@ashx-j/lunr 0.2.25 → 0.2.27

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth-flow.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;GAIG;AAEH,OAAO,EACL,IAAI,IAAI,UAAU,EAClB,iBAAiB,GAClB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,eAAe,GAEhB,MAAM,eAAe,CAAA;AAUtB,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;AACnD,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAEjF,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA+B,CAAA;AAErE,qDAAqD;AACrD,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAE5C;;GAEG;AACH,SAAS,aAAa,GAAW;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AAAA,CACZ;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAuB,EAAkB;IAC1E,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAA;IAC5F,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAA;IACzF,IAAI,UAAU,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAA;IACrG,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAA;IAChF,IAAI,UAAU,CAAC,KAAK,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QAChD,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QACvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,WAAW,CAAA;IAClC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;IAChC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;IAC9B,CAAC;IACD,OAAO,MAAM,CAAA;AAAA,CACd;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAgE;IAChH,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC3C,MAAM,WAAW,GAAG,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAA;IACtH,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;AAAA,CAC1D;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAAkB,EAClB,SAAiB,EACjB,UAAwB,EACe;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAE/D,IAAI,MAAM,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,UAAU,EAAE,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrE,eAAe,CAAC,UAAU,CAAC,CAAA;YAC3B,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAC7B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;YACvE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;YAAA,CAC5E;SACF,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjH,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAElC,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC;YACzB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YACxE,UAAU;YACV,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvJ,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;IAED,IAAI,WAA4B,CAAA;IAChC,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;QACvE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACzB,WAAW,GAAG,GAAG,CAAA;QAAA,CAClB;KACF,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,UAAU,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,eAAe,CAAC,UAAU,CAAC,CAAA;gBAC3B,iBAAiB,CAAC,UAAU,CAAC,CAAA;gBAC7B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;YACnC,CAAC;iBAAM,CAAC;gBACN,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,YAAY,CAAA;gBACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3F,eAAe,CAAC,UAAU,CAAC,CAAA;oBAC3B,WAAW,CAAC,UAAU,CAAC,CAAA;oBACvB,iBAAiB,CAAC,UAAU,CAAC,CAAA;oBAC7B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;QAEzD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,qBAAqB,CAAC,UAAU,CAAC,CAAA;YACjC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;YACjC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;QACjC,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QAChG,MAAM,mBAAmB,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAA;QACnE,OAAO,EAAE,gBAAgB,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAA;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;AAAA,CACF;AAED,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,SAAwC,EACxC,UAAkB,EACH;IACf,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAClC,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAC5C,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;QACpC,KAAK,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAAA,CAC9C,EAAE,sBAAsB,CAAC,CAAA;IAC1B,YAAY,CAAC,KAAK,EAAE,EAAE,CAAA;IACtB,wBAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;AAAA,CACvD;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,UAAmB,EAAiB;IACtF,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACtD,IAAI,UAAU,IAAI,YAAY,IAAI,YAAY,KAAK,UAAU;QAAE,OAAM;IAErE,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACtD,IAAI,KAAK,EAAE,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACnD,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,YAAY,IAAI,UAAU,CAAA;IACjD,IAAI,cAAc,EAAE,CAAC;QACnB,qBAAqB,CAAC,cAAc,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAA;IACzC,CAAC;AAAA,CACF;AAED,SAAS,wBAAwB,CAAC,KAAa,EAA+B;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;YACpE,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAA;YAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,aAAsB,EAAU;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,aAAa,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;IACvB,CAAC;IAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;AAAA,CACpF;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,KAAa,EACQ;IACrB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC3D,OAAO,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;AAAA,CACtC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,iBAAyB,EACJ;IACrB,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;IAElD,IAAI,CAAC;QACH,4DAA4D;QAC5D,MAAM,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;QAC7C,OAAO,eAAe,CAAA;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAChD,CAAC;AAAA,CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,SAAiB,EACjB,UAAwB,EACxB,OAAO,GAAwB,EAAE,EACZ;IACrB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,KAAK,IAAyB,EAAE,CAAC;QAClD,kBAAkB;QAClB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;QAE/E,+CAA+C;QAC/C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QAED,mDAAmD;QACnD,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;QAEnD,IAAI,CAAC;YACH,kFAAkF;YAClF,gEAAgE;YAChE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;YACpD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,2CAA2C,UAAU,MAAM,gBAAgB,EAAE,CAAC,CAAA;YAC5F,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,wCAAwC,UAAU,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5G,CAAC;YAED,oBAAoB;YACpB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAA;YAElC,iBAAiB;YACjB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;YACnD,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;gBAC/B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;gBACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;YAEjC,oBAAoB;YACpB,OAAO,MAAM,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qBAAqB,CAAC,UAAU,CAAC,CAAA;YACjC,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAC9C,MAAM,KAAK,CAAA;QACb,CAAC;IAAA,CACF,CAAC,EAAE,CAAA;IAEJ,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAEjD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAA;IACxB,CAAC;YAAS,CAAC;QACT,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;AAAA,CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,SAAiB,EACa;IAC9B,gCAAgC;IAChC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACxD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAA;IACrB,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAClD,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,UAAU,sBAAsB,CAAC,CAAA;QAE5E,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;gBACnE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,EAAC,CAAC;aAC3B,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAA;YACzD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,4CAA4C,UAAU,EAAE,CAAC,CAAA;gBACrE,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YAC5D,OAAO,SAAS,EAAE,MAAM,IAAI,IAAI,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5E,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,OAAO,KAAK,CAAC,MAAM,CAAA;AAAA,CACpB;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAuB;IAC3E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO,mBAAmB,CAAA;IAE1C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAA;AAAA,CAC7C;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB,EAAiB;IAClE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAC9C,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC/B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;AAAA,CAC/D;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAuB,EAAW;IAC9D,uBAAuB;IACvB,IAAI,CAAC,UAAU,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEjC,sDAAsD;IACtD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAE5C,gFAAgF;IAChF,IAAI,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAElF,4DAA4D;IAC5D,OAAO,UAAU,CAAC,IAAI,KAAK,SAAS,CAAA;AAAA,CACrC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,GAAkB,EAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,GAAkB;IACnD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,kBAAkB,EAAE,CAAA;AAAA,CAC3B","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Flow\n * \n * High-level OAuth flow management using the MCP SDK's built-in auth functions.\n */\n\nimport {\n  auth as runSdkAuth,\n  UnauthorizedError,\n} from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\"\nimport open from \"open\"\nimport { McpOAuthProvider, type McpOAuthConfig } from \"./mcp-oauth-provider.ts\"\nimport {\n  ensureCallbackServer,\n  waitForCallback,\n  cancelPendingCallback,\n  stopCallbackServer,\n  releaseCallbackServer,\n} from \"./mcp-callback-server.ts\"\nimport {\n  getAuthForUrl,\n  isTokenExpired,\n  hasStoredTokens,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  clearCodeVerifier,\n  updateOAuthState,\n  getOAuthState,\n  clearOAuthState,\n  type StoredTokens,\n} from \"./mcp-auth.ts\"\nimport type { ServerEntry } from \"./types.ts\"\n\n/** Auth status for a server */\nexport type AuthStatus = \"authenticated\" | \"expired\" | \"not_authenticated\"\n\nexport interface AuthenticateOptions {\n  onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>\n}\n\n// Track pending transports for auth completion\nconst pendingTransports = new Map<string, StreamableHTTPClientTransport>()\nconst pendingAuthStates = new Map<string, string>()\nconst pendingAuthCleanupTimers = new Map<string, ReturnType<typeof setTimeout>>()\n\n// Deduplicate concurrent authenticate() calls per server.\nconst pendingAuthentications = new Map<string, Promise<AuthStatus>>()\n\n/** Timeout for manual auth completion (5 minutes) */\nconst MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000\n\n/**\n * Generate a cryptographically secure random state parameter.\n */\nfunction generateState(): string {\n  return Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n}\n\n/**\n * Extract OAuth configuration from a ServerEntry.\n */\nexport function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {\n  if (definition.oauth === false) {\n    return {}\n  }\n\n  const config: McpOAuthConfig = {}\n  if (definition.oauth?.grantType !== undefined) config.grantType = definition.oauth.grantType\n  if (definition.oauth?.clientId !== undefined) config.clientId = definition.oauth.clientId\n  if (definition.oauth?.clientSecret !== undefined) config.clientSecret = definition.oauth.clientSecret\n  if (definition.oauth?.scope !== undefined) config.scope = definition.oauth.scope\n  if (definition.oauth?.redirectUri !== undefined) {\n    if (typeof definition.oauth.redirectUri !== \"string\") {\n      throw new Error(\"OAuth redirectUri must be a string\")\n    }\n    const redirectUri = definition.oauth.redirectUri.trim()\n    if (!redirectUri) {\n      throw new Error(\"OAuth redirectUri must not be empty\")\n    }\n    config.redirectUri = redirectUri\n  }\n  if (definition.oauth?.clientName !== undefined) {\n    if (typeof definition.oauth.clientName !== \"string\") {\n      throw new Error(\"OAuth clientName must be a string\")\n    }\n    const clientName = definition.oauth.clientName.trim()\n    if (!clientName) {\n      throw new Error(\"OAuth clientName must not be empty\")\n    }\n    config.clientName = clientName\n  }\n  if (definition.oauth?.clientUri !== undefined) {\n    if (typeof definition.oauth.clientUri !== \"string\") {\n      throw new Error(\"OAuth clientUri must be a string\")\n    }\n    const clientUri = definition.oauth.clientUri.trim()\n    if (!clientUri) {\n      throw new Error(\"OAuth clientUri must not be empty\")\n    }\n    config.clientUri = clientUri\n  }\n  return config\n}\n\nfunction parseOAuthRedirectUri(redirectUri: string): { port: number; callbackHost: string; callbackPath: string } {\n  let url: URL\n  try {\n    url = new URL(redirectUri)\n  } catch (error) {\n    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error })\n  }\n\n  const hostname = url.hostname.toLowerCase()\n  const isLocalhost = hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\"\n  if (url.protocol !== \"http:\" || !isLocalhost) {\n    throw new Error(\"OAuth redirectUri must be an http:// localhost or loopback URI\")\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"OAuth redirectUri must not include username or password\")\n  }\n\n  if (url.hash) {\n    throw new Error(\"OAuth redirectUri must not include a fragment\")\n  }\n\n  if (!url.port) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const port = Number.parseInt(url.port, 10)\n  if (!Number.isInteger(port) || port <= 0 || port > 65535) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const callbackHost = hostname === \"[::1]\" ? \"::1\" : hostname\n  return { port, callbackHost, callbackPath: url.pathname }\n}\n\n/**\n * Start OAuth authentication flow for a server.\n * Returns the authorization URL when browser authorization is required.\n */\nexport async function startAuth(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry\n): Promise<{ authorizationUrl: string }> {\n  const config = definition ? extractOAuthConfig(definition) : {}\n\n  if (config.grantType === \"client_credentials\") {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {\n      clearClientInfo(serverName)\n      clearCodeVerifier(serverName)\n      await clearOAuthState(serverName)\n    }\n\n    const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n      onRedirect: async () => {\n        throw new Error(\"Browser redirect is not used for client_credentials flow\")\n      },\n    })\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result !