toolhome 0.5.0

package/dist/server/security/credential-materializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-materializer.js","sourceRoot":"","sources":["../../../src/security/credential-materializer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAS/C;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA0B;IACrE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9D,KAAK,SAAS;YACZ,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAC/C,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACjD,KAAK,OAAO;YACV,OAAO;gBACL,OAAO,EAAE,EAAE;gBACX,GAAG,EAAE,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;aACnF,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA0B,EAC1B,QAAgC;IAEhC,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,QAAQ,CAChB,4BAA4B,EAC5B,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAA0B,EAC1B,QAAgC;IAEhC,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC;IAE3F,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B,EAAE,MAAc;IAChE,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAE,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,OAAO,CAAC,WAAY,CAAC;IACtF,MAAM,IAAI,QAAQ,CAChB,4BAA4B,EAC5B,8BAA8B,MAAM,oBAAoB,EACxD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0B,EAC1B,MAAc,EACd,iBAA0B;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO;IAC3E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO;IAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,WAAW,IAAI,iBAAiB;YAAE,OAAO;QACrD,MAAM,IAAI,QAAQ,CAChB,mCAAmC,EACnC,8DAA8D,EAC9D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAChB,4BAA4B,EAC5B,8BAA8B,MAAM,oBAAoB,EACxD,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/dist/server/security/cursor-codec.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+declare const cursorPayloadSchema: z.ZodObject<{
+    key: z.ZodString;
+    offset: z.ZodNumber;
+}, z.core.$strip>;
+export declare class CursorCodec {
+    #private;
+    constructor(key: string);
+    encode(payload: z.infer<typeof cursorPayloadSchema>): string;
+    decode(value: string, expectedKey: string): z.infer<typeof cursorPayloadSchema>;
+}
+export {};
+//# sourceMappingURL=cursor-codec.d.ts.map

package/dist/server/security/cursor-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-codec.d.ts","sourceRoot":"","sources":["../../../src/security/cursor-codec.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,mBAAmB;;;iBAGvB,CAAC;AAEH,qBAAa,WAAW;;IAGtB,YAAY,GAAG,EAAE,MAAM,EAEtB;IAED,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,GAAG,MAAM,CAM3D;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAgB9E;CASF"}

package/dist/server/security/cursor-codec.js

@@ -0,0 +1,43 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { AppError } from '../domain/errors.js';
+const cursorPayloadSchema = z.object({
+    key: z.string(),
+    offset: z.number().int().nonnegative(),
+});
+export class CursorCodec {
+    #key;
+    constructor(key) {
+        this.#key = key;
+    }
+    encode(payload) {
+        const body = Buffer.from(JSON.stringify(cursorPayloadSchema.parse(payload))).toString('base64url');
+        const mac = this.#mac(body);
+        return `v1.${body}.${mac}`;
+    }
+    decode(value, expectedKey) {
+        const [version, body, mac, extra] = value.split('.');
+        if (version !== 'v1' || !body || !mac || extra !== undefined)
+            return this.#invalid();
+        const actual = Buffer.from(this.#mac(body), 'base64url');
+        const expected = Buffer.from(mac, 'base64url');
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+            return this.#invalid();
+        try {
+            const payload = cursorPayloadSchema.parse(JSON.parse(Buffer.from(body, 'base64url').toString('utf8')));
+            if (payload.key !== expectedKey)
+                return this.#invalid();
+            return payload;
+        }
+        catch {
+            return this.#invalid();
+        }
+    }
+    #mac(body) {
+        return createHmac('sha256', this.#key).update(`toolhome.cursor:${body}`).digest('base64url');
+    }
+    #invalid() {
+        throw new AppError('invalid_cursor', 'Cursor is invalid or stale', 400);
+    }
+}
+//# sourceMappingURL=cursor-codec.js.map

package/dist/server/security/cursor-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-codec.js","sourceRoot":"","sources":["../../../src/security/cursor-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;IACb,IAAI,CAAS;IAEtB,YAAY,GAAW;QACrB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,OAA4C;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CACnF,WAAW,CACZ,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,WAAmB;QACvC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC;YACzE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC5D,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAY;QACf,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/server/security/oauth-routes.d.ts

