@ashx-j/lunr 0.1.0

package/dist/builtin-extensions/pi-mcp-adapter/logger.js

@@ -0,0 +1,132 @@
+// @ts-nocheck
+/**
+ * Centralized logging for MCP UI operations.
+ * Provides structured, contextual logs with levels.
+ */
+const LEVEL_PRIORITY = {
+    debug: 0,
+    info: 1,
+    warn: 2,
+    error: 3,
+};
+const LEVEL_PREFIX = {
+    debug: "[MCP-UI:DEBUG]",
+    info: "[MCP-UI]",
+    warn: "[MCP-UI:WARN]",
+    error: "[MCP-UI:ERROR]",
+};
+class Logger {
+    minLevel = "info";
+    handlers = [];
+    defaultContext = {};
+    setLevel(level) {
+        this.minLevel = level;
+    }
+    setDefaultContext(context) {
+        this.defaultContext = context;
+    }
+    addHandler(handler) {
+        this.handlers.push(handler);
+    }
+    clearHandlers() {
+        this.handlers = [];
+    }
+    shouldLog(level) {
+        return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[this.minLevel];
+    }
+    emit(level, message, context, error) {
+        if (!this.shouldLog(level))
+            return;
+        const entry = {
+            level,
+            message,
+            context: { ...this.defaultContext, ...context },
+            error,
+            timestamp: new Date(),
+        };
+        // Default console output
+        const prefix = LEVEL_PREFIX[level];
+        const contextStr = formatContext(entry.context);
+        const fullMessage = contextStr ? `${prefix} ${message} ${contextStr}` : `${prefix} ${message}`;
+        if (level === "error") {
+            console.error(fullMessage, error ?? "");
+        }
+        else if (level === "warn") {
+            console.warn(fullMessage);
+        }
+        else if (level === "debug") {
+            console.debug(fullMessage);
+        }
+        else {
+            console.log(fullMessage);
+        }
+        // Custom handlers
+        for (const handler of this.handlers) {
+            try {
+                handler(entry);
+            }
+            catch {
+                // Ignore handler errors
+            }
+        }
+    }
+    debug(message, context) {
+        this.emit("debug", message, context);
+    }
+    info(message, context) {
+        this.emit("info", message, context);
+    }
+    warn(message, context) {
+        this.emit("warn", message, context);
+    }
+    error(message, error, context) {
+        this.emit("error", message, context, error);
+    }
+    /**
+     * Create a child logger with additional default context.
+     */
+    child(context) {
+        return new ChildLogger(this, context);
+    }
+}
+class ChildLogger {
+    parent;
+    context;
+    constructor(parent, context) {
+        this.parent = parent;
+        this.context = context;
+    }
+    debug(message, context) {
+        this.parent.debug(message, { ...this.context, ...context });
+    }
+    info(message, context) {
+        this.parent.info(message, { ...this.context, ...context });
+    }
+    warn(message, context) {
+        this.parent.warn(message, { ...this.context, ...context });
+    }
+    error(message, error, context) {
+        this.parent.error(message, error, { ...this.context, ...context });
+    }
+    child(context) {
+        return new ChildLogger(this.parent, { ...this.context, ...context });
+    }
+}
+function formatContext(context) {
+    if (!context || Object.keys(context).length === 0)
+        return "";
+    const parts = [];
+    for (const [key, value] of Object.entries(context)) {
+        if (value !== undefined && value !== null) {
+            parts.push(`${key}=${typeof value === "string" ? value : JSON.stringify(value)}`);
+        }
+    }
+    return parts.length > 0 ? `(${parts.join(", ")})` : "";
+}
+// Singleton instance
+export const logger = new Logger();
+// Enable debug mode via environment variable
+if (process.env.MCP_UI_DEBUG === "1" || process.env.MCP_UI_DEBUG === "true") {
+    logger.setLevel("debug");
+}
