@grackle-ai/server 0.72.1 → 0.72.3

package/dist/adapters/ssh.js

@@ -1,214 +0,0 @@
-import { DEFAULT_POWERLINE_PORT, DEFAULT_MCP_PORT } from "@grackle-ai/common";
-import { ProcessTunnel, bootstrapPowerLine, connectThroughTunnel, registerTunnel, getTunnel, closeTunnel, findFreePort, remoteStop, remoteDestroy, remoteHealthCheck, startRemotePowerLine, SSH_CONNECTIVITY_TIMEOUT_MS, REMOTE_EXEC_DEFAULT_TIMEOUT_MS, } from "@grackle-ai/adapter-sdk";
-import { getCredentialProviders } from "../credential-providers.js";
-import { exec } from "../utils/exec.js";
-import { sleep } from "../utils/sleep.js";
-const REMOTE_COPY_TIMEOUT_MS = 120_000;
-/** Delay for reverse tunnels to wait for SSH to establish. */
-const REVERSE_TUNNEL_SETTLE_MS = 3_000;
-// ─── SSH Helpers ────────────────────────────────────────────
-/** Build the common SSH flags shared across exec, scp, and tunnel commands. */
-function buildSshFlags(cfg) {
-    const flags = ["-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new"];
-    if (cfg.sshPort) {
-        flags.push("-p", String(cfg.sshPort));
-    }
-    if (cfg.identityFile) {
-        flags.push("-i", cfg.identityFile);
-    }
-    if (cfg.sshOptions) {
-        for (const [key, value] of Object.entries(cfg.sshOptions)) {
-            flags.push("-o", `${key}=${value}`);
-        }
-    }
-    return flags;
-}
-/** Build the `user@host` destination string. */
-function buildDestination(cfg) {
-    return cfg.user ? `${cfg.user}@${cfg.host}` : cfg.host;
-}
-// ─── Executor ───────────────────────────────────────────────
-/** Execute commands on a remote host via SSH. */
-class SshExecutor {
-    cfg;
-    constructor(cfg) {
-        this.cfg = cfg;
-    }
-    /** Execute a shell command on the remote host and return trimmed stdout. */
-    async exec(command, opts) {
-        const args = [...buildSshFlags(this.cfg), buildDestination(this.cfg), command];
-        const result = await exec("ssh", args, { timeout: opts?.timeout ?? REMOTE_EXEC_DEFAULT_TIMEOUT_MS });
-        return result.stdout;
-    }
-    /** Copy a local file or directory to the remote host via scp. */
-    async copyTo(localPath, remotePath) {
-        const flags = buildSshFlags(this.cfg);
-        // scp uses -P (uppercase) instead of -p for port
-        const scpFlags = flags.map((f, i) => (f === "-p" && i > 0 && flags[i - 1] !== "-o") ? "-P" : f);
-        const args = ["-r", ...scpFlags, localPath, `${buildDestination(this.cfg)}:${remotePath}`];
-        await exec("scp", args, { timeout: REMOTE_COPY_TIMEOUT_MS });
-    }
-}
-// ─── Tunnel ─────────────────────────────────────────────────
-/** SSH tunnel that forwards a local port to the remote PowerLine port. */
-class SshTunnel extends ProcessTunnel {
-    cfg;
-    constructor(localPort, cfg, processFactory, portProbe) {
-        super(localPort, undefined, processFactory, portProbe);
-        this.cfg = cfg;
-    }
-    /** Return the ssh command and arguments for the tunnel process. */
-    spawnArgs() {
-        const flags = buildSshFlags(this.cfg);
-        const args = [
-            "-N",
-            "-L", `${this.localPort}:127.0.0.1:${DEFAULT_POWERLINE_PORT}`,
-            "-o", "ExitOnForwardFailure=yes",
-            "-o", "ServerAliveInterval=15",
-            "-o", "ServerAliveCountMax=3",
-            ...flags,
-            buildDestination(this.cfg),
-        ];
-        return { command: "ssh", args };
-    }
-}
-/**
- * Reverse SSH tunnel: binds a port on the remote host that tunnels back to a local port.
