@agent-native/core 0.117.2 → 0.118.1

package/dist/mcp-client/oauth-routes.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { deleteCookie, defineEventHandler, getCookie, getMethod, getQuery, setCookie, setResponseStatus, } from "h3";
+import { deleteCookie, defineEventHandler, getChunkedCookie, getCookie, getMethod, getQuery, setChunkedCookie, setResponseStatus, } from "h3";
 import { getOrgContext } from "../org/context.js";
 import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
 import { getSession, safeReturnPath } from "../server/auth.js";
@@ -10,6 +10,19 @@ import { finishMcpOAuthAuthorization, startMcpOAuthAuthorization, } from "./oaut
 import { addOAuthRemoteServer, normalizeServerName, validateRemoteUrl, } from "./remote-store.js";
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
+const FLOW_COOKIE_CHUNK_SIZE = 2_800;
+const FLOW_COOKIE_MAX_CHUNKS = 8;
+const CHUNKED_COOKIE_PREFIX = "__chunked__";
+export function redirectWithStagedCookies(event, location) {
+    const headers = new Headers({
+        Location: location,
+        "Cache-Control": "no-store",
+    });
+    for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {
+        headers.append("set-cookie", cookie);
+    }
+    return new Response(null, { status: 302, headers });
+}
 export function mountMcpOAuthRoutes(nitroApp, options) {
     const mountedApps = (globalThis.__agentNativeMcpOAuthMountedApps ??= new WeakSet());
     if (mountedApps.has(nitroApp))
@@ -109,14 +122,8 @@ async function handleMcpOAuthStart(event) {
             ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
             expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
         };
-        setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {
-            httpOnly: true,
-            secure: redirectUri.startsWith("https://"),
-            sameSite: "lax",
-            path: "/",
-            maxAge: FLOW_TTL_SECONDS,
-        });
-        return Response.redirect(started.authorizationUrl.href, 302);
+        setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
+        return redirectWithStagedCookies(event, started.authorizationUrl.href);
     }
     catch {
         setResponseStatus(event, 400);
@@ -133,8 +140,8 @@ async function handleMcpOAuthCallback(event, options) {
     const code = text(query.code);
     const state = text(query.state);
     const providerError = text(query.error);
-    const flow = readFlow(event);
-    deleteCookie(event, FLOW_COOKIE, { path: "/" });
+    const flow = readMcpOAuthFlowCookie(event);
+    clearMcpOAuthFlowCookies(event);
     if (providerError || !code || !state) {
         setResponseStatus(event, 400);
         return { error: "MCP OAuth authorization was not completed." };
@@ -174,15 +181,41 @@ async function handleMcpOAuthCallback(event, options) {
         await options.reconfigure();
         const returnPath = flow.returnUrl ??
             `/settings/connections?connected=mcp-${encodeURIComponent(flow.name)}`;
-        return Response.redirect(getAppUrl(event, returnPath), 302);
+        return redirectWithStagedCookies(event, getAppUrl(event, returnPath));
     }
     catch {
         setResponseStatus(event, 400);
         return { error: "MCP OAuth authorization could not be completed." };
     }
 }
-function readFlow(event) {
-    const encrypted = getCookie(event, FLOW_COOKIE);
+export function setMcpOAuthFlowCookie(event, flow, secure) {
+    const encrypted = encryptSecretValue(JSON.stringify(flow));
+    const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);
+    if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {
+        throw new Error("MCP OAuth flow state exceeds the cookie size limit.");
+    }
+    setChunkedCookie(event, FLOW_COOKIE, encrypted, {
+        httpOnly: true,
+        secure,
+        sameSite: "lax",
+        path: "/",
+        maxAge: FLOW_TTL_SECONDS,
+        chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,
+    });
+}
+export function readMcpOAuthFlowCookie(event) {
+    const primaryCookie = getCookie(event, FLOW_COOKIE);
+    if (!primaryCookie)
+        return null;
+    if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {
+        const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);
+        if (!/^\d+$/.test(rawCount))
+            return null;
+        const chunkCount = Number(rawCount);
+        if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS)
+            return null;
+    }
+    const encrypted = getChunkedCookie(event, FLOW_COOKIE);
     if (!encrypted)
         return null;
     try {
@@ -193,6 +226,12 @@ function readFlow(event) {
         return null;
     }
 }
+export function clearMcpOAuthFlowCookies(event) {
+    deleteCookie(event, FLOW_COOKIE, { path: "/" });
