function readStdinSync() {
-  try {
-    return fs.readFileSync(0, 'utf8');
-  } catch {
-    return '';
-  }
-}
-
-function main() {
-  const raw = readStdinSync();
-  let payload = {};
-  try {
-    payload = raw ? JSON.parse(raw) : {};
-  } catch {
-    payload = {};
-  }
-
-  const transcriptPath = payload.transcript_path || process.env.CLAUDE_TRANSCRIPT_PATH;
-  const message = readLastAssistantTurn(transcriptPath);
-  if (!message) return; // no transcript visible; nothing to check
-
-  const text = extractText(message);
-  const toolUseSummary = extractToolUseSummary(message);
-  const claim = findClaim(text);
-  if (!claim) return; // no completion claim made; silent
-
-  const proofText = `${text}\n${toolUseSummary}`;
-  if (hasProof(proofText)) return; // claim backed by proof in same turn
-
-  // Strict mode (THUMBGATE_STRICT_ENFORCEMENT=1): hard-block the stop. Emit a
-  // Stop-hook block decision so Claude Code does NOT end the turn — the agent
-  // must run the verification (or retract) before it can stop. Default mode
-  // stays soft (a reminder for the next turn) so we don't break existing wiring.
-  if (process.env.THUMBGATE_STRICT_ENFORCEMENT === '1') {
-    const reason = `ThumbGate anti-claim gate (strict): you claimed completion ("${claim}") without a proof tool call in the same message. Run the verification (curl / grep / test / Read) and restate with the proof, or retract — do not end the turn on an unverified claim.`;
-    process.stdout.write(JSON.stringify({ decision: 'block', reason }) + '\n');
-    return;
-  }
-
-  // Default (soft): surface a system reminder for the NEXT turn. Do not hard-block.
-  const reminder = [
-    '⚠️ ThumbGate anti-claim gate: previous turn claimed completion',
-    `   ("${claim}") without a proof tool call in the same message.`,
-    '   Per CLAUDE.md anti-lying: never claim "done / live / deployed / fixed /',
-    '   verified / all green / stable" or commercial truth (money / tax / inventory /',
-    '   permissions / customer-facing state) without curl / grep / test / source-of-truth output in the SAME turn.',
-    '   If the work really is verified, re-state the claim with the proof.',
-    '   If not, retract and run the verification before re-asserting.',
-  ].join('\n');
-  process.stdout.write(reminder + '\n');
-}
-
-// Path-resolve check instead of `require.main === module`. SonarCloud's
-// strict type inference (rule S3403) flags the === form as always-false
-// in CommonJS, and CLAUDE.md "Hard-Won Lessons" pins the path-based form
-// as the portable fix (incident 2026-04-21 / PR #1115). Resolve BOTH sides
-// so the comparison is between two normalized absolute paths.
-const path = require('node:path');
-if (path.resolve(process.argv[1] || '') === path.resolve(__filename)) {
-  try {
-    main();
-  } catch {
-    // never crash the agent
-  }
-}
-
-module.exports = {
-  CLAIM_PATTERNS,
-  PROOF_PATTERNS,
-  findClaim,
-  hasProof,
-  extractText,
-  extractToolUseSummary,
-};

package/scripts/install-shim.js

@@ -1,87 +0,0 @@
-'use strict';
-
-/**
- * install-shim.js — Install a stable shim at ~/.thumbgate/bin/thumbgate-hook
- *
- * The shim is a tiny shell script that resolves the cached ThumbGate runtime
- * first, so hook commands in settings.local.json stay stable across projects
- * and agent restarts.
- *
- * The shim checks for a cached runtime binary first (fast path), and falls
- * back to `npx --yes thumbgate@latest` (slow path, first-time self-install).
- */
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
-const SHIM_DIR = path.join(os.homedir(), '.thumbgate', 'bin');
-const SHIM_PATH = path.join(SHIM_DIR, 'thumbgate-hook');
-const RUNTIME_BIN = path.join(os.homedir(), '.thumbgate', 'runtime', 'node_modules', '.bin', 'thumbgate');
-
-/**
- * The shim script. Key design choices:
- * - Uses `exec` to replace the shell process (no zombie processes)
- * - Fast path: if cached runtime binary exists, exec it directly
- * - Slow path: npx --yes thumbgate@latest (first-time auto-installs)
- * - No default self-mutation: background upgrades are opt-in via
- *   THUMBGATE_SHIM_AUTO_UPDATE=1 so source checkouts, enterprise pins, and
- *   dogfood runtimes cannot be overwritten by a hook side effect.
