@ai-ecoverse/slicc-agent 3.36.0 → 3.36.1

package/README.md

@@ -457,7 +457,7 @@ The built-in `sprinkles` skill teaches the files, the bridge and the command.
 
 ## The kernel
 
-`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.47.1 <2`, the first kernel with users and the H1 wasm commands; until 3.31.0 the floor was 1.26.3): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.47.1), and the unit and integration tests run on it with the H1 wasm commands as devDependencies. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`), with the wasm commands certified for it (`NEWEST_CERTIFIED_WASM`). Today the floor is 1.47.1 and the newest certified kernel 1.54.9; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
+`@ai-ecoverse/slicc-kernel` is a peer dependency (`>=1.47.1 <2`, the first kernel with users and the H1 wasm commands; until 3.31.0 the floor was 1.26.3): the agent only calls `attachKernel`, the client end of the page kernel's port, so it must match the kernel the page runs. Seven chooses that version: slicc-bios pins the certified kernel next to the agent in `src/packages/agent/package.json`, and pnpm fills the peer from that pin. The devDependency is the lowest certified kernel the range allows (1.47.1), and the unit and integration tests run on it with the H1 wasm commands as devDependencies. A second CI job reruns the integration tests on the newest certified kernel (`NEWEST_CERTIFIED_KERNEL` in `.github/workflows/ci.yml`), with the wasm commands certified for it (`NEWEST_CERTIFIED_WASM`). Today the floor is 1.47.1 and the newest certified kernel 1.56.0; the second job moves by hand to each newer certified kernel, so both ends of the range are tested. If the port protocol ever breaks within 1.x, a patch release narrows the upper bound. Renovate opens PRs for the kernel, `wasi-pnpm`, the `wasm-*` packages and `slicc-cdp` but never merges them, because they move only after the homescoop coordinator certifies them.
 
 ## Patched dependencies
 

package/dist/mcp/oauth.js

@@ -9,6 +9,11 @@ import {
 } from "@earendil-works/pi-mcp/oauth";
 import { credentialKey } from "./credentials.js";
 const CLIENT_NAME = "SLICC";
+function sentence(text) {
+  const trimmed = text.trim();
+  const lowered = /^[A-Z][a-z]/.test(trimmed) ? `${trimmed[0]?.toLowerCase()}${trimmed.slice(1)}` : trimmed;
+  return /[.!?]$/.test(lowered) ? lowered : `${lowered}.`;
+}
 const LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function secureUrl(url) {
   return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK.has(url.hostname);
@@ -184,9 +189,9 @@ async function beginSignIn(provider, server, options) {
   if (!configured) await provider.saveDiscoveryState(info);
   const metadata = info.authorizationServerMetadata;
   if (metadata && !metadata.response_types_supported.includes("code"))
-    throw new Error("the authorization server does not support authorization codes");
+    throw new Error("The authorization server doesn't support authorization codes.");
   if (metadata?.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes("S256"))
-    throw new Error("the authorization server does not support PKCE S256");
+    throw new Error("The authorization server doesn't support PKCE S256.");
   const scope = server.config.oauth?.scope || info.resourceMetadata?.scopes_supported?.join(" ") || void 0;
   let client = await provider.clientInformation();
   if (!client) {
@@ -204,7 +209,7 @@ async function beginSignIn(provider, server, options) {
   const url = new URL(
     metadata?.authorization_endpoint ?? new URL("/authorize", info.authorizationServerUrl)
   );
-  if (!secureUrl(url)) throw new Error("the authorization endpoint is not an https URL");
+  if (!secureUrl(url)) throw new Error("The authorization server's sign-in address isn't https.");
   url.searchParams.set("response_type", "code");
   url.searchParams.set("client_id", client.client_id);
   url.searchParams.set("code_challenge", challenge);
@@ -222,14 +227,16 @@ async function finishSignIn(provider, server, answer, fetch) {
   try {
     callback = JSON.parse(answer);
   } catch {
-    throw new Error("the sign-in answer is not a callback");
+    throw new Error("The sign-in answer isn't a callback.");
   }
   const expected = (await provider.load()).oauthState;
   if (!expected || callback.state !== expected)
-    throw new Error("the sign-in answer does not match this sign-in");
+    throw new Error("The sign-in answer doesn't match this sign-in. Try again.");
   if (callback.error)
-    throw new Error(`sign-in failed: ${callback.error_description ?? callback.error}`);
-  if (!callback.code) throw new Error("the sign-in answer has no authorization code");
+    throw new Error(
+      `Sign-in failed: ${sentence(callback.error_description?.trim() || callback.error)}`
+    );
+  if (!callback.code) throw new Error("The sign-in answer has no authorization code.");
   const configured = server.config.oauth?.authServerMetadataUrl;
   await authorizeMcp(provider, {
     serverUrl: server.config.url,
@@ -255,6 +262,7 @@ export {
   pkce,
   randomState,
   secureUrl,
+  sentence,
   signInRequired
 };
 //# sourceMappingURL=oauth.js.map

package/dist/mcp/oauth.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/oauth.ts"],
-  "sourcesContent": ["import type { CredentialStore } from '@earendil-works/pi-ai';\nimport type { AuthProvider, McpFetch, UnauthorizedContext } from '@earendil-works/pi-mcp';\nimport {\n  authorizeMcp,\n  discoverOAuthServerInfo,\n  McpOAuthAuthorizationRequiredError,\n  type McpOAuthState,\n  type OAuthChallenge,\n  parseWwwAuthenticate,\n  registerClient,\n  selectResource,\n  stepUpScope,\n} from '@earendil-works/pi-mcp/oauth';\nimport type { McpSignIn } from '../services.ts';\nimport type { McpServerConfig } from './config.ts';\nimport { credentialKey } from './credentials.ts';\n\ntype Provider = Parameters<typeof authorizeMcp>[0];\ntype Tokens = Awaited<ReturnType<Provider['tokens']>>;\ntype Client = Awaited<ReturnType<Provider['clientInformation']>>;\ntype Discovery = NonNullable<McpOAuthState['discovery']>;\n\nexport const CLIENT_NAME = 'SLICC';\n\nconst LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);\n\nexport function secureUrl(url: URL): boolean {\n  return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));\n}\n\nexport function signInRequired(cause?: unknown): McpOAuthAuthorizationRequiredError {\n  const error = new McpOAuthAuthorizationRequiredError();\n  if (cause !== undefined) error.cause = cause;\n  return error;\n}\n\nexport function authProvider(provider: StoredOAuth, server: OAuthServer): AuthProvider {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  let inFlight: Promise<void> | undefined;\n  const authorize = async (\n    context: UnauthorizedContext,\n    step: boolean,\n    challenge: OAuthChallenge\n  ) => {\n    const granted = step ? await provider.tokens() : undefined;\n    try {\n      await authorizeMcp(provider, {\n        serverUrl: context.serverUrl,\n        ...