@desplega.ai/agent-swarm 1.165.0 → 1.166.0

package/dist/cli-j2jbr8af.js

@@ -0,0 +1,516 @@
+import {
+  acquireOAuthRefreshLock,
+  createOAuthPending,
+  getAuthorizationById,
+  getDefaultAuthorizationIdForProvider,
+  getOAuthAppById,
+  getOAuthAppIdByProvider,
+  init_oauth,
+  markAuthorizationRefreshFailed,
+  releaseOAuthRefreshLock,
+  updateAuthorizationTokens
+} from "./cli-yshaazs1.js";
+import {
+  init_secret_scrubber,
+  registerVolatileSecret,
+  scrubSecrets
+} from "./cli-wt7ccy4r.js";
+
+// src/oauth/ensure-token.ts
+init_oauth();
+init_secret_scrubber();
+
+// node_modules/oauth4webapi/build/index.js
+var USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "oauth4webapi";
+  const VERSION = "v3.8.5";
+  USER_AGENT = `${NAME}/${VERSION}`;
+}
+var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+var allowInsecureRequests = Symbol();
+var clockSkew = Symbol();
+var clockTolerance = Symbol();
+var customFetch = Symbol();
+var modifyAssertion = Symbol();
+var jweDecrypt = Symbol();
+var jwksCache = Symbol();
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+function buf(input) {
+  if (typeof input === "string") {
+    return encoder.encode(input);
+  }
+  return decoder.decode(input);
+}
+var encodeBase64Url;
+if (Uint8Array.prototype.toBase64) {
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    return input.toBase64({ alphabet: "base64url", omitPadding: true });
+  };
+} else {
+  const CHUNK_SIZE = 32768;
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0;i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  };
+}
+var decodeBase64Url;
+if (Uint8Array.fromBase64) {
+  decodeBase64Url = (input) => {
+    try {
+      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+} else {
+  decodeBase64Url = (input) => {
+    try {
+      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0;i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+}
+function b64u(input) {
+  if (typeof input === "string") {
+    return decodeBase64Url(input);
+  }
+  return encodeBase64Url(input);
+}
+class OperationProcessingError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    if (options?.code) {
+      this.code = options?.code;
+    }
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+function OPE(message, code, cause) {
+  return new OperationProcessingError(message, { code, cause });
+}
+function assertString(input, it, code, cause) {
+  try {
+    if (typeof input !== "string") {
+      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input.length === 0) {
+      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+    }
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+function randomBytes() {
+  return b64u(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateRandomCodeVerifier() {
+  return randomBytes();
+}
+function generateRandomState() {
+  return randomBytes();
+}
+async function calculatePKCECodeChallenge(codeVerifier) {
+  assertString(codeVerifier, "codeVerifier");
+  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
+}
+var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+  try {
+    return new URL(url, base);
+  } catch {
+    return null;
+  }
+};
+var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
+var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
+var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
+var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+var skipSubjectCheck = Symbol();
+var idTokenClaims = new WeakMap;
+var jwtRefs = new WeakMap;
+var branded = new WeakSet;
+var nopkce = Symbol();
+var expectNoNonce = Symbol();
+var skipAuthTimeCheck = Symbol();
+var skipStateCheck = Symbol();
+var expectNoState = Symbol();
+var _nodiscoverycheck = Symbol();
+var _expectedIssuer = Symbol();
+
+// src/oauth/wrapper.ts
+init_oauth();
+async function buildAuthorizationUrl(config, options = {}) {
+  const state = generateRandomState();
+  const codeVerifier = generateRandomCodeVerifier();
+  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
+  const appId = options.appId ?? await getOAuthAppIdByProvider(config.provider);
+  if (!appId) {
+    throw new Error(`OAuth app ${config.provider} is not configured`);
+  }
+  await createOAuthPending({
