@compass-ai/nova 1.0.74 → 1.0.76

package/dist/services/mcp-oauth-service.js

@@ -1,892 +0,0 @@
-/**
- * MCP OAuth Service.
- *
- * Handles OAuth 2.0 authentication for MCP servers that require it.
- * Features:
- * - OAuth 2.0 authorization code flow
- * - Token storage and refresh
- * - Local callback server for OAuth redirects
- * - Automatic token refresh
- */
-import { createServer } from 'http';
-import { URL, URLSearchParams } from 'url';
-import { createHash, randomBytes } from 'crypto';
-import { logger } from '../utils/logger.js';
-import { safeReadFile, safeWriteFile, pathExists, ensureDir } from '../utils/file-system.js';
-import { getGlobalCompassDir } from '../utils/path.js';
-/**
- * Built-in OAuth configurations for known MCP servers.
- * These are bundled with Kore-CLI so users don't need to register their own OAuth apps.
- *
- * The client credentials here are for the "Kore-CLI" OAuth application registered
- * with each service. Using PKCE, so client_secret exposure is acceptable for public clients.
- *
- * To add credentials:
- * - Set via environment variables (FIGMA_MCP_CLIENT_ID, FIGMA_MCP_CLIENT_SECRET)
- * - Or hardcode the values directly below for distribution
- */
-const KNOWN_MCP_OAUTH_CONFIGS = {
-    // Figma MCP Server - uses Kore-CLI OAuth application
-    // Get your credentials from: https://www.figma.com/developers/apps
-    // Scopes reference: https://developers.figma.com/docs/rest-api/scopes/
-    'mcp.figma.com': {
-        clientId: process.env.FIGMA_MCP_CLIENT_ID || '7cLAcGuKlF257dbgakWp7O',
-        clientSecret: process.env.FIGMA_MCP_CLIENT_SECRET || 'zPgspJQf9J5WfDxXjYc0XxTB9fFOpL',
-        // OAuth URLs - see: https://developers.figma.com/docs/rest-api/authentication/
-        authorizationUrl: 'https://www.figma.com/oauth',
-        tokenUrl: 'https://api.figma.com/v1/oauth/token', // Note: api.figma.com, not www.figma.com
-        // Required scopes for Figma MCP - enable these in your Figma app settings:
-        // See: https://developers.figma.com/docs/rest-api/scopes/
-        scopes: [
-            'file_content:read', // Read the contents of files (nodes, editor type)
-            'file_metadata:read', // Read metadata of files
-            'file_dev_resources:read', // Read dev resources in files
-            'file_dev_resources:write', // Write dev resources to files
-            // Note: file_variables:read/write are Enterprise-only
-        ],
-    },
-    // Add more known MCP servers here as needed:
-    // 'mcp.example.com': {
-    //   clientId: process.env.EXAMPLE_MCP_CLIENT_ID || 'client-id',
-    //   clientSecret: process.env.EXAMPLE_MCP_CLIENT_SECRET || 'client-secret',
-    // },
-};
-/**
- * Registry of known MCP providers with their authentication restrictions and fallbacks.
- * This helps users when they encounter authentication issues with specific providers.
- */
-const KNOWN_MCP_PROVIDERS = [
-    {
-        name: 'figma',
-        remoteUrlPattern: /^https?:\/\/(mcp\.)?figma\.com/i,
-        oauthRestricted: true,
-        approvedClients: ['VS Code', 'Cursor', 'Claude Code'],
-        fallback: {
-            name: 'Figma Desktop MCP Server',
-            reason: 'Figma restricts remote MCP OAuth to approved clients only. Use the local desktop server instead.',
-            config: {
-                type: 'http',
-                url: 'http://127.0.0.1:3845/mcp',
-                enabled: true,
-            },
-            requirements: [
-                'Figma desktop app installed and running',
-                'Logged in to your Figma account',
-                'A Design file open with Dev Mode enabled',
-            ],
-            setupInstructions: [
-                '1. Open Figma desktop app (ensure latest version)',
-                '2. Create or open a Design file',
-                '3. Enable Dev Mode (toolbar or Shift+D)',
-                '4. In the Inspect panel, enable MCP server',
-                '5. Update your .mcp.json to use: http://127.0.0.1:3845/mcp',
-            ],
-        },
-    },
-];
-/**
- * Gets provider info for a server URL.
