@herbertgao/pi-extensions 2026.9.17 → 2026.9.19

package/node_modules/pi-mcp-adapter/dist/mcp-auth-fetch.js

@@ -1,103 +0,0 @@
-import { combineAbortSignals } from "./runtime-owner.js";
-import { interpolateEnvRecord, resolveCommandSecretsRecord } from "./utils.js";
-export function resolveOAuthHeaders(values, options = {}) {
-    const { commands = true, literal = false } = options;
-    if (literal)
-        return new Headers(values);
-    const selected = Object.fromEntries(Object.entries(values ?? {}).filter(([, value]) => commands || !value.startsWith("!") || value.startsWith("!!")));
-    for (const value of Object.values(selected)) {
-        if (value.startsWith("!") && !value.startsWith("!!"))
-            continue;
-        for (const match of value.matchAll(/\$\{(\w+)\}|\$env:(\w+)|\{env:(\w+)\}/g)) {
-            const name = (match[1] ?? match[2] ?? match[3]);
-            if (!process.env[name])
-                throw new TypeError("Missing environment credential in OAuth HTTP headers");
-        }
-    }
-    try {
-        const resolved = commands
-            ? resolveCommandSecretsRecord(selected, () => "OAuth HTTP header")
-            : interpolateEnvRecord(selected);
-        if (Object.values(resolved ?? {}).some(value => !value.trim())) {
-            throw new Error("empty header");
-        }
-        return new Headers(resolved);
-    }
-    catch {
-        // Header constructors and command errors can otherwise include secret values.
-        throw new TypeError("Failed to resolve OAuth HTTP headers");
-    }
-}
-const DEFAULT_OAUTH_REQUEST_TIMEOUT_MS = 30_000;
-function resolveOAuthRequestTimeoutMs() {
-    const parsed = Number(process.env.PI_MCP_OAUTH_REQUEST_TIMEOUT_MS);
-    return Number.isSafeInteger(parsed) && parsed > 0 && parsed <= 2_147_483_647
-        ? parsed : DEFAULT_OAUTH_REQUEST_TIMEOUT_MS;
-}
-/**
- * Configured service headers belong only to the configured MCP origin, not to
- * discovered issuers. SDK request headers win (notably Authorization and MIME
- * types). Credential-bearing redirects fail closed, including same-origin ones.
- */
-export function createOAuthFetch(serverUrl, getHeaders = () => new Headers(), signal, options = {}) {
-    const origin = new URL(serverUrl).origin;
-    let headerResolutionError;
-    const throwIfHeaderResolutionFailed = () => {
-        if (headerResolutionError)
-            throw headerResolutionError;
-    };
-    const fetchFn = async (input, init) => {
-        const request = input instanceof Request ? input : undefined;
-        const url = new URL(request ? request.url : String(input));
-        const combined = combineAbortSignals(signal, init?.signal ?? request?.signal, options.timeout === false ? undefined : AbortSignal.timeout(resolveOAuthRequestTimeoutMs()));
-        combined?.throwIfAborted();
-        throwIfHeaderResolutionFailed();
-        let serviceHeaders;
-        try {
-            serviceHeaders = url.origin === origin ? getHeaders() : new Headers();
-        }
-        catch {
-            headerResolutionError = new TypeError("Failed to resolve OAuth HTTP headers");
-            throw headerResolutionError;
-        }
-        const headers = new Headers(serviceHeaders);
-        new Headers(init?.headers ?? request?.headers).forEach((value, key) => headers.set(key, value));
-        const protectedRequest = [...serviceHeaders].length > 0;
-        try {
-            return await (options.delegate ?? globalThis.fetch)(input, {
-                ...init,
-                headers,
-                ...(combined ? { signal: combined } : {}),
-                ...(protectedRequest ? { redirect: "error" } : {}),
-            });
-        }
-        catch (error) {
-            combined?.throwIfAborted();
-            // Fetch failures also include DNS, TLS, and connection errors. Do not
-            // misdiagnose them as redirects or expose a potentially secret-bearing cause.
-            if (protectedRequest)
-                throw new TypeError("OAuth HTTP request failed");
-            throw error;
-        }
-    };
-    return Object.assign(fetchFn, { throwIfHeaderResolutionFailed });
-}
-/** Cache success or failure only in the owning auth leg/connection, never in storage. */
-export function oauthHeaderResolver(values, options = {}) {
-    const snapshot = values ? { ...values } : undefined;
-    let result;
-    return () => {
-        if (!result) {
-            try {
-                result = { headers: resolveOAuthHeaders(snapshot, options) };
-            }
-            catch (error) {
-                result = { error };
-            }
-        }
-        if ("error" in result)
-            throw result.error;
-        return result.headers;
-    };
-}
-//# sourceMappingURL=mcp-auth-fetch.js.map