(challenge.resourceMetadataUrl\n          ? { resourceMetadataUrl: challenge.resourceMetadataUrl }\n          : {}),\n        ...(step\n          ? { scope: stepUpScope(granted?.scope, challenge.scope), skipRefresh: true }\n          : challenge.scope\n            ? { scope: challenge.scope }\n            : {}),\n        ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n        fetch: context.fetch,\n      });\n    } catch (error) {\n      throw error instanceof McpOAuthAuthorizationRequiredError ? error : signInRequired(error);\n    }\n  };\n  return {\n    token: async () => (await provider.tokens())?.access_token,\n    async onUnauthorized(context) {\n      const challenge = parseWwwAuthenticate(context.response.headers.get('www-authenticate'));\n      const step = challenge.error === 'insufficient_scope';\n      if (!step && !inFlight && context.token !== undefined) {\n        const current = (await provider.tokens())?.access_token;\n        if (current !== undefined && current !== context.token) return;\n      }\n      inFlight ??= authorize(context, step, challenge).finally(() => {\n        inFlight = undefined;\n      });\n      await inFlight;\n    },\n  };\n}\n\nconst bytesToBase64Url = (bytes: Uint8Array) =>\n  btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst random = (length: number) => crypto.getRandomValues(new Uint8Array(length));\n\nexport async function pkce(): Promise<{ verifier: string; challenge: string }> {\n  const verifier = bytesToBase64Url(random(32));\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };\n}\n\nexport function randomState(): string {\n  return [...random(32)].map((byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nexport interface OAuthServer {\n  name: string;\n  config: McpServerConfig;\n}\n\nexport class StoredOAuth implements Provider {\n  readonly redirectUrl: string;\n  readonly clientMetadata: Provider['clientMetadata'];\n  readonly #credentials: CredentialStore;\n  readonly #server: OAuthServer;\n  #writes: Promise<unknown> = Promise.resolve();\n\n  constructor(server: OAuthServer, credentials: CredentialStore, redirectUrl: string) {\n    this.#server = server;\n    this.#credentials = credentials;\n    this.redirectUrl = redirectUrl;\n    this.clientMetadata = {\n      client_name: server.config.oauth?.clientName ?? CLIENT_NAME,\n      redirect_uris: [redirectUrl],\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method: 'none',\n      ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    };\n  }\n\n  get serverUrl(): string {\n    return String(new URL(this.#server.config.url));\n  }\n\n  async #key(): Promise<string> {\n    return credentialKey(this.#server.name, this.#server.config.url);\n  }\n\n  async load(): Promise<McpOAuthState> {\n    await this.#writes;\n    const stored = await this.#credentials.read(await this.#key());\n    const state =\n      stored?.type === 'oauth' ? (stored.state as McpOAuthState | undefined) : undefined;\n    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };\n  }\n\n  async update(change: (state: McpOAuthState) => McpOAuthState): Promise<void> {\n    const write = this.#writes.then(async () => {\n      const key = await this.#key();\n      await this.#credentials.modify(key, async (current) => {\n        const before =\n          current?.type === 'oauth' ? (current.state as McpOAuthState | undefined) : undefined;\n        const next = change(\n          before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl }\n        );\n        return {\n          type: 'oauth',\n          access: next.tokens?.access_token ?? '',\n          refresh: next.tokens?.refresh_token ?? '',\n          expires: next.tokensExpireAt ?? 0,\n          state: next,\n        };\n      });\n    });\n    this.#writes = write.catch(() => undefined);\n    await write;\n  }\n\n  async signedIn(): Promise<boolean> {\n    return (await this.load()).tokens !== undefined;\n  }\n\n  state(): string {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async clientInformation(): Promise<Client> {\n    const configured = this.#server.config.oauth?.clientId;\n    return configured ? { client_id: configured } : (await this.load()).clientInformation;\n  }\n\n  async saveClientInformation(information: NonNullable<Client>): Promise<void> {\n    if (this.#server.config.oauth?.clientId) return;\n    await this.update((state) => ({ ...state, clientInformation: information }));\n  }\n\n  async tokens(): Promise<Tokens> {\n    return (await this.load()).tokens;\n  }\n\n  async saveTokens(tokens: NonNullable<Tokens>): Promise<void> {\n    const expires =\n      tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;\n    await this.update((state) => {\n      const next: McpOAuthState = { ...state, tokens };\n      if (expires === undefined) delete next.tokensExpireAt;\n      else next.tokensExpireAt = expires;\n      return next;\n    });\n  }\n\n  redirectToAuthorization(): void {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.update((state) => ({ ...state, codeVerifier: verifier }));\n  }\n\n  async codeVerifier(): Promise<string> {\n    const verifier = (await this.load()).codeVerifier;\n    if (!verifier) throw new Error('No OAuth PKCE code verifier is stored');\n    return verifier;\n  }\n\n  async invalidateCredentials(\n    kind: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'\n  ): Promise<void> {\n    await this.update((state) => {\n      const next = { ...state };\n      if (kind === 'all' || kind === 'client') delete next.clientInformation;\n      if (kind === 'all' || kind === 'tokens') {\n        delete next.tokens;\n        delete next.tokensExpireAt;\n      }\n      if (kind === 'all' || kind === 'verifier') delete next.codeVerifier;\n      if (kind === 'all' || kind === 'discovery') delete next.discovery;\n      if (kind === 'all') delete next.oauthState;\n      return next;\n    });\n  }\n\n  async saveDiscoveryState(discovery: Discovery): Promise<void> {\n    await this.update((state) => ({ ...state, discovery }));\n  }\n\n  async discoveryState(): Promise<Discovery | undefined> {\n    return (await this.load()).discovery;\n  }\n\n  async forget(): Promise<void> {\n    await this.#writes;\n    await this.#credentials.delete(await this.#key());\n  }\n}\n\nexport type { McpSignIn } from '../services.ts';\n\nexport async function beginSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  options: { fetch: McpFetch; resourceMetadataUrl?: URL }\n): Promise<McpSignIn> {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  const info = await discoverOAuthServerInfo(server.config.url, {\n    fetch: options.fetch,\n    ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n  });\n  if (!configured) await provider.saveDiscoveryState(info);\n  const metadata = info.authorizationServerMetadata;\n  if (metadata && !metadata.response_types_supported.includes('code'))\n    throw new Error('the authorization server does not support authorization codes');\n  if (\n    metadata?.code_challenge_methods_supported &&\n    !metadata.code_challenge_methods_supported.includes('S256')\n  )\n    throw new Error('the authorization server does not support PKCE S256');\n  const scope =\n    server.config.oauth?.scope || info.resourceMetadata?.scopes_supported?.join(' ') || undefined;\n  let client = await provider.clientInformation();\n  if (!client) {\n    client = await registerClient(info.authorizationServerUrl, {\n      ...