== \"AUTHORIZED\") {\n      throw new UnauthorizedError(\"Failed to authorize\")\n    }\n    return { authorizationUrl: \"\" }\n  }\n\n  const redirectCallback = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined\n  const oauthState = generateState()\n\n  try {\n    await ensureCallbackServer({\n      strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,\n      oauthState,\n      reserveState: true,\n      ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),\n    })\n  } catch (error) {\n    await clearOAuthState(serverName)\n    throw error\n  }\n\n  let capturedUrl: URL | undefined\n  const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n    onRedirect: async (url) => {\n      capturedUrl = url\n    },\n  })\n\n  try {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !config.clientId) {\n      if (!storedAuth.tokens) {\n        clearClientInfo(serverName)\n        clearCodeVerifier(serverName)\n        await clearOAuthState(serverName)\n      } else {\n        const redirectUris = storedAuth.clientInfo.redirectUris\n        if (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? \"\")) {\n          clearClientInfo(serverName)\n          clearTokens(serverName)\n          clearCodeVerifier(serverName)\n          await clearOAuthState(serverName)\n        }\n      }\n    }\n\n    await updateOAuthState(serverName, oauthState, serverUrl)\n\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result === \"AUTHORIZED\") {\n      releaseCallbackServer(oauthState)\n      await clearOAuthState(serverName)\n      return { authorizationUrl: \"\" }\n    }\n    if (!capturedUrl) {\n      throw new UnauthorizedError(\"OAuth authorization URL was not provided\")\n    }\n    const pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider })\n    await setPendingTransport(serverName, pendingTransport, oauthState)\n    return { authorizationUrl: capturedUrl.toString() }\n  } catch (error) {\n    await clearPendingAuth(serverName, oauthState)\n    throw error\n  }\n}\n\nasync function setPendingTransport(\n  serverName: string,\n  transport: StreamableHTTPClientTransport,\n  oauthState: string,\n): Promise<void> {\n  await clearPendingAuth(serverName)\n  pendingTransports.set(serverName, transport)\n  pendingAuthStates.set(serverName, oauthState)\n  const cleanupTimer = setTimeout(() => {\n    void clearPendingAuth(serverName, oauthState)\n  }, MANUAL_AUTH_TIMEOUT_MS)\n  cleanupTimer.unref?.()\n  pendingAuthCleanupTimers.set(serverName, cleanupTimer)\n}\n\nasync function clearPendingAuth(serverName: string, oauthState?: string): Promise<void> {\n  const pendingState = pendingAuthStates.get(serverName)\n  if (oauthState && pendingState && pendingState !== oauthState) return\n\n  const timer = pendingAuthCleanupTimers.get(serverName)\n  if (timer) {\n    clearTimeout(timer)\n    pendingAuthCleanupTimers.delete(serverName)\n  }\n\n  const transport = pendingTransports.get(serverName)\n  pendingTransports.delete(serverName)\n  pendingAuthStates.delete(serverName)\n  const stateToRelease = pendingState ?? oauthState\n  if (stateToRelease) {\n    releaseCallbackServer(stateToRelease)\n    const storedState = await getOAuthState(serverName)\n    if (storedState === stateToRelease) {\n      await clearOAuthState(serverName)\n    }\n  }\n  if (transport) {\n    await transport.close().catch(() => {})\n  }\n}\n\nfunction getSearchParamsFromInput(input: string): URLSearchParams | undefined {\n  try {\n    const url = new URL(input)\n    const params = new URLSearchParams(url.search)\n    if (url.hash) {\n      const hash = url.hash.startsWith(\"#\") ? url.hash.slice(1) : url.hash\n      const hashParams = new URLSearchParams(hash)\n      for (const [key, value] of hashParams) {\n        if (!params.has(key)) params.set(key, value)\n      }\n    }\n    return params\n  } catch {\n    const query = input.includes(\"?\") ? input.slice(input.indexOf(\"?\") + 1) : input\n    const params = new URLSearchParams(query.startsWith(\"#\") ? query.slice(1) : query)\n    return params.has(\"code\") || params.has(\"state\") || params.has(\"error\") ? params : undefined\n  }\n}\n\n/**\n * Extract an OAuth authorization code from either a raw code, a query string,\n * or the full localhost redirect URL copied from the browser address bar.\n */\nexport function parseAuthorizationCodeInput(input: string, expectedState?: string): string {\n  const trimmed = input.trim()\n  if (!trimmed) {\n    throw new Error(\"Authorization code or redirect URL is required\")\n  }\n\n  const params = getSearchParamsFromInput(trimmed)\n  if (params) {\n    const error = params.get(\"error\")\n    if (error) {\n      const description = params.get(\"error_description\")\n      throw new Error(description ? `${error}: ${description}` : error)\n    }\n\n    const state = params.get(\"state\")\n    if (expectedState && !state) {\n      throw new Error(\"OAuth state missing from redirect URL\")\n    }\n    if (expectedState && state !== expectedState) {\n      throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n    }\n\n    const code = params.get(\"code\")\n    if (code) return code\n  }\n\n  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {\n    return trimmed\n  }\n\n  throw new Error(\"Could not find an OAuth authorization code in the provided input\")\n}\n\n/**\n * Complete OAuth authentication from manual user input.\n */\nexport async function completeAuthFromInput(\n  serverName: string,\n  input: string,\n): Promise<AuthStatus> {\n  const oauthState = await getOAuthState(serverName)\n  const code = parseAuthorizationCodeInput(input, oauthState)\n  return completeAuth(serverName, code)\n}\n\n/**\n * Complete OAuth authentication with the authorization code.\n */\nexport async function completeAuth(\n  serverName: string,\n  authorizationCode: string\n): Promise<AuthStatus> {\n  const transport = pendingTransports.get(serverName)\n  if (!transport) {\n    throw new Error(`No pending OAuth flow for server: ${serverName}`)\n  }\n\n  const oauthState = await getOAuthState(serverName)\n\n  try {\n    // Complete the auth using the transport's finishAuth method\n    await transport.finishAuth(authorizationCode)\n    return \"authenticated\"\n  } finally {\n    await clearPendingAuth(serverName, oauthState)\n  }\n}\n\n/**\n * Perform the complete OAuth authentication flow for a server.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server  \n * @param definition - The server definition (optional)\n * @returns The final auth status\n */\nexport async function authenticate(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry,\n  options: AuthenticateOptions = {},\n): Promise<AuthStatus> {\n  const inFlight = pendingAuthentications.get(serverName)\n  if (inFlight) {\n    return inFlight\n  }\n\n  const operation = (async (): Promise<AuthStatus> => {\n    // Start auth flow\n    const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)\n\n    // If no auth URL needed, already authenticated\n    if (!authorizationUrl) {\n      return \"authenticated\"\n    }\n\n    // Get the state that was already generated and stored in startAuth()\n    const oauthState = await getOAuthState(serverName)\n    if (!oauthState) {\n      throw new Error(\"OAuth state not found - this should not happen\")\n    }\n\n    // Register the callback BEFORE opening the browser\n    const callbackPromise = waitForCallback(oauthState)\n\n    try {\n      // Open browser. Always surface the URL first so remote/headless users can copy it\n      // even when the OS browser handoff is unavailable or invisible.\n      if (options.onAuthorizationUrl) {\n        await options.onAuthorizationUrl(authorizationUrl)\n      } else {\n        console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\\n${authorizationUrl}`)\n      }\n      try {\n        await open(authorizationUrl)\n      } catch (error) {\n        console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })\n      }\n\n      // Wait for callback\n      const code = await callbackPromise\n\n      // Validate state\n      const storedState = await getOAuthState(serverName)\n      if (storedState !== oauthState) {\n        await clearOAuthState(serverName)\n        throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n      }\n      await clearOAuthState(serverName)\n\n      // Complete the auth\n      return await completeAuth(serverName, code)\n    } catch (error) {\n      cancelPendingCallback(oauthState)\n      await clearPendingAuth(serverName, oauthState)\n      throw error\n    }\n  })()\n\n  pendingAuthentications.set(serverName, operation)\n\n  try {\n    return await operation\n  } finally {\n    if (pendingAuthentications.get(serverName) === operation) {\n      pendingAuthentications.delete(serverName)\n    }\n  }\n}\n\n/**\n * Get a valid access token for a server, refreshing if necessary.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server\n * @returns The valid tokens or null if not authenticated\n */\nexport async function getValidToken(\n  serverName: string,\n  serverUrl: string,\n): Promise<StoredTokens | null> {\n  // Check if we have valid tokens\n  const entry = await getAuthForUrl(serverName, serverUrl)\n  if (!entry?.tokens) {\n    return null\n  }\n\n  // Check expiration\n  const expired = await isTokenExpired(serverName)\n  if (expired === false) {\n    return entry.tokens\n  }\n\n  if (expired === true && entry.tokens.refreshToken) {\n    // Token is expired, try to refresh\n    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`)\n\n    try {\n      // Create auth provider for token refresh\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {\n        onRedirect: async () => {},\n      })\n\n      const clientInfo = await authProvider.clientInformation()\n      if (!clientInfo) {\n        console.log(`MCP Auth: No client info for refresh for ${serverName}`)\n        return null\n      }\n\n      const result = await runSdkAuth(authProvider, { serverUrl })\n      if (result !== \"AUTHORIZED\") {\n        return null\n      }\n      const refreshed = await getAuthForUrl(serverName, serverUrl)\n      return refreshed?.tokens ?? null\n    } catch (error) {\n      console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error })\n      return null\n    }\n  }\n\n  // No expiration info or no refresh token, assume valid\n  return entry.tokens\n}\n\n/**\n * Check the authentication status for a server.\n * \n * @param serverName - The name of the MCP server\n * @returns The current auth status\n */\nexport async function getAuthStatus(serverName: string): Promise<AuthStatus> {\n  const hasTokens = await hasStoredTokens(serverName)\n  if (!hasTokens) return \"not_authenticated\"\n\n  const expired = await isTokenExpired(serverName)\n  return expired ? \"expired\" : \"authenticated\"\n}\n\n/**\n * Remove all OAuth credentials for a server.\n * \n * @param serverName - The name of the MCP server\n */\nexport async function removeAuth(serverName: string): Promise<void> {\n  const oauthState = await getOAuthState(serverName)\n  if (oauthState) {\n    cancelPendingCallback(oauthState)\n  }\n  await clearPendingAuth(serverName, oauthState)\n  clearAllCredentials(serverName)\n  await clearOAuthState(serverName)\n  console.log(`MCP Auth: Removed credentials for ${serverName}`)\n}\n\n/**\n * Check if OAuth is supported for a server configuration.\n * OAuth is supported for HTTP servers unless explicitly disabled.\n * \n * @param definition - The server definition\n * @returns True if OAuth is supported\n */\nexport function supportsOAuth(definition: ServerEntry): boolean {\n  // OAuth requires a URL\n  if (!definition.url) return false\n  \n  // Explicitly disabled via auth: false or oauth: false\n  if (definition.auth === false) return false\n  if (definition.oauth === false) return false\n  if (definition.auth === \"oauth\") return true\n  \n  // Configured custom headers take precedence over implicit OAuth auto-detection.\n  if (definition.headers && Object.keys(definition.headers).length > 0) return false\n\n  // OAuth is enabled when auth is not specified (auto-detect)\n  return definition.auth === undefined\n}\n\n/**\n * Initialize the OAuth system on startup.\n * OAuth callback binding is lazy and starts from startAuth() only.\n */\nexport async function initializeOAuth(): Promise<void> {}\n\n/**\n * Shutdown the OAuth system.\n * Stops the callback server and cancels pending auths.\n */\nexport async function shutdownOAuth(): Promise<void> {\n  for (const serverName of Array.from(pendingTransports.keys())) {\n    await clearPendingAuth(serverName)\n  }\n  await stopCallbackServer()\n}\n"]}
+{"version":3,"file":"mcp-auth-flow.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;GAIG;AAEH,OAAO,EACL,IAAI,IAAI,UAAU,EAClB,iBAAiB,GAClB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAA+C,MAAM,yBAAyB,CAAA;AACvG,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,mBAAmB,GAEpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAUtD,qDAAqD;AACrD,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAE5C;;GAEG;AACH,SAAS,aAAa,GAAW;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AAAA,CACZ;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAuB,EAAkB;IAC1E,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAA;IAC5F,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAA;IACzF,IAAI,UAAU,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAA;IACrG,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAA;IAChF,IAAI,UAAU,CAAC,KAAK,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QAChD,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QACvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,WAAW,CAAA;IAClC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;IAChC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;IAC9B,CAAC;IACD,OAAO,MAAM,CAAA;AAAA,CACd;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAgE;IAChH,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC3C,MAAM,WAAW,GAAG,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAA;IACtH,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;AAAA,CAC1D;AAED,SAAS,wBAAwB,CAAC,KAAa,EAA+B;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;YACpE,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAA;YAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,aAAsB,EAAU;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,aAAa,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;IACvB,CAAC;IAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;AAAA,CACpF;AAUD,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,GAAG;IAClC,MAAM,KAAK,GAAG,0BAA0B,EAAE,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAA;IAChD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA+B,CAAA;IAC7D,IAAI,eAA0C,CAAA;IAC9C,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,SAAS,UAAU,GAAS;QAC1B,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAAA,CACxD;IAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAiB;QAC/F,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;oBAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,IAAI,CAAC,KAAK;oBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA;gBAC3D,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC5C,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC5C,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAA;YAAA,CAC9C,CAAC,EAAE,CAAA;QACN,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAA;IAAA,CACnB;IAED,KAAK,UAAU,SAAS,CACtB,UAAkB,EAClB,SAAiB,EACjB,UAAwB,EACe;QACvC,UAAU,EAAE,CAAA;QACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACtC,IAAI,QAAQ;YAAE,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC1D,UAAU,EAAE,CAAA;QACZ,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAA;QAClG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,IAAI,GAAoB,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAA;QAC/G,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;QAChC,MAAM,OAAO,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;YAC1D,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SAChF,CAAC,CAAA;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC/D,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YAC7D,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,EAAE,UAAU,CAAA;YAC9C,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,MAAM,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC5C,MAAM,kBAAkB,GAAG,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAA;oBACpE,IAAI,kBAAkB;wBAAE,MAAM,CAAC,WAAW,GAAG,kBAAkB,CAAA;gBACjE,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC3F,MAAM,oBAAoB,CAAC;oBACzB,KAAK;oBACL,MAAM;oBACN,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;oBAClG,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;oBACjC,YAAY,EAAE,IAAI;oBAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvH,CAAC,CAAA;gBACF,cAAc,CAAC,MAAM,CAAC,CAAA;YACxB,CAAC;YACD,IAAI,WAA4B,CAAA;YAChC,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;gBACvE,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,CAAA,CAAA,CAAE;aACnE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YACd,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;YACxF,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;gBACxC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;YACjC,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,KAAK,oBAAoB,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9D,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACxG,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA,CAAA,CAAE,EAAE,sBAAsB,CAAC,CAAA;YAClG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;YACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YACxC,MAAM,KAAK,CAAA;QACb,CAAC;IAAA,CACF;IAED,KAAK,UAAU,qBAAqB,CAAC,UAAkB,EAAE,KAAa,EAAuB;QAC3F,UAAU,EAAE,CAAA;QACZ,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;QAC7E,OAAO,YAAY,CAAC,UAAU,EAAE,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IAAA,CAC3F;IAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,IAAY,EAAuB;QACjF,UAAU,EAAE,CAAA;QACZ,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,EAAE,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;QACxF,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACnE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjC,OAAO,eAAe,CAAA;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC1C,CAAC;IAAA,CACF;IAED,KAAK,UAAU,YAAY,CACzB,UAAkB,EAClB,SAAiB,EACjB,UAAwB,EACxB,OAAO,GAAwB,EAAE,EACZ;QACrB,UAAU,EAAE,CAAA;QACZ,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,MAAM,SAAS,GAAG,CAAC,KAAK,IAAyB,EAAE,CAAC;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;YAC/E,IAAI,CAAC,gBAAgB;gBAAE,OAAO,eAAe,CAAA;YAC7C,UAAU,EAAE,CAAA;YACZ,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAClC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;YAC7E,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YACvD,sEAAsE;YACtE,KAAK,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAA;YAC7B,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC/B,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACnG,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,2CAA2C,UAAU,MAAM,gBAAgB,EAAE,CAAC,CAAA;gBAC5F,CAAC;gBACD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACjC,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC5D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;oBACjC,OAAO,CAAC,IAAI,CAAC,wCAAwC,UAAU,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC5G,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAA;gBAC3B,OAAO,MAAM,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;gBACxC,MAAM,KAAK,CAAA;YACb,CAAC;QAAA,CACF,CAAC,EAAE,CAAA;QACJ,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QACzC,IAAI,CAAC;YAAC,OAAO,MAAM,SAAS,CAAA;QAAC,CAAC;gBAAS,CAAC;YACtC,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS;gBAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACrF,CAAC;IAAA,CACF;IAED,KAAK,UAAU,UAAU,CAAC,UAAkB,EAAiB;QAC3D,UAAU,EAAE,CAAA;QACZ,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAA;QAClC,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAAA,CAChC;IAED,SAAS,QAAQ,GAAkB;QACjC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,4EAA4E;YAC5E,MAAM,GAAG,IAAI,CAAA;YACb,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7B,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;gBACjF,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAA;YAAA,CACxC,CAAC,EAAE,CAAA;QACN,CAAC;QACD,OAAO,eAAe,CAAA;IAAA,CACvB;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;AAAA,CAC9F;AAID;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,SAAiB,EACa;IAC9B,gCAAgC;IAChC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACxD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAA;IACrB,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAClD,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,UAAU,sBAAsB,CAAC,CAAA;QAE5E,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;gBACnE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,EAAC,CAAC;aAC3B,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAA;YACzD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,4CAA4C,UAAU,EAAE,CAAC,CAAA;gBACrE,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YAC5D,OAAO,SAAS,EAAE,MAAM,IAAI,IAAI,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5E,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,OAAO,KAAK,CAAC,MAAM,CAAA;AAAA,CACpB;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAuB;IAC3E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO,mBAAmB,CAAA;IAE1C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAA;AAAA,CAC7C;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAuB,EAAW;IAC9D,uBAAuB;IACvB,IAAI,CAAC,UAAU,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEjC,sDAAsD;IACtD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAE5C,gFAAgF;IAChF,IAAI,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAElF,4DAA4D;IAC5D,OAAO,UAAU,CAAC,IAAI,KAAK,SAAS,CAAA;AAAA,CACrC","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Flow\n * \n * High-level OAuth flow management using the MCP SDK's built-in auth functions.\n */\n\nimport {\n  auth as runSdkAuth,\n  UnauthorizedError,\n} from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\"\nimport open from \"open\"\nimport { McpOAuthProvider, type McpOAuthConfig, type McpOAuthFlowState } from \"./mcp-oauth-provider.ts\"\nimport {\n  ensureCallbackServer,\n  waitForCallback,\n  cancelPendingCallback,\n  acquireCallbackServerOwner,\n  releaseCallbackServerOwner,\n  releaseCallbackServer,\n} from \"./mcp-callback-server.ts\"\nimport {\n  getAuthForUrl,\n  isTokenExpired,\n  hasStoredTokens,\n  clearAllCredentials,\n  type StoredTokens,\n} from \"./mcp-auth.ts\"\nimport { abortable, throwIfAborted } from \"./abort.ts\"\nimport type { ServerEntry } from \"./types.ts\"\n\n/** Auth status for a server */\nexport type AuthStatus = \"authenticated\" | \"expired\" | \"not_authenticated\"\n\nexport interface AuthenticateOptions {\n  onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>\n}\n\n/** Timeout for manual auth completion (5 minutes) */\nconst MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000\n\n/**\n * Generate a cryptographically secure random state parameter.\n */\nfunction generateState(): string {\n  return Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n}\n\n/**\n * Extract OAuth configuration from a ServerEntry.\n */\nexport function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {\n  if (definition.oauth === false) {\n    return {}\n  }\n\n  const config: McpOAuthConfig = {}\n  if (definition.oauth?.grantType !== undefined) config.grantType = definition.oauth.grantType\n  if (definition.oauth?.clientId !== undefined) config.clientId = definition.oauth.clientId\n  if (definition.oauth?.clientSecret !== undefined) config.clientSecret = definition.oauth.clientSecret\n  if (definition.oauth?.scope !== undefined) config.scope = definition.oauth.scope\n  if (definition.oauth?.redirectUri !== undefined) {\n    if (typeof definition.oauth.redirectUri !== \"string\") {\n      throw new Error(\"OAuth redirectUri must be a string\")\n    }\n    const redirectUri = definition.oauth.redirectUri.trim()\n    if (!redirectUri) {\n      throw new Error(\"OAuth redirectUri must not be empty\")\n    }\n    config.redirectUri = redirectUri\n  }\n  if (definition.oauth?.clientName !== undefined) {\n    if (typeof definition.oauth.clientName !== \"string\") {\n      throw new Error(\"OAuth clientName must be a string\")\n    }\n    const clientName = definition.oauth.clientName.trim()\n    if (!clientName) {\n      throw new Error(\"OAuth clientName must not be empty\")\n    }\n    config.clientName = clientName\n  }\n  if (definition.oauth?.clientUri !== undefined) {\n    if (typeof definition.oauth.clientUri !== \"string\") {\n      throw new Error(\"OAuth clientUri must be a string\")\n    }\n    const clientUri = definition.oauth.clientUri.trim()\n    if (!clientUri) {\n      throw new Error(\"OAuth clientUri must not be empty\")\n    }\n    config.clientUri = clientUri\n  }\n  return config\n}\n\nfunction parseOAuthRedirectUri(redirectUri: string): { port: number; callbackHost: string; callbackPath: string } {\n  let url: URL\n  try {\n    url = new URL(redirectUri)\n  } catch (error) {\n    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error })\n  }\n\n  const hostname = url.hostname.toLowerCase()\n  const isLocalhost = hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\"\n  if (url.protocol !== \"http:\" || !isLocalhost) {\n    throw new Error(\"OAuth redirectUri must be an http:// localhost or loopback URI\")\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"OAuth redirectUri must not include username or password\")\n  }\n\n  if (url.hash) {\n    throw new Error(\"OAuth redirectUri must not include a fragment\")\n  }\n\n  if (!url.port) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const port = Number.parseInt(url.port, 10)\n  if (!Number.isInteger(port) || port <= 0 || port > 65535) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const callbackHost = hostname === \"[::1]\" ? \"::1\" : hostname\n  return { port, callbackHost, callbackPath: url.pathname }\n}\n\nfunction getSearchParamsFromInput(input: string): URLSearchParams | undefined {\n  try {\n    const url = new URL(input)\n    const params = new URLSearchParams(url.search)\n    if (url.hash) {\n      const hash = url.hash.startsWith(\"#\") ? url.hash.slice(1) : url.hash\n      const hashParams = new URLSearchParams(hash)\n      for (const [key, value] of hashParams) {\n        if (!params.has(key)) params.set(key, value)\n      }\n    }\n    return params\n  } catch {\n    const query = input.includes(\"?\") ? input.slice(input.indexOf(\"?\") + 1) : input\n    const params = new URLSearchParams(query.startsWith(\"#\") ? query.slice(1) : query)\n    return params.has(\"code\") || params.has(\"state\") || params.has(\"error\") ? params : undefined\n  }\n}\n\n/**\n * Extract an OAuth authorization code from either a raw code, a query string,\n * or the full localhost redirect URL copied from the browser address bar.\n */\nexport function parseAuthorizationCodeInput(input: string, expectedState?: string): string {\n  const trimmed = input.trim()\n  if (!trimmed) {\n    throw new Error(\"Authorization code or redirect URL is required\")\n  }\n\n  const params = getSearchParamsFromInput(trimmed)\n  if (params) {\n    const error = params.get(\"error\")\n    if (error) {\n      const description = params.get(\"error_description\")\n      throw new Error(description ? `${error}: ${description}` : error)\n    }\n\n    const state = params.get(\"state\")\n    if (expectedState && !state) {\n      throw new Error(\"OAuth state missing from redirect URL\")\n    }\n    if (expectedState && state !== expectedState) {\n      throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n    }\n\n    const code = params.get(\"code\")\n    if (code) return code\n  }\n\n  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {\n    return trimmed\n  }\n\n  throw new Error(\"Could not find an OAuth authorization code in the provided input\")\n}\n\ninterface PendingAuthFlow {\n  state: McpOAuthFlowState\n  controller: AbortController\n  transport?: StreamableHTTPClientTransport\n  timer?: ReturnType<typeof setTimeout>\n  cleanup?: Promise<void>\n}\n\n/** Each session owns its flows; only the callback listener is shared. */\nexport function createMcpAuthFlow() {\n  const owner = acquireCallbackServerOwner()\n  const flows = new Map<string, PendingAuthFlow>()\n  const authenticating = new Map<string, Promise<AuthStatus>>()\n  let shutdownPromise: Promise<void> | undefined\n  let closed = false\n\n  function assertOpen(): void {\n    if (closed) throw new Error(\"MCP OAuth session closed\")\n  }\n\n  async function clearPendingAuth(serverName: string, flow = flows.get(serverName)): Promise<void> {\n    if (!flow) return\n    if (!flow.cleanup) {\n      flow.cleanup = (async () => {\n        if (flows.get(serverName) === flow) flows.delete(serverName)\n        if (flow.timer) clearTimeout(flow.timer)\n        flow.controller.abort(new Error(\"Authorization cancelled\"))\n        cancelPendingCallback(flow.state.oauthState)\n        releaseCallbackServer(flow.state.oauthState)\n        await flow.transport?.close().catch(() => {})\n      })()\n    }\n    await flow.cleanup\n  }\n\n  async function startAuth(\n    serverName: string,\n    serverUrl: string,\n    definition?: ServerEntry,\n  ): Promise<{ authorizationUrl: string }> {\n    assertOpen()\n    const previous = flows.get(serverName)\n    if (previous) await clearPendingAuth(serverName, previous)\n    assertOpen()\n    if (flows.has(serverName)) throw new Error(`OAuth flow already pending for server: ${serverName}`)\n    const controller = new AbortController()\n    const flow: PendingAuthFlow = { controller, state: { oauthState: generateState(), signal: controller.signal } }\n    flows.set(serverName, flow)\n    const signal = controller.signal\n    const fetchFn: typeof fetch = (input, init) => fetch(input, {\n      ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal,\n    })\n    try {\n      const config = definition ? extractOAuthConfig(definition) : {}\n      const storedAuth = await getAuthForUrl(serverName, serverUrl)\n      throwIfAborted(signal)\n      flow.state.clientInfo = storedAuth?.clientInfo\n      // Reuse the registered redirect endpoint and client ID, including clients\n      // without tokens. Display metadata changes never invalidate registrations.\n      if (config.grantType !== \"client_credentials\") {\n        if (!config.redirectUri && !config.clientId) {\n          const registeredRedirect = storedAuth?.clientInfo?.redirectUris?.[0]\n          if (registeredRedirect) config.redirectUri = registeredRedirect\n        }\n        const redirect = config.redirectUri ? parseOAuthRedirectUri(config.redirectUri) : undefined\n        await ensureCallbackServer({\n          owner,\n          signal,\n          strictPort: Boolean(config.clientId || storedAuth?.clientInfo) || config.redirectUri !== undefined,\n          oauthState: flow.state.oauthState,\n          reserveState: true,\n          ...(redirect ? { port: redirect.port, callbackHost: redirect.callbackHost, callbackPath: redirect.callbackPath } : {}),\n        })\n        throwIfAborted(signal)\n      }\n      let capturedUrl: URL | undefined\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n        onRedirect: (url) => { throwIfAborted(signal); capturedUrl = url },\n      }, flow.state)\n      const result = await abortable(runSdkAuth(authProvider, { serverUrl, fetchFn }), signal)\n      throwIfAborted(signal)\n      if (result === \"AUTHORIZED\") {\n        await clearPendingAuth(serverName, flow)\n        return { authorizationUrl: \"\" }\n      }\n      if (config.grantType === \"client_credentials\" || !capturedUrl) {\n        throw new UnauthorizedError(\"OAuth authorization URL was not provided\")\n      }\n      flow.transport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider, fetch: fetchFn })\n      flow.timer = setTimeout(() => { void clearPendingAuth(serverName, flow) }, MANUAL_AUTH_TIMEOUT_MS)\n      flow.timer.unref?.