@akon-labs/nexus-cli 0.1.9 → 0.1.10

package/dist/extensions/mcp/mcp-bearer-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-bearer-store.js","sourceRoot":"","sources":["../../../src/extensions/mcp/mcp-bearer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA6B1C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACjD,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AACvC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,IAAI,iBAAsD,CAAC;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AACtD,IAAI,8BAA8B,GAAG,CAAC,CAAC;AAEvC,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC3C,IAAI,GAAG,qCAAqC,CAAC;IAC7C,SAAS,CAA8B;IAEhD,qEAAqE;IACrE,gEAAgE;IAChE,YAAY,OAAe,EAAE,SAAsC,EAAE,KAAc,EAAE;QACpF,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAAA,CAC3B;CACD;AAQD,MAAM,uBAAuB,GAAsB;IAClD,IAAI,CAAC,OAAO,EAAE;QACb,8BAA8B,EAAE,CAAC;QACjC,OAAO,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAA,CACxC;IACD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE;QACvB,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CAC1C;IACD,MAAM,CAAC,OAAO,EAAE;QACf,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAA,CACpC;CACD,CAAC;AAEF,MAAM,4BAA4B,GAAsB;IACvD,IAAI,CAAC,OAAO,EAAE;QACb,8BAA8B,EAAE,CAAC;QACjC,OAAO,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAA,CACxC;IACD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE;QACvB,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACd,8EAA8E,yBAAyB,GAAG,CAAC,QAAQ,CACnH,CAAC;QACH,CAAC;QACD,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CAC1C;IACD,MAAM,CAAC,OAAO,EAAE;QACf,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAA,CACpC;CACD,CAAC;AAEF,MAAM,4BAA4B,GAAsB;IACvD,IAAI,GAAG;QACN,8BAA8B,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAAA,CACjE;IACD,KAAK,GAAG;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAAA,CACjE;IACD,MAAM,GAAG;QACR,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAAA,CACjE;CACD,CAAC;AAEF,MAAM,wBAAwB,GAAsB;IACnD,IAAI,CAAC,OAAO,EAAE;QACb,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IAAA,CAC3D;IACD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE;QACvB,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CAC9C;IACD,MAAM,CAAC,OAAO,EAAE;QACf,eAAe,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAAA,CAC5C;CACD,CAAC;AAEF,SAAS,oBAAoB,GAAsB;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAClF,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,aAAa;QAAE,OAAO,4BAA4B,CAAC;IAC5F,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,aAAa;QAAE,OAAO,4BAA4B,CAAC;IAC5F,OAAO,wBAAwB,CAAC;AAAA,CAChC;AAED,SAAS,eAAe,CAAC,OAAe,EAAgB;IACvD,IAAI,CAAC;QACJ,iBAAiB,KAAK,qBAAqB,EAAE,CAAC;QAC9C,OAAO,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,qGAAqG,EACrG,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,CAC7B,cAAc,GAAmB,OAAO,EACxC,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,IAAI,GAAwB,OAAO,CAAC,IAAI,EACd;IAC1B,IAAI,CAAC;QACJ,OAAQ,cAAc,CAAC,kBAAkB,CAAmB,CAAC,KAAK,CAAC;IACpE,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACtB,IAAI,CAAC;YACJ,OAAO,gCAAgC,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC;QAC/E,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC/F,MAAM,IAAI,KAAK,CACd,uFAAuF,OAAO,EAAE,EAChG,EAAE,KAAK,EAAE,WAAW,EAAE,CACtB,CAAC;QACH,CAAC;IACF,CAAC;AAAA,CACD;AAED,SAAS,gCAAgC,CACxC,cAA8B,EAC9B,QAAyB,EACzB,IAAyB,EACT;IAChB,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,WAAW,EAAE,oBAAoB,MAAM,EAAE;QACzC,WAAW,EAAE,WAAW,MAAM,OAAO;KACrC,CAAC,CAAC,CAAC;IACJ,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,eAAe,CAAC,CAAC;YACrF,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAkB,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,CAAC;QACnB,CAAC;IACF,CAAC;IACD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,+BAA+B,CAAC,QAAyB,EAAE,IAAyB,EAAY;IACxG,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACrE,OAAO,EAAE,CAAC;AAAA,CACV;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAU;IACrD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,CACjF;AAED,SAAS,kBAAkB,CAAC,UAAkB,EAAE,OAAe,EAA2B;IACzF,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,oBAAoB,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,MAA0C,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,oBAAoB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAAA,CAC5D;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe,EAAW;IAC5E,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAgC;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAqC,CAAC;IACvD,OAAO,CACN,QAAQ,CAAC,uBAAuB,KAAK,CAAC;QACtC,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,QAAQ,CAAC,UAAU,GAAG,CAAC;QACvB,QAAQ,CAAC,UAAU,IAAI,wBAAwB;QAC/C,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC3C,CAAC;AAAA,CACF;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,OAAe,EAAmC;IAC3F,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC1D;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,QAA6B,EAAE,KAAa,EAAU;IAC5F,OAAO,GAAG,OAAO,UAAU,QAAQ,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC;AAAA,CAC3D;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,QAA6B,EAAY;IAChF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAAA,CACzG;AAED,SAAS,cAAc,CAAC,OAAe,EAAuB;IAC7D,OAAO;QACN,uBAAuB,EAAE,CAAC;QAC1B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,wBAAwB,CAAC;QAChE,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACpF,CAAC;AAAA,CACF;AAED,SAAS,oBAAoB,CAC5B,KAAwB,EACxB,UAAkB,EAClB,OAAe,EACmB;IAClC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,YAAY,CAAC,KAAwB,EAAE,OAAe,EAAE,QAAyC,EAAQ;IACjH,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,KAAK,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAAA,CACtF;AAED,SAAS,eAAe,CAAC,KAAwB,EAAE,OAAe,EAAE,QAAyC,EAAQ;IACpH,IAAI,CAAC;QACJ,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,mEAAmE;IACpE,CAAC;AAAA,CACD;AAED,SAAS,yBAAyB,CAAC,KAAwB,EAAE,UAAkB,EAAuC;IACrH,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACJ,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CACnC,mCAAmC,UAAU,sCAAsC,EACnF,MAAM,EACN,KAAK,CACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,QAAQ;YAC7B,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;iBAC/B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACpC,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAAC;gBACzF,OAAO,KAAK,CAAC;YAAA,CACb,CAAC;iBACD,IAAI,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,OAAO,CAAC;QACX,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,QAAQ,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CACnC,mCAAmC,UAAU,sCAAsC,EACnF,MAAM,EACN,KAAK,CACL,CAAC;IACH,CAAC;AAAA,CACD;AAED,SAAS,wBAAwB,CAAC,KAAwB,EAAE,UAAkB,EAAE,MAA+B,EAAQ;IACtH,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,CAAC;QACJ,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC1D,KAAK,CAAC,KAAK,CACV,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EACtC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,wBAAwB,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,wBAAwB,CAAC,CACvF,CAAC;YACH,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,gBAAgB,EAAE,WAAW,KAAK,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC7D,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,gBAAgB,EAAE,WAAW,KAAK,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC7D,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,0BAA0B,CACnC,oCAAoC,UAAU,oCAAoC,EAClF,OAAO,EACP,KAAK,CACL,CAAC;IACH,CAAC;AAAA,CACD;AAED,SAAS,2BAA2B,CAAC,KAAwB,EAAE,UAAkB,EAAQ;IACxF,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACvF,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,0BAA0B,CACnC,qCAAqC,UAAU,sCAAsC,EACrF,QAAQ,EACR,KAAK,CACL,CAAC;IACH,CAAC;AAAA,CACD;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,SAAiB,EAAsB;IAC/F,MAAM,MAAM,GAAG,yBAAyB,CAAC,oBAAoB,EAAE,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACjE;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,KAAa,EAAE,SAAiB,EAAQ;IACjG,wBAAwB,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAAA,CACnF;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAQ;IAC3D,2BAA2B,CAAC,oBAAoB,EAAE,EAAE,UAAU,CAAC,CAAC;AAAA,CAChE;AAED,MAAM,UAAU,wBAAwB,CAAC,UAAkB,EAAE,SAAiB,EAA0B;IACvG,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,oBAAoB,EAAE,EAAE,UAAU,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,0BAA0B,CAAC;YAAE,MAAM,KAAK,CAAC;QAChE,OAAO;YACN,MAAM,EAAE,aAAa;YACrB,OAAO,EACN,0GAA0G;SAC3G,CAAC;IACH,CAAC;AAAA,CACD;AAED,MAAM,UAAU,yBAAyB,GAAS;IACjD,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC5B,8BAA8B,GAAG,CAAC,CAAC;AAAA,CACnC;AAED,MAAM,UAAU,8BAA8B,GAAuB;IACpE,OAAO,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC;AAAA,CAC1C;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAe,EAAQ;IACtE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAAA,CACpC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,OAAe,EAAQ;IACpF,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAAA,CAC1C;AAED,MAAM,UAAU,gCAAgC,GAAW;IAC1D,OAAO,8BAA8B,CAAC;AAAA,CACtC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join } from \"node:path\";\n\ntype KeyringEntry = {\n\tgetPassword(): string | null;\n\tsetPassword(password: string): void;\n\tdeleteCredential(): boolean;\n};\n\ntype KeyringEntryConstructor = new (service: string, account: string) => KeyringEntry;\ntype KeyringModule = { Entry: KeyringEntryConstructor };\ntype KeyringRequire = ((id: string) => unknown) & { resolve(id: string): string };\n\ntype BearerSecretStore = {\n\tread(account: string): string | undefined;\n\twrite(account: string, payload: string): void;\n\tremove(account: string): void;\n};\n\ninterface StoredBearerTokenRecord {\n\ttoken: string;\n\tserverUrl: string;\n}\n\ninterface BearerChunkManifest {\n\t__nexusMcpBearerChunked: 1;\n\tchunkCount: number;\n\tchunkDigest: string;\n}\n\nconst require = createRequire(import.meta.url);\nconst BEARER_SECRET_SERVICE = \"nexus-mcp.bearer\";\nconst TEST_AUTH_STORE_ENV = \"NEXUS_MCP_TEST_AUTH_STORE\";\nconst BEARER_SECRET_CHUNK_SIZE = 1000;\nconst BEARER_SECRET_VALUE_LIMIT = 1280;\nconst MAX_BEARER_SECRET_CHUNKS = 128;\n\nlet KeyringEntryClass: KeyringEntryConstructor | undefined;\nconst memoryBearerEntries = new Map<string, string>();\nlet testBearerSecretStoreReadCount = 0;\n\nexport class BearerCredentialStoreError extends Error {\n\treadonly code = \"BEARER_CREDENTIAL_STORE_UNAVAILABLE\";\n\treadonly operation: \"read\" | \"write\" | \"remove\";\n\n\t// No parameter properties: cli.js loads this module under plain Node\n\t// type stripping, which rejects non-erasable TypeScript syntax.\n\tconstructor(message: string, operation: \"read\" | \"write\" | \"remove\", cause: unknown) {\n\t\tsuper(message, { cause });\n\t\tthis.name = \"BearerCredentialStoreError\";\n\t\tthis.operation = operation;\n\t}\n}\n\nexport type BearerCredentialStatus =\n\t| { status: \"present\" }\n\t| { status: \"missing\" }\n\t| { status: \"url-mismatch\" }\n\t| { status: \"unavailable\"; message: string };\n\nconst memoryBearerSecretStore: BearerSecretStore = {\n\tread(account) {\n\t\ttestBearerSecretStoreReadCount++;\n\t\treturn memoryBearerEntries.get(account);\n\t},\n\twrite(account, payload) {\n\t\tmemoryBearerEntries.set(account, payload);\n\t},\n\tremove(account) {\n\t\tmemoryBearerEntries.delete(account);\n\t},\n};\n\nconst sizeLimitedBearerSecretStore: BearerSecretStore = {\n\tread(account) {\n\t\ttestBearerSecretStoreReadCount++;\n\t\treturn memoryBearerEntries.get(account);\n\t},\n\twrite(account, payload) {\n\t\tif (payload.length > BEARER_SECRET_VALUE_LIMIT) {\n\t\t\tthrow new Error(\n\t\t\t\t`Value of 'password encoded as UTF-16' is longer than the platform limit of ${BEARER_SECRET_VALUE_LIMIT * 2} chars`,\n\t\t\t);\n\t\t}\n\t\tmemoryBearerEntries.set(account, payload);\n\t},\n\tremove(account) {\n\t\tmemoryBearerEntries.delete(account);\n\t},\n};\n\nconst unavailableBearerSecretStore: BearerSecretStore = {\n\tread() {\n\t\ttestBearerSecretStoreReadCount++;\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n\twrite() {\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n\tremove() {\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n};\n\nconst keyringBearerSecretStore: BearerSecretStore = {\n\tread(account) {\n\t\treturn getKeyringEntry(account).getPassword() ?? undefined;\n\t},\n\twrite(account, payload) {\n\t\tgetKeyringEntry(account).setPassword(payload);\n\t},\n\tremove(account) {\n\t\tgetKeyringEntry(account).deleteCredential();\n\t},\n};\n\nfunction getBearerSecretStore(): BearerSecretStore {\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"memory\") return memoryBearerSecretStore;\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"sizelimited\") return sizeLimitedBearerSecretStore;\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"unavailable\") return unavailableBearerSecretStore;\n\treturn keyringBearerSecretStore;\n}\n\nfunction getKeyringEntry(account: string): KeyringEntry {\n\ttry {\n\t\tKeyringEntryClass ??= loadKeyringEntryClass();\n\t\treturn new KeyringEntryClass(BEARER_SECRET_SERVICE, account);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t\"Bearer token secure credential storage is unavailable. Configure the OS credential store and retry.\",\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\nfunction loadKeyringEntryClass(\n\tkeyringRequire: KeyringRequire = require,\n\tplatform: NodeJS.Platform = process.platform,\n\tarch: NodeJS.Architecture = process.arch,\n): KeyringEntryConstructor {\n\ttry {\n\t\treturn (keyringRequire(\"@napi-rs/keyring\") as KeyringModule).Entry;\n\t} catch (loaderError) {\n\t\ttry {\n\t\t\treturn loadKeyringNativeBindingFallback(keyringRequire, platform, arch).Entry;\n\t\t} catch (fallbackError) {\n\t\t\tconst message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${message}`,\n\t\t\t\t{ cause: loaderError },\n\t\t\t);\n\t\t}\n\t}\n}\n\nfunction loadKeyringNativeBindingFallback(\n\tkeyringRequire: KeyringRequire,\n\tplatform: NodeJS.Platform,\n\tarch: NodeJS.Architecture,\n): KeyringModule {\n\tconst targets = getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({\n\t\tpackageName: `@napi-rs/keyring-${suffix}`,\n\t\tbindingFile: `keyring.${suffix}.node`,\n\t}));\n\tlet lastError: unknown;\n\tfor (const target of targets) {\n\t\ttry {\n\t\t\tconst packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);\n\t\t\treturn keyringRequire(join(dirname(packageJsonPath), target.bindingFile)) as KeyringModule;\n\t\t} catch (error) {\n\t\t\tlastError = error;\n\t\t}\n\t}\n\tthrow lastError instanceof Error ? lastError : new Error(String(lastError));\n}\n\nfunction getKeyringNativeBindingSuffixes(platform: NodeJS.Platform, arch: NodeJS.Architecture): string[] {\n\tif (platform === \"darwin\") {\n\t\tif (arch === \"arm64\") return [\"darwin-arm64\"];\n\t\tif (arch === \"x64\") return [\"darwin-x64\"];\n\t}\n\tif (platform === \"win32\") {\n\t\tif (arch === \"arm64\") return [\"win32-arm64-msvc\"];\n\t\tif (arch === \"x64\") return [\"win32-x64-msvc\"];\n\t\tif (arch === \"ia32\") return [\"win32-ia32-msvc\"];\n\t}\n\tif (platform === \"linux\") {\n\t\tif (arch === \"arm64\") return [\"linux-arm64-gnu\", \"linux-arm64-musl\"];\n\t\tif (arch === \"arm\") return [\"linux-arm-gnueabihf\"];\n\t\tif (arch === \"riscv64\") return [\"linux-riscv64-gnu\"];\n\t\tif (arch === \"x64\") return [\"linux-x64-gnu\", \"linux-x64-musl\"];\n\t}\n\tif (platform === \"freebsd\" && arch === \"x64\") return [\"freebsd-x64\"];\n\treturn [];\n}\n\nfunction getBearerAccount(serverName: string): string {\n\tif (typeof serverName !