- */
-export function getProviderInfo(serverUrl) {
-    for (const provider of KNOWN_MCP_PROVIDERS) {
-        if (provider.remoteUrlPattern.test(serverUrl)) {
-            return provider;
-        }
-    }
-    return undefined;
-}
-/**
- * Gets fallback configuration for a server URL if available.
- */
-export function getFallbackConfig(serverUrl) {
-    const provider = getProviderInfo(serverUrl);
-    return provider?.fallback;
-}
-/**
- * Checks if a server URL is for a provider with restricted OAuth.
- */
-export function isOAuthRestricted(serverUrl) {
-    const provider = getProviderInfo(serverUrl);
-    return provider?.oauthRestricted ?? false;
-}
-/**
- * Checks if the local Figma MCP server is available.
- * Returns true if the server responds to a health check.
- */
-export async function checkLocalFigmaServer() {
-    try {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 2000);
-        const response = await fetch('http://127.0.0.1:3845/mcp', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                jsonrpc: '2.0',
-                id: 1,
-                method: 'initialize',
-                params: {
-                    protocolVersion: '2024-11-05',
-                    capabilities: {},
-                    clientInfo: { name: 'kore-cli', version: '1.0.0' },
-                },
-            }),
-            signal: controller.signal,
-        });
-        clearTimeout(timeoutId);
-        return response.ok;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Gets the built-in OAuth config for a known MCP server URL.
- * Returns undefined if the server is not in the known registry or has placeholder credentials.
- */
-function getKnownOAuthConfig(serverUrl) {
-    try {
-        const url = new URL(serverUrl);
-        const host = url.host.toLowerCase();
-        // Check for exact match or subdomain match
-        for (const [knownHost, config] of Object.entries(KNOWN_MCP_OAUTH_CONFIGS)) {
-            if (host === knownHost || host.endsWith(`.${knownHost}`)) {
-                // Only return if we have real credentials (not placeholders)
-                const hasRealClientId = config.clientId &&
-                    !config.clientId.includes('YOUR_') &&
-                    !config.clientId.includes('_HERE');
-                if (hasRealClientId) {
-                    logger.debug(`Found built-in OAuth config for ${knownHost}`);
-                    return config;
-                }
-                else {
-                    // Return URLs only (for discovery) if credentials are placeholders
-                    if (config.authorizationUrl || config.tokenUrl) {
-                        logger.debug(`Found built-in OAuth URLs (no credentials) for ${knownHost}`);
-                        return {
-                            authorizationUrl: config.authorizationUrl,
-                            tokenUrl: config.tokenUrl,
-                            scopes: config.scopes,
-                        };
-                    }
-                }
-            }
-        }
-    }
-    catch {
-        // Invalid URL, ignore
-    }
-    return undefined;
-}
-/**
- * MCP OAuth Service class.
- */
-class MCPOAuthService {
-    storage = { tokens: {} };
-    storagePath;
-    pendingAuths = new Map();
-    callbackServer = null;
-    callbackPort = 23456; // Default callback port
-    constructor() {
-        this.storagePath = `${getGlobalCompassDir()}/mcp-oauth.json`;
-    }
-    /**
-     * Loads stored OAuth tokens.
-     */
-    async load() {
-        try {
-            if (await pathExists(this.storagePath)) {
-                const content = await safeReadFile(this.storagePath);
-                this.storage = JSON.parse(content || '{"tokens":{}}');
-            }
-        }
-        catch (error) {
-            logger.warn('Failed to load OAuth storage', error);
-            this.storage = { tokens: {} };
-        }
-    }
-    /**
-     * Saves OAuth tokens.
-     */
-    async save() {
-        try {
-            await ensureDir(getGlobalCompassDir());
-            await safeWriteFile(this.storagePath, JSON.stringify(this.storage, null, 2));
-        }
-        catch (error) {
-            logger.error('Failed to save OAuth storage', error);
-        }
-    }
-    /**
-     * Gets authentication state for a server.