(metadata ? { metadata } : {}),\n      clientMetadata: provider.clientMetadata,\n      ...(scope ? { scope } : {}),\n      fetch: options.fetch,\n    });\n    await provider.saveClientInformation(client);\n  }\n  const { verifier, challenge } = await pkce();\n  const state = randomState();\n  await provider.update((current) => ({ ...current, codeVerifier: verifier, oauthState: state }));\n  const url = new URL(\n    metadata?.authorization_endpoint ?? new URL('/authorize', info.authorizationServerUrl)\n  );\n  if (!secureUrl(url)) throw new Error('the authorization endpoint is not an https URL');\n  url.searchParams.set('response_type', 'code');\n  url.searchParams.set('client_id', client.client_id);\n  url.searchParams.set('code_challenge', challenge);\n  url.searchParams.set('code_challenge_method', 'S256');\n  url.searchParams.set('redirect_uri', provider.redirectUrl);\n  url.searchParams.set('state', state);\n  if (scope) url.searchParams.set('scope', scope);\n  if (scope?.split(/\\s+/).includes('offline_access')) url.searchParams.set('prompt', 'consent');\n  const resource = selectResource(server.config.url, info.resourceMetadata);\n  if (resource) url.searchParams.set('resource', resource);\n  return { url: url.href, state };\n}\n\nexport interface Callback {\n  code?: string;\n  state?: string;\n  iss?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport async function finishSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  answer: string,\n  fetch: McpFetch\n): Promise<void> {\n  let callback: Callback;\n  try {\n    callback = JSON.parse(answer) as Callback;\n  } catch {\n    throw new Error('the sign-in answer is not a callback');\n  }\n  const expected = (await provider.load()).oauthState;\n  if (!expected || callback.state !== expected)\n    throw new Error('the sign-in answer does not match this sign-in');\n  if (callback.error)\n    throw new Error(`sign-in failed: ${callback.error_description ?? callback.error}`);\n  if (!callback.code) throw new Error('the sign-in answer has no authorization code');\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  await authorizeMcp(provider, {\n    serverUrl: server.config.url,\n    authorizationCode: callback.code,\n    ...(callback.iss ? { iss: callback.iss } : {}),\n    ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n    fetch,\n  });\n  await provider.update((state) => {\n    const next = { ...state };\n    delete next.oauthState;\n    delete next.codeVerifier;\n    return next;\n  });\n}\n"],
-  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,qBAAqB;AAOvB,MAAM,cAAc;AAE3B,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAErD,SAAS,UAAU,KAAmB;AAC3C,SAAO,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,SAAS,IAAI,IAAI,QAAQ;AAC5F;AAEO,SAAS,eAAe,OAAqD;AAClF,QAAM,QAAQ,IAAI,mCAAmC;AACrD,MAAI,UAAU,OAAW,OAAM,QAAQ;AACvC,SAAO;AACT;AAEO,SAAS,aAAa,UAAuB,QAAmC;AACrF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,MAAI;AACJ,QAAM,YAAY,OAChB,SACA,MACA,cACG;AACH,UAAM,UAAU,OAAO,MAAM,SAAS,OAAO,IAAI;AACjD,QAAI;AACF,YAAM,aAAa,UAAU;AAAA,QAC3B,WAAW,QAAQ;AAAA,QACnB,GAAI,UAAU,sBACV,EAAE,qBAAqB,UAAU,oBAAoB,IACrD,CAAC;AAAA,QACL,GAAI,OACA,EAAE,OAAO,YAAY,SAAS,OAAO,UAAU,KAAK,GAAG,aAAa,KAAK,IACzE,UAAU,QACR,EAAE,OAAO,UAAU,MAAM,IACzB,CAAC;AAAA,QACP,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,QAC5E,OAAO,QAAQ;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,iBAAiB,qCAAqC,QAAQ,eAAe,KAAK;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,aAAa,MAAM,SAAS,OAAO,IAAI;AAAA,IAC9C,MAAM,eAAe,SAAS;AAC5B,YAAM,YAAY,qBAAqB,QAAQ,SAAS,QAAQ,IAAI,kBAAkB,CAAC;AACvF,YAAM,OAAO,UAAU,UAAU;AACjC,UAAI,CAAC,QAAQ,CAAC,YAAY,QAAQ,UAAU,QAAW;AACrD,cAAM,WAAW,MAAM,SAAS,OAAO,IAAI;AAC3C,YAAI,YAAY,UAAa,YAAY,QAAQ,MAAO;AAAA,MAC1D;AACA,mBAAa,UAAU,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM;AAC7D,mBAAW;AAAA,MACb,CAAC;AACD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB,CAAC,UACxB,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAC/B,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEtB,MAAM,SAAS,CAAC,WAAmB,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAEhF,eAAsB,OAAyD;AAC7E,QAAM,WAAW,iBAAiB,OAAO,EAAE,CAAC;AAC5C,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AACvF,SAAO,EAAE,UAAU,WAAW,iBAAiB,IAAI,WAAW,MAAM,CAAC,EAAE;AACzE;AAEO,SAAS,cAAsB;AACpC,SAAO,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAClF;AAOO,MAAM,YAAgC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,UAA4B,QAAQ,QAAQ;AAAA,EAE5C,YAAY,QAAqB,aAA8B,aAAqB;AAClF,SAAK,UAAU;AACf,SAAK,eAAe;AACpB,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,MACpB,aAAa,OAAO,OAAO,OAAO,cAAc;AAAA,MAChD,eAAe,CAAC,WAAW;AAAA,MAC3B,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,EAEA,IAAI,YAAoB;AACtB,WAAO,OAAO,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AAAA,EAChD;AAAA,EAEA,MAAM,OAAwB;AAC5B,WAAO,cAAc,KAAK,QAAQ,MAAM,KAAK,QAAQ,OAAO,GAAG;AAAA,EACjE;AAAA,EAEA,MAAM,OAA+B;AACnC,UAAM,KAAK;AACX,UAAM,SAAS,MAAM,KAAK,aAAa,KAAK,MAAM,KAAK,KAAK,CAAC;AAC7D,UAAM,QACJ,QAAQ,SAAS,UAAW,OAAO,QAAsC;AAC3E,WAAO,OAAO,cAAc,KAAK,YAAY,QAAQ,EAAE,WAAW,KAAK,UAAU;AAAA,EACnF;AAAA,EAEA,MAAM,OAAO,QAAgE;AAC3E,UAAM,QAAQ,KAAK,QAAQ,KAAK,YAAY;AAC1C,YAAM,MAAM,MAAM,KAAK,KAAK;AAC5B,YAAM,KAAK,aAAa,OAAO,KAAK,OAAO,YAAY;AACrD,cAAM,SACJ,SAAS,SAAS,UAAW,QAAQ,QAAsC;AAC7E,cAAM,OAAO;AAAA,UACX,QAAQ,cAAc,KAAK,YAAY,SAAS,EAAE,WAAW,KAAK,UAAU;AAAA,QAC9E;AACA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,KAAK,QAAQ,gBAAgB;AAAA,UACrC,SAAS,KAAK,QAAQ,iBAAiB;AAAA,UACvC,SAAS,KAAK,kBAAkB;AAAA,UAChC,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,SAAK,UAAU,MAAM,MAAM,MAAM,MAAS;AAC1C,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,WAA6B;AACjC,YAAQ,MAAM,KAAK,KAAK,GAAG,WAAW;AAAA,EACxC;AAAA,EAEA,QAAgB;AACd,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,oBAAqC;AACzC,UAAM,aAAa,KAAK,QAAQ,OAAO,OAAO;AAC9C,WAAO,aAAa,EAAE,WAAW,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG;AAAA,EACtE;AAAA,EAEA,MAAM,sBAAsB,aAAiD;AAC3E,QAAI,KAAK,QAAQ,OAAO,OAAO,SAAU;AACzC,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,mBAAmB,YAAY,EAAE;AAAA,EAC7E;AAAA,EAEA,MAAM,SAA0B;AAC9B,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAA4C;AAC3D,UAAM,UACJ,OAAO,eAAe,SAAY,SAAY,KAAK,IAAI,IAAI,OAAO,aAAa;AACjF,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAsB,EAAE,GAAG,OAAO,OAAO;AAC/C,UAAI,YAAY,OAAW,QAAO,KAAK;AAAA,UAClC,MAAK,iBAAiB;AAC3B,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,0BAAgC;AAC9B,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,iBAAiB,UAAiC;AACtD,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,cAAc,SAAS,EAAE;AAAA,EACrE;AAAA,EAEA,MAAM,eAAgC;AACpC,UAAM,YAAY,MAAM,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,uCAAuC;AACtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBACJ,MACe;AACf,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAO,EAAE,GAAG,MAAM;AACxB,UAAI,SAAS,SAAS,SAAS,SAAU,QAAO,KAAK;AACrD,UAAI,SAAS,SAAS,SAAS,UAAU;AACvC,eAAO,KAAK;AACZ,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,SAAS,SAAS,WAAY,QAAO,KAAK;AACvD,UAAI,SAAS,SAAS,SAAS,YAAa,QAAO,KAAK;AACxD,UAAI,SAAS,MAAO,QAAO,KAAK;AAChC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,mBAAmB,WAAqC;AAC5D,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,UAAU,EAAE;AAAA,EACxD;AAAA,EAEA,MAAM,iBAAiD;AACrD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,SAAwB;AAC5B,UAAM,KAAK;AACX,UAAM,KAAK,aAAa,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAClD;AACF;AAIA,eAAsB,YACpB,UACA,QACA,SACoB;AACpB,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,OAAO,MAAM,wBAAwB,OAAO,OAAO,KAAK;AAAA,IAC5D,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,sBAAsB,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,IAC1F,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,EAC9E,CAAC;AACD,MAAI,CAAC,WAAY,OAAM,SAAS,mBAAmB,IAAI;AACvD,QAAM,WAAW,KAAK;AACtB,MAAI,YAAY,CAAC,SAAS,yBAAyB,SAAS,MAAM;AAChE,UAAM,IAAI,MAAM,+DAA+D;AACjF,MACE,UAAU,oCACV,CAAC,SAAS,iCAAiC,SAAS,MAAM;AAE1D,UAAM,IAAI,MAAM,qDAAqD;AACvE,QAAM,QACJ,OAAO,OAAO,OAAO,SAAS,KAAK,kBAAkB,kBAAkB,KAAK,GAAG,KAAK;AACtF,MAAI,SAAS,MAAM,SAAS,kBAAkB;AAC9C,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,eAAe,KAAK,wBAAwB;AAAA,MACzD,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,gBAAgB,SAAS;AAAA,MACzB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MACzB,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,UAAM,SAAS,sBAAsB,MAAM;AAAA,EAC7C;AACA,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,KAAK;AAC3C,QAAM,QAAQ,YAAY;AAC1B,QAAM,SAAS,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,cAAc,UAAU,YAAY,MAAM,EAAE;AAC9F,QAAM,MAAM,IAAI;AAAA,IACd,UAAU,0BAA0B,IAAI,IAAI,cAAc,KAAK,sBAAsB;AAAA,EACvF;AACA,MAAI,CAAC,UAAU,GAAG,EAAG,OAAM,IAAI,MAAM,gDAAgD;AACrF,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,aAAa,OAAO,SAAS;AAClD,MAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,gBAAgB,SAAS,WAAW;AACzD,MAAI,aAAa,IAAI,SAAS,KAAK;AACnC,MAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,MAAI,OAAO,MAAM,KAAK,EAAE,SAAS,gBAAgB,EAAG,KAAI,aAAa,IAAI,UAAU,SAAS;AAC5F,QAAM,WAAW,eAAe,OAAO,OAAO,KAAK,KAAK,gBAAgB;AACxE,MAAI,SAAU,KAAI,aAAa,IAAI,YAAY,QAAQ;AACvD,SAAO,EAAE,KAAK,IAAI,MAAM,MAAM;AAChC;AAUA,eAAsB,aACpB,UACA,QACA,QACA,OACe;AACf,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,MAAM;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,QAAM,YAAY,MAAM,SAAS,KAAK,GAAG;AACzC,MAAI,CAAC,YAAY,SAAS,UAAU;AAClC,UAAM,IAAI,MAAM,gDAAgD;AAClE,MAAI,SAAS;AACX,UAAM,IAAI,MAAM,mBAAmB,SAAS,qBAAqB,SAAS,KAAK,EAAE;AACnF,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,8CAA8C;AAClF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,aAAa,UAAU;AAAA,IAC3B,WAAW,OAAO,OAAO;AAAA,IACzB,mBAAmB,SAAS;AAAA,IAC5B,GAAI,SAAS,MAAM,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC;AAAA,IAC5C,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IACzE,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AACD,QAAM,SAAS,OAAO,CAAC,UAAU;AAC/B,UAAM,OAAO,EAAE,GAAG,MAAM;AACxB,WAAO,KAAK;AACZ,WAAO,KAAK;AACZ,WAAO;AAAA,EACT,CAAC;AACH;",
+  "sourcesContent": ["import type { CredentialStore } from '@earendil-works/pi-ai';\nimport type { AuthProvider, McpFetch, UnauthorizedContext } from '@earendil-works/pi-mcp';\nimport {\n  authorizeMcp,\n  discoverOAuthServerInfo,\n  McpOAuthAuthorizationRequiredError,\n  type McpOAuthState,\n  type OAuthChallenge,\n  parseWwwAuthenticate,\n  registerClient,\n  selectResource,\n  stepUpScope,\n} from '@earendil-works/pi-mcp/oauth';\nimport type { McpSignIn } from '../services.ts';\nimport type { McpServerConfig } from './config.ts';\nimport { credentialKey } from './credentials.ts';\n\ntype Provider = Parameters<typeof authorizeMcp>[0];\ntype Tokens = Awaited<ReturnType<Provider['tokens']>>;\ntype Client = Awaited<ReturnType<Provider['clientInformation']>>;\ntype Discovery = NonNullable<McpOAuthState['discovery']>;\n\nexport const CLIENT_NAME = 'SLICC';\n\nexport function sentence(text: string): string {\n  const trimmed = text.trim();\n  const lowered = /^[A-Z][a-z]/.test(trimmed)\n    ? `${trimmed[0]?.toLowerCase()}${trimmed.slice(1)}`\n    : trimmed;\n  return /[.!?]$/.test(lowered) ? lowered : `${lowered}.`;\n}\n\nconst LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);\n\nexport function secureUrl(url: URL): boolean {\n  return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));\n}\n\nexport function signInRequired(cause?: unknown): McpOAuthAuthorizationRequiredError {\n  const error = new McpOAuthAuthorizationRequiredError();\n  if (cause !== undefined) error.cause = cause;\n  return error;\n}\n\nexport function authProvider(provider: StoredOAuth, server: OAuthServer): AuthProvider {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  let inFlight: Promise<void> | undefined;\n  const authorize = async (\n    context: UnauthorizedContext,\n    step: boolean,\n    challenge: OAuthChallenge\n  ) => {\n    const granted = step ? await provider.tokens() : undefined;\n    try {\n      await authorizeMcp(provider, {\n        serverUrl: context.serverUrl,\n        ...(challenge.resourceMetadataUrl\n          ? { resourceMetadataUrl: challenge.resourceMetadataUrl }\n          : {}),\n        ...(step\n          ? { scope: stepUpScope(granted?.scope, challenge.scope), skipRefresh: true }\n          : challenge.scope\n            ? { scope: challenge.scope }\n            : {}),\n        ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n        fetch: context.fetch,\n      });\n    } catch (error) {\n      throw error instanceof McpOAuthAuthorizationRequiredError ? error : signInRequired(error);\n    }\n  };\n  return {\n    token: async () => (await provider.tokens())?.access_token,\n    async onUnauthorized(context) {\n      const challenge = parseWwwAuthenticate(context.response.headers.get('www-authenticate'));\n      const step = challenge.error === 'insufficient_scope';\n      if (!step && !inFlight && context.token !== undefined) {\n        const current = (await provider.tokens())?.access_token;\n        if (current !== undefined && current !== context.token) return;\n      }\n      inFlight ??= authorize(context, step, challenge).finally(() => {\n        inFlight = undefined;\n      });\n      await inFlight;\n    },\n  };\n}\n\nconst bytesToBase64Url = (bytes: Uint8Array) =>\n  btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst random = (length: number) => crypto.getRandomValues(new Uint8Array(length));\n\nexport async function pkce(): Promise<{ verifier: string; challenge: string }> {\n  const verifier = bytesToBase64Url(random(32));\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };\n}\n\nexport function randomState(): string {\n  return [...random(32)].map((byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nexport interface OAuthServer {\n  name: string;\n  config: McpServerConfig;\n}\n\nexport class StoredOAuth implements Provider {\n  readonly redirectUrl: string;\n  readonly clientMetadata: Provider['clientMetadata'];\n  readonly #credentials: CredentialStore;\n  readonly #server: OAuthServer;\n  #writes: Promise<unknown> = Promise.resolve();\n\n  constructor(server: OAuthServer, credentials: CredentialStore, redirectUrl: string) {\n    this.