()\n      return { authorizationUrl: capturedUrl.toString() }\n    } catch (error) {\n      await clearPendingAuth(serverName, flow)\n      throw error\n    }\n  }\n\n  async function completeAuthFromInput(serverName: string, input: string): Promise<AuthStatus> {\n    assertOpen()\n    const flow = flows.get(serverName)\n    if (!flow) throw new Error(`No pending OAuth flow for server: ${serverName}`)\n    return completeAuth(serverName, parseAuthorizationCodeInput(input, flow.state.oauthState))\n  }\n\n  async function completeAuth(serverName: string, code: string): Promise<AuthStatus> {\n    assertOpen()\n    const flow = flows.get(serverName)\n    if (!flow?.transport) throw new Error(`No pending OAuth flow for server: ${serverName}`)\n    try {\n      await abortable(flow.transport.finishAuth(code), flow.state.signal)\n      throwIfAborted(flow.state.signal)\n      return \"authenticated\"\n    } finally {\n      await clearPendingAuth(serverName, flow)\n    }\n  }\n\n  async function authenticate(\n    serverName: string,\n    serverUrl: string,\n    definition?: ServerEntry,\n    options: AuthenticateOptions = {},\n  ): Promise<AuthStatus> {\n    assertOpen()\n    const pending = authenticating.get(serverName)\n    if (pending) return pending\n    const operation = (async (): Promise<AuthStatus> => {\n      const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)\n      if (!authorizationUrl) return \"authenticated\"\n      assertOpen()\n      const flow = flows.get(serverName)\n      if (!flow) throw new Error(`No pending OAuth flow for server: ${serverName}`)\n      const callback = waitForCallback(flow.state.oauthState)\n      // Attach a rejection handler before asynchronous UI/browser handoffs.\n      void callback.catch(() => {})\n      try {\n        if (options.onAuthorizationUrl) {\n          await abortable(Promise.resolve(options.onAuthorizationUrl(authorizationUrl)), flow.state.signal)\n        } else {\n          console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\\n${authorizationUrl}`)\n        }\n        throwIfAborted(flow.state.signal)\n        try {\n          await abortable(open(authorizationUrl), flow.state.signal)\n        } catch (error) {\n          throwIfAborted(flow.state.signal)\n          console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })\n        }\n        const code = await callback\n        return await completeAuth(serverName, code)\n      } catch (error) {\n        await clearPendingAuth(serverName, flow)\n        throw error\n      }\n    })()\n    authenticating.set(serverName, operation)\n    try { return await operation } finally {\n      if (authenticating.get(serverName) === operation) authenticating.delete(serverName)\n    }\n  }\n\n  async function removeAuth(serverName: string): Promise<void> {\n    assertOpen()\n    await clearPendingAuth(serverName)\n    clearAllCredentials(serverName)\n  }\n\n  function shutdown(): Promise<void> {\n    if (!shutdownPromise) {\n      // Mark closed before cleanup can yield, so stale callers cannot start work.\n      closed = true\n      shutdownPromise = (async () => {\n        await Promise.all([...flows].map(([name, flow]) => clearPendingAuth(name, flow)))\n        await releaseCallbackServerOwner(owner)\n      })()\n    }\n    return shutdownPromise\n  }\n\n  return { startAuth, completeAuth, completeAuthFromInput, authenticate, removeAuth, shutdown }\n}\n\nexport type McpAuthFlow = ReturnType<typeof createMcpAuthFlow>\n\n/**\n * Get a valid access token for a server, refreshing if necessary.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server\n * @returns The valid tokens or null if not authenticated\n */\nexport async function getValidToken(\n  serverName: string,\n  serverUrl: string,\n): Promise<StoredTokens | null> {\n  // Check if we have valid tokens\n  const entry = await getAuthForUrl(serverName, serverUrl)\n  if (!entry?.tokens) {\n    return null\n  }\n\n  // Check expiration\n  const expired = await isTokenExpired(serverName)\n  if (expired === false) {\n    return entry.tokens\n  }\n\n  if (expired === true && entry.tokens.refreshToken) {\n    // Token is expired, try to refresh\n    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`)\n\n    try {\n      // Create auth provider for token refresh\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {\n        onRedirect: async () => {},\n      })\n\n      const clientInfo = await authProvider.clientInformation()\n      if (!clientInfo) {\n        console.log(`MCP Auth: No client info for refresh for ${serverName}`)\n        return null\n      }\n\n      const result = await runSdkAuth(authProvider, { serverUrl })\n      if (result !== \"AUTHORIZED\") {\n        return null\n      }\n      const refreshed = await getAuthForUrl(serverName, serverUrl)\n      return refreshed?.tokens ?? null\n    } catch (error) {\n      console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error })\n      return null\n    }\n  }\n\n  // No expiration info or no refresh token, assume valid\n  return entry.tokens\n}\n\n/**\n * Check the authentication status for a server.\n * \n * @param serverName - The name of the MCP server\n * @returns The current auth status\n */\nexport async function getAuthStatus(serverName: string): Promise<AuthStatus> {\n  const hasTokens = await hasStoredTokens(serverName)\n  if (!hasTokens) return \"not_authenticated\"\n\n  const expired = await isTokenExpired(serverName)\n  return expired ? \"expired\" : \"authenticated\"\n}\n\n/**\n * Check if OAuth is supported for a server configuration.\n * OAuth is supported for HTTP servers unless explicitly disabled.\n * \n * @param definition - The server definition\n * @returns True if OAuth is supported\n */\nexport function supportsOAuth(definition: ServerEntry): boolean {\n  // OAuth requires a URL\n  if (!definition.url) return false\n  \n  // Explicitly disabled via auth: false or oauth: false\n  if (definition.auth === false) return false\n  if (definition.oauth === false) return false\n  if (definition.auth === \"oauth\") return true\n  \n  // Configured custom headers take precedence over implicit OAuth auto-detection.\n  if (definition.headers && Object.keys(definition.headers).length > 0) return false\n\n  // OAuth is enabled when auth is not specified (auto-detect)\n  return definition.auth === undefined\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.d.ts

@@ -5,6 +5,8 @@
  * Uses Node.js http module for compatibility.
  */
 interface EnsureCallbackServerOptions {
+    owner?: symbol;
+    signal?: AbortSignal;
     strictPort?: boolean;
     port?: number;
     callbackHost?: string;
@@ -12,6 +14,9 @@ interface EnsureCallbackServerOptions {
     oauthState?: string;
     reserveState?: boolean;
 }
+/** Listener ownership survives a completed callback until its session closes. */
+export declare function acquireCallbackServerOwner(): symbol;
+export declare function releaseCallbackServerOwner(owner: symbol): Promise<void>;
 /**
  * Ensure the callback server is running.
  * If strictPort is true, requires binding on the configured callback port.

package/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-callback-server.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-callback-server.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AA+EH,UAAU,2BAA2B;IACnC,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAiFD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CAcnG;AAoGD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYnE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAQ9D;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAwBxD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Callback Server\n * \n * HTTP server that handles OAuth callbacks from the authorization server.\n * Uses Node.js http module for compatibility.\n */\n\nimport { createServer, type Server, type IncomingMessage, type ServerResponse } from \"http\"\nimport {\n  DEFAULT_OAUTH_CALLBACK_PATH,\n  getConfiguredOAuthCallbackPort,\n  getOAuthCallbackPath,\n  getOAuthCallbackPort,\n  setOAuthCallbackPath,\n  setOAuthCallbackPort,\n} from \"./mcp-oauth-provider.ts\"\n\n// HTML templates for callback responses\nconst HTML_SUCCESS = `<!DOCTYPE html>\n<html>\n<head>\n  <title>Pi - Authorization Successful</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #4ade80; margin-bottom: 1rem; }\n    p { color: #aaa; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Successful</h1>\n    <p>You can close this window and return to Pi.</p>\n  </div>\n  <script>setTimeout(() => window.close(), 2000);</script>\n</body>\n</html>`\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\")\n}\n\nconst HTML_ERROR = (error: string) => `<!DOCTYPE html>\n<html>\n<head>\n  <title>Pi - Authorization Failed</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #f87171; margin-bottom: 1rem; }\n    p { color: #aaa; }\n    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Failed</h1>\n    <p>An error occurred during authorization.</p>\n    <div class=\"error\">${escapeHtml(error)}</div>\n  </div>\n</body>\n</html>`\n\n/** Pending authorization request */\ninterface PendingAuth {\n  resolve: (code: string) => void\n  reject: (error: Error) => void\n  timeout: ReturnType<typeof setTimeout>\n}\n\n/** Server singleton state */\nlet server: Server | undefined\nlet bindingPromise: Promise<void> | undefined\nconst pendingAuths = new Map<string, PendingAuth>()\nconst reservedAuthStates = new Set<string>()\n\n/** Timeout for callback completion (5 minutes) */\nconst CALLBACK_TIMEOUT_MS = 5 * 60 * 1000\n\ninterface EnsureCallbackServerOptions {\n  strictPort?: boolean\n  port?: number\n  callbackHost?: string\n  callbackPath?: string\n  oauthState?: string\n  reserveState?: boolean\n}\n\nconst DEFAULT_OAUTH_CALLBACK_HOST = \"localhost\"\nlet callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n\n/**\n * Handle incoming HTTP requests to the callback server.\n */\nfunction handleRequest(req: IncomingMessage, res: ServerResponse): void {\n  const url = new URL(req.url || \"/\", `http://${req.headers.host}`)\n\n  // Only handle the callback path\n  if (url.pathname !== getOAuthCallbackPath()) {\n    res.writeHead(404, { \"Content-Type\": \"text/plain\" })\n    res.end(\"Not found\")\n    return\n  }\n\n  const code = url.searchParams.get(\"code\")\n  const state = url.searchParams.get(\"state\")\n  const error = url.searchParams.get(\"error\")\n  const errorDescription = url.searchParams.get(\"error_description\")\n\n  // Enforce state parameter presence for CSRF protection\n  if (!state) {\n    const errorMsg = \"Missing required state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  const pending = pendingAuths.get(state)\n  const isReserved = reservedAuthStates.has(state)\n\n  // Handle OAuth errors only for a state that belongs to an active flow.\n  if (error) {\n    if (!pending && !isReserved) {\n      const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n      res.writeHead(400, { \"Content-Type\": \"text/html\" })\n      res.end(HTML_ERROR(errorMsg))\n      return\n    }\n\n    const errorMsg = errorDescription || error\n    // Send HTTP response first before rejecting promise\n    res.writeHead(200, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    reservedAuthStates.delete(state)\n    // Reject promise after response is sent (defer to allow test to attach handler)\n    if (pending) {\n      clearTimeout(pending.timeout)\n      pendingAuths.delete(state)\n      setTimeout(() => pending.reject(new Error(errorMsg)), 0)\n    }\n    return\n  }\n\n  // Validate state parameter\n  if (!pending) {\n    const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  // Require authorization code\n  if (!code) {\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(\"No authorization code provided\"))\n    return\n  }\n\n  // Clear timeout and resolve the pending promise\n  clearTimeout(pending.timeout)\n  pendingAuths.delete(state)\n  pending.resolve(code)\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\" })\n  res.end(HTML_SUCCESS)\n}\n\n/**\n * Ensure the callback server is running.\n * If strictPort is true, requires binding on the configured callback port.\n * If strictPort is false, asks the OS for an available local port.\n */\nexport async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  while (bindingPromise) {\n    await bindingPromise\n  }\n\n  const operation = ensureCallbackServerLocked(options)\n  bindingPromise = operation\n  try {\n    await operation\n  } finally {\n    if (bindingPromise === operation) {\n      bindingPromise = undefined\n    }\n  }\n}\n\nasync function ensureCallbackServerLocked(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort()\n  const strictPort = options.strictPort === true\n  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST\n  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH\n  const requestedPath = rawRequestedPath.startsWith(\"/\") ? rawRequestedPath : `/${rawRequestedPath}`\n  if (options.reserveState && !options.oauthState) {\n    throw new Error(\"OAuth callback reservation requires an oauthState\")\n  }\n  let reservedState: string | undefined\n\n  const previousServer = server\n  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort)\n  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost)\n  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath)\n\n  if (previousServer) {\n    if (!needsStrictRebind && !needsHostSwitch) {\n      if (needsPathSwitch) {\n        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n          throw new Error(\n            `OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`\n          )\n        }\n        setOAuthCallbackPath(requestedPath)\n      }\n      if (options.reserveState && options.oauthState) {\n        reservedAuthStates.add(options.oauthState)\n        reservedState = options.oauthState\n      }\n      return\n    }\n\n    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n      throw new Error(\n        `OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`\n      )\n    }\n  }\n\n  const candidateServer = createServer(handleRequest)\n  const listenPort = strictPort ? requiredPort : 0\n\n  try {\n    await new Promise<void>((resolve, reject) => {\n      candidateServer.once(\"error\", (err) => {\n        reject(err)\n      })\n\n      candidateServer.listen(listenPort, requestedHost, () => {\n        resolve()\n      })\n    })\n\n    if (strictPort) {\n      setOAuthCallbackPort(requiredPort)\n    } else {\n      const address = candidateServer.address()\n      if (!address || typeof address === \"string\" || typeof address.port !