- * Used so agents (running on the remote host) can reach the Grackle MCP server (on the host).
- */
-class SshReverseTunnel extends ProcessTunnel {
-    cfg;
-    remotePort;
-    constructor(localPort, remotePort, cfg, processFactory, portProbe) {
-        super(localPort, undefined, processFactory, portProbe);
-        this.cfg = cfg;
-        this.remotePort = remotePort;
-    }
-    /** Return the ssh command with -R for reverse port forwarding. */
-    spawnArgs() {
-        const flags = buildSshFlags(this.cfg);
-        const args = [
-            "-N",
-            "-R", `${this.remotePort}:127.0.0.1:${this.localPort}`,
-            "-o", "ExitOnForwardFailure=yes",
-            "-o", "ServerAliveInterval=15",
-            "-o", "ServerAliveCountMax=3",
-            ...flags,
-            buildDestination(this.cfg),
-        ];
-        return { command: "ssh", args };
-    }
-    /**
-     * Reverse tunnels bind on the remote side, not locally.
-     * We can't probe the remote port, so wait a fixed delay for SSH to establish.
-     */
-    async waitForReady() {
-        await sleep(REVERSE_TUNNEL_SETTLE_MS);
-        if (this.process?.exitCode !== null) {
-            throw new Error(`Reverse tunnel exited immediately with code ${this.process?.exitCode}`);
-        }
-    }
-}
-// ─── Adapter ────────────────────────────────────────────────
-/** Environment adapter that provisions and manages remote environments via SSH. */
-export class SshAdapter {
-    type = "ssh";
-    /** Provision the remote host: test connectivity, bootstrap PowerLine, open tunnel. */
-    async *provision(environmentId, config, powerlineToken) {
-        const cfg = config;
-        if (!cfg.host) {
-            throw new Error("SSH adapter requires a 'host' in the configuration");
-        }
-        const executor = new SshExecutor(cfg);
-        // Test SSH connectivity
-        yield { stage: "connecting", message: `Testing SSH connectivity to ${cfg.host}...`, progress: 0.05 };
-        try {
-            await executor.exec("echo ok", { timeout: SSH_CONNECTIVITY_TIMEOUT_MS });
-        }
-        catch (err) {
-            throw new Error(`Cannot reach ${cfg.host} via SSH: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        // Bootstrap PowerLine on the remote host
-        yield* bootstrapPowerLine(executor, powerlineToken, {
-            extraEnv: cfg.env,
-            isGitHubProviderEnabled: () => getCredentialProviders().github !== "off",
-            defaultRuntime: config.defaultRuntime || undefined,
-        });
-        // Open SSH tunnel
-        const localPort = cfg.localPort || await findFreePort();
-        yield { stage: "tunneling", message: `Opening SSH tunnel on local port ${localPort}...`, progress: 0.80 };
-        const tunnel = new SshTunnel(localPort, cfg);
-        await tunnel.open();
-        // Open reverse tunnel (remote → host MCP server) for agent tool calls
-        const mcpPort = parseInt(process.env.GRACKLE_MCP_PORT || String(DEFAULT_MCP_PORT), 10);
-        const reverseTunnel = new SshReverseTunnel(mcpPort, mcpPort, cfg);
-        await reverseTunnel.open();
-        registerTunnel(environmentId, { tunnel, reverseTunnel });
-        yield { stage: "connecting", message: `Tunnel open, connecting on port ${localPort}...`, progress: 0.90 };
-    }
-    /**
-     * Attempt fast reconnect: probe PowerLine, restart if needed, re-open tunnel.
-     *
-     * Any failure (SSH unreachable, PowerLine won't start, tunnel error) throws
-     * and falls through to the caller, which should trigger a full provision.
-     *
-     * Minimizes SSH round trips — probe and conditional restart run in a single
-     * SSH call via `startRemotePowerLine({ probeFirst: true })`.