- */
-function shimContent() {
-  const escapedRuntimeBin = JSON.stringify(RUNTIME_BIN);
-  const escapedRuntimeDir = JSON.stringify(path.join(os.homedir(), '.thumbgate', 'runtime'));
-
-  return `#!/usr/bin/env bash
-# ThumbGate hook shim — DO NOT EDIT
-# Installed by: thumbgate init
-# Purpose: stable hook entry point that runs the cached ThumbGate runtime
-# Pattern: Volta-style stable shim (see https://volta.sh)
-
-set -euo pipefail
-
-RUNTIME_BIN=${escapedRuntimeBin}
-RUNTIME_DIR=${escapedRuntimeDir}
-
-# Fast path: cached runtime binary exists and is executable
-if [ -x "$RUNTIME_BIN" ]; then
-  # Optional background upgrade. Disabled by default so hooks never mutate a
-  # source checkout, enterprise pin, or dogfood runtime behind the operator's back.
-  if [ "\${THUMBGATE_SHIM_AUTO_UPDATE:-0}" = "1" ]; then
-    ( nohup npm install --prefix "$RUNTIME_DIR" --no-save --omit=dev thumbgate@latest >/dev/null 2>&1 & ) 2>/dev/null || true
-  fi
-  exec "$RUNTIME_BIN" "$@"
-fi
-
-# Slow path: no cached binary — install + exec via npx
-mkdir -p "$RUNTIME_DIR"
-exec npx --yes --package thumbgate@latest -- thumbgate "$@"
-`;
-}
-
-function installShim() {
-  fs.mkdirSync(SHIM_DIR, { recursive: true });
-  fs.writeFileSync(SHIM_PATH, shimContent(), { mode: 0o755 });
-  return SHIM_PATH;
-}
-
-function shimInstalled() {
-  try {
-    return fs.existsSync(SHIM_PATH) && (fs.statSync(SHIM_PATH).mode & 0o111) !== 0;
-  } catch {
-    return false;
-  }
-}
-
-function shimPath() {
-  return SHIM_PATH;
-}
-
-module.exports = {
-  installShim,
-  shimInstalled,
-  shimPath,
-  shimContent,
-  SHIM_DIR,
-  SHIM_PATH,
-};

package/scripts/mcp-oauth.js

@@ -1,293 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * mcp-oauth.js — OAuth 2.1 (PKCE) authorization-server machinery for the remote
- * ThumbGate MCP connector, required by the Claude Connectors Directory
- * ("Use OAuth 2.0 for authenticated services").
- *
- * Pure, dependency-free, IO-free functions + an injectable store, so the full
- * flow is unit-testable without a network. The HTTP wiring (in src/api/server.js)
- * is a thin shell over these.
- *
- * Implements:
- *   - RFC 9728 protected-resource metadata
- *   - RFC 8414 authorization-server metadata
- *   - RFC 7591 dynamic client registration (open registration)
- *   - Authorization-code grant with mandatory PKCE S256 (RFC 7636)
- *   - Bearer access tokens bound to a ThumbGate API key (so existing gating is unchanged)
- *
- * SECURITY NOTES:
- *   - PKCE S256 is mandatory; the plain method is rejected.
- *   - Auth codes are single-use and short-lived (60s); access tokens TTL-bound.
- *   - redirect_uri is matched exactly against the registered set.
- *   - The token never exposes the bound ThumbGate key; it maps server-side only.
- */
-
-const crypto = require('crypto');
-
-const AUTH_CODE_TTL_MS = 60 * 1000; // 1 minute
-const ACCESS_TOKEN_TTL_MS = 60 * 60 * 1000; // 1 hour
-const DEFAULT_SCOPE = 'mcp:read mcp:write';
-
-// Upper bounds on the in-memory store. The registration and authorization
-// endpoints are reachable pre-auth, so without a cap a malicious caller could
-// grow these Maps unboundedly and exhaust server memory. When a Map is full we
-// evict the oldest entry (FIFO) rather than deny service to legitimate clients.
-const MAX_CLIENTS = 10000;
-const MAX_CODES = 10000;
-const MAX_TOKENS = 50000;
-
-function now() {
-  return Date.now();
-}
-
-function randomToken(bytes = 32) {
-  return crypto.randomBytes(bytes).toString('base64url');
-}
-
-function base64UrlSha256(input) {
-  return crypto.createHash('sha256').update(String(input)).digest('base64url');
-}
-
-/**
- * Create a fresh in-memory store.
- *
- * DURABILITY (known limitation): this uses plain Maps, so a process restart or a
- * multi-instance / load-balanced deployment will drop issued tokens and
- * registered clients (clients see 401s, in-flight authorizations break). For
- * single-instance use this is fine; production multi-tenancy needs a durable,
- * shared backing (Redis/DB) — tracked as the per-user-data-scoping follow-up.