== \"string\") {\n\t\tthrow new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);\n\t}\n\treturn `sha256-${createHash(\"sha256\").update(serverName, \"utf8\").digest(\"hex\")}`;\n}\n\nfunction parseBearerPayload(serverName: string, payload: string): StoredBearerTokenRecord {\n\tconst parsed = parseStoredBearerJson(serverName, payload);\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\tthrow new Error(`Stored bearer token record for ${serverName} has invalid shape`);\n\t}\n\tconst record = parsed as Partial<StoredBearerTokenRecord>;\n\tif (typeof record.token !== \"string\" || typeof record.serverUrl !== \"string\") {\n\t\tthrow new Error(`Stored bearer token record for ${serverName} has invalid shape`);\n\t}\n\treturn { token: record.token, serverUrl: record.serverUrl };\n}\n\nfunction parseStoredBearerJson(serverName: string, payload: string): unknown {\n\ttry {\n\t\treturn JSON.parse(payload) as unknown;\n\t} catch {\n\t\tthrow new Error(`Failed to parse stored bearer token record for ${serverName}`);\n\t}\n}\n\nfunction isBearerChunkManifest(value: unknown): value is BearerChunkManifest {\n\tif (typeof value !== \"object\" || value === null) return false;\n\tconst manifest = value as Partial<BearerChunkManifest>;\n\treturn (\n\t\tmanifest.__nexusMcpBearerChunked === 1 &&\n\t\ttypeof manifest.chunkCount === \"number\" &&\n\t\tNumber.isInteger(manifest.chunkCount) &&\n\t\tmanifest.chunkCount > 0 &&\n\t\tmanifest.chunkCount <= MAX_BEARER_SECRET_CHUNKS &&\n\t\ttypeof manifest.chunkDigest === \"string\" &&\n\t\t/^[a-f0-9]{16}$/.test(manifest.chunkDigest)\n\t);\n}\n\nfunction readManifest(serverName: string, payload: string): BearerChunkManifest | undefined {\n\tconst parsed = parseStoredBearerJson(serverName, payload);\n\treturn isBearerChunkManifest(parsed) ? parsed : undefined;\n}\n\nfunction chunkAccount(account: string, manifest: BearerChunkManifest, index: number): string {\n\treturn `${account}.chunk.${manifest.chunkDigest}.${index}`;\n}\n\nfunction chunkAccounts(account: string, manifest: BearerChunkManifest): string[] {\n\treturn Array.from({ length: manifest.chunkCount }, (_, index) => chunkAccount(account, manifest, index));\n}\n\nfunction createManifest(payload: string): BearerChunkManifest {\n\treturn {\n\t\t__nexusMcpBearerChunked: 1,\n\t\tchunkCount: Math.ceil(payload.length / BEARER_SECRET_CHUNK_SIZE),\n\t\tchunkDigest: createHash(\"sha256\").update(payload, \"utf8\").digest(\"hex\").slice(0, 16),\n\t};\n}\n\nfunction readExistingManifest(\n\tstore: BearerSecretStore,\n\tserverName: string,\n\taccount: string,\n): BearerChunkManifest | undefined {\n\ttry {\n\t\tconst payload = store.read(account);\n\t\treturn payload === undefined ? undefined : readManifest(serverName, payload);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction removeChunks(store: BearerSecretStore, account: string, manifest: BearerChunkManifest | undefined): void {\n\tif (!manifest) return;\n\tfor (const accountName of chunkAccounts(account, manifest)) store.remove(accountName);\n}\n\nfunction tryRemoveChunks(store: BearerSecretStore, account: string, manifest: BearerChunkManifest | undefined): void {\n\ttry {\n\t\tremoveChunks(store, account, manifest);\n\t} catch {\n\t\t// Stale chunk cleanup must not hide a successful credential write.\n\t}\n}\n\nfunction readBearerRecordFromStore(store: BearerSecretStore, serverName: string): StoredBearerTokenRecord | undefined {\n\tconst account = getBearerAccount(serverName);\n\tlet payload: string | undefined;\n\ttry {\n\t\tpayload = store.read(account);\n\t} catch (error) {\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to read bearer token for ${serverName} from the OS secure credential store`,\n\t\t\t\"read\",\n\t\t\terror,\n\t\t);\n\t}\n\tif (payload === undefined) return undefined;\n\ttry {\n\t\tconst manifest = readManifest(serverName, payload);\n\t\tconst recordPayload = manifest\n\t\t\t? chunkAccounts(account, manifest)\n\t\t\t\t\t.map((chunkName) => {\n\t\t\t\t\t\tconst chunk = store.read(chunkName);\n\t\t\t\t\t\tif (chunk === undefined) throw new Error(`Missing bearer token chunk for ${serverName}`);\n\t\t\t\t\t\treturn chunk;\n\t\t\t\t\t})\n\t\t\t\t\t.join(\"\")\n\t\t\t: payload;\n\t\tif (manifest) {\n\t\t\tconst digest = createHash(\"sha256\").update(recordPayload, \"utf8\").digest(\"hex\").slice(0, 16);\n\t\t\tif (digest !== manifest.chunkDigest) throw new Error(`Bearer token chunk digest mismatch for ${serverName}`);\n\t\t}\n\t\treturn parseBearerPayload(serverName, recordPayload);\n\t} catch (error) {\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to read bearer token for ${serverName} from the OS secure credential store`,\n\t\t\t\"read\",\n\t\t\terror,\n\t\t);\n\t}\n}\n\nfunction writeBearerRecordToStore(store: BearerSecretStore, serverName: string, record: StoredBearerTokenRecord): void {\n\tconst account = getBearerAccount(serverName);\n\tconst payload = JSON.stringify(record);\n\tconst previousManifest = readExistingManifest(store, serverName, account);\n\tconst manifest = payload.length > BEARER_SECRET_CHUNK_SIZE ? createManifest(payload) : undefined;\n\ttry {\n\t\tif (manifest) {\n\t\t\tfor (let index = 0; index < manifest.chunkCount; index++) {\n\t\t\t\tstore.write(\n\t\t\t\t\tchunkAccount(account, manifest, index),\n\t\t\t\t\tpayload.slice(index * BEARER_SECRET_CHUNK_SIZE, (index + 1) * BEARER_SECRET_CHUNK_SIZE),\n\t\t\t\t);\n\t\t\t}\n\t\t\tstore.write(account, JSON.stringify(manifest));\n\t\t} else {\n\t\t\tstore.write(account, payload);\n\t\t}\n\t\tif (previousManifest?.chunkDigest !== manifest?.chunkDigest) {\n\t\t\ttryRemoveChunks(store, account, previousManifest);\n\t\t}\n\t} catch (error) {\n\t\t// An identical payload reuses the previous manifest's digest-keyed chunk\n\t\t// accounts. Removing them on a failed rewrite would destroy the still\n\t\t// installed previous credential, so clean up only digest-distinct chunks.\n\t\tif (previousManifest?.chunkDigest !== manifest?.chunkDigest) {\n\t\t\ttryRemoveChunks(store, account, manifest);\n\t\t}\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to write bearer token for ${serverName} to the OS secure credential store`,\n\t\t\t\"write\",\n\t\t\terror,\n\t\t);\n\t}\n}\n\nfunction removeBearerRecordFromStore(store: BearerSecretStore, serverName: string): void {\n\tconst account = getBearerAccount(serverName);\n\ttry {\n\t\tconst payload = store.read(account);\n\t\tconst manifest = payload === undefined ? undefined : readManifest(serverName, payload);\n\t\tremoveChunks(store, account, manifest);\n\t\tstore.remove(account);\n\t} catch (error) {\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to remove bearer token for ${serverName} from the OS secure credential store`,\n\t\t\t\"remove\",\n\t\t\terror,\n\t\t);\n\t}\n}\n\nexport function getBearerTokenForUrl(serverName: string, serverUrl: string): string | undefined {\n\tconst record = readBearerRecordFromStore(getBearerSecretStore(), serverName);\n\tif (!record) return undefined;\n\treturn record.serverUrl === serverUrl ? record.token : undefined;\n}\n\nexport function saveBearerTokenForUrl(serverName: string, token: string, serverUrl: string): void {\n\twriteBearerRecordToStore(getBearerSecretStore(), serverName, { token, serverUrl });\n}\n\nexport function removeBearerToken(serverName: string): void {\n\tremoveBearerRecordFromStore(getBearerSecretStore(), serverName);\n}\n\nexport function inspectBearerTokenForUrl(serverName: string, serverUrl: string): BearerCredentialStatus {\n\ttry {\n\t\tconst record = readBearerRecordFromStore(getBearerSecretStore(), serverName);\n\t\tif (!record) return { status: \"missing\" };\n\t\tif (record.serverUrl !