tiny-http-mcp-server 0.1.0

package/node_modules/auth-store/dist/provider-store.js

@@ -0,0 +1,78 @@
+export function key(providerId) {
+    return `provider:${providerId}`;
+}
+export class MigratingSecretStore {
+    store;
+    legacyStore;
+    pendingMutation = Promise.resolve();
+    constructor(store, legacyStore = null) {
+        this.store = store;
+        this.legacyStore = legacyStore;
+    }
+    async get(options = {}) {
+        const value = await this.store.get();
+        if (value !== null || !this.legacyStore) {
+            return value;
+        }
+        const legacyValue = await this.legacyStore.get();
+        if (legacyValue !== null && !options.readOnly) {
+            await this.mutate(async () => {
+                if (await this.store.get() === null) {
+                    try {
+                        await this.store.set(legacyValue);
+                    }
+                    catch {
+                        return;
+                    }
+                }
+            });
+        }
+        return legacyValue;
+    }
+    async set(value) {
+        await this.mutate(async () => {
+            const previousValue = await this.store.get();
+            const previousLegacyValue = await this.legacyStore?.get() ?? null;
+            await this.store.set(value);
+            try {
+                await this.legacyStore?.set(value);
+            }
+            catch (error) {
+                await restore(this.store, previousValue);
+                if (this.legacyStore) {
+                    await restore(this.legacyStore, previousLegacyValue);
+                }
+                throw error;
+            }
+        });
+    }
+    async delete() {
+        await this.mutate(async () => {
+            const previousValue = await this.store.get();
+            const previousLegacyValue = await this.legacyStore?.get() ?? null;
+            await this.store.delete();
+            try {
+                await this.legacyStore?.delete();
+            }
+            catch (error) {
+                await restore(this.store, previousValue);
+                if (this.legacyStore) {
+                    await restore(this.legacyStore, previousLegacyValue);
+                }
+                throw error;
+            }
+        });
+    }
+    async mutate(action) {
+        const operation = this.pendingMutation.then(action, action);
+        this.pendingMutation = operation.catch(() => undefined);
+        await operation;
+    }
+}
+async function restore(store, value) {
+    if (value === null) {
+        await store.delete();
+        return;
+    }
+    await store.set(value);
+}

package/node_modules/auth-store/dist/types.d.ts

@@ -0,0 +1,22 @@
+import type { EncryptedFileStoreInput } from "./encrypted-file-store.js";
+import type { KeychainStoreInput } from "./keychain-store.js";
+export interface SecretStore {
+    get(options?: {
+        readOnly?: boolean;
+    }): Promise<string | null>;
+    set(value: string): Promise<void>;
+    delete(): Promise<void>;
+}
+export type StoreBackend = "file" | "keychain";
+export interface CreateSecretStoreInput {
+    backend?: StoreBackend;
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    backendEnvVar?: string;
+    fileStore?: EncryptedFileStoreInput;
+    keychainStore?: KeychainStoreInput;
+}
+export interface CreateSecretStoreResult {
+    store: SecretStore;
+    backend: StoreBackend;
+}

package/node_modules/auth-store/dist/types.js

@@ -0,0 +1 @@
+export {};

package/node_modules/auth-store/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "auth-store",
+  "version": "0.0.1",
+  "private": true,
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "node ../../scripts/guard-package-dist.mjs && tsc"
+  },
+  "files": [
+    "dist",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/poe-platform/poe-code.git",
+    "directory": "packages/auth-store"
+  }
+}

package/node_modules/mcp-oauth/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Poe Platform
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/mcp-oauth/README.md