+    for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {
+        deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: "/" });
+    }
+}
 export function isValidMcpOAuthFlow(flow, email, orgId, state) {
     const scopeMatches = flow.scope === "user"
         ? flow.scopeId === email && !flow.orgId

package/dist/mcp-client/oauth-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../src/mcp-client/oauth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AAuBjC,MAAM,UAAU,mBAAmB,CACjC,QAAa,EACb,OAA8B;IAE9B,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,gCAAgC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,kCAAkC,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,gCAAgC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,KAAK,GAAmB,cAAc,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,KAAK,IAAI,cAAc,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,2DAA2D;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,OAAO;gBACZ,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,2DAA2D;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,2CAA2C,CAC5C,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,0BAA0B,CAAC;YACzB,SAAS,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YACnC,WAAW,EAAE,WAAW;YACxB,KAAK;SACN,CAAC,CACL,CAAC;QACF,MAAM,IAAI,GAAiB;YACzB,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YAC7B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,KAAK;YACL,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,GAAG,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE;YACtE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wHAAwH;SAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAc,EACd,OAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,IAAI,aAAa,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GACP,IAAI,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IACE,CAAC,IAAI;QACL,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,KAAK,CAAC,EACzE,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,2BAA2B,CAAC;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI;SACxB,CAAC,CACL,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YAClE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,UAAU,GACd,IAAI,CAAC,SAAS;YACd,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAiB,CAAC;QACzE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,KAAa,EACb,KAAyB,EACzB,KAAa;IAEb,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,KAAK,MAAM;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK;QACvC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;IAC7E,OAAO,CACL,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,YAAY;QACZ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport type { OAuthClientInformationMixed } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  deleteCookie,\n  defineEventHandler,\n  getCookie,\n  getMethod,\n  getQuery,\n  setCookie,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getOrgContext } from \"../org/context.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport { getSession, safeReturnPath } from \"../server/auth.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { getAppUrl, resolveOAuthRedirectUri } from \"../server/google-oauth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport {\n  finishMcpOAuthAuthorization,\n  startMcpOAuthAuthorization,\n  type McpOAuthDiscoveryState,\n} from \"./oauth-client.js\";\nimport {\n  addOAuthRemoteServer,\n  normalizeServerName,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n} from \"./remote-store.js\";\n\nconst FLOW_COOKIE = \"an_mcp_oauth_flow\";\nconst FLOW_TTL_SECONDS = 10 * 60;\n\nexport interface McpOAuthFlow {\n  name: string;\n  url: string;\n  description?: string;\n  scope: RemoteMcpScope;\n  scopeId: string;\n  owner: string;\n  orgId?: string;\n  redirectUri: string;\n  state: string;\n  codeVerifier: string;\n  clientInformation: OAuthClientInformationMixed;\n  discoveryState?: McpOAuthDiscoveryState;\n  returnUrl?: string;\n  expiresAt: number;\n}\n\nexport interface McpOAuthRoutesOptions {\n  reconfigure: () => Promise<void>;\n}\n\nexport function mountMcpOAuthRoutes(\n  nitroApp: any,\n  options: McpOAuthRoutesOptions,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpOAuthMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  getH3App(nitroApp).use(\n    \"/_agent-native/mcp/servers/oauth\",\n    defineEventHandler(async (event: H3Event) => {\n      const method = getMethod(event);\n      const pathname = (event.url?.pathname || \"\")\n        .replace(/^\\/+/, \"\")\n        .replace(/\\/+$/, \"\");\n      const parts = pathname ? pathname.split(\"/\") : [];\n      if (method !