toolcraft 0.0.119 → 0.0.121

package/node_modules/tiny-http-mcp-server/dist/auth.d.ts

@@ -0,0 +1,69 @@
+import type { IncomingMessage } from "node:http";
+export declare const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export declare const PROTECTED_RESOURCE_METADATA_CACHE_CONTROL = "public, max-age=300";
+export interface VerifiedAccessToken {
+    token: string;
+    issuer: string;
+    audience: readonly string[];
+    scopes: readonly string[];
+    expiresAt: number;
+    claims: Record<string, unknown>;
+    subject?: string;
+    clientId?: string;
+}
+export interface TokenVerifier {
+    verify(input: {
+        token: string;
+        resource: string;
+        authorizationServers: readonly string[];
+        requiredScopes: readonly string[];
+    }): Promise<VerifiedAccessToken>;
+}
+export type BearerChallengeErrorCode = "invalid_token" | "insufficient_scope";
+export interface BearerChallengeOptions {
+    error?: BearerChallengeErrorCode;
+    errorDescription?: string;
+    scope?: readonly string[];
+}
+export declare class TokenVerificationError extends Error {
+    readonly error: BearerChallengeErrorCode;
+    readonly errorDescription?: string;
+    readonly scope?: readonly string[];
+    constructor(input: {
+        error: BearerChallengeErrorCode;
+        errorDescription?: string;
+        scope?: readonly string[];
+    });
+}
+export interface RequestAuthInfo extends VerifiedAccessToken {
+    audience: string[];
+    clientId: string;
+    scopes: string[];
+    resource: URL;
+    extra: Record<string, unknown>;
+}
+export type AuthenticatedIncomingMessage = IncomingMessage & {
+    auth?: RequestAuthInfo;
+};
+export interface BearerAuthOptions {
+    resource: string | URL;
+    authorizationServers: readonly (string | URL)[];
+    protectedResourcePath?: string;
+    requiredScopes?: readonly string[];
+    trustedProxy?: boolean;
+    verifier: TokenVerifier;
+}
+export type BearerAuthResult = {
+    ok: true;
+    auth: RequestAuthInfo;
+} | {
+    ok: false;
+    statusCode: 401 | 403;
+    challenge: string;
+} | {
+    ok: false;
+    statusCode: 503;
+};
+export declare function getProtectedResourceMetadataUrl(req: Pick<IncomingMessage, "headers" | "socket">, protectedResourcePath?: string, trustedProxy?: boolean): string;
+export declare function createBearerChallenge(req: Pick<IncomingMessage, "headers" | "socket">, options?: BearerChallengeOptions, protectedResourcePath?: string, trustedProxy?: boolean): string;
+export declare function authorizeBearerRequest(req: AuthenticatedIncomingMessage, options: BearerAuthOptions): Promise<BearerAuthResult>;