-     */
-    getAuthState(serverName, oauthConfig) {
-        const tokens = this.storage.tokens[serverName];
-        const authenticated = !!tokens && this.isTokenValid(tokens);
-        return {
-            serverName,
-            required: !!oauthConfig,
-            authenticated,
-            oauth: oauthConfig,
-            tokens: authenticated ? tokens : undefined,
-            method: oauthConfig ? 'oauth' : 'none',
-        };
-    }
-    /**
-     * Checks if tokens are valid (not expired).
-     */
-    isTokenValid(tokens) {
-        if (!tokens.expiresAt) {
-            return true; // No expiration means always valid
-        }
-        const expiresAt = new Date(tokens.expiresAt);
-        const now = new Date();
-        // Consider token expired 5 minutes early to allow for refresh
-        return expiresAt.getTime() - 5 * 60 * 1000 > now.getTime();
-    }
-    /**
-     * Gets stored tokens for a server.
-     */
-    getTokens(serverName) {
-        return this.storage.tokens[serverName];
-    }
-    /**
-     * Starts the OAuth authorization flow.
-     */
-    async startAuthFlow(serverName, oauthConfig) {
-        if (!oauthConfig.authorizationUrl || !oauthConfig.clientId) {
-            return {
-                authUrl: '',
-                error: 'OAuth configuration incomplete: missing authorizationUrl or clientId',
-            };
-        }
-        try {
-            // Start callback server if not running
-            await this.startCallbackServer();
-            // Generate PKCE code verifier and challenge
-            const codeVerifier = this.generateCodeVerifier();
-            const codeChallenge = this.generateCodeChallenge(codeVerifier);
-            // Generate state for CSRF protection
-            const state = randomBytes(16).toString('hex');
-            // Store pending auth state
-            this.pendingAuths.set(state, {
-                serverName,
-                state,
-                codeVerifier,
-                createdAt: new Date(),
-            });
-            // Build authorization URL
-            const authUrl = new URL(oauthConfig.authorizationUrl);
-            authUrl.searchParams.set('client_id', oauthConfig.clientId);
-            authUrl.searchParams.set('response_type', 'code');
-            authUrl.searchParams.set('redirect_uri', this.getRedirectUri());
-            authUrl.searchParams.set('state', state);
-            authUrl.searchParams.set('code_challenge', codeChallenge);
-            authUrl.searchParams.set('code_challenge_method', 'S256');
-            if (oauthConfig.scopes?.length) {
-                authUrl.searchParams.set('scope', oauthConfig.scopes.join(' '));
-            }
-            logger.info(`Starting OAuth flow for ${serverName}`);
-            return { authUrl: authUrl.toString() };
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error(`Failed to start OAuth flow for ${serverName}:`, error);
-            return { authUrl: '', error: errorMessage };
-        }
-    }
-    /**
-     * Starts the local callback server for OAuth redirects.
-     */
-    async startCallbackServer() {
-        if (this.callbackServer) {
-            return;
-        }
-        return new Promise((resolve, reject) => {
-            this.callbackServer = createServer(this.handleCallback.bind(this));
-            this.callbackServer.on('error', (error) => {
-                if (error.code === 'EADDRINUSE') {
-                    // Try next port
-                    this.callbackPort++;
-                    this.callbackServer = null;
-                    this.startCallbackServer().then(resolve).catch(reject);
-                }
-                else {
-                    reject(error);
-                }
-            });
-            this.callbackServer.listen(this.callbackPort, '127.0.0.1', () => {
-                logger.debug(`OAuth callback server listening on port ${this.callbackPort}`);
-                resolve();
-            });
-        });
-    }
-    /**
-     * Handles OAuth callback requests.
