@herbertgao/pi-extensions 2026.9.17 → 2026.9.19

package/node_modules/pi-mcp-adapter/dist/mcp-auth-flow.js

@@ -1,1097 +0,0 @@
-/**
- * MCP Auth Flow
- *
- * High-level OAuth flow management using the MCP SDK's built-in auth functions.
- */
-import { auth as runSdkAuth, extractWWWAuthenticateParams, LATEST_PROTOCOL_VERSION, UnauthorizedError, validateClientMetadataUrl, } from "@modelcontextprotocol/client";
-import open from "open";
-import { getOAuthCallbackPort, McpOAuthProvider, } from "./mcp-oauth-provider.js";
-import { ensureCallbackServer, waitForCallback, cancelPendingCallback, stopCallbackServer, stopCallbackServerIfIdle, releaseCallbackServer, } from "./mcp-callback-server.js";
-import { getAuthForUrl, getAuthEntry, clearAllCredentials, clearClientInfo, clearCodeVerifier, getOAuthState, clearOAuthState, getAuthBaseDir, beginOAuthRevocation, captureOAuthAuthority, OAuthCredentialStoreError, } from "./mcp-auth.js";
-import { isServerDisabled } from "./types.js";
-import { formatTerminalError, interpolateEnvVars } from "./utils.js";
-import { createOAuthFetch, oauthHeaderResolver, resolveOAuthHeaders } from "./mcp-auth-fetch.js";
-import { isBuiltInAgentPlugin } from "./agent-plugin-provenance.js";
-import { abortable, throwIfAborted } from "./abort.js";
-import { combineAbortSignals, isAbortError } from "./runtime-owner.js";
-function pluginAwareOAuthHeaders(definition) {
-    return oauthHeaderResolver(definition?.headers, {
-        literal: definition ? isBuiltInAgentPlugin(definition, "headers") : false,
-    });
-}
-function applyOAuthConfig(discovery, config) {
-    return {
-        ...discovery,
-        ...(config.scope !== undefined ? { scope: config.scope } : {}),
-        ...(config.skipIssuerMetadataValidation === true ? { skipIssuerMetadataValidation: true } : {}),
-    };
-}
-const runtimeStates = new WeakMap();
-const activeRuntimes = new Set();
-export function createOAuthRuntime(signal) {
-    const controller = new AbortController();
-    const runtime = { signal: combineAbortSignals(signal, controller.signal) };
-    runtimeStates.set(runtime, {
-        controller,
-        generation: 0,
-        pendingAuths: new Map(),
-        pendingAuthStates: new Map(),
-        pendingAuthCleanupTimers: new Map(),
-        pendingAuthentications: new Map(),
-    });
-    activeRuntimes.add(runtime);
-    return runtime;
-}
-let legacyRuntime = createOAuthRuntime();
-activeRuntimes.delete(legacyRuntime);
-function getRuntime(options) {
-    if (options?.runtime) {
-        options.runtime.signal.throwIfAborted();
-        activeRuntimes.add(options.runtime);
-        return options.runtime;
-    }
-    if (legacyRuntime.signal.aborted)
-        legacyRuntime = createOAuthRuntime();
-    activeRuntimes.add(legacyRuntime);
-    return legacyRuntime;
-}
-function getRuntimeState(runtime) {
-    const state = runtimeStates.get(runtime);
-    if (!state)
-        throw new Error("Unknown OAuth runtime");
-    return state;
-}
-function getAuthStorageIdentity(options) {
-    return options.credentialStore === "encrypted-file"
-        ? ["encrypted-file"]
-        : ["os", getAuthBaseDir(options)];
-}
-function getPendingAuthKey(serverName, options) {
-    return JSON.stringify([serverName, ...getAuthStorageIdentity(options)]);
-}
-function hasOAuthAuthority(authority) {
-    try {
-        authority();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function hasPendingAuth(serverName, options, runtime) {
-    const state = getRuntimeState(runtime ?? legacyRuntime);
-    if (options) {
-        return state.pendingAuths.has(getPendingAuthKey(serverName, options));
-    }
-    return Array.from(state.pendingAuths.values()).some(pendingAuth => pendingAuth.serverName === serverName);
-}
-/** Timeout for manual auth completion (5 minutes) */
-const MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
-/**
- * Generate a cryptographically secure random state parameter.
- */
-function generateState() {
-    return Array.from(crypto.getRandomValues(new Uint8Array(32)))
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-}
-/**
- * Extract OAuth configuration from a ServerEntry.
- */
-export function extractOAuthConfig(definition) {
-    if (definition.oauth === false) {
-        return {};
-    }
-    const config = {};
-    if (definition.oauth?.grantType !== undefined)
-        config.grantType = definition.oauth.grantType;
-    if (definition.oauth?.clientId !== undefined) {
-        if (typeof definition.oauth.clientId !== "string")
-            throw new Error("OAuth clientId must be a string");
-        config.clientId = interpolateEnvVars(definition.oauth.clientId);
-    }
-    if (definition.oauth?.clientSecret !== undefined) {
-        if (typeof definition.oauth.clientSecret !== "string")
-            throw new Error("OAuth clientSecret must be a string");
-        // Preserve command expressions for the provider; interpolation remains eager for ordinary values.