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      if (parts.length === 1 && parts[0] === \"start\") {\n        return handleMcpOAuthStart(event);\n      }\n      if (parts.length === 1 && parts[0] === \"callback\") {\n        return handleMcpOAuthCallback(event, options);\n      }\n      setResponseStatus(event, 404);\n      return { error: \"Not found\" };\n    }),\n  );\n}\n\nasync function handleMcpOAuthStart(\n  event: H3Event,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const rawUrl = text(query.url);\n  const rawName = text(query.name);\n  const returnUrl = text(query.return);\n  if (!rawUrl || !rawName) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth requires a server name and URL.\" };\n  }\n  const urlCheck = validateRemoteUrl(rawUrl);\n  if (!urlCheck.ok) {\n    setResponseStatus(event, 400);\n    return { error: urlCheck.error ?? \"MCP server URL is not allowed.\" };\n  }\n  const name = normalizeServerName(rawName);\n  if (!name) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP server name is invalid.\" };\n  }\n\n  const requestedScope = query.scope === \"org\" ? \"org\" : \"user\";\n  const requestedOrgId = text(query.orgId);\n  const org =\n    requestedScope === \"org\"\n      ? await getOrgContext(event).catch(() => null)\n      : null;\n  const scope: RemoteMcpScope = requestedScope;\n  const scopeId = scope === \"user\" ? session.email : (org?.orgId ?? \"\");\n  if (scope === \"org\" && requestedOrgId && requestedOrgId !== scopeId) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"The selected organization is not the active organization.\",\n    };\n  }\n  if (scope === \"org\" && (!scopeId || !isOrgAdmin(org?.role))) {\n    setResponseStatus(event, scopeId ? 403 : 400);\n    return {\n      error: scopeId\n        ? \"Only organization owners and admins can connect an org MCP server.\"\n        : \"Join an organization before connecting an org MCP server.\",\n    };\n  }\n\n  const redirectUri = resolveOAuthRedirectUri(\n    event,\n    \"/_agent-native/mcp/servers/oauth/callback\",\n  );\n  if (!redirectUri) {\n    setResponseStatus(event, 400);\n    return { error: \"Invalid MCP OAuth redirect URI.\" };\n  }\n\n  const state = crypto.randomUUID();\n  const safeReturnUrl = returnUrl ? safeReturnPath(returnUrl) : undefined;\n  try {\n    const started = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        startMcpOAuthAuthorization({\n          serverUrl: urlCheck.url!.toString(),\n          redirectUrl: redirectUri,\n          state,\n        }),\n    );\n    const flow: McpOAuthFlow = {\n      name,\n      url: urlCheck.url!.toString(),\n      description: text(query.description),\n      scope,\n      scopeId,\n      owner: session.email,\n      ...(org?.orgId ? { orgId: org.orgId } : {}),\n      redirectUri,\n      state: started.state,\n      codeVerifier: started.codeVerifier,\n      clientInformation: started.clientInformation,\n      ...(started.discoveryState\n        ? { discoveryState: started.discoveryState }\n        : {}),\n      ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),\n      expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n    };\n    setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {\n      httpOnly: true,\n      secure: redirectUri.startsWith(\"https://\"),\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: FLOW_TTL_SECONDS,\n    });\n    return Response.redirect(started.authorizationUrl.href, 302);\n  } catch {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"This MCP server could not start OAuth. It may not support standard MCP OAuth discovery or dynamic client registration.\",\n    };\n  }\n}\n\nasync function handleMcpOAuthCallback(\n  event: H3Event,\n  options: McpOAuthRoutesOptions,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const code = text(query.code);\n  const state = text(query.state);\n  const providerError = text(query.error);\n  const flow = readFlow(event);\n  deleteCookie(event, FLOW_COOKIE, { path: \"/\" });\n  if (providerError || !code || !state) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization was not completed.\" };\n  }\n  const org =\n    flow?.scope === \"org\" ? await getOrgContext(event).catch(() => null) : null;\n  if (\n    !flow ||\n    !isValidMcpOAuthFlow(flow, session.email, org?.orgId ?? undefined, state)\n  ) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth state is invalid or expired.\" };\n  }\n  if (flow.scope === \"org\" && !isOrgAdmin(org?.role)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Only organization owners and admins can connect an org MCP server.\",\n    };\n  }\n\n  try {\n    const finished = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        finishMcpOAuthAuthorization({\n          serverUrl: flow.url,\n          redirectUrl: flow.redirectUri,\n          state: flow.state,\n          clientInformation: flow.clientInformation,\n          codeVerifier: flow.codeVerifier,\n          discoveryState: flow.discoveryState,\n          authorizationCode: code,\n        }),\n    );\n    const result = await addOAuthRemoteServer(flow.scope, flow.scopeId, {\n      name: flow.name,\n      url: flow.url,\n      description: flow.description,\n      credentials: finished.credentials,\n    });\n    if (!result.ok) {\n      setResponseStatus(event, 400);\n      return { error: result.error };\n    }\n    await options.reconfigure();\n    const returnPath =\n      flow.returnUrl ??\n      `/settings/connections?connected=mcp-${encodeURIComponent(flow.name)}`;\n    return Response.redirect(getAppUrl(event, returnPath), 302);\n  } catch {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization could not be completed.\" };\n  }\n}\n\nfunction readFlow(event: H3Event): McpOAuthFlow | null {\n  const encrypted = getCookie(event, FLOW_COOKIE);\n  if (!encrypted) return null;\n  try {\n    const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;\n    return parsed && typeof parsed === \"object\" ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function isValidMcpOAuthFlow(\n  flow: McpOAuthFlow,\n  email: string,\n  orgId: string | undefined,\n  state: string,\n): boolean {\n  const scopeMatches =\n    flow.scope === \"user\"\n      ? flow.scopeId === email && !flow.orgId\n      : flow.scope === \"org\" && flow.scopeId === orgId && flow.orgId === orgId;\n  return (\n    flow.expiresAt >= Date.now() &&\n    flow.owner === email &&\n    flow.state === state &&\n    scopeMatches &&\n    typeof flow.scopeId === \"string\" &&\n    typeof flow.redirectUri === \"string\" &&\n    flow.redirectUri.includes(\"/_agent-native/mcp/servers/oauth/callback\")\n  );\n}\n\nfunction isOrgAdmin(role: unknown): boolean {\n  return role === \"owner\" || role === \"admin\";\n}\n\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction unauthorized(event: H3Event) {\n  setResponseStatus(event, 401);\n  return { error: \"Authentication required\" };\n}\n"]}
+{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../src/mcp-client/oauth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAuB5C,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAa,EACb,OAA8B;IAE9B,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,gCAAgC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,kCAAkC,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,gCAAgC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,KAAK,GAAmB,cAAc,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,KAAK,IAAI,cAAc,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,2DAA2D;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,OAAO;gBACZ,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,2DAA2D;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,2CAA2C,CAC5C,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,0BAA0B,CAAC;YACzB,SAAS,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YACnC,WAAW,EAAE,WAAW;YACxB,KAAK;SACN,CAAC,CACL,CAAC;QACF,MAAM,IAAI,GAAiB;YACzB,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YAC7B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,KAAK;YACL,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,GAAG,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wHAAwH;SAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAc,EACd,OAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC3C,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,aAAa,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GACP,IAAI,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IACE,CAAC,IAAI;QACL,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,KAAK,CAAC,EACzE,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,2BAA2B,CAAC;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI;SACxB,CAAC,CACL,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YAClE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,UAAU,GACd,IAAI,CAAC,SAAS;YACd,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,yBAAyB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,IAAkB,EAClB,MAAe;IAEf,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;IACxE,IAAI,UAAU,GAAG,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE;QAC9C,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,gBAAgB;QACxB,cAAc,EAAE,sBAAsB;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,sBAAsB;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAiB,CAAC;QACzE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,sBAAsB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,KAAK,EAAE,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,KAAa,EACb,KAAyB,EACzB,KAAa;IAEb,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,KAAK,MAAM;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK;QACvC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;IAC7E,OAAO,CACL,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,YAAY;QACZ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport type { OAuthClientInformationMixed } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  deleteCookie,\n  defineEventHandler,\n  getChunkedCookie,\n  getCookie,\n  getMethod,\n  getQuery,\n  setChunkedCookie,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getOrgContext } from \"../org/context.