+    state,
+    appId,
+    label: options.label ?? "default",
+    flow: options.flow ?? "generic",
+    codeVerifier,
+    nonce: options.nonce ?? null,
+    redirectUri: config.redirectUri,
+    finalRedirect: options.finalRedirect ?? null,
+    userId: options.userId ?? null
+  });
+  const url = new URL(config.authorizeUrl);
+  url.searchParams.set("client_id", config.clientId);
+  url.searchParams.set("redirect_uri", config.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", config.scopes.join(config.scopeSeparator ?? ","));
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  if (config.extraParams) {
+    for (const [key, value] of Object.entries(config.extraParams)) {
+      url.searchParams.set(key, value);
+    }
+  }
+  return { url: url.toString(), state, codeVerifier };
+}
+function tokenRequestInit(config, params) {
+  const useBasic = config.tokenAuthStyle === "basic";
+  const bodyParams = useBasic ? params : { ...params, client_id: config.clientId, client_secret: config.clientSecret };
+  const headers = { Accept: "application/json" };
+  if (useBasic) {
+    headers.Authorization = `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`;
+  }
+  if (config.tokenBodyFormat === "json") {
+    headers["Content-Type"] = "application/json";
+    return { headers, body: JSON.stringify(bodyParams) };
+  }
+  headers["Content-Type"] = "application/x-www-form-urlencoded";
+  return { headers, body: new URLSearchParams(bodyParams).toString() };
+}
+async function exchangeAuthorizationCode(config, params) {
+  const response = await fetch(config.tokenUrl, {
+    method: "POST",
+    ...tokenRequestInit(config, {
+      grant_type: "authorization_code",
+      redirect_uri: params.redirectUri,
+      code: params.code,
+      code_verifier: params.codeVerifier
+    })
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Token exchange failed (${response.status}): ${errorText}`);
+  }
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in,
+    scope: data.scope,
+    tokenType: data.token_type,
+    idToken: data.id_token
+  };
+}
+async function performTokenRefreshRequest(config, refreshToken) {
+  const response = await fetch(config.tokenUrl, {
+    method: "POST",
+    ...tokenRequestInit(config, {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    })
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Token refresh failed (${response.status}): ${errorText}`);
+  }
+  const data = await response.json();
+  if (typeof data.access_token !== "string" || data.access_token.length === 0) {
+    throw new Error(`Token refresh failed: ${config.provider} response missing access_token`);
+  }
+  if (config.requiresRefreshTokenRotation && (typeof data.refresh_token !== "string" || data.refresh_token.length === 0)) {
+    throw new Error(`Token refresh failed: ${config.provider} response did not include a rotated refresh_token`);
+  }
+  const expiresAt = data.expires_in ? new Date(Date.now() + data.expires_in * 1000).toISOString() : null;
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in,
+    scope: data.scope,
+    expiresAt
+  };
+}
+
+// src/oauth/ensure-token.ts
+function parseMetadata(metadataJson) {
+  try {
+    const parsed = JSON.parse(metadataJson || "{}");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, String(item)]));
+}
+function oauthAppRowToProviderConfig(app) {
+  const metadata = parseMetadata(app.metadata);
+  const liftedExtraParams = stringRecord(parseMetadata(app.extraParamsJson));
+  const extraParams = {
+    ...typeof metadata.actor === "string" ? { actor: metadata.actor } : {},
+    ...liftedExtraParams
+  };
+  return {
+    provider: app.provider,
+    clientId: app.clientId,
+    clientSecret: app.clientSecret,
+    authorizeUrl: app.authorizeUrl,
+    tokenUrl: app.tokenUrl,
+    redirectUri: app.redirectUri,
+    scopes: app.scopes.split(",").map((scope) => scope.trim()).filter(Boolean),
+    extraParams: Object.keys(extraParams).length > 0 ? extraParams : undefined,
+    scopeSeparator: app.scopeSeparator,
+    tokenAuthStyle: app.tokenAuthStyle,
+    tokenBodyFormat: app.tokenBodyFormat,
+    requiresRefreshTokenRotation: app.requiresRefreshTokenRotation
+  };
+}
+
