toolcraft 0.0.119 → 0.0.121

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/README.md

@@ -0,0 +1,70 @@
+# mcp-oauth
+
+OAuth client primitives for MCP HTTP transports.
+
+## Usage
+
+```ts
+import {
+  createAuthStoreSessionStore,
+  createDefaultOAuthClientProvider,
+  createJwksTokenVerifier
+} from "mcp-oauth";
+
+const provider = createDefaultOAuthClientProvider({
+  client: { mode: "dynamic" },
+  browser: { openBrowser: async (url) => console.log(url) },
+  sessionStore: createAuthStoreSessionStore({ serviceName: "mcp-client" })
+});
+
+const verifier = createJwksTokenVerifier({
+  jwksUrl: "https://example.com/.well-known/jwks.json"
+});
+```
+
+## Public API
+
+- `createDefaultOAuthClientProvider(options)`: default MCP OAuth client provider with dynamic or static client registration.
+- `createOAuthClientProvider(options)`: lower-level provider constructor.
+- `createAuthStoreSessionStore(options)`: persisted OAuth session store backed by `auth-store`.
+- `createLoopbackAuthorizationSession(options)`: local callback server for browser authorization.
+- `generateCodeVerifier()` and `generateCodeChallenge(...)`: PKCE helpers.
+- `canonicalizeResourceIndicator(value)`: resource indicator canonicalization.
+- `createJwksTokenVerifier(options)`: JWKS-backed access-token verifier for MCP servers.
+- `OAuthError`: token endpoint error type.
+
+## Configuration
+
+`createDefaultOAuthClientProvider(options)` accepts:
+
+- `client`
+  - `mode: "dynamic"` with optional `metadata`
+  - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
+- `browser.openBrowser(url)`
+- `browser.readLine()` optional
+- `browser.createServer()` optional
+- `browser.landingPage` optional
+- `sessionStore` optional
+- `authStore` optional `auth-store` backend config for the default session store
+- `now()` optional clock override
+
+`createJwksTokenVerifier(options)` accepts:
+
+| Option                   | Type                | Default        | Description                                                                              |
+| ------------------------ | ------------------- | -------------- | ---------------------------------------------------------------------------------------- |
+| `jwksUrl`                | `string \| URL`     | none           | Authorization server JWKS endpoint.                                                      |
+| `clockSkewSeconds`       | `number`            | `30`           | Allowed JWT time-claim clock skew.                                                       |
+| `allowedAlgorithms`      | `readonly string[]` | asymmetric set | Allowed JWT signature algorithms.                                                        |
+| `jwksCacheTtlMs`         | `number`            | `300000`       | Successful JWKS cache lifetime.                                                          |
+| `jwksFetchTimeoutMs`     | `number`            | `5000`         | Timeout for each JWKS HTTP fetch.                                                        |
+| `jwksRefreshCooldownMs`  | `number`            | `30000`        | Minimum interval between forced refreshes after an unknown key id.                       |
+| `allowInsecureJwks`      | `boolean`           | `false`        | Permit non-HTTPS JWKS URLs. Loopback HTTP URLs are allowed without enabling this option. |
+| `requireAccessTokenType` | `boolean`           | `false`        | Require the JWT `typ` protected header to be `at+jwt`.                                   |
+| `fetch`                  | `typeof fetch`      | global `fetch` | Custom fetch implementation.                                                             |
+
+`createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
+
+## Environment Variables
+
+This package exposes no direct environment variables. When `authStore` is used,
+`auth-store` honors its own backend environment variables.

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -0,0 +1,14 @@
+import { type CreateSecretStoreInput } from "auth-store";
+import type { OAuthSessionStore } from "./types.js";
+interface StoredOAuthClient {
+    clientId: string;
+    clientSecret?: string;
+}
+export interface OAuthClientStore {
+    load(issuer: string): Promise<StoredOAuthClient | null>;
+    save(issuer: string, client: StoredOAuthClient): Promise<void>;
+    clear(issuer: string): Promise<void>;
+}
+export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput): OAuthSessionStore;
+export declare function createAuthStoreClientStore(options: CreateSecretStoreInput): OAuthClientStore;
+export {};