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport { getSession, safeReturnPath } from \"../server/auth.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { getAppUrl, resolveOAuthRedirectUri } from \"../server/google-oauth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport {\n  finishMcpOAuthAuthorization,\n  startMcpOAuthAuthorization,\n  type McpOAuthDiscoveryState,\n} from \"./oauth-client.js\";\nimport {\n  addOAuthRemoteServer,\n  normalizeServerName,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n} from \"./remote-store.js\";\n\nconst FLOW_COOKIE = \"an_mcp_oauth_flow\";\nconst FLOW_TTL_SECONDS = 10 * 60;\nconst FLOW_COOKIE_CHUNK_SIZE = 2_800;\nconst FLOW_COOKIE_MAX_CHUNKS = 8;\nconst CHUNKED_COOKIE_PREFIX = \"__chunked__\";\n\nexport interface McpOAuthFlow {\n  name: string;\n  url: string;\n  description?: string;\n  scope: RemoteMcpScope;\n  scopeId: string;\n  owner: string;\n  orgId?: string;\n  redirectUri: string;\n  state: string;\n  codeVerifier: string;\n  clientInformation: OAuthClientInformationMixed;\n  discoveryState?: McpOAuthDiscoveryState;\n  returnUrl?: string;\n  expiresAt: number;\n}\n\nexport interface McpOAuthRoutesOptions {\n  reconfigure: () => Promise<void>;\n}\n\nexport function redirectWithStagedCookies(\n  event: H3Event,\n  location: string,\n): Response {\n  const headers = new Headers({\n    Location: location,\n    \"Cache-Control\": \"no-store\",\n  });\n  for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {\n    headers.append(\"set-cookie\", cookie);\n  }\n  return new Response(null, { status: 302, headers });\n}\n\nexport function mountMcpOAuthRoutes(\n  nitroApp: any,\n  options: McpOAuthRoutesOptions,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpOAuthMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  getH3App(nitroApp).use(\n    \"/_agent-native/mcp/servers/oauth\",\n    defineEventHandler(async (event: H3Event) => {\n      const method = getMethod(event);\n      const pathname = (event.url?.pathname || \"\")\n        .replace(/^\\/+/, \"\")\n        .replace(/\\/+$/, \"\");\n      const parts = pathname ? pathname.split(\"/\") : [];\n      if (method !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      if (parts.length === 1 && parts[0] === \"start\") {\n        return handleMcpOAuthStart(event);\n      }\n      if (parts.length === 1 && parts[0] === \"callback\") {\n        return handleMcpOAuthCallback(event, options);\n      }\n      setResponseStatus(event, 404);\n      return { error: \"Not found\" };\n    }),\n  );\n}\n\nasync function handleMcpOAuthStart(\n  event: H3Event,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const rawUrl = text(query.url);\n  const rawName = text(query.name);\n  const returnUrl = text(query.return);\n  if (!rawUrl || !rawName) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth requires a server name and URL.\" };\n  }\n  const urlCheck = validateRemoteUrl(rawUrl);\n  if (!urlCheck.ok) {\n    setResponseStatus(event, 400);\n    return { error: urlCheck.error ?? \"MCP server URL is not allowed.\" };\n  }\n  const name = normalizeServerName(rawName);\n  if (!name) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP server name is invalid.\" };\n  }\n\n  const requestedScope = query.scope === \"org\" ? \"org\" : \"user\";\n  const requestedOrgId = text(query.orgId);\n  const org =\n    requestedScope === \"org\"\n      ? await getOrgContext(event).catch(() => null)\n      : null;\n  const scope: RemoteMcpScope = requestedScope;\n  const scopeId = scope === \"user\" ? session.email : (org?.orgId ?? \"\");\n  if (scope === \"org\" && requestedOrgId && requestedOrgId !== scopeId) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"The selected organization is not the active organization.\",\n    };\n  }\n  if (scope === \"org\" && (!scopeId || !isOrgAdmin(org?.role))) {\n    setResponseStatus(event, scopeId ? 403 : 400);\n    return {\n      error: scopeId\n        ? \"Only organization owners and admins can connect an org MCP server.\"\n        : \"Join an organization before connecting an org MCP server.\",\n    };\n  }\n\n  const redirectUri = resolveOAuthRedirectUri(\n    event,\n    \"/_agent-native/mcp/servers/oauth/callback\",\n  );\n  if (!redirectUri) {\n    setResponseStatus(event, 400);\n    return { error: \"Invalid MCP OAuth redirect URI.