#server = server;\n    this.#credentials = credentials;\n    this.redirectUrl = redirectUrl;\n    this.clientMetadata = {\n      client_name: server.config.oauth?.clientName ?? CLIENT_NAME,\n      redirect_uris: [redirectUrl],\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method: 'none',\n      ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    };\n  }\n\n  get serverUrl(): string {\n    return String(new URL(this.#server.config.url));\n  }\n\n  async #key(): Promise<string> {\n    return credentialKey(this.#server.name, this.#server.config.url);\n  }\n\n  async load(): Promise<McpOAuthState> {\n    await this.#writes;\n    const stored = await this.#credentials.read(await this.#key());\n    const state =\n      stored?.type === 'oauth' ? (stored.state as McpOAuthState | undefined) : undefined;\n    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };\n  }\n\n  async update(change: (state: McpOAuthState) => McpOAuthState): Promise<void> {\n    const write = this.#writes.then(async () => {\n      const key = await this.#key();\n      await this.#credentials.modify(key, async (current) => {\n        const before =\n          current?.type === 'oauth' ? (current.state as McpOAuthState | undefined) : undefined;\n        const next = change(\n          before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl }\n        );\n        return {\n          type: 'oauth',\n          access: next.tokens?.access_token ?? '',\n          refresh: next.tokens?.refresh_token ?? '',\n          expires: next.tokensExpireAt ?? 0,\n          state: next,\n        };\n      });\n    });\n    this.#writes = write.catch(() => undefined);\n    await write;\n  }\n\n  async signedIn(): Promise<boolean> {\n    return (await this.load()).tokens !== undefined;\n  }\n\n  state(): string {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async clientInformation(): Promise<Client> {\n    const configured = this.#server.config.oauth?.clientId;\n    return configured ? { client_id: configured } : (await this.load()).clientInformation;\n  }\n\n  async saveClientInformation(information: NonNullable<Client>): Promise<void> {\n    if (this.#server.config.oauth?.clientId) return;\n    await this.update((state) => ({ ...state, clientInformation: information }));\n  }\n\n  async tokens(): Promise<Tokens> {\n    return (await this.load()).tokens;\n  }\n\n  async saveTokens(tokens: NonNullable<Tokens>): Promise<void> {\n    const expires =\n      tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;\n    await this.update((state) => {\n      const next: McpOAuthState = { ...state, tokens };\n      if (expires === undefined) delete next.tokensExpireAt;\n      else next.tokensExpireAt = expires;\n      return next;\n    });\n  }\n\n  redirectToAuthorization(): void {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.update((state) => ({ ...state, codeVerifier: verifier }));\n  }\n\n  async codeVerifier(): Promise<string> {\n    const verifier = (await this.load()).codeVerifier;\n    if (!verifier) throw new Error('No OAuth PKCE code verifier is stored');\n    return verifier;\n  }\n\n  async invalidateCredentials(\n    kind: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'\n  ): Promise<void> {\n    await this.update((state) => {\n      const next = { ...state };\n      if (kind === 'all' || kind === 'client') delete next.clientInformation;\n      if (kind === 'all' || kind === 'tokens') {\n        delete next.tokens;\n        delete next.tokensExpireAt;\n      }\n      if (kind === 'all' || kind === 'verifier') delete next.codeVerifier;\n      if (kind === 'all' || kind === 'discovery') delete next.discovery;\n      if (kind === 'all') delete next.oauthState;\n      return next;\n    });\n  }\n\n  async saveDiscoveryState(discovery: Discovery): Promise<void> {\n    await this.update((state) => ({ ...state, discovery }));\n  }\n\n  async discoveryState(): Promise<Discovery | undefined> {\n    return (await this.load()).discovery;\n  }\n\n  async forget(): Promise<void> {\n    await this.#writes;\n    await this.#credentials.delete(await this.#key());\n  }\n}\n\nexport type { McpSignIn } from '../services.ts';\n\nexport async function beginSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  options: { fetch: McpFetch; resourceMetadataUrl?: URL }\n): Promise<McpSignIn> {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  const info = await discoverOAuthServerInfo(server.config.url, {\n    fetch: options.fetch,\n    ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n  });\n  if (!configured) await provider.saveDiscoveryState(info);\n  const metadata = info.authorizationServerMetadata;\n  if (metadata && !metadata.response_types_supported.includes('code'))\n    throw new Error(\"The authorization server doesn't support authorization codes.\");\n  if (\n    metadata?.code_challenge_methods_supported &&\n    !metadata.code_challenge_methods_supported.includes('S256')\n  )\n    throw new Error(\"The authorization server doesn't support PKCE S256.\");\n  const scope =\n    server.config.oauth?.scope || info.resourceMetadata?.scopes_supported?.join(' ') || undefined;\n  let client = await provider.clientInformation();\n  if (!client) {\n    client = await registerClient(info.authorizationServerUrl, {\n      ...(metadata ? { metadata } : {}),\n      clientMetadata: provider.clientMetadata,\n      ...(scope ? { scope } : {}),\n      fetch: options.fetch,\n    });\n    await provider.saveClientInformation(client);\n  }\n  const { verifier, challenge } = await pkce();\n  const state = randomState();\n  await provider.update((current) => ({ ...current, codeVerifier: verifier, oauthState: state }));\n  const url = new URL(\n    metadata?.authorization_endpoint ?? new URL('/authorize', info.authorizationServerUrl)\n  );\n  if (!secureUrl(url)) throw new Error(\"The authorization server's sign-in address isn't https.\");\n  url.searchParams.set('response_type', 'code');\n  url.searchParams.set('client_id', client.client_id);\n  url.searchParams.set('code_challenge', challenge);\n  url.searchParams.set('code_challenge_method', 'S256');\n  url.searchParams.set('redirect_uri', provider.redirectUrl);\n  url.searchParams.set('state', state);\n  if (scope) url.searchParams.set('scope', scope);\n  if (scope?.split(/\\s+/).includes('offline_access')) url.searchParams.set('prompt', 'consent');\n  const resource = selectResource(server.config.url, info.resourceMetadata);\n  if (resource) url.searchParams.set('resource', resource);\n  return { url: url.href, state };\n}\n\nexport interface Callback {\n  code?: string;\n  state?: string;\n  iss?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport async function finishSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  answer: string,\n  fetch: McpFetch\n): Promise<void> {\n  let callback: Callback;\n  try {\n    callback = JSON.parse(answer) as Callback;\n  } catch {\n    throw new Error(\"The sign-in answer isn't a callback.\");\n  }\n  const expected = (await provider.load()).oauthState;\n  if (!expected || callback.state !== expected)\n    throw new Error(\"The sign-in answer doesn't match this sign-in. Try again.\");\n  if (callback.error)\n    throw new Error(\n      `Sign-in failed: ${sentence(callback.error_description?.trim() || callback.error)}`\n    );\n  if (!callback.code) throw new Error('The sign-in answer has no authorization code.');\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  await authorizeMcp(provider, {\n    serverUrl: server.config.url,\n    authorizationCode: callback.code,\n    ...(callback.iss ? { iss: callback.iss } : {}),\n    ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n    fetch,\n  });\n  await provider.update((state) => {\n    const next = { ...state };\n    delete next.oauthState;\n    delete next.codeVerifier;\n    return next;\n  });\n}\n"],