== \"number\") {\n        throw new Error(\"OAuth callback server did not report an assigned port\")\n      }\n      setOAuthCallbackPort(address.port)\n    }\n\n    if (previousServer && (needsStrictRebind || needsHostSwitch)) {\n      await new Promise<void>((resolve) => {\n        previousServer.close(() => resolve())\n      })\n    }\n\n    callbackServerHost = requestedHost\n    setOAuthCallbackPath(requestedPath)\n    server = candidateServer\n    if (options.reserveState && options.oauthState) {\n      reservedAuthStates.add(options.oauthState)\n      reservedState = options.oauthState\n    }\n    server.unref()\n  } catch (error) {\n    if (reservedState) {\n      reservedAuthStates.delete(reservedState)\n    }\n    const nodeError = error as NodeJS.ErrnoException\n    await new Promise<void>((resolve) => {\n      candidateServer.close(() => resolve())\n    })\n\n    if (strictPort && nodeError.code === \"EADDRINUSE\") {\n      throw new Error(\n        `OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`,\n        { cause: error }\n      )\n    }\n\n    throw error\n  }\n}\n\nexport function reserveCallbackServer(oauthState: string): void {\n  reservedAuthStates.add(oauthState)\n}\n\nexport function releaseCallbackServer(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n}\n\n/**\n * Wait for a callback with the given OAuth state.\n * Returns a promise that resolves with the authorization code.\n */\nexport function waitForCallback(oauthState: string): Promise<string> {\n  reservedAuthStates.delete(oauthState)\n  return new Promise((resolve, reject) => {\n    const timeout = setTimeout(() => {\n      if (pendingAuths.has(oauthState)) {\n        pendingAuths.delete(oauthState)\n        reject(new Error(\"OAuth callback timeout - authorization took too long\"))\n      }\n    }, CALLBACK_TIMEOUT_MS)\n\n    pendingAuths.set(oauthState, { resolve, reject, timeout })\n  })\n}\n\n/**\n * Cancel a pending authorization by state.\n */\nexport function cancelPendingCallback(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n  const pending = pendingAuths.get(oauthState)\n  if (pending) {\n    clearTimeout(pending.timeout)\n    pendingAuths.delete(oauthState)\n    pending.reject(new Error(\"Authorization cancelled\"))\n  }\n}\n\n/**\n * Stop the callback server and reject all pending authorizations.\n */\nexport async function stopCallbackServer(): Promise<void> {\n  if (server) {\n    await new Promise<void>((resolve) => {\n      server!.close(() => {\n        resolve()\n      })\n    })\n    server = undefined\n  }\n\n  setOAuthCallbackPort(getConfiguredOAuthCallbackPort())\n  callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n  setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH)\n\n  // Reject all pending auths (defer to allow any pending operations to complete)\n  const pendingList = Array.from(pendingAuths.entries())\n  pendingAuths.clear()\n  reservedAuthStates.clear()\n  setTimeout(() => {\n    for (const [, pending] of pendingList) {\n      clearTimeout(pending.timeout)\n      pending.reject(new Error(\"OAuth callback server stopped\"))\n    }\n  }, 0)\n}\n\n/**\n * Check if the callback server is running.\n */\nexport function isCallbackServerRunning(): boolean {\n  return server !== undefined\n}\n\n/**\n * Get the number of pending authorizations.\n */\nexport function getPendingAuthCount(): number {\n  return pendingAuths.size\n}\n"]}
+{"version":3,"file":"mcp-callback-server.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-callback-server.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAiFH,UAAU,2BAA2B;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAmGD,iFAAiF;AACjF,wBAAgB,0BAA0B,IAAI,MAAM,CAInD;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7E;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;AAqGD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYnE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAQ9D;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAExD;AA4BD;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Callback Server\n * \n * HTTP server that handles OAuth callbacks from the authorization server.\n * Uses Node.js http module for compatibility.\n */\n\nimport { createServer, type Server, type IncomingMessage, type ServerResponse } from \"http\"\nimport { throwIfAborted } from \"./abort.ts\"\nimport {\n  DEFAULT_OAUTH_CALLBACK_PATH,\n  getConfiguredOAuthCallbackPort,\n  getOAuthCallbackPath,\n  getOAuthCallbackPort,\n  setOAuthCallbackPath,\n  setOAuthCallbackPort,\n} from \"./mcp-oauth-provider.ts\"\n\n// HTML templates for callback responses\nconst HTML_SUCCESS = `<!DOCTYPE html>\n<html>\n<head>\n  <title>lunR - Authorization Successful</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #4ade80; margin-bottom: 1rem; }\n    p { color: #aaa; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Successful</h1>\n    <p>You can close this window and return to lunR.</p>\n  </div>\n  <script>setTimeout(() => window.close(), 2000);</script>\n</body>\n</html>`\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\")\n}\n\nconst HTML_ERROR = (error: string) => `<!DOCTYPE html>\n<html>\n<head>\n  <title>lunR - Authorization Failed</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #f87171; margin-bottom: 1rem; }\n    p { color: #aaa; }\n    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Failed</h1>\n    <p>An error occurred during authorization.</p>\n    <div class=\"error\">${escapeHtml(error)}</div>\n  </div>\n</body>\n</html>`\n\n/** Pending authorization request */\ninterface PendingAuth {\n  resolve: (code: string) => void\n  reject: (error: Error) => void\n  timeout: ReturnType<typeof setTimeout>\n}\n\n/** Server singleton state */\nlet server: Server | undefined\nlet bindingPromise: Promise<void> | undefined\nconst pendingAuths = new Map<string, PendingAuth>()\nconst reservedAuthStates = new Set<string>()\nconst callbackOwners = new Set<symbol>()\n\n/** Timeout for callback completion (5 minutes) */\nconst CALLBACK_TIMEOUT_MS = 5 * 60 * 1000\n\ninterface EnsureCallbackServerOptions {\n  owner?: symbol\n  signal?: AbortSignal\n  strictPort?: boolean\n  port?: number\n  callbackHost?: string\n  callbackPath?: string\n  oauthState?: string\n  reserveState?: boolean\n}\n\nconst DEFAULT_OAUTH_CALLBACK_HOST = \"localhost\"\nlet callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n\n/**\n * Handle incoming HTTP requests to the callback server.\n */\nfunction handleRequest(req: IncomingMessage, res: ServerResponse): void {\n  const url = new URL(req.url || \"/\", `http://${req.headers.host}`)\n\n  // Only handle the callback path\n  if (url.pathname !== getOAuthCallbackPath()) {\n    res.writeHead(404, { \"Content-Type\": \"text/plain\" })\n    res.end(\"Not found\")\n    return\n  }\n\n  const code = url.searchParams.get(\"code\")\n  const state = url.searchParams.get(\"state\")\n  const error = url.searchParams.get(\"error\")\n  const errorDescription = url.searchParams.get(\"error_description\")\n\n  // Enforce state parameter presence for CSRF protection\n  if (!state) {\n    const errorMsg = \"Missing required state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  const pending = pendingAuths.get(state)\n  const isReserved = reservedAuthStates.has(state)\n\n  // Handle OAuth errors only for a state that belongs to an active flow.\n  if (error) {\n    if (!pending && !isReserved) {\n      const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n      res.writeHead(400, { \"Content-Type\": \"text/html\" })\n      res.end(HTML_ERROR(errorMsg))\n      return\n    }\n\n    const errorMsg = errorDescription || error\n    // Send HTTP response first before rejecting promise\n    res.writeHead(200, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    reservedAuthStates.delete(state)\n    // Reject promise after response is sent (defer to allow test to attach handler)\n    if (pending) {\n      clearTimeout(pending.timeout)\n      pendingAuths.delete(state)\n      setTimeout(() => pending.reject(new Error(errorMsg)), 0)\n    }\n    return\n  }\n\n  // Validate state parameter\n  if (!pending) {\n    const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  // Require authorization code\n  if (!code) {\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(\"No authorization code provided\"))\n    return\n  }\n\n  // Clear timeout and resolve the pending promise\n  clearTimeout(pending.timeout)\n  pendingAuths.delete(state)\n  pending.resolve(code)\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\" })\n  res.end(HTML_SUCCESS)\n}\n\n/** Serialize listener binding and final-owner release. */\nasync function withCallbackLock(action: () => Promise<void>): Promise<void> {\n  while (bindingPromise) {\n    // A failed bind belongs to its caller, not to the next owner in the queue.\n    await bindingPromise.catch(() => {})\n  }\n\n  const operation = action()\n  bindingPromise = operation\n  try {\n    await operation\n  } finally {\n    if (bindingPromise === operation) {\n      bindingPromise = undefined\n    }\n  }\n}\n\n/** Listener ownership survives a completed callback until its session closes. */\nexport function acquireCallbackServerOwner(): symbol {\n  const owner = Symbol(\"MCP OAuth owner\")\n  callbackOwners.add(owner)\n  return owner\n}\n\nexport async function releaseCallbackServerOwner(owner: symbol): Promise<void> {\n  await withCallbackLock(async () => {\n    callbackOwners.delete(owner)\n    if (callbackOwners.size === 0) await stopCallbackServerLocked()\n  })\n}\n\n/**\n * Ensure the callback server is running.\n * If strictPort is true, requires binding on the configured callback port.\n * If strictPort is false, asks the OS for an available local port.\n */\nexport async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  await withCallbackLock(async () => {\n    throwIfAborted(options.signal)\n    if (options.owner && !callbackOwners.has(options.owner)) throw new Error(\"MCP OAuth session closed\")\n    await ensureCallbackServerLocked(options)\n    throwIfAborted(options.signal)\n  })\n}\n\nasync function ensureCallbackServerLocked(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort()\n  const strictPort = options.strictPort === true\n  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST\n  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH\n  const requestedPath = rawRequestedPath.startsWith(\"/\") ? rawRequestedPath : `/${rawRequestedPath}`\n  if (options.reserveState && !options.oauthState) {\n    throw new Error(\"OAuth callback reservation requires an oauthState\")\n  }\n  let reservedState: string | undefined\n\n  const previousServer = server\n  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort)\n  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost)\n  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath)\n\n  if (previousServer) {\n    if (!needsStrictRebind && !needsHostSwitch) {\n      if (needsPathSwitch) {\n        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n          throw new Error(\n            `OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`\n          )\n        }\n        setOAuthCallbackPath(requestedPath)\n      }\n      if (options.reserveState && options.oauthState && !options.signal?.aborted) {\n        reservedAuthStates.add(options.oauthState)\n        reservedState = options.oauthState\n      }\n      return\n    }\n\n    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n      throw new Error(\n        `OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`\n      )\n    }\n  }\n\n  const candidateServer = createServer(handleRequest)\n  const listenPort = strictPort ? requiredPort : 0\n\n  try {\n    await new Promise<void>((resolve, reject) => {\n      candidateServer.once(\"error\", (err) => {\n        reject(err)\n      })\n\n      candidateServer.listen(listenPort, requestedHost, () => {\n        resolve()\n      })\n    })\n\n    if (strictPort) {\n      setOAuthCallbackPort(requiredPort)\n    } else {\n      const address = candidateServer.address()\n      if (!address || typeof address === \"string\" || typeof address.port !== \"number\") {\n        throw new Error(\"OAuth callback server did not report an assigned port\")\n      }\n      setOAuthCallbackPort(address.port)\n    }\n\n    if (previousServer && (needsStrictRebind || needsHostSwitch)) {\n      await new Promise<void>((resolve) => {\n        previousServer.close(() => resolve())\n      })\n    }\n\n    callbackServerHost = requestedHost\n    setOAuthCallbackPath(requestedPath)\n    server = candidateServer\n    // Flow cleanup can finish while binding yields. Never reserve its canceled state afterward.\n    if (options.reserveState && options.oauthState && !options.signal?.aborted) {\n      reservedAuthStates.add(options.oauthState)\n      reservedState = options.oauthState\n    }\n    server.unref()\n  } catch (error) {\n    if (reservedState) {\n      reservedAuthStates.delete(reservedState)\n    }\n    const nodeError = error as NodeJS.ErrnoException\n    await new Promise<void>((resolve) => {\n      candidateServer.close(() => resolve())\n    })\n\n    if (strictPort && nodeError.code === \"EADDRINUSE\") {\n      throw new Error(\n        `OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`,\n        { cause: error }\n      )\n    }\n\n    throw error\n  }\n}\n\nexport function reserveCallbackServer(oauthState: string): void {\n  reservedAuthStates.add(oauthState)\n}\n\nexport function releaseCallbackServer(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n}\n\n/**\n * Wait for a callback with the given OAuth state.\n * Returns a promise that resolves with the authorization code.\n */\nexport function waitForCallback(oauthState: string): Promise<string> {\n  reservedAuthStates.delete(oauthState)\n  return new Promise((resolve, reject) => {\n    const timeout = setTimeout(() => {\n      if (pendingAuths.has(oauthState)) {\n        pendingAuths.delete(oauthState)\n        reject(new Error(\"OAuth callback timeout - authorization took too long\"))\n      }\n    }, CALLBACK_TIMEOUT_MS)\n\n    pendingAuths.set(oauthState, { resolve, reject, timeout })\n  })\n}\n\n/**\n * Cancel a pending authorization by state.\n */\nexport function cancelPendingCallback(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n  const pending = pendingAuths.get(oauthState)\n  if (pending) {\n    clearTimeout(pending.timeout)\n    pendingAuths.delete(oauthState)\n    pending.reject(new Error(\"Authorization cancelled\"))\n  }\n}\n\n/**\n * Stop the callback server and reject all pending authorizations.\n */\nexport async function stopCallbackServer(): Promise<void> {\n  await withCallbackLock(stopCallbackServerLocked)\n}\n\nasync function stopCallbackServerLocked(): Promise<void> {\n  if (server) {\n    await new Promise<void>((resolve) => {\n      server!.close(() => {\n        resolve()\n      })\n    })\n    server = undefined\n  }\n\n  setOAuthCallbackPort(getConfiguredOAuthCallbackPort())\n  callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n  setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH)\n\n  // Reject all pending auths (defer to allow any pending operations to complete)\n  const pendingList = Array.from(pendingAuths.entries())\n  pendingAuths.clear()\n  reservedAuthStates.clear()\n  setTimeout(() => {\n    for (const [, pending] of pendingList) {\n      clearTimeout(pending.timeout)\n      pending.reject(new Error(\"OAuth callback server stopped\"))\n    }\n  }, 0)\n}\n\n/**\n * Check if the callback server is running.\n */\nexport function isCallbackServerRunning(): boolean {\n  return server !== undefined\n}\n\n/**\n * Get the number of pending authorizations.\n */\nexport function getPendingAuthCount(): number {\n  return pendingAuths.size\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.js

@@ -6,12 +6,13 @@
  * Uses Node.js http module for compatibility.