+//# sourceMappingURL=logger.js.map

package/dist/builtin-extensions/pi-mcp-adapter/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/logger.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;GAGG;AAsBH,MAAM,cAAc,GAA6B;IAC/C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,YAAY,GAA6B;IAC7C,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;CACxB,CAAC;AAEF,MAAM,MAAM;IACF,QAAQ,GAAa,MAAM,CAAC;IAC5B,QAAQ,GAAiB,EAAE,CAAC;IAC5B,cAAc,GAAe,EAAE,CAAC;IAExC,QAAQ,CAAC,KAAe,EAAQ;QAC9B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IAAA,CACvB;IAED,iBAAiB,CAAC,OAAmB,EAAQ;QAC3C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAAA,CAC/B;IAED,UAAU,CAAC,OAAmB,EAAQ;QACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAAA,CAC7B;IAED,aAAa,GAAS;QACpB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IAAA,CACpB;IAEO,SAAS,CAAC,KAAe,EAAW;QAC1C,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAAA,CAC/D;IAEO,IAAI,CAAC,KAAe,EAAE,OAAe,EAAE,OAAoB,EAAE,KAAa,EAAQ;QACxF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO;QAEnC,MAAM,KAAK,GAAa;YACtB,KAAK;YACL,OAAO;YACP,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,OAAO,EAAE;YAC/C,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,yBAAyB;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;QAE/F,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QAED,kBAAkB;QAClB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;IAAA,CACF;IAED,KAAK,CAAC,OAAe,EAAE,OAAoB,EAAQ;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CACtC;IAED,IAAI,CAAC,OAAe,EAAE,OAAoB,EAAQ;QAChD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CACrC;IAED,IAAI,CAAC,OAAe,EAAE,OAAoB,EAAQ;QAChD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CACrC;IAED,KAAK,CAAC,OAAe,EAAE,KAAa,EAAE,OAAoB,EAAQ;QAChE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAAA,CAC7C;IAED;;OAEG;IACH,KAAK,CAAC,OAAmB,EAAe;QACtC,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAAA,CACvC;CACF;AAED,MAAM,WAAW;IAEL,MAAM;IACN,OAAO;IAFjB,YACU,MAAc,EACd,OAAmB,EAC3B;sBAFQ,MAAM;uBACN,OAAO;IACd,CAAC;IAEJ,KAAK,CAAC,OAAe,EAAE,OAAoB,EAAQ;QACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAAA,CAC7D;IAED,IAAI,CAAC,OAAe,EAAE,OAAoB,EAAQ;QAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAAA,CAC5D;IAED,IAAI,CAAC,OAAe,EAAE,OAAoB,EAAQ;QAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAAA,CAC5D;IAED,KAAK,CAAC,OAAe,EAAE,KAAa,EAAE,OAAoB,EAAQ;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAAA,CACpE;IAED,KAAK,CAAC,OAAmB,EAAe;QACtC,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAAA,CACtE;CACF;AAED,SAAS,aAAa,CAAC,OAAoB,EAAU;IACnD,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,CACxD;AAED,qBAAqB;AACrB,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;AAEnC,6CAA6C;AAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;IAC5E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["// @ts-nocheck\n/**\n * Centralized logging for MCP UI operations.\n * Provides structured, contextual logs with levels.\n */\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface LogContext {\n  server?: string;\n  session?: string;\n  tool?: string;\n  uri?: string;\n  [key: string]: unknown;\n}\n\nexport interface LogEntry {\n  level: LogLevel;\n  message: string;\n  context?: LogContext;\n  error?: Error;\n  timestamp: Date;\n}\n\ntype LogHandler = (entry: LogEntry) => void;\n\nconst LEVEL_PRIORITY: Record<LogLevel, number> = {\n  debug: 0,\n  info: 1,\n  warn: 2,\n  error: 3,\n};\n\nconst LEVEL_PREFIX: Record<LogLevel, string> = {\n  debug: \"[MCP-UI:DEBUG]\",\n  info: \"[MCP-UI]\",\n  warn: \"[MCP-UI:WARN]\",\n  error: \"[MCP-UI:ERROR]\",\n};\n\nclass Logger {\n  private minLevel: LogLevel = \"info\";\n  private handlers: LogHandler[] = [];\n  private defaultContext: LogContext = {};\n\n  setLevel(level: LogLevel): void {\n    this.minLevel = level;\n  }\n\n  setDefaultContext(context: LogContext): void {\n    this.defaultContext = context;\n  }\n\n  addHandler(handler: LogHandler): void {\n    this.handlers.push(handler);\n  }\n\n  clearHandlers(): void {\n    this.handlers = [];\n  }\n\n  private shouldLog(level: LogLevel): boolean {\n    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[this.minLevel];\n  }\n\n  private emit(level: LogLevel, message: string, context?: LogContext, error?: Error): void {\n    if (!this.shouldLog(level)) return;\n\n    const entry: LogEntry = {\n      level,\n      message,\n      context: { ...this.defaultContext, ...context },\n      error,\n      timestamp: new Date(),\n    };\n\n    // Default console output\n    const prefix = LEVEL_PREFIX[level];\n    const contextStr = formatContext(entry.context);\n    const fullMessage = contextStr ? `${prefix} ${message} ${contextStr}` : `${prefix} ${message}`;\n\n    if (level === \"error\") {\n      console.error(fullMessage, error ?? \"\");\n    } else if (level === \"warn\") {\n      console.warn(fullMessage);\n    } else if (level === \"debug\") {\n      console.debug(fullMessage);\n    } else {\n      console.log(fullMessage);\n    }\n\n    // Custom handlers\n    for (const handler of this.handlers) {\n      try {\n        handler(entry);\n      } catch {\n        // Ignore handler errors\n      }\n    }\n  }\n\n  debug(message: string, context?: LogContext): void {\n    this.emit(\"debug\", message, context);\n  }\n\n  info(message: string, context?: LogContext): void {\n    this.emit(\"info\", message, context);\n  }\n\n  warn(message: string, context?: LogContext): void {\n    this.emit(\"warn\", message, context);\n  }\n\n  error(message: string, error?: Error, context?: LogContext): void {\n    this.emit(\"error\", message, context, error);\n  }\n\n  /**\n   * Create a child logger with additional default context.\n   */\n  child(context: LogContext): ChildLogger {\n    return new ChildLogger(this, context);\n  }\n}\n\nclass ChildLogger {\n  constructor(\n    private parent: Logger,\n    private context: LogContext\n  ) {}\n\n  debug(message: string, context?: LogContext): void {\n    this.parent.debug(message, { ...this.context, ...context });\n  }\n\n  info(message: string, context?: LogContext): void {\n    this.parent.info(message, { ...this.context, ...context });\n  }\n\n  warn(message: string, context?: LogContext): void {\n    this.parent.warn(message, { ...this.context, ...context });\n  }\n\n  error(message: string, error?: Error, context?: LogContext): void {\n    this.parent.error(message, error, { ...this.context, ...context });\n  }\n\n  child(context: LogContext): ChildLogger {\n    return new ChildLogger(this.parent, { ...this.context, ...context });\n  }\n}\n\nfunction formatContext(context?: LogContext): string {\n  if (!context || Object.keys(context).length === 0) return \"\";\n  const parts: string[] = [];\n  for (const [key, value] of Object.entries(context)) {\n    if (value !== undefined && value !== null) {\n      parts.push(`${key}=${typeof value === \"string\" ? value : JSON.stringify(value)}`);\n    }\n  }\n  return parts.length > 0 ? `(${parts.join(\", \")})` : \"\";\n}\n\n// Singleton instance\nexport const logger = new Logger();\n\n// Enable debug mode via environment variable\nif (process.env.MCP_UI_DEBUG === \"1\" || process.env.MCP_UI_DEBUG === \"true\") {\n  logger.setLevel(\"debug\");\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.d.ts

@@ -0,0 +1,86 @@
+/**
+ * MCP Auth Flow
+ *
+ * High-level OAuth flow management using the MCP SDK's built-in auth functions.
+ */
+import { type McpOAuthConfig } from "./mcp-oauth-provider.ts";
+import { type StoredTokens } from "./mcp-auth.ts";
+import type { ServerEntry } from "./types.ts";
+/** Auth status for a server */
+export type AuthStatus = "authenticated" | "expired" | "not_authenticated";
+export interface AuthenticateOptions {
+    onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>;
+}
+/**
+ * Extract OAuth configuration from a ServerEntry.