package/node_modules/tiny-http-mcp-server/dist/auth.js

@@ -0,0 +1,261 @@
+export const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export const PROTECTED_RESOURCE_METADATA_CACHE_CONTROL = "public, max-age=300";
+function isBearerChallengeErrorCode(value) {
+    return value === "invalid_token" || value === "insufficient_scope";
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+export class TokenVerificationError extends Error {
+    error;
+    errorDescription;
+    scope;
+    constructor(input) {
+        super(input.errorDescription ?? input.error);
+        this.name = "TokenVerificationError";
+        this.error = input.error;
+        this.errorDescription = input.errorDescription;
+        this.scope = input.scope;
+    }
+}
+function toUrlString(value) {
+    return value instanceof URL ? value.toString() : value;
+}
+function readSingleHeaderValue(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function getRequestProtocol(req, trustedProxy = false) {
+    if (trustedProxy) {
+        const forwardedProto = readSingleHeaderValue(req.headers["x-forwarded-proto"])
+            ?.split(",")[0]
+            ?.trim()
+            .toLowerCase();
+        if (forwardedProto === "https" || forwardedProto === "http") {
+            return forwardedProto;
+        }
+    }
+    return "encrypted" in req.socket && req.socket.encrypted ? "https" : "http";
+}
+function getRequestHost(req, trustedProxy = false) {
+    if (trustedProxy) {
+        const forwardedHost = readSingleHeaderValue(req.headers["x-forwarded-host"])
+            ?.split(",")[0]
+            ?.trim();
+        if (forwardedHost !== undefined && forwardedHost.length > 0) {
+            return forwardedHost;
+        }
+    }
+    return readSingleHeaderValue(req.headers.host) ?? "127.0.0.1";
+}
+function escapeChallengeValue(value) {
+    return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+}
+function normalizeProtectedResourcePath(path) {
+    if (path === undefined || path.length === 0 || path === "/") {
+        return "";
+    }
+    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+    if (normalizedPath.length > 1 && normalizedPath.endsWith("/")) {
+        return normalizedPath.slice(0, -1);
+    }
+    return normalizedPath;
+}
+function formatScope(scope) {
+    if (scope.length === 0) {
+        return undefined;
+    }
+    return scope.join(" ");
+}
+function hasBearerTokenWhitespace(value) {
+    for (const character of value) {
+        if (character === " " ||
+            character === "\t" ||
+            character === "\n" ||
+            character === "\r" ||
+            character === "\f" ||
+            character === "\v") {
+            return true;
+        }
+    }
+    return false;
+}
+function readBearerToken(req) {
+    const authorization = readSingleHeaderValue(req.headers.authorization);
+    if (authorization === undefined || authorization.length === 0) {
+        return { kind: "missing" };
+    }
+    const separatorIndex = authorization.indexOf(" ");
+    if (separatorIndex <= 0) {
+        return {
+            kind: "malformed",
+            errorDescription: "malformed bearer token"
+        };
+    }
+    const scheme = authorization.slice(0, separatorIndex);
+    const token = authorization.slice(separatorIndex + 1).trim();
+    if (scheme.toLowerCase() !== "bearer" || token.length === 0 || hasBearerTokenWhitespace(token)) {
+        return {
+            kind: "malformed",
+            errorDescription: "malformed bearer token"
+        };
+    }
+    return { kind: "token", token };
+}
+function normalizeTokenVerificationError(error, requiredScopes) {
+    if (typeof error === "object" && error !== null) {
+        const challengeError = error;
+        if (isBearerChallengeErrorCode(challengeError.error) &&
+            (challengeError.errorDescription === undefined ||
+                typeof challengeError.errorDescription === "string") &&
+            (challengeError.scope === undefined || isStringArray(challengeError.scope))) {
+            const scope = challengeError.scope ?? [];
+            return {
+                error: challengeError.error,
+                ...(challengeError.errorDescription === undefined
+                    ? {}
+                    : {
+                        errorDescription: challengeError.errorDescription
+                    }),
+                scope: scope.length > 0
+                    ? [...scope]
+                    : challengeError.error === "insufficient_scope"
+                        ? requiredScopes
+                        : undefined
+            };
+        }
+    }
+    if (error instanceof TokenVerificationError) {
+        return {
+            error: error.error,
+            errorDescription: error.errorDescription,
+            scope: error.scope ?? (error.error === "insufficient_scope" ? requiredScopes : undefined)
+        };
+    }
+    if (error instanceof Error) {
+        return {
+            error: "invalid_token",
+            errorDescription: "token verification failed"
+        };
+    }
+    return {
+        error: "invalid_token",
+        errorDescription: "token verification failed"
+    };
+}
+function isTemporarilyUnavailableError(error) {
+    if (typeof error !== "object" || error === null) {
+        return false;
+    }
+    return error.error === "temporarily_unavailable";
+}