\" };\n  }\n\n  const state = crypto.randomUUID();\n  const safeReturnUrl = returnUrl ? safeReturnPath(returnUrl) : undefined;\n  try {\n    const started = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        startMcpOAuthAuthorization({\n          serverUrl: urlCheck.url!.toString(),\n          redirectUrl: redirectUri,\n          state,\n        }),\n    );\n    const flow: McpOAuthFlow = {\n      name,\n      url: urlCheck.url!.toString(),\n      description: text(query.description),\n      scope,\n      scopeId,\n      owner: session.email,\n      ...(org?.orgId ? { orgId: org.orgId } : {}),\n      redirectUri,\n      state: started.state,\n      codeVerifier: started.codeVerifier,\n      clientInformation: started.clientInformation,\n      ...(started.discoveryState\n        ? { discoveryState: started.discoveryState }\n        : {}),\n      ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),\n      expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n    };\n    setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith(\"https://\"));\n    return redirectWithStagedCookies(event, started.authorizationUrl.href);\n  } catch {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"This MCP server could not start OAuth. It may not support standard MCP OAuth discovery or dynamic client registration.\",\n    };\n  }\n}\n\nasync function handleMcpOAuthCallback(\n  event: H3Event,\n  options: McpOAuthRoutesOptions,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const code = text(query.code);\n  const state = text(query.state);\n  const providerError = text(query.error);\n  const flow = readMcpOAuthFlowCookie(event);\n  clearMcpOAuthFlowCookies(event);\n  if (providerError || !code || !state) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization was not completed.\" };\n  }\n  const org =\n    flow?.scope === \"org\" ? await getOrgContext(event).catch(() => null) : null;\n  if (\n    !flow ||\n    !isValidMcpOAuthFlow(flow, session.email, org?.orgId ?? undefined, state)\n  ) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth state is invalid or expired.\" };\n  }\n  if (flow.scope === \"org\" && !isOrgAdmin(org?.role)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Only organization owners and admins can connect an org MCP server.\",\n    };\n  }\n\n  try {\n    const finished = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        finishMcpOAuthAuthorization({\n          serverUrl: flow.url,\n          redirectUrl: flow.redirectUri,\n          state: flow.state,\n          clientInformation: flow.clientInformation,\n          codeVerifier: flow.codeVerifier,\n          discoveryState: flow.discoveryState,\n          authorizationCode: code,\n        }),\n    );\n    const result = await addOAuthRemoteServer(flow.scope, flow.scopeId, {\n      name: flow.name,\n      url: flow.url,\n      description: flow.description,\n      credentials: finished.credentials,\n    });\n    if (!result.ok) {\n      setResponseStatus(event, 400);\n      return { error: result.error };\n    }\n    await options.reconfigure();\n    const returnPath =\n      flow.returnUrl ??\n      `/settings/connections?connected=mcp-${encodeURIComponent(flow.name)}`;\n    return redirectWithStagedCookies(event, getAppUrl(event, returnPath));\n  } catch {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization could not be completed.\" };\n  }\n}\n\nexport function setMcpOAuthFlowCookie(\n  event: H3Event,\n  flow: McpOAuthFlow,\n  secure: boolean,\n): void {\n  const encrypted = encryptSecretValue(JSON.stringify(flow));\n  const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);\n  if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {\n    throw new Error(\"MCP OAuth flow state exceeds the cookie size limit.\");\n  }\n  setChunkedCookie(event, FLOW_COOKIE, encrypted, {\n    httpOnly: true,\n    secure,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: FLOW_TTL_SECONDS,\n    chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,\n  });\n}\n\nexport function readMcpOAuthFlowCookie(event: H3Event): McpOAuthFlow | null {\n  const primaryCookie = getCookie(event, FLOW_COOKIE);\n  if (!primaryCookie) return null;\n  if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {\n    const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);\n    if (!