== serverUrl) return { status: \"url-mismatch\" };\n\t\treturn { status: \"present\" };\n\t} catch (error) {\n\t\tif (!(error instanceof BearerCredentialStoreError)) throw error;\n\t\treturn {\n\t\t\tstatus: \"unavailable\",\n\t\t\tmessage:\n\t\t\t\t\"Bearer token secure credential store unavailable. Configure or unlock the OS credential store and retry.\",\n\t\t};\n\t}\n}\n\nexport function resetTestBearerTokenStore(): void {\n\tmemoryBearerEntries.clear();\n\ttestBearerSecretStoreReadCount = 0;\n}\n\nexport function getTestBearerTokenStoreEntries(): [string, string][] {\n\treturn [...memoryBearerEntries.entries()];\n}\n\nexport function removeTestBearerTokenStoreEntry(account: string): void {\n\tmemoryBearerEntries.delete(account);\n}\n\nexport function setTestBearerTokenStoreEntry(account: string, payload: string): void {\n\tmemoryBearerEntries.set(account, payload);\n}\n\nexport function getTestBearerTokenStoreReadCount(): number {\n\treturn testBearerSecretStoreReadCount;\n}\n"]}

package/dist/extensions/mcp/mcp-callback-server.d.ts

@@ -0,0 +1,54 @@
+/**
+ * MCP OAuth Callback Server
+ *
+ * HTTP server that handles OAuth callbacks from the authorization server.
+ * Uses Node.js http module for compatibility.
+ */
+/** Result of a successful OAuth callback */
+export interface OAuthCallbackResult {
+    code: string;
+    /** RFC 9207 `iss` authorization response parameter, when provided */
+    iss?: string;
+}
+interface EnsureCallbackServerOptions {
+    strictPort?: boolean;
+    port?: number;
+    callbackHost?: string;
+    callbackPath?: string;
+    oauthState?: string;
+    reserveState?: boolean;
+}
+/**
+ * Ensure the callback server is running.
+ * If strictPort is true, requires binding on the configured callback port.
+ * If strictPort is false, asks the OS for an available local port.
+ */
+export declare function ensureCallbackServer(options?: EnsureCallbackServerOptions): Promise<void>;
+export declare function reserveCallbackServer(oauthState: string): void;
+export declare function releaseCallbackServer(oauthState: string): void;
+/**
+ * Wait for a callback with the given OAuth state.
+ * Returns a promise that resolves with the authorization code and, when the
+ * authorization server sends one, the RFC 9207 `iss` parameter.
+ */
+export declare function waitForCallback(oauthState: string): Promise<OAuthCallbackResult>;
+/**
+ * Cancel a pending authorization by state.
+ */
+export declare function cancelPendingCallback(oauthState: string): void;
+/**
+ * Stop the callback server and reject all pending authorizations.
+ */
+export declare function stopCallbackServer(): Promise<void>;
+/** Stop the callback server only when no bind or authorization owns it. */
+export declare function stopCallbackServerIfIdle(): Promise<void>;
+/**
+ * Check if the callback server is running.
+ */
+export declare function isCallbackServerRunning(): boolean;
+/**
+ * Get the number of pending authorizations.
+ */
+export declare function getPendingAuthCount(): number;
+export {};
+//# sourceMappingURL=mcp-callback-server.d.ts.map

package/dist/extensions/mcp/mcp-callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-callback-server.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/mcp-callback-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoJH,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAwBD,UAAU,2BAA2B;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAgGD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BnG;AAsGD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAG9D;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAG9D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmBhF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAS9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA4ClD;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAUxD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C","sourcesContent":["/**\n * MCP OAuth Callback Server\n *\n * HTTP server that handles OAuth callbacks from the authorization server.\n * Uses Node.js http module for compatibility.\n */\n\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from \"http\";\nimport { getAppName } from \"./agent-dir.ts\";\nimport {\n\tDEFAULT_OAUTH_CALLBACK_PATH,\n\tgetConfiguredOAuthCallbackPort,\n\tgetOAuthCallbackPath,\n\tgetOAuthCallbackPort,\n\tsetOAuthCallbackPath,\n\tsetOAuthCallbackPort,\n} from \"./mcp-oauth-provider.ts\";\n\n// HTML templates for callback responses.\n//\n// These pages are served from localhost during OAuth and are the last thing a\n// user sees before returning to their terminal, so they are self-contained: no\n// webfonts, no external assets, nothing that needs the network. They also name\n// the host rather than hardcoding \"Nexus\", so a distribution that rebrands nexus\n// (arc, tau, …) does not send its users back to an app they are not running.\n\n/** Shared chrome: system fonts, a centred card, and light/dark support. */\nconst PAGE_STYLE = `\n    :root { color-scheme: light dark; }\n    * { box-sizing: border-box; }\n    body {\n      margin: 0;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 24px;\n      font: 15px/1.55 ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", sans-serif;\n      background: #0f1117;\n      color: #e6e8ee;\n    }\n    .card {\n      width: 100%;\n      max-width: 26rem;\n      padding: 2.5rem 2rem;\n      text-align: center;\n      background: #161922;\n      border: 1px solid #242938;\n      border-radius: 14px;\n      box-shadow: 0 1px 2px rgba(0,0,0,.3), 0 12px 32px rgba(0,0,0,.25);\n    }\n    .badge {\n      width: 3rem; height: 3rem;\n      margin: 0 auto 1.25rem;\n      display: grid; place-items: center;\n      border-radius: 50%;\n    }\n    .badge svg { width: 1.5rem; height: 1.5rem; display: block; }\n    .ok   { background: rgba(74,222,128,.12); color: #4ade80; }\n    .bad  { background: rgba(248,113,113,.12); color: #f87171; }\n    h1 { margin: 0 0 .5rem; font-size: 1.15rem; font-weight: 600; letter-spacing: -0.01em; }\n    p  { margin: 0; color: #9aa1b1; }\n    .app { color: #e6e8ee; font-weight: 500; }\n    .hint { margin-top: 1.25rem; font-size: .8125rem; color: #6b7280; }\n    code {\n      display: block;\n      margin-top: 1.25rem;\n      padding: .75rem .875rem;\n      text-align: left;\n      font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;\n      color: #fca5a5;\n      background: rgba(248,113,113,.08);\n      border: 1px solid rgba(248,113,113,.2);\n      border-radius: 8px;\n      overflow-wrap: anywhere;\n    }\n    @media (prefers-color-scheme: light) {\n      body { background: #f6f7f9; color: #121620; }\n      .card { background: #fff; border-color: #e4e7ee; }\n      p { color: #5b6474; }\n      .app { color: #121620; }\n      .hint { color: #8b93a3; }\n    }`;\n\nconst CHECK_ICON =\n\t'<svg viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M20 6 9 17l-5-5\"/></svg>';\n\nconst CROSS_ICON =\n\t'<svg viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M18 6 6 18M6 6l12 12\"/></svg>';\n\nfunction page(options: {\n\ttitle: string;\n\theading: string;\n\tbody: string;\n\ticon: string;\n\ttone: \"ok\" | \"bad\";\n\textra?: string;\n\tautoClose?: boolean;\n}): string {\n\treturn `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>${options.title}</title>\n  <style>${PAGE_STYLE}\n  </style>\n</head>\n<body>\n  <main class=\"card\">\n    <div class=\"badge ${options.tone}\">${options.icon}</div>\n    <h1>${options.heading}</h1>\n    <p>${options.body}</p>\n    ${options.extra ?? \"\"}\n  </main>\n${options.autoClose ? \"  <script>setTimeout(() => window.close(), 2000);</script>\\n\" : \"\"}</body>\n</html>`;\n}\n\nfunction escapeHtml(value: string): string {\n\treturn value\n\t\t.replace(/&/g, \"&amp;\")\n\t\t.replace(/</g, \"&lt;\")\n\t\t.replace(/>/g, \"&gt;\")\n\t\t.replace(/\"/g, \"&quot;\")\n\t\t.replace(/'/g, \"&#39;\");\n}\n\n/** Built per request so authorization pages always use the Nexus product name. */\nfunction htmlSuccess(): string {\n\tconst app = escapeHtml(getAppName());\n\treturn page({\n\t\ttitle: `${app} — Authorization Successful`,\n\t\theading: \"Authorization Successful\",\n\t\tbody: `You can close this window and return to <span class=\"app\">${app}</span>.`,\n\t\ticon: CHECK_ICON,\n\t\ttone: \"ok\",\n\t\tautoClose: true,\n\t});\n}\n\nfunction htmlError(error: string): string {\n\tconst app = escapeHtml(getAppName());\n\treturn page({\n\t\ttitle: `${app} — Authorization Failed`,\n\t\theading: \"Authorization Failed\",\n\t\tbody: `Something went wrong during authorization. You can close this window and try again from <span class=\"app\">${app}</span>.`,\n\t\ticon: CROSS_ICON,\n\t\ttone: \"bad\",\n\t\textra: `<code>${escapeHtml(error)}</code>`,\n\t});\n}\n\n/** Result of a successful OAuth callback */\nexport interface OAuthCallbackResult {\n\tcode: string;\n\t/** RFC 9207 `iss` authorization response parameter, when provided */\n\tiss?: string;\n}\n\n/** Pending authorization request */\ninterface PendingAuth {\n\tresolve: (result: OAuthCallbackResult) => void;\n\treject: (error: Error) => void;\n\ttimeout: ReturnType<typeof setTimeout>;\n}\n\ntype EarlyAuthResult = { status: \"resolved\"; result: OAuthCallbackResult } | { status: \"rejected\"; error: Error };\n\n/** Server singleton state */\nlet server: Server | undefined;\nlet bindingPromise: Promise<void> | undefined;\nlet stoppingPromise: Promise<void> | undefined;\nlet restartableStoppingPromise: Promise<void> | undefined;\nlet callbackGeneration = 0;\nconst pendingAuths = new Map<string, PendingAuth>();\nconst reservedAuthStates = new Set<string>();\nconst earlyAuthResults = new Map<string, EarlyAuthResult>();\n\n/** Timeout for callback completion (5 minutes) */\nconst CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;\n\ninterface EnsureCallbackServerOptions {\n\tstrictPort?: boolean;\n\tport?: number;\n\tcallbackHost?: string;\n\tcallbackPath?: string;\n\toauthState?: string;\n\treserveState?: boolean;\n}\n\nconst DEFAULT_OAUTH_CALLBACK_HOST = \"localhost\";\nlet callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;\n\n/**\n * Handle incoming HTTP requests to the callback server.\n */\nfunction handleRequest(req: IncomingMessage, res: ServerResponse): void {\n\tconst url = new URL(req.url || \"/\", `http://${req.headers.host}`);\n\n\t// Only handle the callback path\n\tif (url.pathname !== getOAuthCallbackPath()) {\n\t\tres.writeHead(404, { \"Content-Type\": \"text/plain\" });\n\t\tres.end(\"Not found\");\n\t\treturn;\n\t}\n\n\tconst code = url.searchParams.get(\"code\");\n\tconst iss = url.searchParams.get(\"iss\");\n\tconst state = url.searchParams.get(\"state\");\n\tconst error = url.searchParams.get(\"error\");\n\tconst errorDescription = url.searchParams.get(\"error_description\");\n\n\t// Enforce state parameter presence for CSRF protection\n\tif (!state) {\n\t\tconst errorMsg = \"Missing required state parameter - potential CSRF attack\";\n\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\tres.end(htmlError(errorMsg));\n\t\treturn;\n\t}\n\n\tconst pending = pendingAuths.get(state);\n\tconst isReserved = reservedAuthStates.has(state);\n\n\t// Handle OAuth errors only for a state that belongs to an active flow.\n\tif (error) {\n\t\tif (!pending && !isReserved) {\n\t\t\tconst errorMsg = \"Invalid or expired state parameter - potential CSRF attack\";\n\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\tres.end(htmlError(errorMsg));\n\t\t\treturn;\n\t\t}\n\n\t\tconst errorMsg = errorDescription || error;\n\t\t// Send HTTP response first before rejecting promise\n\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\tres.end(htmlError(errorMsg));\n\t\tif (pending) {\n\t\t\treservedAuthStates.delete(state);\n\t\t\tclearTimeout(pending.timeout);\n\t\t\tpendingAuths.delete(state);\n\t\t\t// Reject after the response is sent so callers can attach their handler.\n\t\t\tsetTimeout(() => pending.reject(new Error(errorMsg)), 0);\n\t\t} else {\n\t\t\treservedAuthStates.delete(state);\n\t\t\tearlyAuthResults.set(state, { status: \"rejected\", error: new Error(errorMsg) });\n\t\t}\n\t\treturn;\n\t}\n\n\t// Validate state parameter\n\tif (!pending && !isReserved) {\n\t\tconst errorMsg = \"Invalid or expired state parameter - potential CSRF attack\";\n\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\tres.end(htmlError(errorMsg));\n\t\treturn;\n\t}\n\n\t// Require authorization code\n\tif (!code) {\n\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\tres.end(htmlError(\"No authorization code provided\"));\n\t\treturn;\n\t}\n\n\tif (!pending) {\n\t\treservedAuthStates.delete(state);\n\t\tearlyAuthResults.set(state, {\n\t\t\tstatus: \"resolved\",\n\t\t\tresult: { code, ...(iss !== null ? { iss } : {}) },\n\t\t});\n\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\tres.end(htmlSuccess());\n\t\treturn;\n\t}\n\n\t// Clear timeout and resolve the pending promise\n\tclearTimeout(pending.timeout);\n\tpendingAuths.delete(state);\n\tpending.resolve({ code, ...(iss !== null ? { iss } : {}) });\n\n\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\tres.end(htmlSuccess());\n}\n\n/**\n * Ensure the callback server is running.\n * If strictPort is true, requires binding on the configured callback port.\n * If strictPort is false, asks the OS for an available local port.\n */\nexport async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {\n\tconst generation = callbackGeneration;\n\tif (stoppingPromise) {\n\t\tif (!restartableStoppingPromise) {\n\t\t\tthrow new Error(\"OAuth callback server stopped\");\n\t\t}\n\t\tawait restartableStoppingPromise;\n\t\tif (generation !== callbackGeneration) {\n\t\t\tthrow new Error(\"OAuth callback server stopped\");\n\t\t}\n\t}\n\twhile (bindingPromise) {\n\t\tawait bindingPromise;\n\t\tif (generation !== callbackGeneration) {\n\t\t\tthrow new Error(\"OAuth callback server stopped\");\n\t\t}\n\t}\n\tif (generation !