  */
 import { createServer } from "http";
+import { throwIfAborted } from "./abort.js";
 import { DEFAULT_OAUTH_CALLBACK_PATH, getConfiguredOAuthCallbackPort, getOAuthCallbackPath, getOAuthCallbackPort, setOAuthCallbackPath, setOAuthCallbackPort, } from "./mcp-oauth-provider.js";
 // HTML templates for callback responses
 const HTML_SUCCESS = `<!DOCTYPE html>
 <html>
 <head>
-  <title>Pi - Authorization Successful</title>
+  <title>lunR - Authorization Successful</title>
   <style>
     body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
     .container { text-align: center; padding: 2rem; }
@@ -22,7 +23,7 @@ const HTML_SUCCESS = `<!DOCTYPE html>
 <body>
   <div class="container">
     <h1>Authorization Successful</h1>
-    <p>You can close this window and return to Pi.</p>
+    <p>You can close this window and return to lunR.</p>
   </div>
   <script>setTimeout(() => window.close(), 2000);</script>
 </body>
@@ -38,7 +39,7 @@ function escapeHtml(value) {
 const HTML_ERROR = (error) => `<!DOCTYPE html>
 <html>
 <head>
-  <title>Pi - Authorization Failed</title>
+  <title>lunR - Authorization Failed</title>
   <style>
     body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
     .container { text-align: center; padding: 2rem; }
@@ -60,6 +61,7 @@ let server;
 let bindingPromise;
 const pendingAuths = new Map();
 const reservedAuthStates = new Set();
+const callbackOwners = new Set();
 /** Timeout for callback completion (5 minutes) */
 const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
 const DEFAULT_OAUTH_CALLBACK_HOST = "localhost";
@@ -129,16 +131,13 @@ function handleRequest(req, res) {
     res.writeHead(200, { "Content-Type": "text/html" });
     res.end(HTML_SUCCESS);
 }
-/**
- * Ensure the callback server is running.
- * If strictPort is true, requires binding on the configured callback port.
- * If strictPort is false, asks the OS for an available local port.
- */
-export async function ensureCallbackServer(options = {}) {
+/** Serialize listener binding and final-owner release. */
+async function withCallbackLock(action) {
     while (bindingPromise) {
-        await bindingPromise;
+        // A failed bind belongs to its caller, not to the next owner in the queue.
+        await bindingPromise.catch(() => { });
     }
-    const operation = ensureCallbackServerLocked(options);
+    const operation = action();
     bindingPromise = operation;
     try {
         await operation;
@@ -149,6 +148,33 @@ export async function ensureCallbackServer(options = {}) {
         }
     }
 }
+/** Listener ownership survives a completed callback until its session closes. */
+export function acquireCallbackServerOwner() {
+    const owner = Symbol("MCP OAuth owner");
+    callbackOwners.add(owner);
+    return owner;
+}
+export async function releaseCallbackServerOwner(owner) {
+    await withCallbackLock(async () => {
+        callbackOwners.delete(owner);
+        if (callbackOwners.size === 0)
+            await stopCallbackServerLocked();
+    });
+}
+/**
+ * Ensure the callback server is running.
+ * If strictPort is true, requires binding on the configured callback port.
+ * If strictPort is false, asks the OS for an available local port.
+ */
+export async function ensureCallbackServer(options = {}) {
+    await withCallbackLock(async () => {
+        throwIfAborted(options.signal);
+        if (options.owner && !callbackOwners.has(options.owner))
+            throw new Error("MCP OAuth session closed");
+        await ensureCallbackServerLocked(options);
+        throwIfAborted(options.signal);
+    });
+}
 async function ensureCallbackServerLocked(options = {}) {
     const requiredPort = options.port ?? getConfiguredOAuthCallbackPort();
     const strictPort = options.strictPort === true;
@@ -171,7 +197,7 @@ async function ensureCallbackServerLocked(options = {}) {
                 }
                 setOAuthCallbackPath(requestedPath);
             }
-            if (options.reserveState && options.oauthState) {
+            if (options.reserveState && options.oauthState && !options.signal?.aborted) {
                 reservedAuthStates.add(options.oauthState);
                 reservedState = options.oauthState;
             }
@@ -210,7 +236,8 @@ async function ensureCallbackServerLocked(options = {}) {
         callbackServerHost = requestedHost;
         setOAuthCallbackPath(requestedPath);
         server = candidateServer;
-        if (options.reserveState && options.oauthState) {
+        // Flow cleanup can finish while binding yields. Never reserve its canceled state afterward.
+        if (options.reserveState && options.oauthState && !options.signal?.aborted) {
             reservedAuthStates.add(options.oauthState);
             reservedState = options.oauthState;
         }
@@ -268,6 +295,9 @@ export function cancelPendingCallback(oauthState) {
  * Stop the callback server and reject all pending authorizations.
  */
 export async function stopCallbackServer() {
+    await withCallbackLock(stopCallbackServerLocked);
+}
+async function stopCallbackServerLocked() {
     if (server) {
         await new Promise((resolve) => {
             server.close(() => {

package/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-callback-server.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-callback-server.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,MAAM,CAAA;AAC3F,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAEhC,wCAAwC;AACxC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;QAkBb,CAAA;AAER,SAAS,UAAU,CAAC,KAAa,EAAU;IACzC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAAA,CAC1B;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;yBAgBb,UAAU,CAAC,KAAK,CAAC;;;QAGlC,CAAA;AASR,6BAA6B;AAC7B,IAAI,MAA0B,CAAA;AAC9B,IAAI,cAAyC,CAAA;AAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAA;AACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;AAE5C,kDAAkD;AAClD,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAWzC,MAAM,2BAA2B,GAAG,WAAW,CAAA;AAC/C,IAAI,kBAAkB,GAAG,2BAA2B,CAAA;AAEpD;;GAEG;AACH,SAAS,aAAa,CAAC,GAAoB,EAAE,GAAmB,EAAQ;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAEjE,gCAAgC;IAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,EAAE,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAElE,uDAAuD;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0DAA0D,CAAA;QAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7B,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAEhD,uEAAuE;IACvE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,4DAA4D,CAAA;YAC7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;YACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC7B,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,IAAI,KAAK,CAAA;QAC1C,oDAAoD;QACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7B,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAChC,gFAAgF;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAC7B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC1B,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1D,CAAC;QACD,OAAM;IACR,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,4DAA4D,CAAA;QAC7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7B,OAAM;IACR,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAA;QACrD,OAAM;IACR,CAAC;IAED,gDAAgD;IAChD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAErB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;IACnD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAAA,CACtB;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAO,GAAgC,EAAE,EAAiB;IACnG,OAAO,cAAc,EAAE,CAAC;QACtB,MAAM,cAAc,CAAA;IACtB,CAAC;IAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;IACrD,cAAc,GAAG,SAAS,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,SAAS,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,cAAc,GAAG,SAAS,CAAA;QAC5B,CAAC;IACH,CAAC;AAAA,CACF;AAED,KAAK,UAAU,0BAA0B,CAAC,OAAO,GAAgC,EAAE,EAAiB;IAClG,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,8BAA8B,EAAE,CAAA;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAA;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,2BAA2B,CAAA;IACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,IAAI,2BAA2B,CAAA;IAC5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAA;IAClG,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,aAAiC,CAAA;IAErC,MAAM,cAAc,GAAG,MAAM,CAAA;IAC7B,MAAM,iBAAiB,GAAG,OAAO,CAAC,cAAc,IAAI,UAAU,IAAI,oBAAoB,EAAE,KAAK,YAAY,CAAC,CAAA;IAC1G,MAAM,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,kBAAkB,KAAK,aAAa,CAAC,CAAA;IACvF,MAAM,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,EAAE,KAAK,aAAa,CAAC,CAAA;IAE3F,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,iBAAiB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,oBAAoB,EAAE,uBAAuB,aAAa,sEAAsE,CACxK,CAAA;gBACH,CAAC;gBACD,oBAAoB,CAAC,aAAa,CAAC,CAAA;YACrC,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC/C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBAC1C,aAAa,GAAG,OAAO,CAAC,UAAU,CAAA;YACpC,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,kBAAkB,IAAI,oBAAoB,EAAE,kCAAkC,aAAa,IAAI,YAAY,sEAAsE,CACzN,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEhD,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;YAC3C,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,CAAA;YAAA,CACZ,CAAC,CAAA;YAEF,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;gBACtD,OAAO,EAAE,CAAA;YAAA,CACV,CAAC,CAAA;QAAA,CACH,CAAC,CAAA;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,oBAAoB,CAAC,YAAY,CAAC,CAAA;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,CAAA;YACzC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAC1E,CAAC;YACD,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,iBAAiB,IAAI,eAAe,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnC,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;YAAA,CACtC,CAAC,CAAA;QACJ,CAAC;QAED,kBAAkB,GAAG,aAAa,CAAA;QAClC,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACnC,MAAM,GAAG,eAAe,CAAA;QACxB,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YAC1C,aAAa,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,EAAE,CAAC;YAClB,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAC1C,CAAC;QACD,MAAM,SAAS,GAAG,KAA8B,CAAA;QAChD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAAA,CACvC,CAAC,CAAA;QAEF,IAAI,UAAU,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,oJAAoJ,YAAY,EAAE,EACrM,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;QACH,CAAC;QAED,MAAM,KAAK,CAAA;IACb,CAAC;AAAA,CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAQ;IAC9D,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;AAAA,CACnC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAQ;IAC9D,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;AAAA,CACtC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAmB;IACnE,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBAC/B,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAA;YAC3E,CAAC;QAAA,CACF,EAAE,mBAAmB,CAAC,CAAA;QAEvB,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAAA,CAC3D,CAAC,CAAA;AAAA,CACH;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAQ;IAC9D,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC7B,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA;IACtD,CAAC;AAAA,CACF;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,GAAkB;IACxD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAA;YAAA,CACV,CAAC,CAAA;QAAA,CACH,CAAC,CAAA;QACF,MAAM,GAAG,SAAS,CAAA;IACpB,CAAC;IAED,oBAAoB,CAAC,8BAA8B,EAAE,CAAC,CAAA;IACtD,kBAAkB,GAAG,2BAA2B,CAAA;IAChD,oBAAoB,CAAC,2BAA2B,CAAC,CAAA;IAEjD,+EAA+E;IAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,YAAY,CAAC,KAAK,EAAE,CAAA;IACpB,kBAAkB,CAAC,KAAK,EAAE,CAAA;IAC1B,UAAU,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC;YACtC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAC7B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAA;QAC5D,CAAC;IAAA,CACF,EAAE,CAAC,CAAC,CAAA;AAAA,CACN;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,GAAY;IACjD,OAAO,MAAM,KAAK,SAAS,CAAA;AAAA,CAC5B;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,GAAW;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAA;AAAA,CACzB","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Callback Server\n * \n * HTTP server that handles OAuth callbacks from the authorization server.\n * Uses Node.js http module for compatibility.\n */\n\nimport { createServer, type Server, type IncomingMessage, type ServerResponse } from \"http\"\nimport {\n  DEFAULT_OAUTH_CALLBACK_PATH,\n  getConfiguredOAuthCallbackPort,\n  getOAuthCallbackPath,\n  getOAuthCallbackPort,\n  setOAuthCallbackPath,\n  setOAuthCallbackPort,\n} from \"./mcp-oauth-provider.ts\"\n\n// HTML templates for callback responses\nconst HTML_SUCCESS = `<!DOCTYPE html>\n<html>\n<head>\n  <title>Pi - Authorization Successful</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #4ade80; margin-bottom: 1rem; }\n    p { color: #aaa; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Successful</h1>\n    <p>You can close this window and return to Pi.</p>\n  </div>\n  <script>setTimeout(() => window.close(), 2000);</script>\n</body>\n</html>`\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\")\n}\n\nconst HTML_ERROR = (error: string) => `<!DOCTYPE html>\n<html>\n<head>\n  <title>Pi - Authorization Failed</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #f87171; margin-bottom: 1rem; }\n    p { color: #aaa; }\n    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Failed</h1>\n    <p>An error occurred during authorization.</p>\n    <div class=\"error\">${escapeHtml(error)}</div>\n  </div>\n</body>\n</html>`\n\n/** Pending authorization request */\ninterface PendingAuth {\n  resolve: (code: string) => void\n  reject: (error: Error) => void\n  timeout: ReturnType<typeof setTimeout>\n}\n\n/** Server singleton state */\nlet server: Server | undefined\nlet bindingPromise: Promise<void> | undefined\nconst pendingAuths = new Map<string, PendingAuth>()\nconst reservedAuthStates = new Set<string>()\n\n/** Timeout for callback completion (5 minutes) */\nconst CALLBACK_TIMEOUT_MS = 5 * 60 * 1000\n\ninterface EnsureCallbackServerOptions {\n  strictPort?: boolean\n  port?: number\n  callbackHost?: string\n  callbackPath?: string\n  oauthState?: string\n  reserveState?: boolean\n}\n\nconst DEFAULT_OAUTH_CALLBACK_HOST = \"localhost\"\nlet callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n\n/**\n * Handle incoming HTTP requests to the callback server.\n */\nfunction handleRequest(req: IncomingMessage, res: ServerResponse): void {\n  const url = new URL(req.url || \"/\", `http://${req.headers.host}`)\n\n  // Only handle the callback path\n  if (url.pathname !