+ */
+export declare function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig;
+/**
+ * Start OAuth authentication flow for a server.
+ * Returns the authorization URL when browser authorization is required.
+ */
+export declare function startAuth(serverName: string, serverUrl: string, definition?: ServerEntry): Promise<{
+    authorizationUrl: string;
+}>;
+/**
+ * Extract an OAuth authorization code from either a raw code, a query string,
+ * or the full localhost redirect URL copied from the browser address bar.
+ */
+export declare function parseAuthorizationCodeInput(input: string, expectedState?: string): string;
+/**
+ * Complete OAuth authentication from manual user input.
+ */
+export declare function completeAuthFromInput(serverName: string, input: string): Promise<AuthStatus>;
+/**
+ * Complete OAuth authentication with the authorization code.
+ */
+export declare function completeAuth(serverName: string, authorizationCode: string): Promise<AuthStatus>;
+/**
+ * Perform the complete OAuth authentication flow for a server.
+ *
+ * @param serverName - The name of the MCP server
+ * @param serverUrl - The URL of the MCP server
+ * @param definition - The server definition (optional)
+ * @returns The final auth status
+ */
+export declare function authenticate(serverName: string, serverUrl: string, definition?: ServerEntry, options?: AuthenticateOptions): Promise<AuthStatus>;
+/**
+ * Get a valid access token for a server, refreshing if necessary.
+ *
+ * @param serverName - The name of the MCP server
+ * @param serverUrl - The URL of the MCP server
+ * @returns The valid tokens or null if not authenticated
+ */
+export declare function getValidToken(serverName: string, serverUrl: string): Promise<StoredTokens | null>;
+/**
+ * Check the authentication status for a server.
+ *
+ * @param serverName - The name of the MCP server
+ * @returns The current auth status
+ */
+export declare function getAuthStatus(serverName: string): Promise<AuthStatus>;
+/**
+ * Remove all OAuth credentials for a server.
+ *
+ * @param serverName - The name of the MCP server
+ */
+export declare function removeAuth(serverName: string): Promise<void>;
+/**
+ * Check if OAuth is supported for a server configuration.
+ * OAuth is supported for HTTP servers unless explicitly disabled.
+ *
+ * @param definition - The server definition
+ * @returns True if OAuth is supported
+ */
+export declare function supportsOAuth(definition: ServerEntry): boolean;
+/**
+ * Initialize the OAuth system on startup.
+ * OAuth callback binding is lazy and starts from startAuth() only.
+ */
+export declare function initializeOAuth(): Promise<void>;
+/**
+ * Shutdown the OAuth system.
+ * Stops the callback server and cancels pending auths.
+ */
+export declare function shutdownOAuth(): Promise<void>;
+//# sourceMappingURL=mcp-auth-flow.d.ts.map

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-flow.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAQH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAQ/E,OAAO,EAWL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAE1E,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxE;AAsBD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,WAAW,GAAG,cAAc,CAyC1E;AAqCD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAiFvC;AA8DD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CA+BzF;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,UAAU,CAAC,CAerB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,EACxB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,UAAU,CAAC,CAmErB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASlE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAc9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;AAEzD;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Flow\n * \n * High-level OAuth flow management using the MCP SDK's built-in auth functions.