+  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,qBAAqB;AAOvB,MAAM,cAAc;AAEpB,SAAS,SAAS,MAAsB;AAC7C,QAAM,UAAU,KAAK,KAAK;AAC1B,QAAM,UAAU,cAAc,KAAK,OAAO,IACtC,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,KAC/C;AACJ,SAAO,SAAS,KAAK,OAAO,IAAI,UAAU,GAAG,OAAO;AACtD;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAErD,SAAS,UAAU,KAAmB;AAC3C,SAAO,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,SAAS,IAAI,IAAI,QAAQ;AAC5F;AAEO,SAAS,eAAe,OAAqD;AAClF,QAAM,QAAQ,IAAI,mCAAmC;AACrD,MAAI,UAAU,OAAW,OAAM,QAAQ;AACvC,SAAO;AACT;AAEO,SAAS,aAAa,UAAuB,QAAmC;AACrF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,MAAI;AACJ,QAAM,YAAY,OAChB,SACA,MACA,cACG;AACH,UAAM,UAAU,OAAO,MAAM,SAAS,OAAO,IAAI;AACjD,QAAI;AACF,YAAM,aAAa,UAAU;AAAA,QAC3B,WAAW,QAAQ;AAAA,QACnB,GAAI,UAAU,sBACV,EAAE,qBAAqB,UAAU,oBAAoB,IACrD,CAAC;AAAA,QACL,GAAI,OACA,EAAE,OAAO,YAAY,SAAS,OAAO,UAAU,KAAK,GAAG,aAAa,KAAK,IACzE,UAAU,QACR,EAAE,OAAO,UAAU,MAAM,IACzB,CAAC;AAAA,QACP,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,QAC5E,OAAO,QAAQ;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,iBAAiB,qCAAqC,QAAQ,eAAe,KAAK;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,aAAa,MAAM,SAAS,OAAO,IAAI;AAAA,IAC9C,MAAM,eAAe,SAAS;AAC5B,YAAM,YAAY,qBAAqB,QAAQ,SAAS,QAAQ,IAAI,kBAAkB,CAAC;AACvF,YAAM,OAAO,UAAU,UAAU;AACjC,UAAI,CAAC,QAAQ,CAAC,YAAY,QAAQ,UAAU,QAAW;AACrD,cAAM,WAAW,MAAM,SAAS,OAAO,IAAI;AAC3C,YAAI,YAAY,UAAa,YAAY,QAAQ,MAAO;AAAA,MAC1D;AACA,mBAAa,UAAU,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM;AAC7D,mBAAW;AAAA,MACb,CAAC;AACD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB,CAAC,UACxB,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAC/B,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEtB,MAAM,SAAS,CAAC,WAAmB,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAEhF,eAAsB,OAAyD;AAC7E,QAAM,WAAW,iBAAiB,OAAO,EAAE,CAAC;AAC5C,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AACvF,SAAO,EAAE,UAAU,WAAW,iBAAiB,IAAI,WAAW,MAAM,CAAC,EAAE;AACzE;AAEO,SAAS,cAAsB;AACpC,SAAO,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAClF;AAOO,MAAM,YAAgC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,UAA4B,QAAQ,QAAQ;AAAA,EAE5C,YAAY,QAAqB,aAA8B,aAAqB;AAClF,SAAK,UAAU;AACf,SAAK,eAAe;AACpB,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,MACpB,aAAa,OAAO,OAAO,OAAO,cAAc;AAAA,MAChD,eAAe,CAAC,WAAW;AAAA,MAC3B,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,EAEA,IAAI,YAAoB;AACtB,WAAO,OAAO,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AAAA,EAChD;AAAA,EAEA,MAAM,OAAwB;AAC5B,WAAO,cAAc,KAAK,QAAQ,MAAM,KAAK,QAAQ,OAAO,GAAG;AAAA,EACjE;AAAA,EAEA,MAAM,OAA+B;AACnC,UAAM,KAAK;AACX,UAAM,SAAS,MAAM,KAAK,aAAa,KAAK,MAAM,KAAK,KAAK,CAAC;AAC7D,UAAM,QACJ,QAAQ,SAAS,UAAW,OAAO,QAAsC;AAC3E,WAAO,OAAO,cAAc,KAAK,YAAY,QAAQ,EAAE,WAAW,KAAK,UAAU;AAAA,EACnF;AAAA,EAEA,MAAM,OAAO,QAAgE;AAC3E,UAAM,QAAQ,KAAK,QAAQ,KAAK,YAAY;AAC1C,YAAM,MAAM,MAAM,KAAK,KAAK;AAC5B,YAAM,KAAK,aAAa,OAAO,KAAK,OAAO,YAAY;AACrD,cAAM,SACJ,SAAS,SAAS,UAAW,QAAQ,QAAsC;AAC7E,cAAM,OAAO;AAAA,UACX,QAAQ,cAAc,KAAK,YAAY,SAAS,EAAE,WAAW,KAAK,UAAU;AAAA,QAC9E;AACA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,KAAK,QAAQ,gBAAgB;AAAA,UACrC,SAAS,KAAK,QAAQ,iBAAiB;AAAA,UACvC,SAAS,KAAK,kBAAkB;AAAA,UAChC,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,SAAK,UAAU,MAAM,MAAM,MAAM,MAAS;AAC1C,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,WAA6B;AACjC,YAAQ,MAAM,KAAK,KAAK,GAAG,WAAW;AAAA,EACxC;AAAA,EAEA,QAAgB;AACd,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,oBAAqC;AACzC,UAAM,aAAa,KAAK,QAAQ,OAAO,OAAO;AAC9C,WAAO,aAAa,EAAE,WAAW,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG;AAAA,EACtE;AAAA,EAEA,MAAM,sBAAsB,aAAiD;AAC3E,QAAI,KAAK,QAAQ,OAAO,OAAO,SAAU;AACzC,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,mBAAmB,YAAY,EAAE;AAAA,EAC7E;AAAA,EAEA,MAAM,SAA0B;AAC9B,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAA4C;AAC3D,UAAM,UACJ,OAAO,eAAe,SAAY,SAAY,KAAK,IAAI,IAAI,OAAO,aAAa;AACjF,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAsB,EAAE,GAAG,OAAO,OAAO;AAC/C,UAAI,YAAY,OAAW,QAAO,KAAK;AAAA,UAClC,MAAK,iBAAiB;AAC3B,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,0BAAgC;AAC9B,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,iBAAiB,UAAiC;AACtD,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,cAAc,SAAS,EAAE;AAAA,EACrE;AAAA,EAEA,MAAM,eAAgC;AACpC,UAAM,YAAY,MAAM,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,uCAAuC;AACtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBACJ,MACe;AACf,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAO,EAAE,GAAG,MAAM;AACxB,UAAI,SAAS,SAAS,SAAS,SAAU,QAAO,KAAK;AACrD,UAAI,SAAS,SAAS,SAAS,UAAU;AACvC,eAAO,KAAK;AACZ,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,SAAS,SAAS,WAAY,QAAO,KAAK;AACvD,UAAI,SAAS,SAAS,SAAS,YAAa,QAAO,KAAK;AACxD,UAAI,SAAS,MAAO,QAAO,KAAK;AAChC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,mBAAmB,WAAqC;AAC5D,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,UAAU,EAAE;AAAA,EACxD;AAAA,EAEA,MAAM,iBAAiD;AACrD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,SAAwB;AAC5B,UAAM,KAAK;AACX,UAAM,KAAK,aAAa,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAClD;AACF;AAIA,eAAsB,YACpB,UACA,QACA,SACoB;AACpB,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,OAAO,MAAM,wBAAwB,OAAO,OAAO,KAAK;AAAA,IAC5D,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,sBAAsB,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,IAC1F,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,EAC9E,CAAC;AACD,MAAI,CAAC,WAAY,OAAM,SAAS,mBAAmB,IAAI;AACvD,QAAM,WAAW,KAAK;AACtB,MAAI,YAAY,CAAC,SAAS,yBAAyB,SAAS,MAAM;AAChE,UAAM,IAAI,MAAM,+DAA+D;AACjF,MACE,UAAU,oCACV,CAAC,SAAS,iCAAiC,SAAS,MAAM;AAE1D,UAAM,IAAI,MAAM,qDAAqD;AACvE,QAAM,QACJ,OAAO,OAAO,OAAO,SAAS,KAAK,kBAAkB,kBAAkB,KAAK,GAAG,KAAK;AACtF,MAAI,SAAS,MAAM,SAAS,kBAAkB;AAC9C,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,eAAe,KAAK,wBAAwB;AAAA,MACzD,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,gBAAgB,SAAS;AAAA,MACzB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MACzB,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,UAAM,SAAS,sBAAsB,MAAM;AAAA,EAC7C;AACA,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