-        config.clientSecret = definition.oauth.clientSecret.startsWith("!")
-            ? definition.oauth.clientSecret
-            : interpolateEnvVars(definition.oauth.clientSecret);
-    }
-    if (definition.oauth?.clientMetadataUrl !== undefined) {
-        if (typeof definition.oauth.clientMetadataUrl !== "string") {
-            throw new Error("OAuth clientMetadataUrl must be a string");
-        }
-        const clientMetadataUrl = interpolateEnvVars(definition.oauth.clientMetadataUrl).trim();
-        if (!clientMetadataUrl) {
-            throw new Error("OAuth clientMetadataUrl must not be empty");
-        }
-        validateClientMetadataUrl(clientMetadataUrl);
-        config.clientMetadataUrl = clientMetadataUrl;
-    }
-    if (config.clientMetadataUrl !== undefined && config.clientSecret !== undefined && !config.clientId) {
-        throw new Error("OAuth clientSecret requires an explicit clientId when clientMetadataUrl is configured");
-    }
-    if (definition.oauth?.scope !== undefined) {
-        if (typeof definition.oauth.scope !== "string")
-            throw new Error("OAuth scope must be a string");
-        config.scope = interpolateEnvVars(definition.oauth.scope);
-    }
-    if (definition.oauth?.authorizationParams !== undefined) {
-        const params = definition.oauth.authorizationParams;
-        if (!params || typeof params !== "object" || Array.isArray(params)) {
-            throw new Error("OAuth authorizationParams must be an object");
-        }
-        config.authorizationParams = {};
-        for (const [key, value] of Object.entries(params)) {
-            if (!key)
-                throw new Error("OAuth authorizationParams keys must not be empty");
-            if (typeof value !== "string")
-                throw new Error(`OAuth authorizationParams.${key} must be a string`);
-            config.authorizationParams[key] = interpolateEnvVars(value);
-        }
-    }
-    if (definition.oauth?.redirectUri !== undefined) {
-        if (typeof definition.oauth.redirectUri !== "string") {
-            throw new Error("OAuth redirectUri must be a string");
-        }
-        const redirectUri = interpolateEnvVars(definition.oauth.redirectUri).trim();
-        if (!redirectUri) {
-            throw new Error("OAuth redirectUri must not be empty");
-        }
-        config.redirectUri = redirectUri;
-    }
-    if (definition.oauth?.clientName !== undefined) {
-        if (typeof definition.oauth.clientName !== "string") {
-            throw new Error("OAuth clientName must be a string");
-        }
-        const clientName = interpolateEnvVars(definition.oauth.clientName).trim();
-        if (!clientName) {
-            throw new Error("OAuth clientName must not be empty");
-        }
-        config.clientName = clientName;
-    }
-    if (definition.oauth?.clientUri !== undefined) {
-        if (typeof definition.oauth.clientUri !== "string") {
-            throw new Error("OAuth clientUri must be a string");
-        }
-        const clientUri = interpolateEnvVars(definition.oauth.clientUri).trim();
-        if (!clientUri) {
-            throw new Error("OAuth clientUri must not be empty");
-        }
-        config.clientUri = clientUri;
-    }
-    if (definition.oauth?.logoUri !== undefined) {
-        if (typeof definition.oauth.logoUri !== "string") {
-            throw new Error("OAuth logoUri must be a string");
-        }
-        const logoUri = interpolateEnvVars(definition.oauth.logoUri).trim();
-        if (!logoUri) {
-            throw new Error("OAuth logoUri must not be empty");
-        }
-        // Consent screens fetch this server-side, so a local path silently renders
-        // nothing. Fail here instead, where the message can say why.
-        let parsed;
-        try {
-            parsed = new URL(logoUri);
-        }
-        catch {
-            throw new Error("OAuth logoUri must be an absolute http(s) URL");
-        }
-        if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-            throw new Error("OAuth logoUri must be an absolute http(s) URL");
-        }
-        config.logoUri = logoUri;
-    }
-    if (definition.oauth?.authServerMetadataUrl !== undefined) {
-        if (typeof definition.oauth.authServerMetadataUrl !== "string") {
-            throw new Error("OAuth authServerMetadataUrl must be a string");
-        }
-        const authServerMetadataUrl = interpolateEnvVars(definition.oauth.authServerMetadataUrl).trim();
-        if (!authServerMetadataUrl) {
-            throw new Error("OAuth authServerMetadataUrl must not be empty");
-        }
-        let parsed;
-        try {
-            parsed = new URL(authServerMetadataUrl);
-        }
-        catch {
-            throw new Error("OAuth authServerMetadataUrl must be an absolute https:// URL");
-        }
-        if (parsed.protocol !== "https:") {
-            throw new Error("OAuth authServerMetadataUrl must be an absolute https:// URL");
-        }
-        config.authServerMetadataUrl = authServerMetadataUrl;
-    }
-    if (definition.oauth?.skipIssuerMetadataValidation !== undefined) {
-        if (typeof definition.oauth.skipIssuerMetadataValidation !== "boolean") {
-            throw new Error("OAuth skipIssuerMetadataValidation must be a boolean");
-        }
-        config.skipIssuerMetadataValidation = definition.oauth.skipIssuerMetadataValidation;
-    }
-    return config;
-}
-async function probeAuthDiscovery(serverUrl, definition, signal) {
-    // The preliminary probe is command-free; real SDK discovery resolves commands.