== getOAuthCallbackPath()) {\n    res.writeHead(404, { \"Content-Type\": \"text/plain\" })\n    res.end(\"Not found\")\n    return\n  }\n\n  const code = url.searchParams.get(\"code\")\n  const state = url.searchParams.get(\"state\")\n  const error = url.searchParams.get(\"error\")\n  const errorDescription = url.searchParams.get(\"error_description\")\n\n  // Enforce state parameter presence for CSRF protection\n  if (!state) {\n    const errorMsg = \"Missing required state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  const pending = pendingAuths.get(state)\n  const isReserved = reservedAuthStates.has(state)\n\n  // Handle OAuth errors only for a state that belongs to an active flow.\n  if (error) {\n    if (!pending && !isReserved) {\n      const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n      res.writeHead(400, { \"Content-Type\": \"text/html\" })\n      res.end(HTML_ERROR(errorMsg))\n      return\n    }\n\n    const errorMsg = errorDescription || error\n    // Send HTTP response first before rejecting promise\n    res.writeHead(200, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    reservedAuthStates.delete(state)\n    // Reject promise after response is sent (defer to allow test to attach handler)\n    if (pending) {\n      clearTimeout(pending.timeout)\n      pendingAuths.delete(state)\n      setTimeout(() => pending.reject(new Error(errorMsg)), 0)\n    }\n    return\n  }\n\n  // Validate state parameter\n  if (!pending) {\n    const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  // Require authorization code\n  if (!code) {\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(\"No authorization code provided\"))\n    return\n  }\n\n  // Clear timeout and resolve the pending promise\n  clearTimeout(pending.timeout)\n  pendingAuths.delete(state)\n  pending.resolve(code)\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\" })\n  res.end(HTML_SUCCESS)\n}\n\n/**\n * Ensure the callback server is running.\n * If strictPort is true, requires binding on the configured callback port.\n * If strictPort is false, asks the OS for an available local port.\n */\nexport async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  while (bindingPromise) {\n    await bindingPromise\n  }\n\n  const operation = ensureCallbackServerLocked(options)\n  bindingPromise = operation\n  try {\n    await operation\n  } finally {\n    if (bindingPromise === operation) {\n      bindingPromise = undefined\n    }\n  }\n}\n\nasync function ensureCallbackServerLocked(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort()\n  const strictPort = options.strictPort === true\n  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST\n  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH\n  const requestedPath = rawRequestedPath.startsWith(\"/\") ? rawRequestedPath : `/${rawRequestedPath}`\n  if (options.reserveState && !options.oauthState) {\n    throw new Error(\"OAuth callback reservation requires an oauthState\")\n  }\n  let reservedState: string | undefined\n\n  const previousServer = server\n  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort)\n  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost)\n  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath)\n\n  if (previousServer) {\n    if (!needsStrictRebind && !needsHostSwitch) {\n      if (needsPathSwitch) {\n        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n          throw new Error(\n            `OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`\n          )\n        }\n        setOAuthCallbackPath(requestedPath)\n      }\n      if (options.reserveState && options.oauthState) {\n        reservedAuthStates.add(options.oauthState)\n        reservedState = options.oauthState\n      }\n      return\n    }\n\n    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n      throw new Error(\n        `OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`\n      )\n    }\n  }\n\n  const candidateServer = createServer(handleRequest)\n  const listenPort = strictPort ? requiredPort : 0\n\n  try {\n    await new Promise<void>((resolve, reject) => {\n      candidateServer.once(\"error\", (err) => {\n        reject(err)\n      })\n\n      candidateServer.listen(listenPort, requestedHost, () => {\n        resolve()\n      })\n    })\n\n    if (strictPort) {\n      setOAuthCallbackPort(requiredPort)\n    } else {\n      const address = candidateServer.address()\n      if (!address || typeof address === \"string\" || typeof address.port !== \"number\") {\n        throw new Error(\"OAuth callback server did not report an assigned port\")\n      }\n      setOAuthCallbackPort(address.port)\n    }\n\n    if (previousServer && (needsStrictRebind || needsHostSwitch)) {\n      await new Promise<void>((resolve) => {\n        previousServer.close(() => resolve())\n      })\n    }\n\n    callbackServerHost = requestedHost\n    setOAuthCallbackPath(requestedPath)\n    server = candidateServer\n    if (options.reserveState && options.oauthState) {\n      reservedAuthStates.add(options.oauthState)\n      reservedState = options.oauthState\n    }\n    server.unref()\n  } catch (error) {\n    if (reservedState) {\n      reservedAuthStates.delete(reservedState)\n    }\n    const nodeError = error as NodeJS.ErrnoException\n    await new Promise<void>((resolve) => {\n      candidateServer.close(() => resolve())\n    })\n\n    if (strictPort && nodeError.code === \"EADDRINUSE\") {\n      throw new Error(\n        `OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`,\n        { cause: error }\n      )\n    }\n\n    throw error\n  }\n}\n\nexport function reserveCallbackServer(oauthState: string): void {\n  reservedAuthStates.add(oauthState)\n}\n\nexport function releaseCallbackServer(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n}\n\n/**\n * Wait for a callback with the given OAuth state.\n * Returns a promise that resolves with the authorization code.\n */\nexport function waitForCallback(oauthState: string): Promise<string> {\n  reservedAuthStates.delete(oauthState)\n  return new Promise((resolve, reject) => {\n    const timeout = setTimeout(() => {\n      if (pendingAuths.has(oauthState)) {\n        pendingAuths.delete(oauthState)\n        reject(new Error(\"OAuth callback timeout - authorization took too long\"))\n      }\n    }, CALLBACK_TIMEOUT_MS)\n\n    pendingAuths.set(oauthState, { resolve, reject, timeout })\n  })\n}\n\n/**\n * Cancel a pending authorization by state.\n */\nexport function cancelPendingCallback(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n  const pending = pendingAuths.get(oauthState)\n  if (pending) {\n    clearTimeout(pending.timeout)\n    pendingAuths.delete(oauthState)\n    pending.reject(new Error(\"Authorization cancelled\"))\n  }\n}\n\n/**\n * Stop the callback server and reject all pending authorizations.\n */\nexport async function stopCallbackServer(): Promise<void> {\n  if (server) {\n    await new Promise<void>((resolve) => {\n      server!.close(() => {\n        resolve()\n      })\n    })\n    server = undefined\n  }\n\n  setOAuthCallbackPort(getConfiguredOAuthCallbackPort())\n  callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n  setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH)\n\n  // Reject all pending auths (defer to allow any pending operations to complete)\n  const pendingList = Array.from(pendingAuths.entries())\n  pendingAuths.clear()\n  reservedAuthStates.clear()\n  setTimeout(() => {\n    for (const [, pending] of pendingList) {\n      clearTimeout(pending.timeout)\n      pending.reject(new Error(\"OAuth callback server stopped\"))\n    }\n  }, 0)\n}\n\n/**\n * Check if the callback server is running.\n */\nexport function isCallbackServerRunning(): boolean {\n  return server !== undefined\n}\n\n/**\n * Get the number of pending authorizations.\n */\nexport function getPendingAuthCount(): number {\n  return pendingAuths.size\n}\n"]}
+{"version":3,"file":"mcp-callback-server.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-callback-server.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,MAAM,CAAA;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAEhC,wCAAwC;AACxC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;QAkBb,CAAA;AAER,SAAS,UAAU,CAAC,KAAa,EAAU;IACzC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAAA,CAC1B;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;yBAgBb,UAAU,CAAC,KAAK,CAAC;;;QAGlC,CAAA;AASR,6BAA6B;AAC7B,IAAI,MAA0B,CAAA;AAC9B,IAAI,cAAyC,CAAA;AAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAA;AACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;AAC5C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;AAExC,kDAAkD;AAClD,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAazC,MAAM,2BAA2B,GAAG,WAAW,CAAA;AAC/C,IAAI,kBAAkB,GAAG,2BAA2B,CAAA;AAEpD;;GAEG;AACH,SAAS,aAAa,CAAC,GAAoB,EAAE,GAAmB,EAAQ;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAEjE,gCAAgC;IAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,EAAE,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAElE,uDAAuD;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0DAA0D,CAAA;QAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7B,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAEhD,uEAAuE;IACvE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,4DAA4D,CAAA;YAC7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;YACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC7B,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,IAAI,KAAK,CAAA;QAC1C,oDAAoD;QACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7B,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAChC,gFAAgF;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAC7B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC1B,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1D,CAAC;QACD,OAAM;IACR,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,4DAA4D,CAAA;QAC7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7B,OAAM;IACR,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACnD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAA;QACrD,OAAM;IACR,CAAC;IAED,gDAAgD;IAChD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAErB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;IACnD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAAA,CACtB;AAED,0DAA0D;AAC1D,KAAK,UAAU,gBAAgB,CAAC,MAA2B,EAAiB;IAC1E,OAAO,cAAc,EAAE,CAAC;QACtB,2EAA2E;QAC3E,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,CAAA;IAC1B,cAAc,GAAG,SAAS,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,SAAS,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,cAAc,GAAG,SAAS,CAAA;QAC5B,CAAC;IACH,CAAC;AAAA,CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,GAAW;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACvC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACzB,OAAO,KAAK,CAAA;AAAA,CACb;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAa,EAAiB;IAC7E,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,wBAAwB,EAAE,CAAA;IAAA,CAChE,CAAC,CAAA;AAAA,CACH;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAO,GAAgC,EAAE,EAAiB;IACnG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACpG,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAA;QACzC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAAA,CAC/B,CAAC,CAAA;AAAA,CACH;AAED,KAAK,UAAU,0BAA0B,CAAC,OAAO,GAAgC,EAAE,EAAiB;IAClG,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,8BAA8B,EAAE,CAAA;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAA;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,2BAA2B,CAAA;IACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,IAAI,2BAA2B,CAAA;IAC5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAA;IAClG,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,aAAiC,CAAA;IAErC,MAAM,cAAc,GAAG,MAAM,CAAA;IAC7B,MAAM,iBAAiB,GAAG,OAAO,CAAC,cAAc,IAAI,UAAU,IAAI,oBAAoB,EAAE,KAAK,YAAY,CAAC,CAAA;IAC1G,MAAM,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,kBAAkB,KAAK,aAAa,CAAC,CAAA;IACvF,MAAM,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,EAAE,KAAK,aAAa,CAAC,CAAA;IAE3F,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,iBAAiB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,oBAAoB,EAAE,uBAAuB,aAAa,sEAAsE,CACxK,CAAA;gBACH,CAAC;gBACD,oBAAoB,CAAC,aAAa,CAAC,CAAA;YACrC,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC3E,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBAC1C,aAAa,GAAG,OAAO,CAAC,UAAU,CAAA;YACpC,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,uCAAuC,kBAAkB,IAAI,oBAAoB,EAAE,kCAAkC,aAAa,IAAI,YAAY,sEAAsE,CACzN,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAEhD,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;YAC3C,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,CAAA;YAAA,CACZ,CAAC,CAAA;YAEF,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;gBACtD,OAAO,EAAE,CAAA;YAAA,CACV,CAAC,CAAA;QAAA,CACH,CAAC,CAAA;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,oBAAoB,CAAC,YAAY,CAAC,CAAA;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,CAAA;YACzC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAC1E,CAAC;YACD,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,iBAAiB,IAAI,eAAe,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnC,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;YAAA,CACtC,CAAC,CAAA;QACJ,CAAC;QAED,kBAAkB,GAAG,aAAa,CAAA;QAClC,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACnC,MAAM,GAAG,eAAe,CAAA;QACxB,4FAA4F;QAC5F,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3E,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YAC1C,aAAa,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,EAAE,CAAC;YAClB,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAC1C,CAAC;QACD,MAAM,SAAS,GAAG,KAA8B,CAAA;QAChD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAAA,CACvC,CAAC,CAAA;QAEF,IAAI,UAAU,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,oJAAoJ,YAAY,EAAE,EACrM,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;QACH,CAAC;QAED,MAAM,KAAK,CAAA;IACb,CAAC;AAAA,CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAQ;IAC9D,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;AAAA,CACnC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAQ;IAC9D,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;AAAA,CACtC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAmB;IACnE,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBAC/B,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAA;YAC3E,CAAC;QAAA,CACF,EAAE,mBAAmB,CAAC,CAAA;QAEvB,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IAAA,CAC3D,CAAC,CAAA;AAAA,CACH;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAQ;IAC9D,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC7B,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA;IACtD,CAAC;AAAA,CACF;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,GAAkB;IACxD,MAAM,gBAAgB,CAAC,wBAAwB,CAAC,CAAA;AAAA,CACjD;AAED,KAAK,UAAU,wBAAwB,GAAkB;IACvD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAA;YAAA,CACV,CAAC,CAAA;QAAA,CACH,CAAC,CAAA;QACF,MAAM,GAAG,SAAS,CAAA;IACpB,CAAC;IAED,oBAAoB,CAAC,8BAA8B,EAAE,CAAC,CAAA;IACtD,kBAAkB,GAAG,2BAA2B,CAAA;IAChD,oBAAoB,CAAC,2BAA2B,CAAC,CAAA;IAEjD,+EAA+E;IAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,YAAY,CAAC,KAAK,EAAE,CAAA;IACpB,kBAAkB,CAAC,KAAK,EAAE,CAAA;IAC1B,UAAU,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC;YACtC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAC7B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAA;QAC5D,CAAC;IAAA,CACF,EAAE,CAAC,CAAC,CAAA;AAAA,CACN;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,GAAY;IACjD,OAAO,MAAM,KAAK,SAAS,CAAA;AAAA,CAC5B;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,GAAW;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAA;AAAA,CACzB","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Callback Server\n * \n * HTTP server that handles OAuth callbacks from the authorization server.