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -0,0 +1,169 @@
+import crypto from "node:crypto";
+import path from "node:path";
+import { createSecretStore } from "auth-store";
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+const DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
+const DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
+const DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
+const DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
+const DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
+const DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
+const MAX_JS_DATE_MS = 8_640_000_000_000_000;
+export function createAuthStoreSessionStore(options = {}) {
+    return {
+        async load(resource) {
+            const store = createResourceSecretStore(resource, options);
+            const value = await store.get();
+            if (value === null) {
+                return null;
+            }
+            const parsed = JSON.parse(value);
+            if (isStoredOAuthSession(parsed)) {
+                return parsed;
+            }
+            throw new Error("Stored OAuth session must match the expected shape");
+        },
+        async save(resource, session) {
+            const store = createResourceSecretStore(resource, options);
+            await store.set(JSON.stringify(session));
+        },
+        async clear(resource) {
+            const store = createResourceSecretStore(resource, options);
+            await store.delete();
+        }
+    };
+}
+export function createAuthStoreClientStore(options) {
+    return {
+        async load(issuer) {
+            const store = createIssuerSecretStore(issuer, options);
+            const value = await store.get();
+            if (value === null) {
+                return null;
+            }
+            const parsed = JSON.parse(value);
+            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
+            if (clientId !== undefined) {
+                const client = { clientId };
+                if (isObjectRecord(parsed) &&
+                    Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
+                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
+                }
+                return client;
+            }
+            throw new Error("Stored OAuth client must be a JSON object with clientId");
+        },
+        async save(issuer, client) {
+            const store = createIssuerSecretStore(issuer, options);
+            await store.set(JSON.stringify(client));
+        },
+        async clear(issuer) {
+            const store = createIssuerSecretStore(issuer, options);
+            await store.delete();
+        }
+    };
+}
+function createNamedSecretStore(key, options, defaults) {
+    const hash = crypto.createHash("sha256").update(key).digest("hex");
+    const configuredFilePath = options.fileStore?.filePath;
+    const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
+    const fileStore = {
+        ...options.fileStore,
+        filePath: parsedFilePath === null
+            ? undefined
+            : path.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
+        salt: options.fileStore?.salt ?? defaults.salt,
+        defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
+        defaultFileName: parsedFilePath === null
+            ? `${hash}.enc`
+            : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
+    };
+    const keychainStore = {
+        ...options.keychainStore,
+        service: options.keychainStore?.service ?? defaults.service,
+        account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
+    };
+    return createSecretStore({ ...options, fileStore, keychainStore }).store;
+}
+function createResourceSecretStore(resource, options) {
+    return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
+        salt: DEFAULT_FILE_SALT,
+        directory: DEFAULT_FILE_DIRECTORY,
+        service: DEFAULT_KEYCHAIN_SERVICE,
+        accountPrefix: "provider"
+    });
+}
+function createIssuerSecretStore(issuer, options) {
+    return createNamedSecretStore(issuer, options, {
+        salt: DEFAULT_CLIENT_FILE_SALT,
+        directory: DEFAULT_CLIENT_FILE_DIRECTORY,
+        service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
+        accountPrefix: "issuer"
+    });
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
+function getOwnString(record, key) {
+    const value = getOwnEntry(record, key);
+    return typeof value === "string" ? value : undefined;
+}
+function isStoredOAuthSession(value) {
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    return (isNonBlankOwnString(value, "resource") &&
+        isNonBlankOwnString(value, "authorizationServer") &&
+        isStoredOAuthClient(getOwnEntry(value, "client")) &&
+        isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
+        isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));
+}
+function isStoredOAuthClient(value) {
+    if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
+        return false;
+    }
+    const clientSecret = getOwnEntry(value, "clientSecret");
+    return (clientSecret === undefined ||
+        (typeof clientSecret === "string" && clientSecret.trim().length > 0));
+}
+function isStoredOAuthDiscovery(value) {
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    return (isNonBlankOwnString(value, "resourceMetadataUrl") &&
+        isObjectRecord(getOwnEntry(value, "resourceMetadata")) &&
+        isObjectRecord(getOwnEntry(value, "authorizationServerMetadata")));
+}
+function isStoredOAuthTokensOrMissing(value) {
+    if (value === undefined) {
+        return true;
+    }
+    if (!isObjectRecord(value)) {
+        return false;
+    }
+    if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
+        return false;
+    }
+    const expiresAt = getOwnEntry(value, "expiresAt");
+    if (expiresAt !== null &&
+        (typeof expiresAt !== "number" ||
+            !Number.isSafeInteger(expiresAt) ||
+            expiresAt > MAX_JS_DATE_MS ||
+            !Number.isFinite(new Date(expiresAt).getTime()))) {
+        return false;
+    }
+    const refreshToken = getOwnEntry(value, "refreshToken");
+    if (refreshToken !== undefined &&
+        (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+        return false;
+    }
+    const scope = getOwnEntry(value, "scope");
+    return scope === undefined || (typeof scope === "string" && scope.trim().length > 0);
+}
+function isNonBlankOwnString(record, key) {
+    const value = getOwnString(record, key);
+    return value !== undefined && value.trim().length > 0;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/authorization-state.d.ts

@@ -0,0 +1,8 @@
+export declare function createAuthorizationState(input: {
+    issuer: string;
+    requireIssuer: boolean;
+}): string;
+export declare function parseAuthorizationState(value: string | null): {
+    issuer: string;
+    requireIssuer: boolean;
+} | null;

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/authorization-state.js

@@ -0,0 +1,47 @@
+import crypto from "node:crypto";
+export function createAuthorizationState(input) {
+    const payload = {
+        v: 1,
+        n: crypto.randomBytes(16).toString("base64url"),
+        i: input.issuer,
+        r: input.requireIssuer,
+    };
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+export function parseAuthorizationState(value) {
+    if (value === null || value.length === 0) {
+        return null;
+    }
+    try {
+        const decoded = Buffer.from(value, "base64url").toString("utf8");
+        const parsed = JSON.parse(decoded);
+        if (!isObjectRecord(parsed)) {
+            return null;
+        }
+        const version = getOwnEntry(parsed, "v");
+        const nonce = getOwnEntry(parsed, "n");
+        const issuer = getOwnEntry(parsed, "i");
+        const requireIssuer = getOwnEntry(parsed, "r");
+        if (version !== 1
+            || typeof nonce !== "string"
+            || nonce.length === 0
+            || typeof issuer !== "string"
+            || issuer.length === 0
+            || typeof requireIssuer !== "boolean") {
+            return null;
+        }
+        return {
+            issuer,
+            requireIssuer,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}

package/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.d.ts

@@ -0,0 +1,3 @@
+import type { DefaultOAuthClientProviderOptions, OAuthClientProvider, OAuthClientProviderOptions } from "./types.js";
+export declare function createOAuthClientProvider(options: OAuthClientProviderOptions): OAuthClientProvider;
+export declare function createDefaultOAuthClientProvider(options: DefaultOAuthClientProviderOptions): OAuthClientProvider;