-     */
-    async *reconnect(environmentId, config, powerlineToken) {
-        const cfg = config;
-        if (!cfg.host) {
-            throw new Error("SSH adapter requires a 'host' in the configuration");
-        }
-        const executor = new SshExecutor(cfg);
-        // 1. Close any stale tunnel
-        yield { stage: "reconnecting", message: "Closing stale tunnel...", progress: 0.10 };
-        await closeTunnel(environmentId);
-        // 2. Probe + conditional restart in a single SSH call.
-        yield { stage: "reconnecting", message: `Checking PowerLine on ${cfg.host}...`, progress: 0.30 };
-        const { alreadyRunning } = await startRemotePowerLine(executor, powerlineToken, {
-            extraEnv: cfg.env,
-            probeFirst: true,
-        });
-        if (!alreadyRunning) {
-            yield { stage: "reconnecting", message: "PowerLine restarted", progress: 0.50 };
-        }
-        // 3. Open new SSH tunnel + reverse tunnel for MCP
-        const localPort = cfg.localPort || await findFreePort();
-        yield { stage: "reconnecting", message: `Opening SSH tunnel on local port ${localPort}...`, progress: 0.70 };
-        const tunnel = new SshTunnel(localPort, cfg);
-        await tunnel.open();
-        const mcpPort = parseInt(process.env.GRACKLE_MCP_PORT || String(DEFAULT_MCP_PORT), 10);
-        const reverseTunnel = new SshReverseTunnel(mcpPort, mcpPort, cfg);
-        await reverseTunnel.open();
-        registerTunnel(environmentId, { tunnel, reverseTunnel });
-        yield { stage: "reconnecting", message: "Reconnected via SSH", progress: 0.90 };
-    }
-    /** Connect to the PowerLine through the SSH tunnel. */
-    async connect(environmentId, config, powerlineToken) {
-        const state = getTunnel(environmentId);
-        if (!state) {
-            throw new Error(`No tunnel registered for environment ${environmentId}`);
-        }
-        return connectThroughTunnel(environmentId, state.tunnel.localPort, powerlineToken);
-    }
-    /** Close the SSH tunnel without stopping the remote PowerLine. */
-    async disconnect(environmentId) {
-        await closeTunnel(environmentId);
-    }
-    /** Stop the remote PowerLine process and close the tunnel. */
-    async stop(environmentId, config) {
-        const cfg = config;
-        await remoteStop(environmentId, new SshExecutor(cfg));
-    }
-    /** Stop the remote PowerLine, remove artifacts, and close the tunnel. */
-    async destroy(environmentId, config) {
-        const cfg = config;
-        await remoteDestroy(environmentId, new SshExecutor(cfg));
-    }
-    /** Check that the tunnel is alive and the PowerLine responds to a ping. */
-    async healthCheck(connection) {
-        return remoteHealthCheck(connection);
-    }
-}
-//# sourceMappingURL=ssh.js.map

package/dist/adapters/ssh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../src/adapters/ssh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAIL,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE1C,MAAM,sBAAsB,GAAW,OAAO,CAAC;AAE/C,8DAA8D;AAC9D,MAAM,wBAAwB,GAAW,KAAK,CAAC;AAsB/C,+DAA+D;AAE/D,+EAA+E;AAC/E,SAAS,aAAa,CAAC,GAAyB;IAC9C,MAAM,KAAK,GAAa,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kCAAkC,CAAC,CAAC;IAC1F,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gDAAgD;AAChD,SAAS,gBAAgB,CAAC,GAAyB;IACjD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,+DAA+D;AAE/D,iDAAiD;AACjD,MAAM,WAAW;IACE,GAAG,CAAuB;IAE3C,YAAmB,GAAyB;QAC1C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,4EAA4E;IACrE,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,IAA2B;QAC5D,MAAM,IAAI,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,8BAA8B,EAAE,CAAC,CAAC;QACrG,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,iEAAiE;IAC1D,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,UAAkB;QACvD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,iDAAiD;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,+DAA+D;AAE/D,0EAA0E;AAC1E,MAAM,SAAU,SAAQ,aAAa;IAClB,GAAG,CAAuB;IAE3C,YACE,SAAiB,EACjB,GAAyB,EACzB,cAAqC,EACrC,SAA2B;QAE3B,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