- * Entry counts are bounded (see MAX_* and capInsert) to prevent memory
- * exhaustion from anonymous calls to the registration/authorization endpoints.
- */
-function createStore() {
-  return {
-    clients: new Map(),
-    codes: new Map(),
-    tokens: new Map(),
-  };
-}
-
-/** Insert into a Map, evicting the oldest entry (FIFO) once `max` is reached. */
-function capInsert(map, key, value, max) {
-  if (map.size >= max && !map.has(key)) {
-    const oldest = map.keys().next().value;
-    if (oldest !== undefined) map.delete(oldest);
-  }
-  map.set(key, value);
-}
-
-// ---------------------------------------------------------------------------
-// Metadata (RFC 9728 / RFC 8414)
-// ---------------------------------------------------------------------------
-
-function trimSlash(u) {
-  // Non-regex trailing-slash strip (avoids a SonarCloud S5852 false-positive on a
-  // provably-linear pattern).
-  let s = String(u || '');
-  while (s.endsWith('/')) s = s.slice(0, -1);
-  return s;
-}
-
-function buildProtectedResourceMetadata(baseUrl) {
-  const base = trimSlash(baseUrl);
-  return {
-    resource: `${base}/mcp`,
-    authorization_servers: [base],
-    bearer_methods_supported: ['header'],
-    scopes_supported: ['mcp:read', 'mcp:write'],
-    resource_documentation: `${base}/docs/connectors`,
-  };
-}
-
-function buildAuthServerMetadata(baseUrl) {
-  const base = trimSlash(baseUrl);
-  return {
-    issuer: base,
-    authorization_endpoint: `${base}/oauth/authorize`,
-    token_endpoint: `${base}/oauth/token`,
-    registration_endpoint: `${base}/oauth/register`,
-    scopes_supported: ['mcp:read', 'mcp:write'],
-    response_types_supported: ['code'],
-    grant_types_supported: ['authorization_code'],
-    code_challenge_methods_supported: ['S256'],
-    token_endpoint_auth_methods_supported: ['none'],
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Dynamic client registration (RFC 7591)
-// ---------------------------------------------------------------------------
-
-// The MCP authorization spec is explicit: "All redirect URIs MUST be either
-// `localhost` or use HTTPS." We therefore accept only HTTPS and loopback
-// (http://localhost | http://127.0.0.1) and reject every other scheme —
-// including native-app custom schemes (myapp://, intent://, etc.), which the MCP
-// profile does not sanction and the real client (Claude) does not use.
-function isAllowedRedirectUri(uri) {
-  const u = String(uri || '');
-  if (/^https:\/\//i.test(u)) return true;
-  if (/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?(\/|$)/i.test(u)) return true;
-  return false;
-}
-
-function registerClient(store, body = {}) {
-  const redirectUris = Array.isArray(body.redirect_uris) ? body.redirect_uris.filter(Boolean) : [];
-  if (redirectUris.length === 0) {
-    return { error: 'invalid_redirect_uri', error_description: 'redirect_uris is required' };
-  }
-  for (const uri of redirectUris) {
-    if (!isAllowedRedirectUri(uri)) {
-      return { error: 'invalid_redirect_uri', error_description: `unsupported redirect_uri: ${uri}` };
-    }
-  }
-  const clientId = `tg_${randomToken(16)}`;
-  const record = {
-    client_id: clientId,
-    redirect_uris: redirectUris,
-    token_endpoint_auth_method: 'none',
-    grant_types: ['authorization_code'],
-    response_types: ['code'],
-    client_name: typeof body.client_name === 'string' ? body.client_name.slice(0, 200) : 'mcp-client',
-    created_at: now(),
-  };
-  capInsert(store.clients, clientId, record, MAX_CLIENTS);
-  return record;
-}
-
-function getClient(store, clientId) {
-  return store.clients.get(clientId) || null;
-}
-
-// ---------------------------------------------------------------------------
-// Authorization code (PKCE S256)
-// ---------------------------------------------------------------------------
-
-/**
- * Issue an auth code. `boundKey` is the ThumbGate API key the resulting access
- * token will act as (resolved by the authorize step once the user consents).