== callbackGeneration) {\n\t\tthrow new Error(\"OAuth callback server stopped\");\n\t}\n\n\tconst operation = ensureCallbackServerLocked(options);\n\tbindingPromise = operation;\n\ttry {\n\t\tawait operation;\n\t} finally {\n\t\tif (bindingPromise === operation) {\n\t\t\tbindingPromise = undefined;\n\t\t}\n\t}\n}\n\nasync function ensureCallbackServerLocked(options: EnsureCallbackServerOptions = {}): Promise<void> {\n\tconst requiredPort = options.port ?? getConfiguredOAuthCallbackPort();\n\tconst strictPort = options.strictPort === true;\n\tconst requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST;\n\tconst rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH;\n\tconst requestedPath = rawRequestedPath.startsWith(\"/\") ? rawRequestedPath : `/${rawRequestedPath}`;\n\tif (options.reserveState && !options.oauthState) {\n\t\tthrow new Error(\"OAuth callback reservation requires an oauthState\");\n\t}\n\tlet reservedState: string | undefined;\n\n\tconst previousServer = server;\n\tconst needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort);\n\tconst needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost);\n\tconst needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath);\n\n\tif (previousServer) {\n\t\tif (!needsStrictRebind && !needsHostSwitch) {\n\t\t\tif (needsPathSwitch) {\n\t\t\t\tif (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tsetOAuthCallbackPath(requestedPath);\n\t\t\t}\n\t\t\tif (options.reserveState && options.oauthState) {\n\t\t\t\tearlyAuthResults.delete(options.oauthState);\n\t\t\t\treservedAuthStates.add(options.oauthState);\n\t\t\t\treservedState = options.oauthState;\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tif (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`,\n\t\t\t);\n\t\t}\n\t}\n\n\tconst candidateServer = createServer(handleRequest);\n\tconst listenPort = strictPort ? requiredPort : 0;\n\n\ttry {\n\t\tawait new Promise<void>((resolve, reject) => {\n\t\t\tcandidateServer.once(\"error\", (err) => {\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tcandidateServer.listen(listenPort, requestedHost, () => {\n\t\t\t\tresolve();\n\t\t\t});\n\t\t});\n\n\t\tif (strictPort) {\n\t\t\tsetOAuthCallbackPort(requiredPort);\n\t\t} else {\n\t\t\tconst address = candidateServer.address();\n\t\t\tif (!address || typeof address === \"string\" || typeof address.port !== \"number\") {\n\t\t\t\tthrow new Error(\"OAuth callback server did not report an assigned port\");\n\t\t\t}\n\t\t\tsetOAuthCallbackPort(address.port);\n\t\t}\n\n\t\tif (previousServer && (needsStrictRebind || needsHostSwitch)) {\n\t\t\tawait new Promise<void>((resolve) => {\n\t\t\t\tpreviousServer.close(() => resolve());\n\t\t\t});\n\t\t}\n\n\t\tcallbackServerHost = requestedHost;\n\t\tsetOAuthCallbackPath(requestedPath);\n\t\tserver = candidateServer;\n\t\tif (options.reserveState && options.oauthState) {\n\t\t\tearlyAuthResults.delete(options.oauthState);\n\t\t\treservedAuthStates.add(options.oauthState);\n\t\t\treservedState = options.oauthState;\n\t\t}\n\t\tserver.unref();\n\t} catch (error) {\n\t\tif (reservedState) {\n\t\t\treservedAuthStates.delete(reservedState);\n\t\t}\n\t\tconst nodeError = error as NodeJS.ErrnoException;\n\t\tawait new Promise<void>((resolve) => {\n\t\t\tcandidateServer.close(() => resolve());\n\t\t});\n\n\t\tif (strictPort && nodeError.code === \"EADDRINUSE\") {\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`,\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n\nexport function reserveCallbackServer(oauthState: string): void {\n\tearlyAuthResults.delete(oauthState);\n\treservedAuthStates.add(oauthState);\n}\n\nexport function releaseCallbackServer(oauthState: string): void {\n\treservedAuthStates.delete(oauthState);\n\tearlyAuthResults.delete(oauthState);\n}\n\n/**\n * Wait for a callback with the given OAuth state.\n * Returns a promise that resolves with the authorization code and, when the\n * authorization server sends one, the RFC 9207 `iss` parameter.\n */\nexport function waitForCallback(oauthState: string): Promise<OAuthCallbackResult> {\n\treservedAuthStates.delete(oauthState);\n\tconst earlyResult = earlyAuthResults.get(oauthState);\n\tif (earlyResult) {\n\t\tearlyAuthResults.delete(oauthState);\n\t\treturn earlyResult.status === \"resolved\"\n\t\t\t? Promise.resolve(earlyResult.result)\n\t\t\t: Promise.reject(earlyResult.error);\n\t}\n\treturn new Promise((resolve, reject) => {\n\t\tconst timeout = setTimeout(() => {\n\t\t\tif (pendingAuths.has(oauthState)) {\n\t\t\t\tpendingAuths.delete(oauthState);\n\t\t\t\treject(new Error(\"OAuth callback timeout - authorization took too long\"));\n\t\t\t}\n\t\t}, CALLBACK_TIMEOUT_MS);\n\n\t\tpendingAuths.set(oauthState, { resolve, reject, timeout });\n\t});\n}\n\n/**\n * Cancel a pending authorization by state.\n */\nexport function cancelPendingCallback(oauthState: string): void {\n\treservedAuthStates.delete(oauthState);\n\tearlyAuthResults.delete(oauthState);\n\tconst pending = pendingAuths.get(oauthState);\n\tif (pending) {\n\t\tclearTimeout(pending.timeout);\n\t\tpendingAuths.delete(oauthState);\n\t\tpending.reject(new Error(\"Authorization cancelled\"));\n\t}\n}\n\n/**\n * Stop the callback server and reject all pending authorizations.\n */\nexport function stopCallbackServer(): Promise<void> {\n\tif (stoppingPromise) {\n\t\trestartableStoppingPromise = undefined;\n\t\tcallbackGeneration += 1;\n\t\treturn stoppingPromise;\n\t}\n\n\tcallbackGeneration += 1;\n\tconst cleanup = (async () => {\n\t\twhile (bindingPromise) {\n\t\t\tawait bindingPromise.catch(() => {});\n\t\t}\n\n\t\tif (server) {\n\t\t\tawait new Promise<void>((resolve) => {\n\t\t\t\tserver!.close(() => {\n\t\t\t\t\tresolve();\n\t\t\t\t});\n\t\t\t});\n\t\t\tserver = undefined;\n\t\t}\n\n\t\tsetOAuthCallbackPort(getConfiguredOAuthCallbackPort());\n\t\tcallbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;\n\t\tsetOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);\n\n\t\t// Reject all pending auths (defer to allow any pending operations to complete)\n\t\tconst pendingList = Array.from(pendingAuths.entries());\n\t\tpendingAuths.clear();\n\t\treservedAuthStates.clear();\n\t\tearlyAuthResults.clear();\n\t\tsetTimeout(() => {\n\t\t\tfor (const [, pending] of pendingList) {\n\t\t\t\tclearTimeout(pending.timeout);\n\t\t\t\tpending.reject(new Error(\"OAuth callback server stopped\"));\n\t\t\t}\n\t\t}, 0);\n\t})();\n\n\tconst operation = cleanup.finally(() => {\n\t\tif (stoppingPromise === operation) stoppingPromise = undefined;\n\t});\n\tstoppingPromise = operation;\n\treturn operation;\n}\n\n/** Stop the callback server only when no bind or authorization owns it. */\nexport function stopCallbackServerIfIdle(): Promise<void> {\n\tif (stoppingPromise) return stoppingPromise;\n\tif (bindingPromise || !server || pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n\t\treturn Promise.resolve();\n\t}\n\tconst operation = stopCallbackServer().finally(() => {\n\t\tif (restartableStoppingPromise === operation) restartableStoppingPromise = undefined;\n\t});\n\trestartableStoppingPromise = operation;\n\treturn operation;\n}\n\n/**\n * Check if the callback server is running.\n */\nexport function isCallbackServerRunning(): boolean {\n\treturn server !== undefined;\n}\n\n/**\n * Get the number of pending authorizations.\n */\nexport function getPendingAuthCount(): number {\n\treturn pendingAuths.size;\n}\n"]}

package/dist/extensions/mcp/mcp-callback-server.js

@@ -0,0 +1,454 @@
+/**
+ * MCP OAuth Callback Server
+ *
+ * HTTP server that handles OAuth callbacks from the authorization server.