,mEAAmE;IACzD,SAAS;QACjB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,cAAc,sBAAsB,EAAE;YAC7D,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,uBAAuB;YAC7B,GAAG,KAAK;YACR,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;SAC3B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,gBAAiB,SAAQ,aAAa;IACzB,GAAG,CAAuB;IAC1B,UAAU,CAAS;IAEpC,YACE,SAAiB,EACjB,UAAkB,EAClB,GAAyB,EACzB,cAAqC,EACrC,SAA2B;QAE3B,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,kEAAkE;IACxD,SAAS;QACjB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,cAAc,IAAI,CAAC,SAAS,EAAE;YACtD,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,uBAAuB;YAC7B,GAAG,KAAK;YACR,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;SAC3B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,YAAY;QAC1B,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AAED,+DAA+D;AAE/D,mFAAmF;AACnF,MAAM,OAAO,UAAU;IACd,IAAI,GAAW,KAAK,CAAC;IAE5B,sFAAsF;IAC/E,KAAK,CAAC,CAAC,SAAS,CACrB,aAAqB,EACrB,MAA+B,EAC/B,cAAsB;QAEtB,MAAM,GAAG,GAAG,MAAyC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtC,wBAAwB;QACxB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,+BAA+B,GAAG,CAAC,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrG,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,IAAI,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,yCAAyC;QACzC,KAAK,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE;YAClD,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,uBAAuB,EAAE,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,MAAM,KAAK,KAAK;YACxE,cAAc,EAAG,MAAM,CAAC,cAAyB,IAAI,SAAS;SAC/D,CAAC,CAAC;QAEH,kBAAkB;QAClB,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,YAAY,EAAE,CAAC;QACxD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,SAAS,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE1G,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,sEAAsE;QACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,aAAa,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAE3B,cAAc,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEzD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,mCAAmC,SAAS,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5G,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,CAAC,SAAS,CACrB,aAAqB,EACrB,MAA+B,EAC/B,cAAsB;QAEtB,MAAM,GAAG,GAAG,MAAyC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtC,4BAA4B;QAC5B,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpF,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;QAEjC,uDAAuD;QACvD,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjG,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,cAAc,EAAE;YAC9E,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClF,CAAC;QAED,kDAAkD;QAClD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,YAAY,EAAE,CAAC;QACxD,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,SAAS,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC7G,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,aAAa,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAE3B,cAAc,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEzD,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,uDAAuD;IAChD,KAAK,CAAC,OAAO,CAClB,aAAqB,EACrB,MAA+B,EAC/B,cAAsB;QAEtB,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wCAAwC,aAAa,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,oBAAoB,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACrF,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,UAAU,CAAC,aAAqB;QAC3C,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAED,8DAA8D;IACvD,KAAK,CAAC,IAAI,CAAC,aAAqB,EAAE,MAA+B;QACtE,MAAM,GAAG,GAAG,MAAyC,CAAC;QACtD,MAAM,UAAU,CAAC,aAAa,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,yEAAyE;IAClE,KAAK,CAAC,OAAO,CAAC,aAAqB,EAAE,MAA+B;QACzE,MAAM,GAAG,GAAG,MAAyC,CAAC;QACtD,MAAM,aAAa,CAAC,aAAa,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,2EAA2E;IACpE,KAAK,CAAC,WAAW,CAAC,UAA+B;QACtD,OAAO,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/api-key.d.ts

@@ -1,8 +0,0 @@
-/**
- * Load or create the API key. On first run, a random 256-bit key is
- * generated and written to ~/.grackle/api-key with 0600 permissions.