package/node_modules/pi-mcp-adapter/dist/mcp-auth-fetch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-auth-fetch.js","sourceRoot":"","sources":["../mcp-auth-fetch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAS9E,MAAM,UAAU,mBAAmB,CAAC,MAA0C,EAAE,UAA8B,EAAE;IAC9G,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IACpD,IAAI,OAAO;QAAE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CACpF,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,wCAAwC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAE,CAAA;YAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAA;QACrG,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ;YACvB,CAAC,CAAC,2BAA2B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC;YAClE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,gCAAgC,GAAG,MAAM,CAAA;AAC/C,SAAS,4BAA4B;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;IAClE,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,aAAa;QAC1E,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAA;AAC/C,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,aAA4B,GAAG,EAAE,CAAC,IAAI,OAAO,EAAE,EAC/C,MAAoB,EACpB,UAAuD,EAAE;IAEzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAA;IACxC,IAAI,qBAA4C,CAAA;IAChD,MAAM,6BAA6B,GAAG,GAAG,EAAE;QACzC,IAAI,qBAAqB;YAAE,MAAM,qBAAqB,CAAA;IACxD,CAAC,CAAA;IACD,MAAM,OAAO,GAAc,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,EAC1E,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAA;QAC9F,QAAQ,EAAE,cAAc,EAAE,CAAA;QAC1B,6BAA6B,EAAE,CAAA;QAC/B,IAAI,cAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB,GAAG,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;YAC7E,MAAM,qBAAqB,CAAA;QAC7B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,cAAc,CAAC,CAAA;QAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QAC/F,MAAM,gBAAgB,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE;gBACzD,GAAG,IAAI;gBACP,OAAO;gBACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,EAAE,cAAc,EAAE,CAAA;YAC1B,sEAAsE;YACtE,8EAA8E;YAC9E,IAAI,gBAAgB;gBAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAA;YACtE,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,6BAA6B,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,MAA0C,EAAE,UAA+C,EAAE;IAC/H,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACnD,IAAI,MAA6D,CAAA;IACjE,OAAO,GAAG,EAAE;QACV,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,GAAG,EAAE,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAA;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,EAAE,KAAK,EAAE,CAAA;YACpB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,CAAA;QACzC,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC,CAAA;AACH,CAAC"}