-     */
-    async handleCallback(req, res) {
-        try {
-            const url = new URL(req.url || '', `http://127.0.0.1:${this.callbackPort}`);
-            if (url.pathname !== '/oauth/callback') {
-                res.writeHead(404);
-                res.end('Not found');
-                return;
-            }
-            const code = url.searchParams.get('code');
-            const state = url.searchParams.get('state');
-            const error = url.searchParams.get('error');
-            if (error) {
-                res.writeHead(400);
-                res.end(`OAuth error: ${error}`);
-                return;
-            }
-            if (!code || !state) {
-                res.writeHead(400);
-                res.end('Missing code or state parameter');
-                return;
-            }
-            const pendingAuth = this.pendingAuths.get(state);
-            if (!pendingAuth) {
-                res.writeHead(400);
-                res.end('Invalid state parameter');
-                return;
-            }
-            // Clean up pending auth
-            this.pendingAuths.delete(state);
-            // Display success page
-            res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`
-        <!DOCTYPE html>
-        <html>
-          <head>
-            <title>Compass CLI - OAuth Success</title>
-            <style>
-              body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
-              .container { text-align: center; padding: 2rem; }
-              h1 { color: #4ade80; }
-              p { color: #9ca3af; }
-            </style>
-          </head>
-          <body>
-            <div class="container">
-              <h1>Authentication Successful</h1>
-              <p>You can close this window and return to Compass CLI.</p>
-            </div>
-          </body>
-        </html>
-      `);
-            // Store the auth code for later exchange
-            // The code exchange happens separately via completeAuthFlow
-            this.pendingAuths.set(`code:${pendingAuth.serverName}`, {
-                ...pendingAuth,
-                state: code, // Temporarily store code in state field
-            });
-            logger.info(`OAuth callback received for ${pendingAuth.serverName}`);
-        }
-        catch (error) {
-            logger.error('Error handling OAuth callback:', error);
-            res.writeHead(500);
-            res.end('Internal server error');
-        }
-    }
-    /**
-     * Completes the OAuth flow by exchanging the code for tokens.
-     */
-    async completeAuthFlow(serverName, oauthConfig) {
-        const pendingKey = `code:${serverName}`;
-        const pendingAuth = this.pendingAuths.get(pendingKey);
-        if (!pendingAuth) {
-            return {
-                success: false,
-                error: 'No pending OAuth flow for this server',
-            };
-        }
-        const code = pendingAuth.state;
-        const codeVerifier = pendingAuth.codeVerifier;
-        this.pendingAuths.delete(pendingKey);
-        if (!oauthConfig.tokenUrl) {
-            return {
-                success: false,
-                error: 'OAuth configuration incomplete: missing tokenUrl',
-            };
-        }
-        try {
-            // Exchange code for tokens
-            const tokenParams = new URLSearchParams();
-            tokenParams.set('grant_type', 'authorization_code');
-            tokenParams.set('client_id', oauthConfig.clientId || '');
-            tokenParams.set('code', code);
-            tokenParams.set('redirect_uri', this.getRedirectUri());
-            tokenParams.set('code_verifier', codeVerifier);
-            if (oauthConfig.clientSecret) {
-                tokenParams.set('client_secret', oauthConfig.clientSecret);
-            }
-            const response = await fetch(oauthConfig.tokenUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                body: tokenParams.toString(),
-            });
-            if (!response.ok) {
-                const errorText = await response.text();
-                return {
-                    success: false,
-                    error: `Token exchange failed: ${response.status} ${errorText}`,
-                };
-            }
-            const tokenData = (await response.json());
-            // Store tokens
-            const tokens = {
-                accessToken: tokenData.access_token,
-                tokenType: tokenData.token_type || 'Bearer',
-                refreshToken: tokenData.refresh_token,
-                expiresAt: tokenData.expires_in
-                    ? new Date(Date.now() + tokenData.expires_in * 1000)
-                    : undefined,
-                scopes: tokenData.scope?.split(' '),
-            };
-            this.storage.tokens[serverName] = tokens;
-            await this.save();
-            logger.info(`OAuth flow completed for ${serverName}`);
-            return { success: true };
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error(`Failed to complete OAuth flow for ${serverName}:`, error);
-            return { success: false, error: errorMessage };
-        }
-    }
-    /**
-     * Refreshes tokens for a server.