\n */\n\nimport {\n  auth as runSdkAuth,\n  UnauthorizedError,\n} from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\"\nimport open from \"open\"\nimport { McpOAuthProvider, type McpOAuthConfig } from \"./mcp-oauth-provider.ts\"\nimport {\n  ensureCallbackServer,\n  waitForCallback,\n  cancelPendingCallback,\n  stopCallbackServer,\n  releaseCallbackServer,\n} from \"./mcp-callback-server.ts\"\nimport {\n  getAuthForUrl,\n  isTokenExpired,\n  hasStoredTokens,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  clearCodeVerifier,\n  updateOAuthState,\n  getOAuthState,\n  clearOAuthState,\n  type StoredTokens,\n} from \"./mcp-auth.ts\"\nimport type { ServerEntry } from \"./types.ts\"\n\n/** Auth status for a server */\nexport type AuthStatus = \"authenticated\" | \"expired\" | \"not_authenticated\"\n\nexport interface AuthenticateOptions {\n  onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>\n}\n\n// Track pending transports for auth completion\nconst pendingTransports = new Map<string, StreamableHTTPClientTransport>()\nconst pendingAuthStates = new Map<string, string>()\nconst pendingAuthCleanupTimers = new Map<string, ReturnType<typeof setTimeout>>()\n\n// Deduplicate concurrent authenticate() calls per server.\nconst pendingAuthentications = new Map<string, Promise<AuthStatus>>()\n\n/** Timeout for manual auth completion (5 minutes) */\nconst MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000\n\n/**\n * Generate a cryptographically secure random state parameter.\n */\nfunction generateState(): string {\n  return Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n}\n\n/**\n * Extract OAuth configuration from a ServerEntry.\n */\nexport function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {\n  if (definition.oauth === false) {\n    return {}\n  }\n\n  const config: McpOAuthConfig = {}\n  if (definition.oauth?.grantType !== undefined) config.grantType = definition.oauth.grantType\n  if (definition.oauth?.clientId !== undefined) config.clientId = definition.oauth.clientId\n  if (definition.oauth?.clientSecret !== undefined) config.clientSecret = definition.oauth.clientSecret\n  if (definition.oauth?.scope !== undefined) config.scope = definition.oauth.scope\n  if (definition.oauth?.redirectUri !== undefined) {\n    if (typeof definition.oauth.redirectUri !== \"string\") {\n      throw new Error(\"OAuth redirectUri must be a string\")\n    }\n    const redirectUri = definition.oauth.redirectUri.trim()\n    if (!redirectUri) {\n      throw new Error(\"OAuth redirectUri must not be empty\")\n    }\n    config.redirectUri = redirectUri\n  }\n  if (definition.oauth?.clientName !== undefined) {\n    if (typeof definition.oauth.clientName !== \"string\") {\n      throw new Error(\"OAuth clientName must be a string\")\n    }\n    const clientName = definition.oauth.clientName.trim()\n    if (!clientName) {\n      throw new Error(\"OAuth clientName must not be empty\")\n    }\n    config.clientName = clientName\n  }\n  if (definition.oauth?.clientUri !== undefined) {\n    if (typeof definition.oauth.clientUri !== \"string\") {\n      throw new Error(\"OAuth clientUri must be a string\")\n    }\n    const clientUri = definition.oauth.clientUri.trim()\n    if (!clientUri) {\n      throw new Error(\"OAuth clientUri must not be empty\")\n    }\n    config.clientUri = clientUri\n  }\n  return config\n}\n\nfunction parseOAuthRedirectUri(redirectUri: string): { port: number; callbackHost: string; callbackPath: string } {\n  let url: URL\n  try {\n    url = new URL(redirectUri)\n  } catch (error) {\n    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error })\n  }\n\n  const hostname = url.hostname.toLowerCase()\n  const isLocalhost = hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\"\n  if (url.protocol !== \"http:\" || !isLocalhost) {\n    throw new Error(\"OAuth redirectUri must be an http:// localhost or loopback URI\")\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"OAuth redirectUri must not include username or password\")\n  }\n\n  if (url.hash) {\n    throw new Error(\"OAuth redirectUri must not include a fragment\")\n  }\n\n  if (!url.port) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const port = Number.parseInt(url.port, 10)\n  if (!Number.isInteger(port) || port <= 0 || port > 65535) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const callbackHost = hostname === \"[::1]\" ? \"::1\" : hostname\n  return { port, callbackHost, callbackPath: url.pathname }\n}\n\n/**\n * Start OAuth authentication flow for a server.\n * Returns the authorization URL when browser authorization is required.