,KAAK;AAC3C,QAAM,QAAQ,YAAY;AAC1B,QAAM,SAAS,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,cAAc,UAAU,YAAY,MAAM,EAAE;AAC9F,QAAM,MAAM,IAAI;AAAA,IACd,UAAU,0BAA0B,IAAI,IAAI,cAAc,KAAK,sBAAsB;AAAA,EACvF;AACA,MAAI,CAAC,UAAU,GAAG,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAC9F,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,aAAa,OAAO,SAAS;AAClD,MAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,gBAAgB,SAAS,WAAW;AACzD,MAAI,aAAa,IAAI,SAAS,KAAK;AACnC,MAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,MAAI,OAAO,MAAM,KAAK,EAAE,SAAS,gBAAgB,EAAG,KAAI,aAAa,IAAI,UAAU,SAAS;AAC5F,QAAM,WAAW,eAAe,OAAO,OAAO,KAAK,KAAK,gBAAgB;AACxE,MAAI,SAAU,KAAI,aAAa,IAAI,YAAY,QAAQ;AACvD,SAAO,EAAE,KAAK,IAAI,MAAM,MAAM;AAChC;AAUA,eAAsB,aACpB,UACA,QACA,QACA,OACe;AACf,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,MAAM;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,QAAM,YAAY,MAAM,SAAS,KAAK,GAAG;AACzC,MAAI,CAAC,YAAY,SAAS,UAAU;AAClC,UAAM,IAAI,MAAM,2DAA2D;AAC7E,MAAI,SAAS;AACX,UAAM,IAAI;AAAA,MACR,mBAAmB,SAAS,SAAS,mBAAmB,KAAK,KAAK,SAAS,KAAK,CAAC;AAAA,IACnF;AACF,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,+CAA+C;AACnF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,aAAa,UAAU;AAAA,IAC3B,WAAW,OAAO,OAAO;AAAA,IACzB,mBAAmB,SAAS;AAAA,IAC5B,GAAI,SAAS,MAAM,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC;AAAA,IAC5C,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IACzE,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AACD,QAAM,SAAS,OAAO,CAAC,UAAU;AAC/B,UAAM,OAAO,EAAE,GAAG,MAAM;AACxB,WAAO,KAAK;AACZ,WAAO,KAAK;AACZ,WAAO;AAAA,EACT,CAAC;AACH;",
   "names": []
 }

package/dist/spectrum/mcp-login.js

@@ -28,7 +28,7 @@ function answered(channel, state, signal, timeoutMs) {
     };
     const timer = setTimeout(() => {
       done();
-      reject(new Error("the sign-in window gave no answer; try again"));
+      reject(new Error("The sign-in window gave no answer. Try again."));
     }, timeoutMs);
     signal.addEventListener("abort", stop, { once: true });
     channel.onmessage = ({ data }) => {
@@ -47,11 +47,11 @@ function mcpLogin(host = browser) {
     try {
       const started = await signIn();
       options.signal.throwIfAborted();
-      if (!started?.url) throw new Error("this MCP server has no sign-in");
+      if (!started?.url) throw new Error("This MCP server has no sign-in.");
       if (!safeAuthorizationUrl(started.url))
-        throw new Error("the authorization server gave a sign-in address that is not https");
+        throw new Error("The authorization server gave a sign-in address that isn't https.");
       if (!popup)
-        throw new Error("the browser blocked the sign-in window; allow pop-ups for SLICC");
+        throw new Error("The browser blocked the sign-in window. Allow pop-ups for SLICC.");
       state = started.state;
       host.remember?.(state, providerId.replace(/^mcp:/, ""));
       popup.location.href = started.url;

package/dist/spectrum/mcp-login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/spectrum/mcp-login.ts"],
-  "sourcesContent": ["import type { McpSignIn, SignIn } from '../services.ts';\n\nexport const MCP_CHANNEL = 'slicc-mcp-oauth';\nexport const MCP_NAME_KEY = 'slicc-mcp-oauth:';\nexport const SIGN_IN_TIMEOUT_MS = 5 * 60 * 1000;\n\nexport interface Popup {\n  location: { href: string };\n  close(): void;\n}\n\nexport interface Channel {\n  onmessage: ((event: { data: unknown }) => void) | null;\n  close(): void;\n}\n\nexport interface McpLoginHost {\n  open(): Popup | null;\n  channel(): Channel;\n  remember?(state: string, name: string | null): void;\n  timeoutMs?: number;\n}\n\nconst browser: McpLoginHost = {\n  open: () =>\n    globalThis.open?.('about:blank', 'slicc-mcp-oauth', 'popup,width=520,height=720') ?? null,\n  channel: () => new BroadcastChannel(MCP_CHANNEL) as unknown as Channel,\n  remember: (state, name) => {\n    const key = `${MCP_NAME_KEY}${state}`;\n    if (name === null) globalThis.localStorage?.removeItem(key);\n    else globalThis.localStorage?.setItem(key, name);\n  },\n};\n\nconst LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);\n\nexport function safeAuthorizationUrl(value: string): boolean {\n  if (!URL.canParse(value)) return false;\n  const url = new URL(value);\n  return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));\n}\n\nfunction answered(channel: Channel, state: string, signal: AbortSignal, timeoutMs: number) {\n  return new Promise<string>((resolve, reject) => {\n    const done = () => {\n      clearTimeout(timer);\n      signal.removeEventListener('abort', stop);\n    };\n    const stop = () => {\n      done();\n      reject(signal.reason);\n    };\n    const timer = setTimeout(() => {\n      done();\n      reject(new Error('the sign-in window gave no answer; try again'));\n    }, timeoutMs);\n    signal.addEventListener('abort', stop, { once: true });\n    channel.onmessage = ({ data }) => {\n      const answer = data as { state?: unknown } | null;\n      if (answer?.state !== state) return;\n      done();\n      resolve(JSON.stringify(answer));\n    };\n  });\n}\n\nexport function mcpLogin(host: McpLoginHost = browser) {\n  return async (\n    providerId: string,\n    signIn: () => Promise<SignIn | McpSignIn | null>,\n    options: { signal: AbortSignal }\n  ): Promise<string> => {\n    const popup = host.open();\n    const channel = host.channel();\n    let state: string | undefined;\n    try {\n      const started = (await signIn()) as McpSignIn | null;\n      options.signal.throwIfAborted();\n      if (!started?.url) throw new Error('this MCP server has no sign-in');\n      if (!safeAuthorizationUrl(started.url))\n        throw new Error('the authorization server gave a sign-in address that is not https');\n      if (!popup)\n        throw new Error('the browser blocked the sign-in window; allow pop-ups for SLICC');\n      state = started.state;\n      host.remember?.(state, providerId.replace(/^mcp:/, ''));\n      popup.location.href = started.url;\n      return await answered(channel, state, options.signal, host.timeoutMs ?? SIGN_IN_TIMEOUT_MS);\n    } finally {\n      if (state) host.remember?.(state, null);\n      channel.close();\n      popup?.close();\n    }\n  };\n}\n"],