-     */
-    async refreshTokens(serverName, oauthConfig) {
-        const existingTokens = this.storage.tokens[serverName];
-        if (!existingTokens?.refreshToken) {
-            return {
-                success: false,
-                error: 'No refresh token available',
-            };
-        }
-        if (!oauthConfig.tokenUrl) {
-            return {
-                success: false,
-                error: 'OAuth configuration incomplete: missing tokenUrl',
-            };
-        }
-        try {
-            const tokenParams = new URLSearchParams();
-            tokenParams.set('grant_type', 'refresh_token');
-            tokenParams.set('client_id', oauthConfig.clientId || '');
-            tokenParams.set('refresh_token', existingTokens.refreshToken);
-            if (oauthConfig.clientSecret) {
-                tokenParams.set('client_secret', oauthConfig.clientSecret);
-            }
-            const response = await fetch(oauthConfig.tokenUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                body: tokenParams.toString(),
-            });
-            if (!response.ok) {
-                const errorText = await response.text();
-                return {
-                    success: false,
-                    error: `Token refresh failed: ${response.status} ${errorText}`,
-                };
-            }
-            const tokenData = (await response.json());
-            // Update tokens
-            this.storage.tokens[serverName] = {
-                accessToken: tokenData.access_token,
-                tokenType: tokenData.token_type || 'Bearer',
-                refreshToken: tokenData.refresh_token || existingTokens.refreshToken,
-                expiresAt: tokenData.expires_in
-                    ? new Date(Date.now() + tokenData.expires_in * 1000)
-                    : undefined,
-                scopes: tokenData.scope?.split(' ') || existingTokens.scopes,
-            };
-            await this.save();
-            logger.debug(`Tokens refreshed for ${serverName}`);
-            return { success: true };
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error(`Failed to refresh tokens for ${serverName}:`, error);
-            return { success: false, error: errorMessage };
-        }
-    }
-    /**
-     * Clears authentication for a server.
-     */
-    async clearAuth(serverName) {
-        delete this.storage.tokens[serverName];
-        if (this.storage.apiTokens) {
-            delete this.storage.apiTokens[serverName];
-        }
-        await this.save();
-        logger.info(`Cleared authentication for ${serverName}`);
-    }
-    /**
-     * Sets a simple API token for a server (non-OAuth authentication).
-     * Used for servers that accept Bearer tokens or API keys directly.
-     */
-    async setApiToken(serverName, token) {
-        if (!this.storage.apiTokens) {
-            this.storage.apiTokens = {};
-        }
-        this.storage.apiTokens[serverName] = token;
-        await this.save();
-        logger.info(`Stored API token for ${serverName}`);
-    }
-    /**
-     * Gets a simple API token for a server.
-     */
-    getApiToken(serverName) {
-        return this.storage.apiTokens?.[serverName];
-    }
-    /**
-     * Checks if a server has any form of stored authentication (OAuth or API token).
-     */
-    hasStoredAuth(serverName) {
-        const hasOAuth = !!this.storage.tokens[serverName] && this.isTokenValid(this.storage.tokens[serverName]);
-        const hasApiToken = !!this.storage.apiTokens?.[serverName];
-        return hasOAuth || hasApiToken;
-    }
-    /**
-     * Gets the OAuth redirect URI.
-     */
-    getRedirectUri() {
-        return `http://127.0.0.1:${this.callbackPort}/oauth/callback`;
-    }
-    /**
-     * Generates a PKCE code verifier.
-     */
-    generateCodeVerifier() {
-        return randomBytes(32)
-            .toString('base64')
-            .replace(/\+/g, '-')
-            .replace(/\//g, '_')
-            .replace(/=/g, '');
-    }
-    /**
-     * Generates a PKCE code challenge from verifier.
-     */
-    generateCodeChallenge(verifier) {
-        return createHash('sha256')
-            .update(verifier)
-            .digest('base64')
-            .replace(/\+/g, '-')
-            .replace(/\//g, '_')
-            .replace(/=/g, '');
-    }
-    /**
-     * Gets authorization header for a server.
-     * Checks OAuth tokens first, then falls back to simple API tokens.
