@cachly-dev/mcp-server 0.10.146 → 0.10.148

package/dist/src/auth.js

@@ -1,9 +1,11 @@
-import{ErrorCode as o,McpError as s}from"@modelcontextprotocol/sdk/types.js";import{cachlyUrl as c}from"./cachly-url.js";function u(e){try{const t=e.split(".");if(t.length!==3)return null;const n=JSON.parse(Buffer.from(t[1],"base64url").toString("utf-8"));return n.exp?n.exp*1e3:null}catch{return null}}const p="cky_";function h(e){return e.startsWith(p)}const d=600*1e3,i=c("/setup-ai","auth-diagnosis");function f(e,t=Date.now()){if(!e)return{state:"no_jwt",usable:!1,expiresInMs:null,message:`No CACHLY_JWT set \u2014 the brain can't persist or recall anything (you'd silently get 0 recalls).
+import{ErrorCode as i,McpError as s}from"@modelcontextprotocol/sdk/types.js";import{cachlyUrl as c}from"./cachly-url.js";function u(e){try{const t=e.split(".");if(t.length!==3)return null;const n=JSON.parse(Buffer.from(t[1],"base64url").toString("utf-8"));return n.exp?n.exp*1e3:null}catch{return null}}const h="cky_";function p(e){return e.startsWith(h)}const d=600*1e3,o=c("/setup-ai","auth-diagnosis");function f(e,t=Date.now()){if(!e)return{state:"no_jwt",usable:!1,expiresInMs:null,message:`No CACHLY_JWT set \u2014 the brain can't persist or recall anything (you'd silently get 0 recalls).
 
-Get your token at ${i} and add it to your MCP config, or just call any tool to start the one-time device-flow sign-in.`};const n=u(e);if(n===null)return{state:h(e)?"long_lived":"healthy",usable:!0,expiresInMs:null,message:""};const r=n-t;if(r<=0)return{state:"expired",usable:!1,expiresInMs:r,message:`CACHLY_JWT expired at ${new Date(n).toISOString()} \u2014 recalls will silently return nothing until you re-authenticate.
+Get your token at ${o} and add it to your MCP config, or just call any tool to start the one-time device-flow sign-in.`};const n=u(e);if(n===null)return{state:p(e)?"long_lived":"healthy",usable:!0,expiresInMs:null,message:""};const r=n-t;if(r<=0)return{state:"expired",usable:!1,expiresInMs:r,message:`CACHLY_JWT expired at ${new Date(n).toISOString()} \u2014 recalls will silently return nothing until you re-authenticate.
 
-Get a fresh token at ${i}, or call any tool to re-run the device-flow sign-in.`};if(r<=d){const l=Math.max(1,Math.round(r/6e4));return{state:"near_expiry",usable:!0,expiresInMs:r,message:`CACHLY_JWT expires in ~${l} min. cachly will refresh it automatically into a long-lived key while it's still valid.`}}return{state:"healthy",usable:!0,expiresInMs:r,message:""}}function y(e){switch(e.state){case"no_jwt":case"expired":return"reauth";case"near_expiry":return"refresh";case"healthy":case"long_lived":return"none"}}function x(e){const t=f(e);if(!t.usable)throw new s(o.InvalidRequest,t.message)}const a="https://auth.cachly.dev/realms/cachly/protocol/openid-connect";function g(e=process.env){const t=e.CACHLY_CLIENT_ID,n=e.CACHLY_CLIENT_SECRET;return!t||!n?null:{clientId:t,clientSecret:n,scope:e.CACHLY_CLIENT_SCOPE||"openid",authBase:e.CACHLY_AUTH_URL||a}}function m(e){const t=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});return e.scope&&t.set("scope",e.scope),t.toString()}function A(e){return`${e.authBase??a}/token`}function w(e,t){throw e===401?new s(o.InvalidRequest,`Authentication failed (401): ${t}
+Get a fresh token at ${o}, or call any tool to re-run the device-flow sign-in.`};if(r<=d){const l=Math.max(1,Math.round(r/6e4));return{state:"near_expiry",usable:!0,expiresInMs:r,message:`CACHLY_JWT expires in ~${l} min. cachly will refresh it automatically into a long-lived key while it's still valid.`}}return{state:"healthy",usable:!0,expiresInMs:r,message:""}}function C(e){switch(e.state){case"no_jwt":case"expired":return"reauth";case"near_expiry":return"refresh";case"healthy":case"long_lived":return"none"}}function x(e){const t=f(e);if(!t.usable)throw new s(i.InvalidRequest,t.message)}const a="https://auth.cachly.dev/realms/cachly/protocol/openid-connect";function g(e=process.env){const t=e.CACHLY_CLIENT_ID,n=e.CACHLY_CLIENT_SECRET;return!t||!n?null:{clientId:t,clientSecret:n,scope:e.CACHLY_CLIENT_SCOPE||"openid",authBase:e.CACHLY_AUTH_URL||a}}function m(e){const t=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});return e.scope&&t.set("scope",e.scope),t.toString()}function A(e){return`${e.authBase??a}/token`}function w(e,t){throw e===401?new s(i.InvalidRequest,`Authentication failed (401): ${t}
 
-Your CACHLY_JWT may be expired or invalid. Get a fresh token at ${i}`):e===403?new s(o.InvalidRequest,`Access denied (403): ${t}
+Your CACHLY_JWT may be expired or invalid. Get a fresh token at ${o}`):e===403?new s(i.InvalidRequest,`Access denied (403): ${t}
 
-Check that your CACHLY_JWT belongs to an account with access to this resource.`):new s(o.InternalError,`cachly API error ${e}: ${t}`)}export{p as API_KEY_PREFIX,a as DEFAULT_AUTH_BASE,d as NEAR_EXPIRY_MS,m as buildClientCredentialsBody,x as checkJwt,A as clientCredentialsTokenUrl,f as diagnoseAuth,w as handleApiError,h as isLongLivedApiKey,u as jwtExpiryMs,y as planAuthHeal,g as readClientCredentialsFromEnv};
+Check that your CACHLY_JWT belongs to an account with access to this resource.`):e===400&&/invalid instance id/i.test(t)?new s(i.InvalidRequest,`cachly API error 400: ${t}
+
+Tip: omit the instance_id parameter entirely \u2014 the configured instance of this session is used automatically. Never guess an id.`):new s(i.InternalError,`cachly API error ${e}: ${t}`)}export{h as API_KEY_PREFIX,a as DEFAULT_AUTH_BASE,d as NEAR_EXPIRY_MS,m as buildClientCredentialsBody,x as checkJwt,A as clientCredentialsTokenUrl,f as diagnoseAuth,w as handleApiError,p as isLongLivedApiKey,u as jwtExpiryMs,C as planAuthHeal,g as readClientCredentialsFromEnv};