+function toRequestAuthInfo(verifiedToken, resource) {
+    const audience = [...verifiedToken.audience];
+    const scopes = [...verifiedToken.scopes];
+    const claims = { ...verifiedToken.claims };
+    return {
+        ...verifiedToken,
+        audience,
+        clientId: verifiedToken.clientId ?? "",
+        scopes,
+        claims,
+        resource: new URL(resource),
+        extra: {
+            issuer: verifiedToken.issuer,
+            audience,
+            claims,
+            ...(verifiedToken.subject === undefined
+                ? {}
+                : {
+                    subject: verifiedToken.subject
+                })
+        }
+    };
+}
+export function getProtectedResourceMetadataUrl(req, protectedResourcePath, trustedProxy = false) {
+    const path = `${PROTECTED_RESOURCE_METADATA_PATH}${normalizeProtectedResourcePath(protectedResourcePath)}`;
+    const protocol = getRequestProtocol(req, trustedProxy);
+    try {
+        return new URL(path, `${protocol}://${getRequestHost(req, trustedProxy)}`).toString();
+    }
+    catch {
+        return new URL(path, `${protocol}://127.0.0.1`).toString();
+    }
+}
+export function createBearerChallenge(req, options = {}, protectedResourcePath, trustedProxy = false) {
+    const parts = [
+        'Bearer realm="mcp"',
+        `resource_metadata="${escapeChallengeValue(getProtectedResourceMetadataUrl(req, protectedResourcePath, trustedProxy))}"`
+    ];
+    if (options.error !== undefined) {
+        parts.push(`error="${escapeChallengeValue(options.error)}"`);
+    }
+    if (options.errorDescription !== undefined) {
+        parts.push(`error_description="${escapeChallengeValue(options.errorDescription)}"`);
+    }
+    const scope = options.scope === undefined ? undefined : formatScope(options.scope);
+    if (scope !== undefined) {
+        parts.push(`scope="${escapeChallengeValue(scope)}"`);
+    }
+    return parts.join(", ");
+}
+export async function authorizeBearerRequest(req, options) {
+    const authorization = readBearerToken(req);
+    if (authorization.kind === "missing") {
+        return {
+            ok: false,
+            statusCode: 401,
+            challenge: createBearerChallenge(req, {}, options.protectedResourcePath, options.trustedProxy)
+        };
+    }
+    if (authorization.kind === "malformed") {
+        return {
+            ok: false,
+            statusCode: 401,
+            challenge: createBearerChallenge(req, {
+                error: "invalid_token",
+                errorDescription: authorization.errorDescription
+            }, options.protectedResourcePath, options.trustedProxy)
+        };
+    }
+    const requiredScopes = options.requiredScopes ?? [];
+    try {
+        const verifiedToken = await options.verifier.verify({
+            token: authorization.token,
+            resource: toUrlString(options.resource),
+            authorizationServers: options.authorizationServers.map(toUrlString),
+            requiredScopes
+        });
+        const verifiedScopes = new Set(verifiedToken.scopes);
+        if (requiredScopes.some((scope) => !verifiedScopes.has(scope))) {
+            return {
+                ok: false,
+                statusCode: 403,
+                challenge: createBearerChallenge(req, {
+                    error: "insufficient_scope",
+                    errorDescription: "insufficient scope",
+                    scope: requiredScopes
+                }, options.protectedResourcePath, options.trustedProxy)
+            };
+        }
+        const auth = toRequestAuthInfo(verifiedToken, toUrlString(options.resource));
+        req.auth = auth;
+        return {
+            ok: true,
+            auth
+        };
+    }
+    catch (error) {
+        if (isTemporarilyUnavailableError(error)) {
+            return {
+                ok: false,
+                statusCode: 503
+            };
+        }
+        const challengeOptions = normalizeTokenVerificationError(error, requiredScopes);
+        return {
+            ok: false,
+            statusCode: challengeOptions.error === "insufficient_scope" ? 403 : 401,
+            challenge: createBearerChallenge(req, challengeOptions, options.protectedResourcePath, options.trustedProxy)
+        };
+    }
+}

package/node_modules/tiny-http-mcp-server/dist/cli.d.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { createHttpServer } from "./http-server.js";
+import type { HttpServer } from "./http-server.js";
+import type { TokenVerifier } from "./auth.js";
+type CliServerFactory = (options: Parameters<typeof createHttpServer>[0]) => Pick<HttpServer, "listenHttp">;
+interface RunCliDependencies {
+    createServer?: CliServerFactory;
+    loadOAuthVerifier?: (input: {
+        modulePath: string;
+        exportName: string;
+    }) => Promise<TokenVerifier>;
+    stdout?: Pick<NodeJS.WriteStream, "write">;
+    stderr?: Pick<NodeJS.WriteStream, "write">;
+    waitForShutdown?: (shutdown: () => Promise<void>) => Promise<void>;
+    listenForShutdownSignals?: (listener: () => void) => () => void;
+    scheduleShutdownGrace?: (listener: () => void, graceMs: number) => () => void;
+}
+export declare function isCliInvocation(argv: string[], moduleUrl: string, realpath?: (path: string) => string): boolean;
+export declare function runCli(args?: string[], dependencies?: RunCliDependencies): Promise<number>;
+export {};