- */
-function createAuthorizationCode(store, {
-  clientId, redirectUri, codeChallenge, codeChallengeMethod, scope, boundKey, state, resource,
-} = {}) {
-  const client = getClient(store, clientId);
-  if (!client) return { error: 'invalid_client' };
-  if (!client.redirect_uris.includes(redirectUri)) return { error: 'invalid_request', error_description: 'redirect_uri mismatch' };
-  if (codeChallengeMethod !== 'S256') return { error: 'invalid_request', error_description: 'code_challenge_method must be S256' };
-  if (!codeChallenge || String(codeChallenge).length < 16) return { error: 'invalid_request', error_description: 'code_challenge required' };
-
-  const code = randomToken(24);
-  capInsert(store.codes, code, {
-    clientId,
-    redirectUri,
-    codeChallenge,
-    scope: scope || DEFAULT_SCOPE,
-    boundKey: boundKey || '',
-    resource: resource || '', // RFC 8707 resource indicator (the MCP server URL)
-    expiresAt: now() + AUTH_CODE_TTL_MS,
-    used: false,
-  }, MAX_CODES);
-  return { code, state };
-}
-
-function verifyPkce(codeChallenge, codeVerifier) {
-  if (!codeChallenge || !codeVerifier) return false;
-  // RFC 7636: verifier 43–128 chars.
-  if (String(codeVerifier).length < 43 || String(codeVerifier).length > 128) return false;
-  try {
-    return crypto.timingSafeEqual(
-      Buffer.from(base64UrlSha256(codeVerifier)),
-      Buffer.from(String(codeChallenge)),
-    );
-  } catch {
-    return false;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Token exchange + validation
-// ---------------------------------------------------------------------------
-
-function exchangeCode(store, { code, codeVerifier, clientId, redirectUri, resource } = {}) {
-  const entry = store.codes.get(code);
-  if (!entry) return { error: 'invalid_grant', error_description: 'unknown code' };
-  // Single-use + expiry: consume regardless of outcome.
-  store.codes.delete(code);
-  if (entry.used) return { error: 'invalid_grant', error_description: 'code already used' };
-  if (now() > entry.expiresAt) return { error: 'invalid_grant', error_description: 'code expired' };
-  if (entry.clientId !== clientId) return { error: 'invalid_grant', error_description: 'client mismatch' };
-  if (entry.redirectUri !== redirectUri) return { error: 'invalid_grant', error_description: 'redirect_uri mismatch' };
-  if (!verifyPkce(entry.codeChallenge, codeVerifier)) return { error: 'invalid_grant', error_description: 'PKCE verification failed' };
-  // RFC 8707: the resource at token time must match the one bound at authorize time.
-  if (entry.resource && resource && entry.resource !== resource) {
-    return { error: 'invalid_target', error_description: 'resource indicator mismatch' };
-  }
-
-  const accessToken = `tgat_${randomToken(32)}`;
-  capInsert(store.tokens, accessToken, {
-    boundKey: entry.boundKey,
-    scope: entry.scope,
-    clientId,
-    aud: entry.resource || resource || '',
-    expiresAt: now() + ACCESS_TOKEN_TTL_MS,
-  }, MAX_TOKENS);
-  return {
-    access_token: accessToken,
-    token_type: 'Bearer',
-    expires_in: Math.floor(ACCESS_TOKEN_TTL_MS / 1000),
-    scope: entry.scope,
-  };
-}
-
-/** Resolve an access token to its session, or null if invalid/expired. */
-function resolveAccessToken(store, token) {
-  if (!token) return null;
-  const entry = store.tokens.get(token);
-  if (!entry) return null;
-  if (now() > entry.expiresAt) {
-    store.tokens.delete(token);
-    return null;
-  }
-  return { boundKey: entry.boundKey, scope: entry.scope, clientId: entry.clientId, aud: entry.aud };
-}
-
-/**
- * RFC 8707 audience validation: a token is valid for `expectedResource` only if it
- * was issued for it (or carries no audience, for back-compat). MCP servers MUST
- * reject tokens minted for a different resource.
- */
-function tokenAudienceValid(session, expectedResource) {
-  if (!session) return false;
-  if (!session.aud) return true; // no audience recorded — accept (back-compat)
-  return session.aud === expectedResource;
-}
-
-/** Best-effort GC of expired codes/tokens (call opportunistically). */
-function pruneExpired(store) {
-  const t = now();
-  for (const [k, v] of store.codes) if (t > v.expiresAt) store.codes.delete(k);
-  for (const [k, v] of store.tokens) if (t > v.expiresAt) store.tokens.delete(k);
-}
-
-module.exports = {
-  createStore,
-  buildProtectedResourceMetadata,
-  buildAuthServerMetadata,
-  registerClient,
-  getClient,
-  createAuthorizationCode,
-  verifyPkce,
-  exchangeCode,
-  resolveAccessToken,
-  tokenAudienceValid,
-  pruneExpired,
-  isAllowedRedirectUri,
-  base64UrlSha256,
-  AUTH_CODE_TTL_MS,
-  ACCESS_TOKEN_TTL_MS,
-  DEFAULT_SCOPE,
-  MAX_CLIENTS,
-  MAX_CODES,
-  MAX_TOKENS,
-};