+ * Uses Node.js http module for compatibility.
+ */
+import { createServer } from "http";
+import { getAppName } from "./agent-dir.js";
+import { DEFAULT_OAUTH_CALLBACK_PATH, getConfiguredOAuthCallbackPort, getOAuthCallbackPath, getOAuthCallbackPort, setOAuthCallbackPath, setOAuthCallbackPort, } from "./mcp-oauth-provider.js";
+// HTML templates for callback responses.
+//
+// These pages are served from localhost during OAuth and are the last thing a
+// user sees before returning to their terminal, so they are self-contained: no
+// webfonts, no external assets, nothing that needs the network. They also name
+// the host rather than hardcoding "Nexus", so a distribution that rebrands nexus
+// (arc, tau, …) does not send its users back to an app they are not running.
+/** Shared chrome: system fonts, a centred card, and light/dark support. */
+const PAGE_STYLE = `
+    :root { color-scheme: light dark; }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      font: 15px/1.55 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+      background: #0f1117;
+      color: #e6e8ee;
+    }
+    .card {
+      width: 100%;
+      max-width: 26rem;
+      padding: 2.5rem 2rem;
+      text-align: center;
+      background: #161922;
+      border: 1px solid #242938;
+      border-radius: 14px;
+      box-shadow: 0 1px 2px rgba(0,0,0,.3), 0 12px 32px rgba(0,0,0,.25);
+    }
+    .badge {
+      width: 3rem; height: 3rem;
+      margin: 0 auto 1.25rem;
+      display: grid; place-items: center;
+      border-radius: 50%;
+    }
+    .badge svg { width: 1.5rem; height: 1.5rem; display: block; }
+    .ok   { background: rgba(74,222,128,.12); color: #4ade80; }
+    .bad  { background: rgba(248,113,113,.12); color: #f87171; }
+    h1 { margin: 0 0 .5rem; font-size: 1.15rem; font-weight: 600; letter-spacing: -0.01em; }
+    p  { margin: 0; color: #9aa1b1; }
+    .app { color: #e6e8ee; font-weight: 500; }
+    .hint { margin-top: 1.25rem; font-size: .8125rem; color: #6b7280; }
+    code {
+      display: block;
+      margin-top: 1.25rem;
+      padding: .75rem .875rem;
+      text-align: left;
+      font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;
+      color: #fca5a5;
+      background: rgba(248,113,113,.08);
+      border: 1px solid rgba(248,113,113,.2);
+      border-radius: 8px;
+      overflow-wrap: anywhere;
+    }
+    @media (prefers-color-scheme: light) {
+      body { background: #f6f7f9; color: #121620; }
+      .card { background: #fff; border-color: #e4e7ee; }
+      p { color: #5b6474; }
+      .app { color: #121620; }
+      .hint { color: #8b93a3; }
+    }`;
+const CHECK_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
+const CROSS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>';
+function page(options) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${options.title}</title>
+  <style>${PAGE_STYLE}
+  </style>
+</head>
+<body>
+  <main class="card">
+    <div class="badge ${options.tone}">${options.icon}</div>
+    <h1>${options.heading}</h1>
+    <p>${options.body}</p>
+    ${options.extra ?? ""}
+  </main>
+${options.autoClose ? "  <script>setTimeout(() => window.close(), 2000);</script>\n" : ""}</body>
+</html>`;
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/** Built per request so authorization pages always use the Nexus product name. */
+function htmlSuccess() {
+    const app = escapeHtml(getAppName());
+    return page({
+        title: `${app} — Authorization Successful`,
+        heading: "Authorization Successful",
+        body: `You can close this window and return to <span class="app">${app}</span>.`,
+        icon: CHECK_ICON,
+        tone: "ok",
+        autoClose: true,
+    });
+}
+function htmlError(error) {
+    const app = escapeHtml(getAppName());
+    return page({
+        title: `${app} — Authorization Failed`,
+        heading: "Authorization Failed",
+        body: `Something went wrong during authorization. You can close this window and try again from <span class="app">${app}</span>.`,
+        icon: CROSS_ICON,
+        tone: "bad",
+        extra: `<code>${escapeHtml(error)}</code>`,
+    });
+}
+/** Server singleton state */
+let server;
+let bindingPromise;
+let stoppingPromise;
+let restartableStoppingPromise;
+let callbackGeneration = 0;
+const pendingAuths = new Map();
+const reservedAuthStates = new Set();
+const earlyAuthResults = new Map();
+/** Timeout for callback completion (5 minutes) */
+const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_OAUTH_CALLBACK_HOST = "localhost";
+let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+/**
+ * Handle incoming HTTP requests to the callback server.
+ */
+function handleRequest(req, res) {
+    const url = new URL(req.url || "/", `http://${req.headers.host}`);
+    // Only handle the callback path
+    if (url.pathname !== getOAuthCallbackPath()) {
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+        return;
+    }
+    const code = url.searchParams.get("code");
+    const iss = url.searchParams.get("iss");
+    const state = url.searchParams.get("state");
+    const error = url.searchParams.get("error");
+    const errorDescription = url.searchParams.get("error_description");
+    // Enforce state parameter presence for CSRF protection
+    if (!state) {
+        const errorMsg = "Missing required state parameter - potential CSRF attack";
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(htmlError(errorMsg));
+        return;
+    }
+    const pending = pendingAuths.get(state);
+    const isReserved = reservedAuthStates.has(state);
+    // Handle OAuth errors only for a state that belongs to an active flow.
+    if (error) {
+        if (!pending && !isReserved) {
+            const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+            res.writeHead(400, { "Content-Type": "text/html" });
+            res.end(htmlError(errorMsg));
+            return;
+        }
+        const errorMsg = errorDescription || error;
+        // Send HTTP response first before rejecting promise
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(htmlError(errorMsg));
+        if (pending) {
+            reservedAuthStates.delete(state);
+            clearTimeout(pending.timeout);
+            pendingAuths.delete(state);
+            // Reject after the response is sent so callers can attach their handler.