-     */
-    getAuthHeader(serverName) {
-        logger.debug(`getAuthHeader called for server: ${serverName}`);
-        logger.debug(`Available token keys: ${Object.keys(this.storage.tokens || {}).join(', ') || 'none'}`);
-        logger.debug(`Available API token keys: ${Object.keys(this.storage.apiTokens || {}).join(', ') || 'none'}`);
-        // First check OAuth tokens
-        const tokens = this.storage.tokens[serverName];
-        if (tokens) {
-            logger.debug(`Found OAuth token for ${serverName}, valid: ${this.isTokenValid(tokens)}`);
-            if (this.isTokenValid(tokens)) {
-                // Normalize token type to "Bearer" (capitalized) as per RFC 6750
-                // Some servers return lowercase "bearer" but expect capitalized in requests
-                const tokenType = tokens.tokenType?.toLowerCase() === 'bearer' ? 'Bearer' : tokens.tokenType;
-                logger.debug(`Returning OAuth auth header for ${serverName} with tokenType: ${tokenType}`);
-                return `${tokenType} ${tokens.accessToken}`;
-            }
-        }
-        // Fall back to simple API token
-        const apiToken = this.storage.apiTokens?.[serverName];
-        if (apiToken) {
-            logger.debug(`Returning API token auth header for ${serverName}`);
-            return `Bearer ${apiToken}`;
-        }
-        logger.debug(`No auth header found for ${serverName}`);
-        return undefined;
-    }
-    /**
-     * Discovers OAuth configuration from a server URL using RFC 8414.
-     * Tries multiple well-known endpoints to find OAuth metadata.
-     */
-    async discoverOAuthConfig(serverUrl) {
-        const baseUrl = new URL(serverUrl);
-        const origin = baseUrl.origin;
-        // Try different well-known OAuth discovery endpoints
-        const discoveryEndpoints = [
-            `${origin}/.well-known/oauth-authorization-server`,
-            `${origin}/.well-known/openid-configuration`,
-        ];
-        for (const endpoint of discoveryEndpoints) {
-            try {
-                logger.debug(`Trying OAuth discovery at: ${endpoint}`);
-                const response = await fetch(endpoint, {
-                    method: 'GET',
-                    headers: { 'Accept': 'application/json' },
-                });
-                if (response.ok) {
-                    const metadata = (await response.json());
-                    logger.debug(`OAuth discovery response from ${endpoint}: ${JSON.stringify(metadata)}`);
-                    if (metadata.authorization_endpoint && metadata.token_endpoint) {
-                        logger.info(`Discovered OAuth config from ${endpoint}`);
-                        return {
-                            authorizationUrl: metadata.authorization_endpoint,
-                            tokenUrl: metadata.token_endpoint,
-                            scopes: metadata.scopes_supported,
-                            // Note: clientId needs to be registered or dynamically obtained
-                            // Some servers support dynamic client registration
-                        };
-                    }
-                }
-            }
-            catch (error) {
-                logger.debug(`OAuth discovery failed at ${endpoint}:`, error);
-            }
-        }
-        return null;
-    }
-    /**
-     * Starts OAuth flow with automatic discovery if no config is provided.
-     * This handles servers that support standard OAuth discovery.