@@ -0,0 +1,21 @@
+import type { Logger } from '../observability/logger.js';
+import type { CapabilityRegistry } from '../data-plane/registry.js';
+import type { OAuthServer } from './oauth-server.js';
+interface OAuthApp {
+    get(path: string, handler: (context: OAuthContext) => Response | Promise<Response>): void;
+    post(path: string, handler: (context: OAuthContext) => Response | Promise<Response>): void;
+}
+interface OAuthContext {
+    req: {
+        raw: Request;
+        param(name: string): string;
+        json(): Promise<unknown>;
+    };
+}
+export declare function mountOAuthRoutes(app: OAuthApp, options: {
+    oauth: OAuthServer;
+    registry: CapabilityRegistry;
+    logger: Logger;
+}): void;
+export {};
+//# sourceMappingURL=oauth-routes.d.ts.map

package/dist/server/security/oauth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.d.ts","sourceRoot":"","sources":["../../../src/security/oauth-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,UAAU,QAAQ;IAChB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC1F,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;CAC5F;AAED,UAAU,YAAY;IACpB,GAAG,EAAE;QACH,GAAG,EAAE,OAAO,CAAC;QACb,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QAC5B,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;KAC1B,CAAC;CACH;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE;IACP,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB,GACA,IAAI,CA+CN"}

package/dist/server/security/oauth-routes.js

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+import { AppError } from '../domain/errors.js';
+export function mountOAuthRoutes(app, options) {
+    const route = (handler) => async (context) => {
+        try {
+            return await handler(context);
+        }
+        catch (error) {
+            return oauthError(error, options.logger);
+        }
+    };
+    const authorizationMetadata = () => json(options.oauth.authorizationServerMetadata());
+    app.get('/.well-known/oauth-authorization-server', authorizationMetadata);
+    app.get('/.well-known/oauth-protected-resource', () => json(options.oauth.protectedResourceMetadata(options.oauth.mcpResource(null))));
+    app.get('/.well-known/oauth-protected-resource/mcp', () => json(options.oauth.protectedResourceMetadata(options.oauth.mcpResource(null))));
+    app.get('/.well-known/oauth-protected-resource/mcp/:slug', route((context) => {
+        const slug = context.req.param('slug');
+        options.registry.entryBySlug(slug);
+        return json(options.oauth.protectedResourceMetadata(options.oauth.mcpResource(slug)));
+    }));
+    app.get('/oauth/authorize', route((context) => options.oauth.beginAuthorization(new URL(context.req.raw.url))));
+    app.post('/oauth/authorize', route(async (context) => options.oauth.approveAuthorization(await readUrlEncodedForm(context.req.raw))));
+    app.post('/oauth/token', route(async (context) => options.oauth.token(await readUrlEncodedForm(context.req.raw))));
+    app.post('/oauth/register', route(async (context) => json(options.oauth.register(await readJson(context.req.raw)), 201)));
+}
+function json(value, status = 200) {
+    return new Response(JSON.stringify(value), {
+        status,
+        headers: {
+            'content-type': 'application/json',
+            'cache-control': 'no-store',
+        },
+    });
+}
+function oauthError(error, logger) {
+    const appError = error instanceof AppError
+        ? error
+        : error instanceof z.ZodError
+            ? new AppError('invalid_request', 'OAuth request validation failed', 400)
+            : new AppError('server_error', 'OAuth request failed', 500);
+    if (appError.status >= 500) {
+        logger.error('OAuth endpoint error', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return json({
+        error: appError.code,
+        error_description: appError.message,
+    }, appError.status);
+}
+async function readUrlEncodedForm(request) {
+    const contentType = request.headers.get('content-type') ?? '';
+    if (!contentType.toLowerCase().startsWith('application/x-www-form-urlencoded')) {
+        throw new AppError('invalid_request', 'OAuth form must be URL encoded', 400);
+    }
+    const values = new URLSearchParams(await readLimitedBody(request));
+    const form = new FormData();
+    for (const [name, value] of values)
+        form.append(name, value);
+    return form;
+}
+async function readJson(request) {
+    const contentType = request.headers.get('content-type') ?? '';
+    if (!contentType.toLowerCase().startsWith('application/json')) {
+        throw new AppError('invalid_request', 'OAuth registration must use JSON', 400);
+    }
+    try {
+        return JSON.parse(await readLimitedBody(request));
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        throw new AppError('invalid_request', 'OAuth registration JSON is invalid', 400);
+    }
+}
+async function readLimitedBody(request) {
+    const limit = 64 * 1024;
+    const declared = Number(request.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > limit) {
+        throw new AppError('invalid_request', 'OAuth request body is too large', 413);
+    }
+    if (!request.body)
+        return '';
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    while (true) {
+        const next = await reader.read();
+        if (next.done)
+            break;
+        size += next.value.byteLength;
+        if (size > limit) {
+            await reader.cancel();
+            throw new AppError('invalid_request', 'OAuth request body is too large', 413);
+        }
+        chunks.push(Buffer.from(next.value));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+//# sourceMappingURL=oauth-routes.js.map