+            setTimeout(() => pending.reject(new Error(errorMsg)), 0);
+        }
+        else {
+            reservedAuthStates.delete(state);
+            earlyAuthResults.set(state, { status: "rejected", error: new Error(errorMsg) });
+        }
+        return;
+    }
+    // Validate state parameter
+    if (!pending && !isReserved) {
+        const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(htmlError(errorMsg));
+        return;
+    }
+    // Require authorization code
+    if (!code) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(htmlError("No authorization code provided"));
+        return;
+    }
+    if (!pending) {
+        reservedAuthStates.delete(state);
+        earlyAuthResults.set(state, {
+            status: "resolved",
+            result: { code, ...(iss !== null ? { iss } : {}) },
+        });
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(htmlSuccess());
+        return;
+    }
+    // Clear timeout and resolve the pending promise
+    clearTimeout(pending.timeout);
+    pendingAuths.delete(state);
+    pending.resolve({ code, ...(iss !== null ? { iss } : {}) });
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(htmlSuccess());
+}
+/**
+ * Ensure the callback server is running.
+ * If strictPort is true, requires binding on the configured callback port.
+ * If strictPort is false, asks the OS for an available local port.
+ */
+export async function ensureCallbackServer(options = {}) {
+    const generation = callbackGeneration;
+    if (stoppingPromise) {
+        if (!restartableStoppingPromise) {
+            throw new Error("OAuth callback server stopped");
+        }
+        await restartableStoppingPromise;
+        if (generation !== callbackGeneration) {
+            throw new Error("OAuth callback server stopped");
+        }
+    }
+    while (bindingPromise) {
+        await bindingPromise;
+        if (generation !== callbackGeneration) {
+            throw new Error("OAuth callback server stopped");
+        }
+    }
+    if (generation !== callbackGeneration) {
+        throw new Error("OAuth callback server stopped");
+    }
+    const operation = ensureCallbackServerLocked(options);
+    bindingPromise = operation;
+    try {
+        await operation;
+    }
+    finally {
+        if (bindingPromise === operation) {
+            bindingPromise = undefined;
+        }
+    }
+}
+async function ensureCallbackServerLocked(options = {}) {
+    const requiredPort = options.port ?? getConfiguredOAuthCallbackPort();
+    const strictPort = options.strictPort === true;
+    const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST;
+    const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH;
+    const requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
+    if (options.reserveState && !options.oauthState) {
+        throw new Error("OAuth callback reservation requires an oauthState");
+    }
+    let reservedState;
+    const previousServer = server;
+    const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort);
+    const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost);
+    const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath);
+    if (previousServer) {
+        if (!needsStrictRebind && !needsHostSwitch) {
+            if (needsPathSwitch) {
+                if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+                    throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
+                }
+                setOAuthCallbackPath(requestedPath);
+            }
+            if (options.reserveState && options.oauthState) {
+                earlyAuthResults.delete(options.oauthState);
+                reservedAuthStates.add(options.oauthState);
+                reservedState = options.oauthState;
+            }
+            return;
+        }
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+            throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
+        }
+    }
+    const candidateServer = createServer(handleRequest);
+    const listenPort = strictPort ? requiredPort : 0;
+    try {
+        await new Promise((resolve, reject) => {
+            candidateServer.once("error", (err) => {
+                reject(err);
+            });
+            candidateServer.listen(listenPort, requestedHost, () => {
+                resolve();
+            });
+        });
+        if (strictPort) {
+            setOAuthCallbackPort(requiredPort);
+        }
+        else {
+            const address = candidateServer.address();
+            if (!address || typeof address === "string" || typeof address.port !== "number") {
+                throw new Error("OAuth callback server did not report an assigned port");
+            }
+            setOAuthCallbackPort(address.port);
+        }
+        if (previousServer && (needsStrictRebind || needsHostSwitch)) {
+            await new Promise((resolve) => {
+                previousServer.close(() => resolve());
+            });
+        }
+        callbackServerHost = requestedHost;
+        setOAuthCallbackPath(requestedPath);
+        server = candidateServer;
+        if (options.reserveState && options.oauthState) {
+            earlyAuthResults.delete(options.oauthState);
+            reservedAuthStates.add(options.oauthState);
+            reservedState = options.oauthState;
+        }
+        server.unref();
+    }
+    catch (error) {
+        if (reservedState) {
+            reservedAuthStates.delete(reservedState);
+        }
+        const nodeError = error;
+        await new Promise((resolve) => {
+            candidateServer.close(() => resolve());
+        });
+        if (strictPort && nodeError.code === "EADDRINUSE") {
+            throw new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error });
+        }
+        throw error;
+    }
+}
+export function reserveCallbackServer(oauthState) {
+    earlyAuthResults.delete(oauthState);
+    reservedAuthStates.add(oauthState);
+}
+export function releaseCallbackServer(oauthState) {
+    reservedAuthStates.delete(oauthState);
+    earlyAuthResults.delete(oauthState);
+}
+/**
+ * Wait for a callback with the given OAuth state.
+ * Returns a promise that resolves with the authorization code and, when the
+ * authorization server sends one, the RFC 9207 `iss` parameter.
+ */
+export function waitForCallback(oauthState) {
+    reservedAuthStates.delete(oauthState);
+    const earlyResult = earlyAuthResults.get(oauthState);
+    if (earlyResult) {
+        earlyAuthResults.delete(oauthState);
+        return earlyResult.status === "resolved"
+            ? Promise.resolve(earlyResult.result)
+            : Promise.reject(earlyResult.error);
+    }
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            if (pendingAuths.has(oauthState)) {
+                pendingAuths.delete(oauthState);
+                reject(new Error("OAuth callback timeout - authorization took too long"));
+            }
+        }, CALLBACK_TIMEOUT_MS);
+        pendingAuths.set(oauthState, { resolve, reject, timeout });
+    });
+}
+/**
+ * Cancel a pending authorization by state.
+ */
+export function cancelPendingCallback(oauthState) {
+    reservedAuthStates.delete(oauthState);
+    earlyAuthResults.delete(oauthState);
+    const pending = pendingAuths.get(oauthState);
+    if (pending) {
+        clearTimeout(pending.timeout);
+        pendingAuths.delete(oauthState);
+        pending.reject(new Error("Authorization cancelled"));
+    }
+}
+/**
+ * Stop the callback server and reject all pending authorizations.
+ */
+export function stopCallbackServer() {
+    if (stoppingPromise) {
+        restartableStoppingPromise = undefined;
+        callbackGeneration += 1;
+        return stoppingPromise;
+    }
+    callbackGeneration += 1;
+    const cleanup = (async () => {
+        while (bindingPromise) {
+            await bindingPromise.catch(() => { });
+        }
+        if (server) {
+            await new Promise((resolve) => {
+                server.close(() => {
+                    resolve();
+                });
+            });
+            server = undefined;
+        }
+        setOAuthCallbackPort(getConfiguredOAuthCallbackPort());
+        callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+        setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
+        // Reject all pending auths (defer to allow any pending operations to complete)
+        const pendingList = Array.from(pendingAuths.entries());
+        pendingAuths.clear();
+        reservedAuthStates.clear();
+        earlyAuthResults.clear();
+        setTimeout(() => {
+            for (const [, pending] of pendingList) {
+                clearTimeout(pending.timeout);
+                pending.reject(new Error("OAuth callback server stopped"));
+            }
+        }, 0);
+    })();
+    const operation = cleanup.finally(() => {
+        if (stoppingPromise === operation)
+            stoppingPromise = undefined;
+    });
+    stoppingPromise = operation;
+    return operation;
+}
+/** Stop the callback server only when no bind or authorization owns it. */
+export function stopCallbackServerIfIdle() {
+    if (stoppingPromise)
+        return stoppingPromise;
+    if (bindingPromise || !server || pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+        return Promise.resolve();
+    }
+    const operation = stopCallbackServer().finally(() => {
+        if (restartableStoppingPromise === operation)
+            restartableStoppingPromise = undefined;
+    });
+    restartableStoppingPromise = operation;
+    return operation;
+}
+/**
+ * Check if the callback server is running.
+ */
+export function isCallbackServerRunning() {
+    return server !== undefined;
+}
+/**
+ * Get the number of pending authorizations.
+ */
+export function getPendingAuthCount() {
+    return pendingAuths.size;
+}
+//# sourceMappingURL=mcp-callback-server.js.map