-     *
-     * Config priority (highest to lowest):
-     * 1. User-provided config in .mcp.json
-     * 2. Built-in known config for the server (Kore-CLI registered apps)
-     * 3. Discovered config from server's well-known endpoint
-     */
-    async startAuthFlowWithDiscovery(serverName, serverUrl, providedConfig) {
-        // Check for built-in known OAuth config for this server
-        const knownConfig = getKnownOAuthConfig(serverUrl);
-        if (knownConfig) {
-            logger.info(`Using built-in Kore-CLI OAuth credentials for ${serverName}`);
-        }
-        // Merge configs: user-provided > known > discovered
-        // Start with provided config as base
-        let oauthConfig = providedConfig;
-        // If no OAuth URLs provided, try to discover them
-        if (!oauthConfig?.authorizationUrl) {
-            logger.info(`Discovering OAuth endpoints for ${serverName}...`);
-            const discovered = await this.discoverOAuthConfig(serverUrl);
-            if (discovered) {
-                // Merge priority: discovered URLs/scopes > known credentials > user overrides
-                // Key: Use discovered URLs and scopes, but use our clientId/clientSecret
-                oauthConfig = {
-                    // Start with known credentials (clientId, clientSecret)
-                    clientId: knownConfig?.clientId,
-                    clientSecret: knownConfig?.clientSecret,
-                    // Use discovered URLs and scopes (server-specific)
-                    authorizationUrl: discovered.authorizationUrl,
-                    tokenUrl: discovered.tokenUrl,
-                    scopes: discovered.scopes, // Use server's supported scopes
-                    // Allow user overrides for everything
-                    ...providedConfig,
-                };
-                logger.debug(`Merged OAuth config: authUrl=${oauthConfig.authorizationUrl}, scopes=${oauthConfig.scopes?.join(',')}`);
-                logger.info(`Using discovered OAuth config for ${serverName}`);
-            }
-            else if (knownConfig?.clientId) {
-                // No discovery, but we have known credentials - use hardcoded URLs as fallback
-                oauthConfig = { ...knownConfig, ...providedConfig };
-                logger.debug(`Using hardcoded OAuth config for ${serverName}`);
-            }
-            else {
-                return {
-                    authUrl: '',
-                    error: 'Could not discover OAuth configuration. Server may require manual token authentication.',
-                };
-            }
-        }
-        else {
-            // User provided URLs, just merge with known credentials if available
-            oauthConfig = {
-                clientId: knownConfig?.clientId,
-                clientSecret: knownConfig?.clientSecret,
-                ...providedConfig,
-            };
-        }
-        // Check if we have the minimum required config
-        if (!oauthConfig.authorizationUrl) {
-            return {
-                authUrl: '',
-                error: 'OAuth configuration incomplete: missing authorizationUrl',
-            };
-        }
-        // For servers without a pre-registered client, we may need dynamic registration
-        // or the server may accept requests without a client_id (public client)
-        const clientId = oauthConfig.clientId || 'compass-cli';
-        try {
-            // Start callback server if not running
-            await this.startCallbackServer();
-            // Generate PKCE code verifier and challenge
-            const codeVerifier = this.generateCodeVerifier();
-            const codeChallenge = this.generateCodeChallenge(codeVerifier);
-            // Generate state for CSRF protection
-            const state = randomBytes(16).toString('hex');
-            // Store pending auth state
-            this.pendingAuths.set(state, {
-                serverName,
-                state,
-                codeVerifier,
-                createdAt: new Date(),
-            });
-            // Build authorization URL
-            const authUrl = new URL(oauthConfig.authorizationUrl);
-            authUrl.searchParams.set('client_id', clientId);
-            authUrl.searchParams.set('response_type', 'code');
-            authUrl.searchParams.set('redirect_uri', this.getRedirectUri());
-            authUrl.searchParams.set('state', state);
-            authUrl.searchParams.set('code_challenge', codeChallenge);
-            authUrl.searchParams.set('code_challenge_method', 'S256');
-            if (oauthConfig.scopes?.length) {
-                authUrl.searchParams.set('scope', oauthConfig.scopes.join(' '));
-            }
-            logger.info(`Starting OAuth flow for ${serverName}`);
-            return {
-                authUrl: authUrl.toString(),
-                discoveredConfig: oauthConfig,
-            };
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error(`Failed to start OAuth flow for ${serverName}:`, error);
-            return { authUrl: '', error: errorMessage };
-        }
-    }
-    /**
-     * Completes OAuth flow with discovered config.