\n */\nexport async function startAuth(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry\n): Promise<{ authorizationUrl: string }> {\n  const config = definition ? extractOAuthConfig(definition) : {}\n\n  if (config.grantType === \"client_credentials\") {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {\n      clearClientInfo(serverName)\n      clearCodeVerifier(serverName)\n      await clearOAuthState(serverName)\n    }\n\n    const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n      onRedirect: async () => {\n        throw new Error(\"Browser redirect is not used for client_credentials flow\")\n      },\n    })\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result !== \"AUTHORIZED\") {\n      throw new UnauthorizedError(\"Failed to authorize\")\n    }\n    return { authorizationUrl: \"\" }\n  }\n\n  const redirectCallback = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined\n  const oauthState = generateState()\n\n  try {\n    await ensureCallbackServer({\n      strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,\n      oauthState,\n      reserveState: true,\n      ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),\n    })\n  } catch (error) {\n    await clearOAuthState(serverName)\n    throw error\n  }\n\n  let capturedUrl: URL | undefined\n  const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n    onRedirect: async (url) => {\n      capturedUrl = url\n    },\n  })\n\n  try {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !config.clientId) {\n      if (!storedAuth.tokens) {\n        clearClientInfo(serverName)\n        clearCodeVerifier(serverName)\n        await clearOAuthState(serverName)\n      } else {\n        const redirectUris = storedAuth.clientInfo.redirectUris\n        if (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? \"\")) {\n          clearClientInfo(serverName)\n          clearTokens(serverName)\n          clearCodeVerifier(serverName)\n          await clearOAuthState(serverName)\n        }\n      }\n    }\n\n    await updateOAuthState(serverName, oauthState, serverUrl)\n\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result === \"AUTHORIZED\") {\n      releaseCallbackServer(oauthState)\n      await clearOAuthState(serverName)\n      return { authorizationUrl: \"\" }\n    }\n    if (!capturedUrl) {\n      throw new UnauthorizedError(\"OAuth authorization URL was not provided\")\n    }\n    const pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider })\n    await setPendingTransport(serverName, pendingTransport, oauthState)\n    return { authorizationUrl: capturedUrl.toString() }\n  } catch (error) {\n    await clearPendingAuth(serverName, oauthState)\n    throw error\n  }\n}\n\nasync function setPendingTransport(\n  serverName: string,\n  transport: StreamableHTTPClientTransport,\n  oauthState: string,\n): Promise<void> {\n  await clearPendingAuth(serverName)\n  pendingTransports.set(serverName, transport)\n  pendingAuthStates.set(serverName, oauthState)\n  const cleanupTimer = setTimeout(() => {\n    void clearPendingAuth(serverName, oauthState)\n  }, MANUAL_AUTH_TIMEOUT_MS)\n  cleanupTimer.unref?.()\n  pendingAuthCleanupTimers.set(serverName, cleanupTimer)\n}\n\nasync function clearPendingAuth(serverName: string, oauthState?: string): Promise<void> {\n  const pendingState = pendingAuthStates.get(serverName)\n  if (oauthState && pendingState && pendingState !== oauthState) return\n\n  const timer = pendingAuthCleanupTimers.get(serverName)\n  if (timer) {\n    clearTimeout(timer)\n    pendingAuthCleanupTimers.delete(serverName)\n  }\n\n  const transport = pendingTransports.get(serverName)\n  pendingTransports.delete(serverName)\n  pendingAuthStates.delete(serverName)\n  const stateToRelease = pendingState ?? oauthState\n  if (stateToRelease) {\n    releaseCallbackServer(stateToRelease)\n    const storedState = await getOAuthState(serverName)\n    if (storedState === stateToRelease) {\n      await clearOAuthState(serverName)\n    }\n  }\n  if (transport) {\n    await transport.close().catch(() => {})\n  }\n}\n\nfunction getSearchParamsFromInput(input: string): URLSearchParams | undefined {\n  try {\n    const url = new URL(input)\n    const params = new URLSearchParams(url.search)\n    if (url.hash) {\n      const hash = url.hash.startsWith(\"#\") ? url.hash.slice(1) : url.hash\n      const hashParams = new URLSearchParams(hash)\n      for (const [key, value] of hashParams) {\n        if (!params.has(key)) params.set(key, value)\n      }\n    }\n    return params\n  } catch {\n    const query = input.includes(\"?\") ? input.slice(input.indexOf(\"?