+class OAuthRefreshError extends Error {
+  authorizationId;
+  appId;
+  reason;
+  authorizationLabel;
+  constructor(authorizationId, appId, reason, authorizationLabel, message) {
+    super(message ?? `OAuth authorization '${authorizationLabel}' refresh failed (${reason})`);
+    this.authorizationId = authorizationId;
+    this.appId = appId;
+    this.reason = reason;
+    this.authorizationLabel = authorizationLabel;
+    this.name = "OAuthRefreshError";
+  }
+}
+function authorizationLabelFor(app, authorization) {
+  const base = app.displayName?.trim() || app.provider;
+  return authorization.label && authorization.label !== "default" ? `${base} (${authorization.label})` : base;
+}
+var refreshLocks = new Map;
+var REFRESH_LOCK_TTL_MS = 2 * 60 * 1000;
+var REFRESH_LOCK_WAIT_MS = 30 * 1000;
+var REFRESH_LOCK_POLL_MS = 250;
+var DEFAULT_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+async function withAuthorizationRefreshLock(authorizationId, fn) {
+  const previous = refreshLocks.get(authorizationId) ?? Promise.resolve();
+  let release;
+  const current = new Promise((resolve) => {
+    release = resolve;
+  });
+  const next = previous.catch(() => {
+    return;
+  }).then(() => current);
+  refreshLocks.set(authorizationId, next);
+  await previous.catch(() => {
+    return;
+  });
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (refreshLocks.get(authorizationId) === next) {
+      refreshLocks.delete(authorizationId);
+    }
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function authorizationNeedsRefresh(authorization, bufferMs = DEFAULT_REFRESH_BUFFER_MS, force = false) {
+  if (authorization.status === "refresh-failed" || authorization.status === "expired")
+    return true;
+  if (force)
+    return true;
+  if (!authorization.expiresAt)
+    return false;
+  const expiresAt = new Date(authorization.expiresAt).getTime();
+  if (Number.isNaN(expiresAt))
+    return true;
+  return expiresAt - Date.now() < bufferMs;
+}
+var authorizationRefreshedListeners = new Set;
+function onAuthorizationRefreshed(listener) {
+  authorizationRefreshedListeners.add(listener);
+  return () => {
+    authorizationRefreshedListeners.delete(listener);
+  };
+}
+function notifyAuthorizationRefreshed(event) {
+  for (const listener of authorizationRefreshedListeners) {
+    try {
+      listener(event);
+    } catch (err) {
+      console.error(scrubSecrets(`[OAuth] authorization-refreshed listener failed for ${event.provider}: ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+}
+async function ensureAuthorizationTokenOrThrow(authorizationId, bufferMs, force = false) {
+  const initial = await getAuthorizationById(authorizationId);
+  if (!initial || initial.status === "revoked")
+    return;
+  if (!authorizationNeedsRefresh(initial, bufferMs, force))
+    return;
+  await withAuthorizationRefreshLock(authorizationId, async () => {
+    const waitStartedAt = Date.now();
+    while (true) {
+      const current = await getAuthorizationById(authorizationId);
+      if (!current || current.status === "revoked")
+        return;
+      if (current.tokenVersion !== initial.tokenVersion)
+        return;
+      if (!authorizationNeedsRefresh(current, bufferMs, force))
+        return;
+      const app = await getOAuthAppById(current.appId);
+      if (!app || app.mcpServerId !== null)
+        return;
+      if (!current.refreshToken) {
+        const label = authorizationLabelFor(app, current);
+        const message = `OAuth authorization '${label}' cannot refresh: no refresh token stored`;
+        await markAuthorizationRefreshFailed(authorizationId, message);
+        throw new OAuthRefreshError(authorizationId, app.id, "no_refresh_token", label, message);
+      }
+      const lockOwner = await acquireOAuthRefreshLock(`authz:${authorizationId}`, REFRESH_LOCK_TTL_MS);
+      if (!lockOwner) {
+        if (Date.now() - waitStartedAt > REFRESH_LOCK_WAIT_MS) {
+          const label = authorizationLabelFor(app, current);
+          const message = `Timed out waiting for OAuth refresh lock for '${label}'`;
+          await markAuthorizationRefreshFailed(authorizationId, message);