-  "mappings": "AAEO,MAAM,cAAc;AACpB,MAAM,eAAe;AACrB,MAAM,qBAAqB,IAAI,KAAK;AAmB3C,MAAM,UAAwB;AAAA,EAC5B,MAAM,MACJ,WAAW,OAAO,eAAe,mBAAmB,4BAA4B,KAAK;AAAA,EACvF,SAAS,MAAM,IAAI,iBAAiB,WAAW;AAAA,EAC/C,UAAU,CAAC,OAAO,SAAS;AACzB,UAAM,MAAM,GAAG,YAAY,GAAG,KAAK;AACnC,QAAI,SAAS,KAAM,YAAW,cAAc,WAAW,GAAG;AAAA,QACrD,YAAW,cAAc,QAAQ,KAAK,IAAI;AAAA,EACjD;AACF;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAErD,SAAS,qBAAqB,OAAwB;AAC3D,MAAI,CAAC,IAAI,SAAS,KAAK,EAAG,QAAO;AACjC,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,SAAO,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,SAAS,IAAI,IAAI,QAAQ;AAC5F;AAEA,SAAS,SAAS,SAAkB,OAAe,QAAqB,WAAmB;AACzF,SAAO,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC9C,UAAM,OAAO,MAAM;AACjB,mBAAa,KAAK;AAClB,aAAO,oBAAoB,SAAS,IAAI;AAAA,IAC1C;AACA,UAAM,OAAO,MAAM;AACjB,WAAK;AACL,aAAO,OAAO,MAAM;AAAA,IACtB;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,WAAK;AACL,aAAO,IAAI,MAAM,8CAA8C,CAAC;AAAA,IAClE,GAAG,SAAS;AACZ,WAAO,iBAAiB,SAAS,MAAM,EAAE,MAAM,KAAK,CAAC;AACrD,YAAQ,YAAY,CAAC,EAAE,KAAK,MAAM;AAChC,YAAM,SAAS;AACf,UAAI,QAAQ,UAAU,MAAO;AAC7B,WAAK;AACL,cAAQ,KAAK,UAAU,MAAM,CAAC;AAAA,IAChC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,SAAS,OAAqB,SAAS;AACrD,SAAO,OACL,YACA,QACA,YACoB;AACpB,UAAM,QAAQ,KAAK,KAAK;AACxB,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI;AACJ,QAAI;AACF,YAAM,UAAW,MAAM,OAAO;AAC9B,cAAQ,OAAO,eAAe;AAC9B,UAAI,CAAC,SAAS,IAAK,OAAM,IAAI,MAAM,gCAAgC;AACnE,UAAI,CAAC,qBAAqB,QAAQ,GAAG;AACnC,cAAM,IAAI,MAAM,mEAAmE;AACrF,UAAI,CAAC;AACH,cAAM,IAAI,MAAM,iEAAiE;AACnF,cAAQ,QAAQ;AAChB,WAAK,WAAW,OAAO,WAAW,QAAQ,SAAS,EAAE,CAAC;AACtD,YAAM,SAAS,OAAO,QAAQ;AAC9B,aAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,QAAQ,KAAK,aAAa,kBAAkB;AAAA,IAC5F,UAAE;AACA,UAAI,MAAO,MAAK,WAAW,OAAO,IAAI;AACtC,cAAQ,MAAM;AACd,aAAO,MAAM;AAAA,IACf;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { McpSignIn, SignIn } from '../services.ts';\n\nexport const MCP_CHANNEL = 'slicc-mcp-oauth';\nexport const MCP_NAME_KEY = 'slicc-mcp-oauth:';\nexport const SIGN_IN_TIMEOUT_MS = 5 * 60 * 1000;\n\nexport interface Popup {\n  location: { href: string };\n  close(): void;\n}\n\nexport interface Channel {\n  onmessage: ((event: { data: unknown }) => void) | null;\n  close(): void;\n}\n\nexport interface McpLoginHost {\n  open(): Popup | null;\n  channel(): Channel;\n  remember?(state: string, name: string | null): void;\n  timeoutMs?: number;\n}\n\nconst browser: McpLoginHost = {\n  open: () =>\n    globalThis.open?.('about:blank', 'slicc-mcp-oauth', 'popup,width=520,height=720') ?? null,\n  channel: () => new BroadcastChannel(MCP_CHANNEL) as unknown as Channel,\n  remember: (state, name) => {\n    const key = `${MCP_NAME_KEY}${state}`;\n    if (name === null) globalThis.localStorage?.removeItem(key);\n    else globalThis.localStorage?.setItem(key, name);\n  },\n};\n\nconst LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);\n\nexport function safeAuthorizationUrl(value: string): boolean {\n  if (!URL.canParse(value)) return false;\n  const url = new URL(value);\n  return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));\n}\n\nfunction answered(channel: Channel, state: string, signal: AbortSignal, timeoutMs: number) {\n  return new Promise<string>((resolve, reject) => {\n    const done = () => {\n      clearTimeout(timer);\n      signal.removeEventListener('abort', stop);\n    };\n    const stop = () => {\n      done();\n      reject(signal.reason);\n    };\n    const timer = setTimeout(() => {\n      done();\n      reject(new Error('The sign-in window gave no answer. Try again.'));\n    }, timeoutMs);\n    signal.addEventListener('abort', stop, { once: true });\n    channel.onmessage = ({ data }) => {\n      const answer = data as { state?: unknown } | null;\n      if (answer?.state !== state) return;\n      done();\n      resolve(JSON.stringify(answer));\n    };\n  });\n}\n\nexport function mcpLogin(host: McpLoginHost = browser) {\n  return async (\n    providerId: string,\n    signIn: () => Promise<SignIn | McpSignIn | null>,\n    options: { signal: AbortSignal }\n  ): Promise<string> => {\n    const popup = host.open();\n    const channel = host.channel();\n    let state: string | undefined;\n    try {\n      const started = (await signIn()) as McpSignIn | null;\n      options.signal.throwIfAborted();\n      if (!started?.url) throw new Error('This MCP server has no sign-in.');\n      if (!safeAuthorizationUrl(started.url))\n        throw new Error(\"The authorization server gave a sign-in address that isn't https.\");\n      if (!popup)\n        throw new Error('The browser blocked the sign-in window. Allow pop-ups for SLICC.');\n      state = started.state;\n      host.remember?.(state, providerId.replace(/^mcp:/, ''));\n      popup.location.href = started.url;\n      return await answered(channel, state, options.signal, host.timeoutMs ?? SIGN_IN_TIMEOUT_MS);\n    } finally {\n      if (state) host.remember?.(state, null);\n      channel.close();\n      popup?.close();\n    }\n  };\n}\n"],
+  "mappings": "AAEO,MAAM,cAAc;AACpB,MAAM,eAAe;AACrB,MAAM,qBAAqB,IAAI,KAAK;AAmB3C,MAAM,UAAwB;AAAA,EAC5B,MAAM,MACJ,WAAW,OAAO,eAAe,mBAAmB,4BAA4B,KAAK;AAAA,EACvF,SAAS,MAAM,IAAI,iBAAiB,WAAW;AAAA,EAC/C,UAAU,CAAC,OAAO,SAAS;AACzB,UAAM,MAAM,GAAG,YAAY,GAAG,KAAK;AACnC,QAAI,SAAS,KAAM,YAAW,cAAc,WAAW,GAAG;AAAA,QACrD,YAAW,cAAc,QAAQ,KAAK,IAAI;AAAA,EACjD;AACF;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAErD,SAAS,qBAAqB,OAAwB;AAC3D,MAAI,CAAC,IAAI,SAAS,KAAK,EAAG,QAAO;AACjC,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,SAAO,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,SAAS,IAAI,IAAI,QAAQ;AAC5F;AAEA,SAAS,SAAS,SAAkB,OAAe,QAAqB,WAAmB;AACzF,SAAO,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC9C,UAAM,OAAO,MAAM;AACjB,mBAAa,KAAK;AAClB,aAAO,oBAAoB,SAAS,IAAI;AAAA,IAC1C;AACA,UAAM,OAAO,MAAM;AACjB,WAAK;AACL,aAAO,OAAO,MAAM;AAAA,IACtB;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,WAAK;AACL,aAAO,IAAI,MAAM,+CAA+C,CAAC;AAAA,IACnE,GAAG,SAAS;AACZ,WAAO,iBAAiB,SAAS,MAAM,EAAE,MAAM,KAAK,CAAC;AACrD,YAAQ,YAAY,CAAC,EAAE,KAAK,MAAM;AAChC,YAAM,SAAS;AACf,UAAI,QAAQ,UAAU,MAAO;AAC7B,WAAK;AACL,cAAQ,KAAK,UAAU,MAAM,CAAC;AAAA,IAChC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,SAAS,OAAqB,SAAS;AACrD,SAAO,OACL,YACA,QACA,YACoB;AACpB,UAAM,QAAQ,KAAK,KAAK;AACxB,UAAM,UAAU,KAAK,QAAQ;AAC7B,QAAI;AACJ,QAAI;AACF,YAAM,UAAW,MAAM,OAAO;AAC9B,cAAQ,OAAO,eAAe;AAC9B,UAAI,CAAC,SAAS,IAAK,OAAM,IAAI,MAAM,iCAAiC;AACpE,UAAI,CAAC,qBAAqB,QAAQ,GAAG;AACnC,cAAM,IAAI,MAAM,mEAAmE;AACrF,UAAI,CAAC;AACH,cAAM,IAAI,MAAM,kEAAkE;AACpF,cAAQ,QAAQ;AAChB,WAAK,WAAW,OAAO,WAAW,QAAQ,SAAS,EAAE,CAAC;AACtD,YAAM,SAAS,OAAO,QAAQ;AAC9B,aAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,QAAQ,KAAK,aAAa,kBAAkB;AAAA,IAC5F,UAAE;AACA,UAAI,MAAO,MAAK,WAAW,OAAO,IAAI;AACtC,cAAQ,MAAM;AACd,aAAO,MAAM;AAAA,IACf;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/types/mcp/oauth.d.ts

@@ -8,6 +8,7 @@ type Tokens = Awaited<ReturnType<Provider['tokens']>>;
 type Client = Awaited<ReturnType<Provider['clientInformation']>>;
 type Discovery = NonNullable<McpOAuthState['discovery']>;
 export declare const CLIENT_NAME = "SLICC";
+export declare function sentence(text: string): string;
 export declare function secureUrl(url: URL): boolean;
 export declare function signInRequired(cause?: unknown): McpOAuthAuthorizationRequiredError;
 export declare function authProvider(provider: StoredOAuth, server: OAuthServer): AuthProvider;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "3.36.0",
+  "version": "3.36.1",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",
@@ -63,7 +63,7 @@
   "devDependencies": {
     "@ai-ecoverse/slicc-kernel": "1.47.1",
     "@ai-ecoverse/slicc-shared-web": "1.12.1",
-    "@ai-ecoverse/slicc-spectrum": "1.53.0",
+    "@ai-ecoverse/slicc-spectrum": "1.54.0",
     "@ai-ecoverse/wasm-bash": "5.3.0-17",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-5",
     "@ai-ecoverse/wasm-git": "2.55.0-15",