\") + 1) : input\n    const params = new URLSearchParams(query.startsWith(\"#\") ? query.slice(1) : query)\n    return params.has(\"code\") || params.has(\"state\") || params.has(\"error\") ? params : undefined\n  }\n}\n\n/**\n * Extract an OAuth authorization code from either a raw code, a query string,\n * or the full localhost redirect URL copied from the browser address bar.\n */\nexport function parseAuthorizationCodeInput(input: string, expectedState?: string): string {\n  const trimmed = input.trim()\n  if (!trimmed) {\n    throw new Error(\"Authorization code or redirect URL is required\")\n  }\n\n  const params = getSearchParamsFromInput(trimmed)\n  if (params) {\n    const error = params.get(\"error\")\n    if (error) {\n      const description = params.get(\"error_description\")\n      throw new Error(description ? `${error}: ${description}` : error)\n    }\n\n    const state = params.get(\"state\")\n    if (expectedState && !state) {\n      throw new Error(\"OAuth state missing from redirect URL\")\n    }\n    if (expectedState && state !== expectedState) {\n      throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n    }\n\n    const code = params.get(\"code\")\n    if (code) return code\n  }\n\n  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {\n    return trimmed\n  }\n\n  throw new Error(\"Could not find an OAuth authorization code in the provided input\")\n}\n\n/**\n * Complete OAuth authentication from manual user input.\n */\nexport async function completeAuthFromInput(\n  serverName: string,\n  input: string,\n): Promise<AuthStatus> {\n  const oauthState = await getOAuthState(serverName)\n  const code = parseAuthorizationCodeInput(input, oauthState)\n  return completeAuth(serverName, code)\n}\n\n/**\n * Complete OAuth authentication with the authorization code.\n */\nexport async function completeAuth(\n  serverName: string,\n  authorizationCode: string\n): Promise<AuthStatus> {\n  const transport = pendingTransports.get(serverName)\n  if (!transport) {\n    throw new Error(`No pending OAuth flow for server: ${serverName}`)\n  }\n\n  const oauthState = await getOAuthState(serverName)\n\n  try {\n    // Complete the auth using the transport's finishAuth method\n    await transport.finishAuth(authorizationCode)\n    return \"authenticated\"\n  } finally {\n    await clearPendingAuth(serverName, oauthState)\n  }\n}\n\n/**\n * Perform the complete OAuth authentication flow for a server.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server  \n * @param definition - The server definition (optional)\n * @returns The final auth status\n */\nexport async function authenticate(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry,\n  options: AuthenticateOptions = {},\n): Promise<AuthStatus> {\n  const inFlight = pendingAuthentications.get(serverName)\n  if (inFlight) {\n    return inFlight\n  }\n\n  const operation = (async (): Promise<AuthStatus> => {\n    // Start auth flow\n    const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)\n\n    // If no auth URL needed, already authenticated\n    if (!authorizationUrl) {\n      return \"authenticated\"\n    }\n\n    // Get the state that was already generated and stored in startAuth()\n    const oauthState = await getOAuthState(serverName)\n    if (!oauthState) {\n      throw new Error(\"OAuth state not found - this should not happen\")\n    }\n\n    // Register the callback BEFORE opening the browser\n    const callbackPromise = waitForCallback(oauthState)\n\n    try {\n      // Open browser. Always surface the URL first so remote/headless users can copy it\n      // even when the OS browser handoff is unavailable or invisible.\n      if (options.onAuthorizationUrl) {\n        await options.onAuthorizationUrl(authorizationUrl)\n      } else {\n        console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\\n${authorizationUrl}`)\n      }\n      try {\n        await open(authorizationUrl)\n      } catch (error) {\n        console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })\n      }\n\n      // Wait for callback\n      const code = await callbackPromise\n\n      // Validate state\n      const storedState = await getOAuthState(serverName)\n      if (storedState !