package/node_modules/pi-mcp-adapter/dist/mcp-auth-flow.d.ts

@@ -1,118 +0,0 @@
-/**
- * MCP Auth Flow
- *
- * High-level OAuth flow management using the MCP SDK's built-in auth functions.
- */
-import { type McpOAuthConfig } from "./mcp-oauth-provider.ts";
-import { type AuthStorageOptions, type OAuthAuthority, type StoredTokens } from "./mcp-auth.ts";
-import { type ServerEntry } from "./types.ts";
-/** Auth status for a server */
-export type AuthStatus = "authenticated" | "expired" | "not_authenticated";
-export interface McpOAuthRuntime {
-    readonly signal: AbortSignal;
-}
-export interface AuthenticateOptions {
-    onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>;
-    openAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>;
-    onAuthorizationInput?: (authorizationUrl: string, signal: AbortSignal) => Promise<string | undefined>;
-    authStorageOptions?: AuthStorageOptions;
-    signal?: AbortSignal;
-    runtime?: McpOAuthRuntime;
-    skipIssuerMetadataValidation?: boolean;
-    definition?: Pick<ServerEntry, "headers" | "oauth">;
-}
-export declare function createOAuthRuntime(signal?: AbortSignal): McpOAuthRuntime;
-export declare function hasPendingAuth(serverName: string, options?: AuthStorageOptions, runtime?: McpOAuthRuntime): boolean;
-/**
- * Extract OAuth configuration from a ServerEntry.
- */
-export declare function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig;
-/**
- * Start OAuth authentication flow for a server.
- * Returns the authorization URL when browser authorization is required.
- */
-export declare function startAuth(serverName: string, serverUrl: string, definition?: ServerEntry, options?: AuthenticateOptions, operationAuthority?: OAuthAuthority): Promise<{
-    authorizationUrl: string;
-}>;
-/** Authorization code plus the optional RFC 9207 `iss` callback parameter. */
-export interface AuthorizationCodeInput {
-    code: string;
-    iss?: string;
-}
-/**
- * Extract an OAuth authorization code (and the RFC 9207 `iss` parameter, when
- * present) from either a raw code, a query string, or the full localhost
- * redirect URL copied from the browser address bar.
- */
-export declare function parseAuthorizationRedirectInput(input: string, expectedState?: string): AuthorizationCodeInput;
-/**
- * Extract an OAuth authorization code from either a raw code, a query string,
- * or the full localhost redirect URL copied from the browser address bar.
- */
-export declare function parseAuthorizationCodeInput(input: string, expectedState?: string): string;
-type AuthorizationResponse = {
-    input: AuthorizationCodeInput;
-    source: "callback" | "manual";
-};
-/**
- * Wait for either the localhost callback or a manually pasted redirect URL.
- * The manual input prompt is dismissed as soon as either path finishes.
- */
-export declare function waitForAuthorizationResponse(callbackPromise: Promise<AuthorizationCodeInput>, authorizationUrl: string, expectedState: string, onAuthorizationInput?: AuthenticateOptions["onAuthorizationInput"], signal?: AbortSignal): Promise<AuthorizationResponse>;
-/**
- * Complete OAuth authentication from manual user input.
- */
-export declare function completeAuthFromInput(serverName: string, input: string, options?: AuthenticateOptions): Promise<AuthStatus>;
-/**
- * Complete OAuth authentication with the authorization code.
- */
-export declare function completeAuth(serverName: string, authorizationCode: string | AuthorizationCodeInput, options?: AuthenticateOptions): Promise<AuthStatus>;
-/**
- * Perform the complete OAuth authentication flow for a server.
- *
- * @param serverName - The name of the MCP server
- * @param serverUrl - The URL of the MCP server
- * @param definition - The server definition (optional)
- * @returns The final auth status
- */
-export declare function authenticate(serverName: string, serverUrl: string, definition?: ServerEntry, options?: AuthenticateOptions): Promise<AuthStatus>;
-/**
- * Get a valid access token for a server, refreshing if necessary.
- *
- * @param serverName - The name of the MCP server
- * @param serverUrl - The URL of the MCP server
- * @returns The valid tokens or null if not authenticated
- */
-export declare function getValidToken(serverName: string, serverUrl: string, options?: AuthenticateOptions): Promise<StoredTokens | null>;
-/**
- * Check the authentication status for a server.
- *
- * @param serverName - The name of the MCP server
- * @returns The current auth status
- */
-export declare function getAuthStatus(serverName: string, options?: AuthenticateOptions): Promise<AuthStatus>;
-/**
- * Remove all OAuth credentials for a server.
- *
- * @param serverName - The name of the MCP server
- */
-export declare function removeAuth(serverName: string, options?: AuthenticateOptions): Promise<void>;
-/**
- * Check if OAuth is supported for a server configuration.
- * OAuth is supported for HTTP servers unless explicitly disabled.
- *
- * @param definition - The server definition
- * @returns True if OAuth is supported
- */
-export declare function supportsOAuth(definition: ServerEntry): boolean;
-/**
- * Initialize the OAuth system on startup.
- * OAuth callback binding is lazy and starts from startAuth() only.
- */
-export declare function initializeOAuth(runtimeOrSignal?: McpOAuthRuntime | AbortSignal): Promise<McpOAuthRuntime>;
-/**
- * Shutdown one OAuth runtime. The callback server remains process-shared while
- * another runtime has pending/reserved callback state or is still active.
- */
-export declare function shutdownOAuth(runtime?: McpOAuthRuntime): Promise<void>;
-export {};