- */
-export declare function loadOrCreateApiKey(): string;
-/** Verify a bearer token matches the API key. */
-export declare function verifyApiKey(token: string): boolean;
-//# sourceMappingURL=api-key.d.ts.map

package/dist/api-key.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAwCA;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAO3C;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAYnD"}

package/dist/api-key.js

@@ -1,58 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "node:fs";
-import { join } from "node:path";
-import { API_KEY_FILENAME } from "@grackle-ai/common";
-import { logger } from "./logger.js";
-import { grackleHome } from "./paths.js";
-const API_KEY_BYTE_LENGTH = 32;
-const keyPath = join(grackleHome, API_KEY_FILENAME);
-let cachedKey = undefined;
-/** Attempt to read an existing API key from disk. Returns undefined if none exists. */
-function tryLoadApiKey() {
-    if (existsSync(keyPath)) {
-        const content = readFileSync(keyPath, "utf8").trim();
-        if (content.length > 0) {
-            return content;
-        }
-    }
-    return undefined;
-}
-/** Generate a new random API key, write it to disk with 0600 permissions, and return it. */
-function createApiKey() {
-    const key = randomBytes(API_KEY_BYTE_LENGTH).toString("hex");
-    mkdirSync(grackleHome, { recursive: true });
-    writeFileSync(keyPath, key + "\n", { mode: 0o600 });
-    // Ensure permissions on Windows (best-effort)
-    try {
-        chmodSync(keyPath, 0o600);
-    }
-    catch { /* Windows may not support this */ }
-    logger.info({ keyPath }, "Generated new API key");
-    return key;
-}
-/**
- * Load or create the API key. On first run, a random 256-bit key is
- * generated and written to ~/.grackle/api-key with 0600 permissions.
- */
-export function loadOrCreateApiKey() {
-    if (cachedKey) {
-        return cachedKey;
-    }
-    cachedKey = tryLoadApiKey() ?? createApiKey();
-    return cachedKey;
-}
-/** Verify a bearer token matches the API key. */
-export function verifyApiKey(token) {
-    const key = loadOrCreateApiKey();
-    // Constant-time comparison to prevent timing attacks
-    if (token.length !== key.length) {
-        return false;
-    }
-    let result = 0;
-    for (let i = 0; i < key.length; i++) {
-        // eslint-disable-next-line no-bitwise
-        result |= token.charCodeAt(i) ^ key.charCodeAt(i);
-    }
-    return result === 0;
-}
-//# sourceMappingURL=api-key.js.map

package/dist/api-key.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,mBAAmB,GAAW,EAAE,CAAC;AAEvC,MAAM,OAAO,GAAW,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAE5D,IAAI,SAAS,GAAuB,SAAS,CAAC;AAE9C,uFAAuF;AACvF,SAAS,aAAa;IACpB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE7D,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpD,8CAA8C;IAC9C,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IAE9C,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,GAAG,aAAa,EAAE,IAAI,YAAY,EAAE,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,qDAAqD;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,sCAAsC;QACtC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/oauth.d.ts

@@ -1,100 +0,0 @@
-interface ClientRecord {
-    clientId: string;
-    redirectUris: string[];
-    clientName: string;
-    createdAt: number;
-}
-/**
- * Register a new OAuth client with dynamic client registration.
- *
- * @param redirectUris - List of allowed redirect URIs for this client.
- * @param clientName - Human-readable name for the client (optional).
- * @returns The newly registered client record.
- */
-export declare function registerClient(redirectUris: string[], clientName?: string): ClientRecord | undefined;
-/**
- * Look up a registered client by ID.
- *
- * @param clientId - The client ID to look up.
- * @returns The client record, or undefined if not found.
- */
-export declare function getClient(clientId: string): ClientRecord | undefined;
-interface AuthCodeRecord {
-    code: string;
-    clientId: string;
-    redirectUri: string;
-    codeChallenge: string;
-    resource: string;
-    createdAt: number;
-    expiresAt: number;
-}
-/**
- * Create a single-use authorization code bound to the given parameters.
- *
- * @param clientId - The client that requested authorization.
- * @param redirectUri - The redirect URI for this authorization.
- * @param codeChallenge - PKCE S256 code challenge.
- * @param resource - The resource URL the client wants to access.
- * @returns The generated authorization code string.
- */
-export declare function createAuthorizationCode(clientId: string, redirectUri: string, codeChallenge: string, resource: string): string;
-/**
- * Compute the S256 code challenge from a code verifier.
- *
- * @param codeVerifier - The PKCE code verifier string.
- * @returns The base64url-encoded SHA-256 hash.