@@ -0,0 +1,70 @@
+# mcp-oauth
+
+OAuth client primitives for MCP HTTP transports.
+
+## Usage
+
+```ts
+import {
+  createAuthStoreSessionStore,
+  createDefaultOAuthClientProvider,
+  createJwksTokenVerifier
+} from "mcp-oauth";
+
+const provider = createDefaultOAuthClientProvider({
+  client: { mode: "dynamic" },
+  browser: { openBrowser: async (url) => console.log(url) },
+  sessionStore: createAuthStoreSessionStore({ serviceName: "mcp-client" })
+});
+
+const verifier = createJwksTokenVerifier({
+  jwksUrl: "https://example.com/.well-known/jwks.json"
+});
+```
+
+## Public API
+
+- `createDefaultOAuthClientProvider(options)`: default MCP OAuth client provider with dynamic or static client registration.
+- `createOAuthClientProvider(options)`: lower-level provider constructor.
+- `createAuthStoreSessionStore(options)`: persisted OAuth session store backed by `auth-store`.
+- `createLoopbackAuthorizationSession(options)`: local callback server for browser authorization.
+- `generateCodeVerifier()` and `generateCodeChallenge(...)`: PKCE helpers.
+- `canonicalizeResourceIndicator(value)`: resource indicator canonicalization.
+- `createJwksTokenVerifier(options)`: JWKS-backed access-token verifier for MCP servers.
+- `OAuthError`: token endpoint error type.
+
+## Configuration
+
+`createDefaultOAuthClientProvider(options)` accepts:
+
+- `client`
+  - `mode: "dynamic"` with optional `metadata`
+  - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
+- `browser.openBrowser(url)`
+- `browser.readLine()` optional
+- `browser.createServer()` optional
+- `browser.landingPage` optional
+- `sessionStore` optional
+- `authStore` optional `auth-store` backend config for the default session store
+- `now()` optional clock override
+
+`createJwksTokenVerifier(options)` accepts:
+
+| Option                   | Type                | Default        | Description                                                                              |
+| ------------------------ | ------------------- | -------------- | ---------------------------------------------------------------------------------------- |
+| `jwksUrl`                | `string \| URL`     | none           | Authorization server JWKS endpoint.                                                      |
+| `clockSkewSeconds`       | `number`            | `30`           | Allowed JWT time-claim clock skew.                                                       |
+| `allowedAlgorithms`      | `readonly string[]` | asymmetric set | Allowed JWT signature algorithms.                                                        |
+| `jwksCacheTtlMs`         | `number`            | `300000`       | Successful JWKS cache lifetime.                                                          |
+| `jwksFetchTimeoutMs`     | `number`            | `5000`         | Timeout for each JWKS HTTP fetch.                                                        |
+| `jwksRefreshCooldownMs`  | `number`            | `30000`        | Minimum interval between forced refreshes after an unknown key id.                       |
+| `allowInsecureJwks`      | `boolean`           | `false`        | Permit non-HTTPS JWKS URLs. Loopback HTTP URLs are allowed without enabling this option. |
+| `requireAccessTokenType` | `boolean`           | `false`        | Require the JWT `typ` protected header to be `at+jwt`.                                   |
+| `fetch`                  | `typeof fetch`      | global `fetch` | Custom fetch implementation.                                                             |
+
+`createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
+
+## Environment Variables
+
+This package exposes no direct environment variables. When `authStore` is used,
+`auth-store` honors its own backend environment variables.

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -0,0 +1,14 @@
+import { type CreateSecretStoreInput } from "auth-store";
+import type { OAuthSessionStore } from "./types.js";
+interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+}
+export interface OAuthClientStore {
+    load(issuer: string): Promise<StoredOAuthClient | null>;
+    save(issuer: string, client: StoredOAuthClient): Promise<void>;
+    clear(issuer: string): Promise<void>;
+}
+export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput): OAuthSessionStore;
+export declare function createAuthStoreClientStore(options: CreateSecretStoreInput): OAuthClientStore;
+export {};