package/dist/server/security/oauth-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../../src/security/oauth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAkB/C,MAAM,UAAU,gBAAgB,CAC9B,GAAa,EACb,OAIC;IAED,MAAM,KAAK,GACT,CAAC,OAAgE,EAAE,EAAE,CACrE,KAAK,EAAE,OAAqB,EAAqB,EAAE;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;IAEJ,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACtF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,qBAAqB,CAAC,CAAC;IAE1E,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,GAAG,EAAE,CACpD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAC/E,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,2CAA2C,EAAE,GAAG,EAAE,CACxD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAC/E,CAAC;IACF,GAAG,CAAC,GAAG,CACL,iDAAiD,EACjD,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CACnF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,kBAAkB,EAClB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACtB,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC9E,CACF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CACzF,CAAC;IACF,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAAc;IAChD,MAAM,QAAQ,GACZ,KAAK,YAAY,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,QAAQ;YAC3B,CAAC,CAAC,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iCAAiC,EAAE,GAAG,CAAC;YACzE,CAAC,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;YACnC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CACT;QACE,KAAK,EAAE,QAAQ,CAAC,IAAI;QACpB,iBAAiB,EAAE,QAAQ,CAAC,OAAO;KACpC,EACD,QAAQ,CAAC,MAAM,CAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAgB;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3C,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAgB;IAC7C,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM;QACrB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9B,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/server/security/oauth-server.d.ts

@@ -0,0 +1,16 @@
+import type { AuthInfo } from '@modelcontextprotocol/server';
+import type { AuthService } from './auth-service.js';
+export declare class OAuthServer {
+    #private;
+    constructor(publicUrl: URL, masterKey: string, controlAuth: AuthService);
+    authorizationServerMetadata(): Record<string, unknown>;
+    protectedResourceMetadata(resource: URL): Record<string, unknown>;
+    mcpResource(slug: string | null): URL;
+    resourceMetadataUrl(resource: URL): string;
+    beginAuthorization(url: URL): Promise<Response>;
+    approveAuthorization(form: FormData): Response;
+    token(form: FormData): Promise<Response>;
+    register(value: unknown): Record<string, unknown>;
+    verifyAccessToken(token: string, expectedResource: URL): Promise<AuthInfo>;
+}
+//# sourceMappingURL=oauth-server.d.ts.map

package/dist/server/security/oauth-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../../src/security/oauth-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAQ7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgGrD,qBAAa,WAAW;;IAStB,YAAY,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAQtE;IAED,2BAA2B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcrD;IAED,yBAAyB,CAAC,QAAQ,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOhE;IAED,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAMpC;IAED,mBAAmB,CAAC,QAAQ,EAAE,GAAG,GAAG,MAAM,CAGzC;IAEK,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8BpD;IAED,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAsB7C;IAEK,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAM7C;IAED,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBhD;IAEK,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsB/E;CAqLF"}