- */
-export declare function computeCodeChallenge(codeVerifier: string): string;
-/**
- * Verify that a code verifier matches a code challenge using S256.
- *
- * @param codeVerifier - The PKCE code verifier from the token request.
- * @param codeChallenge - The code challenge stored at authorization time.
- * @returns True if the verifier matches the challenge.
- */
-export declare function verifyCodeChallenge(codeVerifier: string, codeChallenge: string): boolean;
-/**
- * Consume an authorization code, validating all parameters.
- *
- * The code is deleted regardless of whether validation succeeds (single-use).
- *
- * @param code - The authorization code to consume.
- * @param clientId - The client ID making the token request.
- * @param redirectUri - The redirect URI from the token request.
- * @param codeVerifier - The PKCE code verifier.
- * @param resource - The resource URL from the token request.
- * @returns The auth code record if valid, or undefined.
- */
-export declare function consumeAuthorizationCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, resource: string): AuthCodeRecord | undefined;
-interface RefreshTokenRecord {
-    token: string;
-    clientId: string;
-    resource: string;
-    createdAt: number;
-    expiresAt: number;
-}
-/**
- * Create a new refresh token for the given client and resource.
- *
- * @param clientId - The client this refresh token is issued to.
- * @param resource - The resource URL this refresh token is scoped to.
- * @returns The generated refresh token string.
- */
-export declare function createRefreshToken(clientId: string, resource: string): string;
-/**
- * Consume a refresh token with rotation — the old token is invalidated and
- * a new one must be issued in its place.
- *
- * @param token - The refresh token to consume.
- * @param clientId - The client ID making the refresh request.
- * @returns The refresh token record if valid, or undefined.
- */
-export declare function consumeRefreshToken(token: string, clientId: string): RefreshTokenRecord | undefined;
-/** Start the periodic OAuth state cleanup timer. Call once on server startup. */
-export declare function startOAuthCleanup(): void;
-/** Stop the periodic OAuth state cleanup timer. */
-export declare function stopOAuthCleanup(): void;
-/** Clear all OAuth state. Intended for testing only. */
-export declare function clearOAuthState(): void;
-export {};
-//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAuBA,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAwBpG;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEpE;AAID,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,MAAM,CAeR;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAGxF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,cAAc,GAAG,SAAS,CA+B5B;AAID,UAAU,kBAAkB;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW7E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAmBnG;AAMD,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,IAAI,CAuBxC;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED,wDAAwD;AACxD,wBAAgB,eAAe,IAAI,IAAI,CAItC"}

package/dist/oauth.js

@@ -1,225 +0,0 @@
-import { randomUUID, randomBytes, createHash } from "node:crypto";
-import { logger } from "./logger.js";
-/** Time-to-live for authorization codes: 30 seconds. */
-const AUTH_CODE_TTL_MS = 30 * 1000;
-/** Time-to-live for refresh tokens: 30 days. */
-const REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-/** Interval at which expired OAuth state is cleaned up. */
-const CLEANUP_INTERVAL_MS = 60 * 1000;
-/** Byte length of generated tokens (authorization codes, refresh tokens). */
-const TOKEN_BYTE_LENGTH = 32;
-/** Maximum number of registered OAuth clients to prevent unbounded growth. */
-const MAX_CLIENTS = 100;
-/** Time-to-live for client registrations: 7 days. */
-const CLIENT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-/** Registered OAuth clients keyed by client ID. */
-const clients = new Map();
-/**
- * Register a new OAuth client with dynamic client registration.
- *
- * @param redirectUris - List of allowed redirect URIs for this client.
- * @param clientName - Human-readable name for the client (optional).
- * @returns The newly registered client record.