\n * Uses Node.js http module for compatibility.\n */\n\nimport { createServer, type Server, type IncomingMessage, type ServerResponse } from \"http\"\nimport { throwIfAborted } from \"./abort.ts\"\nimport {\n  DEFAULT_OAUTH_CALLBACK_PATH,\n  getConfiguredOAuthCallbackPort,\n  getOAuthCallbackPath,\n  getOAuthCallbackPort,\n  setOAuthCallbackPath,\n  setOAuthCallbackPort,\n} from \"./mcp-oauth-provider.ts\"\n\n// HTML templates for callback responses\nconst HTML_SUCCESS = `<!DOCTYPE html>\n<html>\n<head>\n  <title>lunR - Authorization Successful</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #4ade80; margin-bottom: 1rem; }\n    p { color: #aaa; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Successful</h1>\n    <p>You can close this window and return to lunR.</p>\n  </div>\n  <script>setTimeout(() => window.close(), 2000);</script>\n</body>\n</html>`\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\")\n}\n\nconst HTML_ERROR = (error: string) => `<!DOCTYPE html>\n<html>\n<head>\n  <title>lunR - Authorization Failed</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #f87171; margin-bottom: 1rem; }\n    p { color: #aaa; }\n    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Failed</h1>\n    <p>An error occurred during authorization.</p>\n    <div class=\"error\">${escapeHtml(error)}</div>\n  </div>\n</body>\n</html>`\n\n/** Pending authorization request */\ninterface PendingAuth {\n  resolve: (code: string) => void\n  reject: (error: Error) => void\n  timeout: ReturnType<typeof setTimeout>\n}\n\n/** Server singleton state */\nlet server: Server | undefined\nlet bindingPromise: Promise<void> | undefined\nconst pendingAuths = new Map<string, PendingAuth>()\nconst reservedAuthStates = new Set<string>()\nconst callbackOwners = new Set<symbol>()\n\n/** Timeout for callback completion (5 minutes) */\nconst CALLBACK_TIMEOUT_MS = 5 * 60 * 1000\n\ninterface EnsureCallbackServerOptions {\n  owner?: symbol\n  signal?: AbortSignal\n  strictPort?: boolean\n  port?: number\n  callbackHost?: string\n  callbackPath?: string\n  oauthState?: string\n  reserveState?: boolean\n}\n\nconst DEFAULT_OAUTH_CALLBACK_HOST = \"localhost\"\nlet callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n\n/**\n * Handle incoming HTTP requests to the callback server.\n */\nfunction handleRequest(req: IncomingMessage, res: ServerResponse): void {\n  const url = new URL(req.url || \"/\", `http://${req.headers.host}`)\n\n  // Only handle the callback path\n  if (url.pathname !== getOAuthCallbackPath()) {\n    res.writeHead(404, { \"Content-Type\": \"text/plain\" })\n    res.end(\"Not found\")\n    return\n  }\n\n  const code = url.searchParams.get(\"code\")\n  const state = url.searchParams.get(\"state\")\n  const error = url.searchParams.get(\"error\")\n  const errorDescription = url.searchParams.get(\"error_description\")\n\n  // Enforce state parameter presence for CSRF protection\n  if (!state) {\n    const errorMsg = \"Missing required state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  const pending = pendingAuths.get(state)\n  const isReserved = reservedAuthStates.has(state)\n\n  // Handle OAuth errors only for a state that belongs to an active flow.\n  if (error) {\n    if (!pending && !isReserved) {\n      const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n      res.writeHead(400, { \"Content-Type\": \"text/html\" })\n      res.end(HTML_ERROR(errorMsg))\n      return\n    }\n\n    const errorMsg = errorDescription || error\n    // Send HTTP response first before rejecting promise\n    res.writeHead(200, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    reservedAuthStates.delete(state)\n    // Reject promise after response is sent (defer to allow test to attach handler)\n    if (pending) {\n      clearTimeout(pending.timeout)\n      pendingAuths.delete(state)\n      setTimeout(() => pending.reject(new Error(errorMsg)), 0)\n    }\n    return\n  }\n\n  // Validate state parameter\n  if (!pending) {\n    const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  // Require authorization code\n  if (!code) {\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(\"No authorization code provided\"))\n    return\n  }\n\n  // Clear timeout and resolve the pending promise\n  clearTimeout(pending.timeout)\n  pendingAuths.delete(state)\n  pending.resolve(code)\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\" })\n  res.end(HTML_SUCCESS)\n}\n\n/** Serialize listener binding and final-owner release. */\nasync function withCallbackLock(action: () => Promise<void>): Promise<void> {\n  while (bindingPromise) {\n    // A failed bind belongs to its caller, not to the next owner in the queue.\n    await bindingPromise.catch(() => {})\n  }\n\n  const operation = action()\n  bindingPromise = operation\n  try {\n    await operation\n  } finally {\n    if (bindingPromise === operation) {\n      bindingPromise = undefined\n    }\n  }\n}\n\n/** Listener ownership survives a completed callback until its session closes. */\nexport function acquireCallbackServerOwner(): symbol {\n  const owner = Symbol(\"MCP OAuth owner\")\n  callbackOwners.add(owner)\n  return owner\n}\n\nexport async function releaseCallbackServerOwner(owner: symbol): Promise<void> {\n  await withCallbackLock(async () => {\n    callbackOwners.delete(owner)\n    if (callbackOwners.size === 0) await stopCallbackServerLocked()\n  })\n}\n\n/**\n * Ensure the callback server is running.\n * If strictPort is true, requires binding on the configured callback port.\n * If strictPort is false, asks the OS for an available local port.\n */\nexport async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  await withCallbackLock(async () => {\n    throwIfAborted(options.signal)\n    if (options.owner && !callbackOwners.has(options.owner)) throw new Error(\"MCP OAuth session closed\")\n    await ensureCallbackServerLocked(options)\n    throwIfAborted(options.signal)\n  })\n}\n\nasync function ensureCallbackServerLocked(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort()\n  const strictPort = options.strictPort === true\n  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST\n  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH\n  const requestedPath = rawRequestedPath.startsWith(\"/\") ? rawRequestedPath : `/${rawRequestedPath}`\n  if (options.reserveState && !options.oauthState) {\n    throw new Error(\"OAuth callback reservation requires an oauthState\")\n  }\n  let reservedState: string | undefined\n\n  const previousServer = server\n  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort)\n  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost)\n  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath)\n\n  if (previousServer) {\n    if (!needsStrictRebind && !needsHostSwitch) {\n      if (needsPathSwitch) {\n        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n          throw new Error(\n            `OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`\n          )\n        }\n        setOAuthCallbackPath(requestedPath)\n      }\n      if (options.reserveState && options.oauthState && !options.signal?.aborted) {\n        reservedAuthStates.add(options.oauthState)\n        reservedState = options.oauthState\n      }\n      return\n    }\n\n    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n      throw new Error(\n        `OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`\n      )\n    }\n  }\n\n  const candidateServer = createServer(handleRequest)\n  const listenPort = strictPort ? requiredPort : 0\n\n  try {\n    await new Promise<void>((resolve, reject) => {\n      candidateServer.once(\"error\", (err) => {\n        reject(err)\n      })\n\n      candidateServer.listen(listenPort, requestedHost, () => {\n        resolve()\n      })\n    })\n\n    if (strictPort) {\n      setOAuthCallbackPort(requiredPort)\n    } else {\n      const address = candidateServer.address()\n      if (!address || typeof address === \"string\" || typeof address.port !== \"number\") {\n        throw new Error(\"OAuth callback server did not report an assigned port\")\n      }\n      setOAuthCallbackPort(address.port)\n    }\n\n    if (previousServer && (needsStrictRebind || needsHostSwitch)) {\n      await new Promise<void>((resolve) => {\n        previousServer.close(() => resolve())\n      })\n    }\n\n    callbackServerHost = requestedHost\n    setOAuthCallbackPath(requestedPath)\n    server = candidateServer\n    // Flow cleanup can finish while binding yields. Never reserve its canceled state afterward.\n    if (options.reserveState && options.oauthState && !options.signal?.aborted) {\n      reservedAuthStates.add(options.oauthState)\n      reservedState = options.oauthState\n    }\n    server.unref()\n  } catch (error) {\n    if (reservedState) {\n      reservedAuthStates.delete(reservedState)\n    }\n    const nodeError = error as NodeJS.ErrnoException\n    await new Promise<void>((resolve) => {\n      candidateServer.close(() => resolve())\n    })\n\n    if (strictPort && nodeError.code === \"EADDRINUSE\") {\n      throw new Error(\n        `OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`,\n        { cause: error }\n      )\n    }\n\n    throw error\n  }\n}\n\nexport function reserveCallbackServer(oauthState: string): void {\n  reservedAuthStates.add(oauthState)\n}\n\nexport function releaseCallbackServer(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n}\n\n/**\n * Wait for a callback with the given OAuth state.\n * Returns a promise that resolves with the authorization code.\n */\nexport function waitForCallback(oauthState: string): Promise<string> {\n  reservedAuthStates.delete(oauthState)\n  return new Promise((resolve, reject) => {\n    const timeout = setTimeout(() => {\n      if (pendingAuths.has(oauthState)) {\n        pendingAuths.delete(oauthState)\n        reject(new Error(\"OAuth callback timeout - authorization took too long\"))\n      }\n    }, CALLBACK_TIMEOUT_MS)\n\n    pendingAuths.set(oauthState, { resolve, reject, timeout })\n  })\n}\n\n/**\n * Cancel a pending authorization by state.\n */\nexport function cancelPendingCallback(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n  const pending = pendingAuths.get(oauthState)\n  if (pending) {\n    clearTimeout(pending.timeout)\n    pendingAuths.delete(oauthState)\n    pending.reject(new Error(\"Authorization cancelled\"))\n  }\n}\n\n/**\n * Stop the callback server and reject all pending authorizations.\n */\nexport async function stopCallbackServer(): Promise<void> {\n  await withCallbackLock(stopCallbackServerLocked)\n}\n\nasync function stopCallbackServerLocked(): Promise<void> {\n  if (server) {\n    await new Promise<void>((resolve) => {\n      server!.close(() => {\n        resolve()\n      })\n    })\n    server = undefined\n  }\n\n  setOAuthCallbackPort(getConfiguredOAuthCallbackPort())\n  callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n  setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH)\n\n  // Reject all pending auths (defer to allow any pending operations to complete)\n  const pendingList = Array.from(pendingAuths.entries())\n  pendingAuths.clear()\n  reservedAuthStates.clear()\n  setTimeout(() => {\n    for (const [, pending] of pendingList) {\n      clearTimeout(pending.timeout)\n      pending.reject(new Error(\"OAuth callback server stopped\"))\n    }\n  }, 0)\n}\n\n/**\n * Check if the callback server is running.\n */\nexport function isCallbackServerRunning(): boolean {\n  return server !== undefined\n}\n\n/**\n * Get the number of pending authorizations.\n */\nexport function getPendingAuthCount(): number {\n  return pendingAuths.size\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.d.ts

@@ -6,6 +6,14 @@
  */
 import type { AddClientAuthentication, OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { OAuthClientMetadata, OAuthTokens, OAuthClientInformation, OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { type StoredClientInfo } from "./mcp-auth.ts";
+/** Temporary authorization state belongs to one flow, never the credential cache. */
+export interface McpOAuthFlowState {
+    oauthState: string;
+    codeVerifier?: string;
+    signal: AbortSignal;
+    clientInfo?: StoredClientInfo;
+}
 declare const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
 declare const DEFAULT_OAUTH_CALLBACK_PATH = "/callback";
 export declare function getConfiguredOAuthCallbackPort(): number;
@@ -36,8 +44,11 @@ export declare class McpOAuthProvider implements OAuthClientProvider {
     private serverUrl;
     private config;
     private callbacks;
+    private flowState?;
     private readonly redirectUrlSnapshot;
-    constructor(serverName: string, serverUrl: string, config: McpOAuthConfig, callbacks: McpOAuthCallbacks);
+    private flowClientInfo?;
+    private flowClientInfoLoaded;
+    constructor(serverName: string, serverUrl: string, config: McpOAuthConfig, callbacks: McpOAuthCallbacks, flowState?: McpOAuthFlowState | undefined);
     private get usesClientCredentials();
     /**
      * The redirect URL for OAuth callbacks.
@@ -71,8 +82,8 @@ export declare class McpOAuthProvider implements OAuthClientProvider {
      * Redirect the user to the authorization URL.
      * This opens the browser for the user to authenticate.
      *
-     * Throws UnauthorizedError when called outside of a user-initiated flow
-     * (no oauthState saved by startAuth). That path is reached when the SDK
+     * Throws UnauthorizedError when called without owned or legacy flow state.
+     * That path is reached when the SDK
      * falls through from a failed refresh into a fresh authorization_code
      * flow, which library hosts cannot complete in-process.
      */