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -0,0 +1,169 @@
+import crypto from "node:crypto";
+import path from "node:path";
+import { createSecretStore } from "auth-store";
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+const DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
+const DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
+const DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
+const DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
+const DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
+const DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
+const MAX_JS_DATE_MS = 8_640_000_000_000_000;
+export function createAuthStoreSessionStore(options = {}) {
+    return {
+        async load(resource) {
+            const store = createResourceSecretStore(resource, options);
+            const value = await store.get();
+            if (value === null) {
+                return null;
+            }
+            const parsed = JSON.parse(value);
+            if (isStoredOAuthSession(parsed)) {
+                return parsed;
+            }
+            throw new Error("Stored OAuth session must match the expected shape");
+        },
+        async save(resource, session) {
+            const store = createResourceSecretStore(resource, options);
+            await store.set(JSON.stringify(session));
+        },
+        async clear(resource) {
+            const store = createResourceSecretStore(resource, options);
+            await store.delete();
+        }
+    };
+}
+export function createAuthStoreClientStore(options) {
+    return {
+        async load(issuer) {
+            const store = createIssuerSecretStore(issuer, options);
+            const value = await store.get();
+            if (value === null) {
+                return null;
+            }
+            const parsed = JSON.parse(value);
+            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
+            if (clientId !== undefined) {
+                const client = { clientId };
+                if (isObjectRecord(parsed) &&
+                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
+                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
+                }
+                return client;
+            }
+            throw new Error("Stored OAuth client must be a JSON object with clientId");
+        },
+        async save(issuer, client) {
+            const store = createIssuerSecretStore(issuer, options);
+            await store.set(JSON.stringify(client));
+        },
+        async clear(issuer) {
+            const store = createIssuerSecretStore(issuer, options);
+            await store.delete();
+        }
+    };
+}
+function createNamedSecretStore(key, options, defaults) {
+    const hash = crypto.createHash("sha256").update(key).digest("hex");
+    const configuredFilePath = options.fileStore?.filePath;
+    const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
+    const fileStore = {
+        ...options.fileStore,
+        filePath: parsedFilePath === null
+            ? undefined
+            : path.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
+        salt: options.fileStore?.salt ?? defaults.salt,
+        defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
+        defaultFileName: parsedFilePath === null
+            ? `${hash}.enc`
+            : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
+    };
+    const keychainStore = {
+        ...options.keychainStore,
+        service: options.keychainStore?.service ?? defaults.service,
+        account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
+    };
+    return createSecretStore({ ...options, fileStore, keychainStore }).store;
+}
+function createResourceSecretStore(resource, options) {
+    return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
+        salt: DEFAULT_FILE_SALT,
+        directory: DEFAULT_FILE_DIRECTORY,
+        service: DEFAULT_KEYCHAIN_SERVICE,
+        accountPrefix: "provider"
+    });
+}
+function createIssuerSecretStore(issuer, options) {
+    return createNamedSecretStore(issuer, options, {
+        salt: DEFAULT_CLIENT_FILE_SALT,
+        directory: DEFAULT_CLIENT_FILE_DIRECTORY,
+        service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
+        accountPrefix: "issuer"
+    });
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
+function getOwnString(record, key) {
+    const value = getOwnEntry(record, key);
+    return typeof value === "string" ? value : undefined;
+}
+function isStoredOAuthSession(value) {
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    return (isNonBlankOwnString(value, "resource") &&
+        isNonBlankOwnString(value, "authorizationServer") &&
+        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
+        isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
+}
+function isStoredOAuthClient(value) {
+    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
+        return false;
+    }
+    const clientSecret = getOwnEntry(value, "clientSecret");
+    return (clientSecret === undefined ||
+        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
+}
+function isStoredOAuthDiscovery(value) {
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    return (isNonBlankOwnString(value, "resourceMetadataUrl") &&
+        isObjectRecord(getOwnEntry(value, "resourceMetadata")) &&
+        isObjectRecord(getOwnEntry(value, "authorizationServerMetadata")));
+}
+function isStoredOAuthTokensOrMissing(value) {
+    if (value === undefined) {
+        return true;
+    }
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
+        return false;
+    }
+    const expiresAt = getOwnEntry(value, "expiresAt");
+    if (expiresAt !== null &&
+        (typeof expiresAt !== "number" ||
+            !Number.isSafeInteger(expiresAt) ||
+            expiresAt > MAX_JS_DATE_MS ||
+            !Number.isFinite(new Date(expiresAt).getTime()))) {
+        return false;
+    }
+    const refreshToken = getOwnEntry(value, "refreshToken");
+    if (refreshToken !== undefined &&
+        (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+        return false;
+    }
+    const scope = getOwnEntry(value, "scope");
+    return scope === undefined || (typeof scope === "string" && scope.trim().length > 0);
+}
+function isNonBlankOwnString(record, key) {
+    const value = getOwnString(record, key);
+    return value !== undefined && value.trim().length > 0;
+}

package/node_modules/mcp-oauth/dist/client/authorization-state.d.ts

@@ -0,0 +1,8 @@
+export declare function createAuthorizationState(input: {
+    issuer: string;
+    requireIssuer: boolean;
+}): string;
+export declare function parseAuthorizationState(value: string | null): {
+    issuer: string;
+    requireIssuer: boolean;
+} | null;

package/node_modules/mcp-oauth/dist/client/authorization-state.js

@@ -0,0 +1,47 @@
+import crypto from "node:crypto";
+export function createAuthorizationState(input) {
+    const payload = {
+        v: 1,
+        n: crypto.randomBytes(16).toString("base64url"),
+        i: input.issuer,
+        r: input.requireIssuer,
+    };
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+export function parseAuthorizationState(value) {
+    if (value === null || value.length === 0) {
+        return null;
+    }
+    try {
+        const decoded = Buffer.from(value, "base64url").toString("utf8");
+        const parsed = JSON.parse(decoded);
+        if (!isObjectRecord(parsed)) {
+            return null;
+        }
+        const version = getOwnEntry(parsed, "v");
+        const nonce = getOwnEntry(parsed, "n");
+        const issuer = getOwnEntry(parsed, "i");
+        const requireIssuer = getOwnEntry(parsed, "r");
+        if (version !== 1
+            || typeof nonce !== "string"
+            || nonce.length === 0
+            || typeof issuer !== "string"
+            || issuer.length === 0
+            || typeof requireIssuer !== "boolean") {
+            return null;
+        }
+        return {
+            issuer,
+            requireIssuer,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.d.ts

@@ -0,0 +1,3 @@
+import type { DefaultOAuthClientProviderOptions, OAuthClientProvider, OAuthClientProviderOptions } from "./types.js";
+export declare function createOAuthClientProvider(options: OAuthClientProviderOptions): OAuthClientProvider;
+export declare function createDefaultOAuthClientProvider(options: DefaultOAuthClientProviderOptions): OAuthClientProvider;