- */
-export function registerClient(redirectUris, clientName) {
-    // Evict expired clients before checking capacity
-    const now = Date.now();
-    for (const [id, rec] of clients) {
-        if (now - rec.createdAt > CLIENT_TTL_MS) {
-            clients.delete(id);
-        }
-    }
-    if (clients.size >= MAX_CLIENTS) {
-        logger.warn("Maximum registered OAuth clients reached (%d)", MAX_CLIENTS);
-        return undefined;
-    }
-    const clientId = randomUUID();
-    const record = {
-        clientId,
-        redirectUris,
-        clientName: clientName || "Unknown Client",
-        createdAt: now,
-    };
-    clients.set(clientId, record);
-    logger.info({ clientId, clientName: record.clientName }, "OAuth client registered");
-    return record;
-}
-/**
- * Look up a registered client by ID.
- *
- * @param clientId - The client ID to look up.
- * @returns The client record, or undefined if not found.
- */
-export function getClient(clientId) {
-    return clients.get(clientId);
-}
-/** Active authorization codes keyed by code string. */
-const authCodes = new Map();
-/**
- * Create a single-use authorization code bound to the given parameters.
- *
- * @param clientId - The client that requested authorization.
- * @param redirectUri - The redirect URI for this authorization.
- * @param codeChallenge - PKCE S256 code challenge.
- * @param resource - The resource URL the client wants to access.
- * @returns The generated authorization code string.
- */
-export function createAuthorizationCode(clientId, redirectUri, codeChallenge, resource) {
-    const code = randomBytes(TOKEN_BYTE_LENGTH).toString("base64url");
-    const now = Date.now();
-    const record = {
-        code,
-        clientId,
-        redirectUri,
-        codeChallenge,
-        resource,
-        createdAt: now,
-        expiresAt: now + AUTH_CODE_TTL_MS,
-    };
-    authCodes.set(code, record);
-    logger.info({ clientId }, "Authorization code created");
-    return code;
-}
-/**
- * Compute the S256 code challenge from a code verifier.
- *
- * @param codeVerifier - The PKCE code verifier string.
- * @returns The base64url-encoded SHA-256 hash.
- */
-export function computeCodeChallenge(codeVerifier) {
-    return createHash("sha256").update(codeVerifier).digest("base64url");
-}
-/**
- * Verify that a code verifier matches a code challenge using S256.
- *
- * @param codeVerifier - The PKCE code verifier from the token request.
- * @param codeChallenge - The code challenge stored at authorization time.
- * @returns True if the verifier matches the challenge.
- */
-export function verifyCodeChallenge(codeVerifier, codeChallenge) {
-    const computed = computeCodeChallenge(codeVerifier);
-    return computed === codeChallenge;
-}
-/**
- * Consume an authorization code, validating all parameters.
- *
- * The code is deleted regardless of whether validation succeeds (single-use).
- *
- * @param code - The authorization code to consume.
- * @param clientId - The client ID making the token request.
- * @param redirectUri - The redirect URI from the token request.
- * @param codeVerifier - The PKCE code verifier.
- * @param resource - The resource URL from the token request.
- * @returns The auth code record if valid, or undefined.
- */
-export function consumeAuthorizationCode(code, clientId, redirectUri, codeVerifier, resource) {
-    const record = authCodes.get(code);
-    // Always delete to prevent replay — even if validation fails
-    authCodes.delete(code);
-    if (!record) {
-        return undefined;
-    }
-    const now = Date.now();
-    if (now > record.expiresAt) {
-        return undefined;
-    }
-    if (record.clientId !== clientId) {
-        return undefined;
-    }
-    if (record.redirectUri !== redirectUri) {
-        return undefined;
-    }
-    if (record.resource !== resource) {
-        return undefined;
-    }
-    if (!verifyCodeChallenge(codeVerifier, record.codeChallenge)) {
-        return undefined;
-    }
-    return record;
-}
-/** Active refresh tokens keyed by token string. */
-const refreshTokens = new Map();
-/**
- * Create a new refresh token for the given client and resource.
- *
- * @param clientId - The client this refresh token is issued to.
- * @param resource - The resource URL this refresh token is scoped to.
- * @returns The generated refresh token string.
- */
-export function createRefreshToken(clientId, resource) {
-    const token = randomBytes(TOKEN_BYTE_LENGTH).toString("base64url");
-    const now = Date.now();
-    refreshTokens.set(token, {
-        token,
-        clientId,
-        resource,
-        createdAt: now,
-        expiresAt: now + REFRESH_TOKEN_TTL_MS,
-    });
-    return token;
-}
-/**
- * Consume a refresh token with rotation — the old token is invalidated and
- * a new one must be issued in its place.