/^\\d+$/.test(rawCount)) return null;\n    const chunkCount = Number(rawCount);\n    if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS) return null;\n  }\n  const encrypted = getChunkedCookie(event, FLOW_COOKIE);\n  if (!encrypted) return null;\n  try {\n    const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;\n    return parsed && typeof parsed === \"object\" ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function clearMcpOAuthFlowCookies(event: H3Event): void {\n  deleteCookie(event, FLOW_COOKIE, { path: \"/\" });\n  for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {\n    deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: \"/\" });\n  }\n}\n\nexport function isValidMcpOAuthFlow(\n  flow: McpOAuthFlow,\n  email: string,\n  orgId: string | undefined,\n  state: string,\n): boolean {\n  const scopeMatches =\n    flow.scope === \"user\"\n      ? flow.scopeId === email && !flow.orgId\n      : flow.scope === \"org\" && flow.scopeId === orgId && flow.orgId === orgId;\n  return (\n    flow.expiresAt >= Date.now() &&\n    flow.owner === email &&\n    flow.state === state &&\n    scopeMatches &&\n    typeof flow.scopeId === \"string\" &&\n    typeof flow.redirectUri === \"string\" &&\n    flow.redirectUri.includes(\"/_agent-native/mcp/servers/oauth/callback\")\n  );\n}\n\nfunction isOrgAdmin(role: unknown): boolean {\n  return role === \"owner\" || role === \"admin\";\n}\n\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction unauthorized(event: H3Event) {\n  setResponseStatus(event, 401);\n  return { error: \"Authentication required\" };\n}\n"]}

package/dist/notifications/routes.d.ts

@@ -13,13 +13,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;

package/dist/observability/routes.d.ts

@@ -62,7 +62,7 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    id?: undefined;
     deleted?: undefined;
-    message?: undefined;
+    id?: undefined;
+    provider?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,46 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
-    found?: undefined;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
-    id?: undefined;
     deleted?: undefined;
-    message?: undefined;
-    providers?: undefined;
     count?: undefined;
+    id?: undefined;
+    providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
     deleted?: undefined;
-    message?: undefined;
-    providers?: undefined;
     count?: undefined;
     provider?: undefined;
+    providers?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
-    providers?: undefined;
+} | {
     count?: undefined;
     provider?: undefined;
     found?: undefined;
+    providers?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
     deleted?: undefined;
-    providers?: undefined;
     count?: undefined;
     provider?: undefined;
     found?: undefined;
+    providers?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -309,9 +309,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        message?: undefined;
         id?: undefined;
-        deleted?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -323,45 +322,46 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         }[];
         count: number;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
         id?: undefined;
-        deleted?: undefined;
         count?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        deleted?: undefined;
+    } | {
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
+        found?: undefined;
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
-        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        deleted?: undefined;
+        found?: undefined;
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/scripts/call-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-agent.d.ts","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAuJpD,eAAO,MAAM,IAAI,EAAE,UAsDlB,CAAC;AAEF,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,gBAAgB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAmXjB;AA+ND,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE"}
+{"version":3,"file":"call-agent.d.ts","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAuJpD,eAAO,MAAM,IAAI,EAAE,UAsDlB,CAAC;AAEF,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,gBAAgB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAuXjB;AA+ND,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE"}

package/dist/scripts/call-agent.js

@@ -350,7 +350,11 @@ export async function run(args, context, selfAppId) {
             // Terminal states resolve the poll; "input-required" means the remote is
             // blocked waiting on us, not making progress. Only actively-working
             // states count as liveness worth surfacing.
-            const ACTIVELY_WORKING_STATES = new Set(["working", "submitted"]);
+            const ACTIVELY_WORKING_STATES = new Set([
+                "working",
+                "submitted",
+                "processing",
+            ]);
             const callStartedAt = Date.now();
             let lastProgressEmitAt = callStartedAt;
             const onRemotePollUpdate = (task) => {