+          throw new OAuthRefreshError(authorizationId, app.id, "lock_timeout", label, message);
+        }
+        await sleep(REFRESH_LOCK_POLL_MS);
+        continue;
+      }
+      try {
+        const locked = await getAuthorizationById(authorizationId);
+        if (!locked || locked.status === "revoked")
+          return;
+        if (locked.tokenVersion !== initial.tokenVersion)
+          return;
+        if (!authorizationNeedsRefresh(locked, bufferMs, force))
+          return;
+        const lockedApp = await getOAuthAppById(locked.appId);
+        if (!lockedApp || lockedApp.mcpServerId !== null)
+          return;
+        if (!locked.refreshToken) {
+          const label = authorizationLabelFor(lockedApp, locked);
+          const message = `OAuth authorization '${label}' cannot refresh: no refresh token stored`;
+          await markAuthorizationRefreshFailed(authorizationId, message);
+          throw new OAuthRefreshError(authorizationId, lockedApp.id, "no_refresh_token", label, message);
+        }
+        const config = oauthAppRowToProviderConfig(lockedApp);
+        try {
+          const refreshed = await performTokenRefreshRequest(config, locked.refreshToken);
+          const persisted = await updateAuthorizationTokens(authorizationId, {
+            accessToken: refreshed.accessToken,
+            refreshToken: refreshed.refreshToken ?? locked.refreshToken,
+            expiresAt: refreshed.expiresAt,
+            scope: refreshed.scope ?? null,
+            expectedTokenVersion: locked.tokenVersion
+          });
+          if (!persisted) {
+            continue;
+          }
+          notifyAuthorizationRefreshed({
+            authorizationId,
+            appId: lockedApp.id,
+            provider: lockedApp.provider
+          });
+          return;
+        } catch (err) {
+          const label = authorizationLabelFor(lockedApp, locked);
+          if (locked.refreshToken)
+            registerVolatileSecret(locked.refreshToken, "oauth-refresh-token");
+          if (locked.accessToken)
+            registerVolatileSecret(locked.accessToken, "oauth-access-token");
+          if (lockedApp.clientSecret)
+            registerVolatileSecret(lockedApp.clientSecret, "oauth-client-secret");
+          const message = scrubSecrets(err instanceof Error ? err.message : String(err));
+          await markAuthorizationRefreshFailed(authorizationId, message);
+          if (err instanceof OAuthRefreshError)
+            throw err;
+          throw new OAuthRefreshError(authorizationId, lockedApp.id, "refresh_rejected", label, message);
+        }
+      } finally {
+        await releaseOAuthRefreshLock(`authz:${authorizationId}`, lockOwner);
+      }
+    }
+  });
+}
+async function forceRefreshAuthorizationOrThrow(authorizationId) {
+  await ensureAuthorizationTokenOrThrow(authorizationId, undefined, true);
+}
+async function ensureToken(provider, bufferMs) {
+  try {
+    await ensureTokenOrThrow(provider, bufferMs);
+  } catch (err) {
+    console.error(`[OAuth] Failed to refresh ${provider} token:`, err instanceof Error ? err.message : err);
+  }
+}
+async function ensureTokenOrThrow(provider, bufferMs) {
+  const authorizationId = await getDefaultAuthorizationIdForProvider(provider);
+  if (!authorizationId)
+    return;
+  try {
+    await ensureAuthorizationTokenOrThrow(authorizationId, bufferMs);
+  } catch (err) {
+    if (err instanceof OAuthRefreshError && err.reason === "no_refresh_token") {
+      return;
+    }
+    throw err;
+  }
+}
+async function forceRefreshTokenOrThrow(provider) {
+  const authorizationId = await getDefaultAuthorizationIdForProvider(provider);
+  if (!authorizationId)
+    return;
+  try {
+    await forceRefreshAuthorizationOrThrow(authorizationId);
+  } catch (err) {
+    if (err instanceof OAuthRefreshError && err.reason === "no_refresh_token")
+      return;
+    throw err;
+  }
+}
+
+export { generateRandomCodeVerifier, generateRandomState, calculatePKCECodeChallenge, buildAuthorizationUrl, exchangeAuthorizationCode, oauthAppRowToProviderConfig, onAuthorizationRefreshed, ensureAuthorizationTokenOrThrow, forceRefreshAuthorizationOrThrow, ensureToken, ensureTokenOrThrow, forceRefreshTokenOrThrow };