- *
- * @param token - The refresh token to consume.
- * @param clientId - The client ID making the refresh request.
- * @returns The refresh token record if valid, or undefined.
- */
-export function consumeRefreshToken(token, clientId) {
-    const record = refreshTokens.get(token);
-    // Always delete to enforce rotation
-    refreshTokens.delete(token);
-    if (!record) {
-        return undefined;
-    }
-    const now = Date.now();
-    if (now > record.expiresAt) {
-        return undefined;
-    }
-    if (record.clientId !== clientId) {
-        return undefined;
-    }
-    return record;
-}
-// ─── Cleanup ──────────────────────────────────────────────────────────
-let cleanupTimer;
-/** Start the periodic OAuth state cleanup timer. Call once on server startup. */
-export function startOAuthCleanup() {
-    if (cleanupTimer) {
-        return;
-    }
-    cleanupTimer = setInterval(() => {
-        const now = Date.now();
-        for (const [id, record] of clients) {
-            if (now - record.createdAt > CLIENT_TTL_MS) {
-                clients.delete(id);
-            }
-        }
-        for (const [code, record] of authCodes) {
-            if (now > record.expiresAt) {
-                authCodes.delete(code);
-            }
-        }
-        for (const [token, record] of refreshTokens) {
-            if (now > record.expiresAt) {
-                refreshTokens.delete(token);
-            }
-        }
-    }, CLEANUP_INTERVAL_MS);
-    cleanupTimer.unref();
-}
-/** Stop the periodic OAuth state cleanup timer. */
-export function stopOAuthCleanup() {
-    if (cleanupTimer) {
-        clearInterval(cleanupTimer);
-        cleanupTimer = undefined;
-    }
-}
-/** Clear all OAuth state. Intended for testing only. */
-export function clearOAuthState() {
-    clients.clear();
-    authCodes.clear();
-    refreshTokens.clear();
-}
-//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,wDAAwD;AACxD,MAAM,gBAAgB,GAAW,EAAE,GAAG,IAAI,CAAC;AAE3C,gDAAgD;AAChD,MAAM,oBAAoB,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9D,2DAA2D;AAC3D,MAAM,mBAAmB,GAAW,EAAE,GAAG,IAAI,CAAC;AAE9C,6EAA6E;AAC7E,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC,8EAA8E;AAC9E,MAAM,WAAW,GAAW,GAAG,CAAC;AAEhC,qDAAqD;AACrD,MAAM,aAAa,GAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAWtD,mDAAmD;AACnD,MAAM,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,YAAsB,EAAE,UAAmB;IACxE,iDAAiD;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,GAAG,aAAa,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,WAAW,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAiB;QAC3B,QAAQ;QACR,YAAY;QACZ,UAAU,EAAE,UAAU,IAAI,gBAAgB;QAC1C,SAAS,EAAE,GAAG;KACf,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,yBAAyB,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAcD,uDAAuD;AACvD,MAAM,SAAS,GAAgC,IAAI,GAAG,EAAE,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,WAAmB,EACnB,aAAqB,EACrB,QAAgB;IAEhB,MAAM,IAAI,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAmB;QAC7B,IAAI;QACJ,QAAQ;QACR,WAAW;QACX,aAAa;QACb,QAAQ;QACR,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,gBAAgB;KAClC,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,4BAA4B,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;IAC7E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,6DAA6D;IAC7D,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,mDAAmD;AACnD,MAAM,aAAa,GAAoC,IAAI,GAAG,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE;QACvB,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,oBAAoB;KACtC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAAgB;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,oCAAoC;IACpC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AAEzE,IAAI,YAAwD,CAAC;AAE7D,iFAAiF;AACjF,MAAM,UAAU,iBAAiB;IAC/B,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC3C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5C,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3B,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxB,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB;IAC9B,IAAI,YAAY,EAAE,CAAC;QACjB,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC"}