== oauthState) {\n        await clearOAuthState(serverName)\n        throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n      }\n      await clearOAuthState(serverName)\n\n      // Complete the auth\n      return await completeAuth(serverName, code)\n    } catch (error) {\n      cancelPendingCallback(oauthState)\n      await clearPendingAuth(serverName, oauthState)\n      throw error\n    }\n  })()\n\n  pendingAuthentications.set(serverName, operation)\n\n  try {\n    return await operation\n  } finally {\n    if (pendingAuthentications.get(serverName) === operation) {\n      pendingAuthentications.delete(serverName)\n    }\n  }\n}\n\n/**\n * Get a valid access token for a server, refreshing if necessary.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server\n * @returns The valid tokens or null if not authenticated\n */\nexport async function getValidToken(\n  serverName: string,\n  serverUrl: string,\n): Promise<StoredTokens | null> {\n  // Check if we have valid tokens\n  const entry = await getAuthForUrl(serverName, serverUrl)\n  if (!entry?.tokens) {\n    return null\n  }\n\n  // Check expiration\n  const expired = await isTokenExpired(serverName)\n  if (expired === false) {\n    return entry.tokens\n  }\n\n  if (expired === true && entry.tokens.refreshToken) {\n    // Token is expired, try to refresh\n    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`)\n\n    try {\n      // Create auth provider for token refresh\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {\n        onRedirect: async () => {},\n      })\n\n      const clientInfo = await authProvider.clientInformation()\n      if (!clientInfo) {\n        console.log(`MCP Auth: No client info for refresh for ${serverName}`)\n        return null\n      }\n\n      const result = await runSdkAuth(authProvider, { serverUrl })\n      if (result !== \"AUTHORIZED\") {\n        return null\n      }\n      const refreshed = await getAuthForUrl(serverName, serverUrl)\n      return refreshed?.tokens ?? null\n    } catch (error) {\n      console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error })\n      return null\n    }\n  }\n\n  // No expiration info or no refresh token, assume valid\n  return entry.tokens\n}\n\n/**\n * Check the authentication status for a server.\n * \n * @param serverName - The name of the MCP server\n * @returns The current auth status\n */\nexport async function getAuthStatus(serverName: string): Promise<AuthStatus> {\n  const hasTokens = await hasStoredTokens(serverName)\n  if (!hasTokens) return \"not_authenticated\"\n\n  const expired = await isTokenExpired(serverName)\n  return expired ? \"expired\" : \"authenticated\"\n}\n\n/**\n * Remove all OAuth credentials for a server.\n * \n * @param serverName - The name of the MCP server\n */\nexport async function removeAuth(serverName: string): Promise<void> {\n  const oauthState = await getOAuthState(serverName)\n  if (oauthState) {\n    cancelPendingCallback(oauthState)\n  }\n  await clearPendingAuth(serverName, oauthState)\n  clearAllCredentials(serverName)\n  await clearOAuthState(serverName)\n  console.log(`MCP Auth: Removed credentials for ${serverName}`)\n}\n\n/**\n * Check if OAuth is supported for a server configuration.\n * OAuth is supported for HTTP servers unless explicitly disabled.\n * \n * @param definition - The server definition\n * @returns True if OAuth is supported\n */\nexport function supportsOAuth(definition: ServerEntry): boolean {\n  // OAuth requires a URL\n  if (!definition.url) return false\n  \n  // Explicitly disabled via auth: false or oauth: false\n  if (definition.auth === false) return false\n  if (definition.oauth === false) return false\n  if (definition.auth === \"oauth\") return true\n  \n  // Configured custom headers take precedence over implicit OAuth auto-detection.\n  if (definition.headers && Object.keys(definition.headers).length > 0) return false\n\n  // OAuth is enabled when auth is not specified (auto-detect)\n  return definition.auth === undefined\n}\n\n/**\n * Initialize the OAuth system on startup.\n * OAuth callback binding is lazy and starts from startAuth() only.\n */\nexport async function initializeOAuth(): Promise<void> {}\n\n/**\n * Shutdown the OAuth system.\n * Stops the callback server and cancels pending auths.\n */\nexport async function shutdownOAuth(): Promise<void> {\n  for (const serverName of Array.from(pendingTransports.keys())) {\n    await clearPendingAuth(serverName)\n  }\n  await stopCallbackServer()\n}\n"]}