-     */
-    async completeAuthFlowWithConfig(serverName, oauthConfig) {
-        const pendingKey = `code:${serverName}`;
-        const pendingAuth = this.pendingAuths.get(pendingKey);
-        if (!pendingAuth) {
-            return {
-                success: false,
-                error: 'No pending OAuth flow for this server',
-            };
-        }
-        const code = pendingAuth.state;
-        const codeVerifier = pendingAuth.codeVerifier;
-        this.pendingAuths.delete(pendingKey);
-        if (!oauthConfig.tokenUrl) {
-            return {
-                success: false,
-                error: 'OAuth configuration incomplete: missing tokenUrl',
-            };
-        }
-        const clientId = oauthConfig.clientId || 'compass-cli';
-        try {
-            // Exchange code for tokens
-            const tokenParams = new URLSearchParams();
-            tokenParams.set('grant_type', 'authorization_code');
-            tokenParams.set('code', code);
-            tokenParams.set('redirect_uri', this.getRedirectUri());
-            tokenParams.set('code_verifier', codeVerifier);
-            // Build headers - use Basic Auth if we have client credentials (required by some servers like Figma)
-            const headers = {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            };
-            if (oauthConfig.clientId && oauthConfig.clientSecret) {
-                // Use HTTP Basic Authentication for client credentials
-                const credentials = Buffer.from(`${clientId}:${oauthConfig.clientSecret}`).toString('base64');
-                headers['Authorization'] = `Basic ${credentials}`;
-            }
-            else {
-                // Fallback: include client_id in body for servers that don't use Basic Auth
-                tokenParams.set('client_id', clientId);
-                if (oauthConfig.clientSecret) {
-                    tokenParams.set('client_secret', oauthConfig.clientSecret);
-                }
-            }
-            const response = await fetch(oauthConfig.tokenUrl, {
-                method: 'POST',
-                headers,
-                body: tokenParams.toString(),
-            });
-            if (!response.ok) {
-                const errorText = await response.text();
-                return {
-                    success: false,
-                    error: `Token exchange failed: ${response.status} ${errorText}`,
-                };
-            }
-            const tokenData = (await response.json());
-            // Store tokens
-            const tokens = {
-                accessToken: tokenData.access_token,
-                tokenType: tokenData.token_type || 'Bearer',
-                refreshToken: tokenData.refresh_token,
-                expiresAt: tokenData.expires_in
-                    ? new Date(Date.now() + tokenData.expires_in * 1000)
-                    : undefined,
-                scopes: tokenData.scope?.split(' '),
-            };
-            this.storage.tokens[serverName] = tokens;
-            await this.save();
-            logger.info(`OAuth flow completed for ${serverName}`);
-            logger.debug(`Stored token for ${serverName}, tokenType: ${tokens.tokenType}, hasAccessToken: ${!!tokens.accessToken}`);
-            logger.debug(`Current storage token keys: ${Object.keys(this.storage.tokens).join(', ')}`);
-            return { success: true };
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error(`Failed to complete OAuth flow for ${serverName}:`, error);
-            return { success: false, error: errorMessage };
-        }
-    }
-    /**
-     * Stops the callback server.
-     */
-    async stopCallbackServer() {
-        if (this.callbackServer) {
-            return new Promise((resolve) => {
-                this.callbackServer.close(() => {
-                    this.callbackServer = null;
-                    logger.debug('OAuth callback server stopped');
-                    resolve();
-                });
-            });
-        }
-    }
-    /**
-     * Cleans up expired pending auth states.
-     */
-    cleanupPendingAuths() {
-        const now = new Date();
-        const maxAge = 10 * 60 * 1000; // 10 minutes
-        for (const [key, pending] of this.pendingAuths) {
-            if (now.getTime() - pending.createdAt.getTime() > maxAge) {
-                this.pendingAuths.delete(key);
-            }
-        }
-    }
-    /**
-     * Gets all servers with stored authentication.
-     */
-    getAuthenticatedServers() {
-        return Object.keys(this.storage.tokens).filter((name) => this.isTokenValid(this.storage.tokens[name]));
-    }
-}
-// Singleton instance
-let mcpOAuthServiceInstance = null;
-/**
- * Gets the singleton MCPOAuthService instance.
- */
-export async function getMCPOAuthService() {
-    if (!mcpOAuthServiceInstance) {
-        mcpOAuthServiceInstance = new MCPOAuthService();
-        await mcpOAuthServiceInstance.load();
-    }
-    return mcpOAuthServiceInstance;
-}
-/**
- * Creates a new MCPOAuthService instance.
- */
-export function createMCPOAuthService() {
-    return new MCPOAuthService();
-}
-export { MCPOAuthService };
-//# sourceMappingURL=mcp-oauth-service.js.map