-    const serviceHeaders = resolveOAuthHeaders(definition?.headers, {
-        commands: false,
-        literal: definition ? isBuiltInAgentPlugin(definition, "headers") : false,
-    });
-    const probeFetch = createOAuthFetch(serverUrl, () => serviceHeaders, signal, { timeout: false });
-    const headers = new Headers({ "content-type": "application/json" });
-    const controller = new AbortController();
-    const discoverySignal = combineAbortSignals(signal, controller.signal);
-    const timer = setTimeout(() => controller.abort(), 5000);
-    try {
-        headers.set("accept", "application/json, text/event-stream");
-        const response = await probeFetch(new URL(serverUrl), {
-            method: "POST",
-            headers,
-            body: JSON.stringify({
-                jsonrpc: "2.0",
-                id: 0,
-                method: "initialize",
-                params: {
-                    protocolVersion: LATEST_PROTOCOL_VERSION,
-                    capabilities: {},
-                    clientInfo: { name: "pi-mcp-adapter", version: "2.11.0" },
-                },
-            }),
-            ...(discoverySignal ? { signal: discoverySignal } : {}),
-        });
-        const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
-        await response.body?.cancel().catch(() => { });
-        return { ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}), ...(scope ? { scope } : {}) };
-    }
-    catch (error) {
-        if (signal?.aborted)
-            throwIfAborted(signal);
-        return {};
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-function parseOAuthRedirectUri(redirectUri) {
-    const dynamicPortPlaceholder = "{port}";
-    const placeholderCount = redirectUri.split(dynamicPortPlaceholder).length - 1;
-    if (placeholderCount > 1) {
-        throw new Error("OAuth redirectUri may contain at most one {port} placeholder");
-    }
-    let parsedRedirectUri = redirectUri;
-    const dynamicPort = placeholderCount === 1;
-    if (dynamicPort) {
-        const authorityStart = redirectUri.indexOf("://") + 3;
-        const pathStart = redirectUri.slice(authorityStart).search(/[/?#]/);
-        const authorityEnd = pathStart === -1 ? redirectUri.length : authorityStart + pathStart;
-        const authority = redirectUri.slice(authorityStart, authorityEnd);
-        if (authorityStart < 3 || !authority.endsWith(`:${dynamicPortPlaceholder}`)) {
-            throw new Error("OAuth redirectUri {port} placeholder must be the loopback URI port");
-        }
-        // Parse with a real port, then replace the placeholder only after the OS
-        // assigns the callback listener's port.
-        parsedRedirectUri = redirectUri.replace(dynamicPortPlaceholder, "1");
-    }
-    let url;
-    try {
-        url = new URL(parsedRedirectUri);
-    }
-    catch (error) {
-        throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error });
-    }
-    if (url.username || url.password) {
-        throw new Error("OAuth redirectUri must not include username or password");
-    }
-    if (url.hash) {
-        throw new Error("OAuth redirectUri must not include a fragment");
-    }
-    const hostname = url.hostname.toLowerCase();
-    const isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
-    if (dynamicPort && (url.protocol !== "http:" || !isLocalhost)) {
-        throw new Error("OAuth redirectUri {port} placeholder is allowed only for an http:// localhost or loopback URI");
-    }
-    if (url.port) {
-        const parsedPort = Number.parseInt(url.port, 10);
-        if (!Number.isInteger(parsedPort) || parsedPort <= 0 || parsedPort > 65535) {
-            throw new Error("OAuth redirectUri port must be a positive numeric port");
-        }
-    }
-    if (url.protocol === "https:" && !isLocalhost) {
-        return { mode: "manual" };
-    }
-    if (url.protocol !== "http:" || !isLocalhost) {
-        throw new Error("OAuth redirectUri must be an https:// URI or an http:// localhost or loopback URI");
-    }
-    if (!url.port) {
-        throw new Error("OAuth localhost redirectUri must include an explicit numeric port");
-    }
-    const port = Number.parseInt(url.port, 10);
-    const callbackHost = hostname === "[::1]" ? "::1" : hostname;
-    return {
-        mode: "local",
-        ...(dynamicPort ? {} : { port }),
-        callbackHost,
-        callbackPath: url.pathname,
-        dynamicPort,
-        resolveRedirectUri: assignedPort => dynamicPort
-            ? redirectUri.replace(dynamicPortPlaceholder, String(assignedPort))
-            : redirectUri,
-    };
-}
-/**
- * Start OAuth authentication flow for a server.
- * Returns the authorization URL when browser authorization is required.
- */
-export async function startAuth(serverName, serverUrl, definition, options = {}, operationAuthority) {
-    if (isServerDisabled(definition))
-        throw new Error(`MCP server "${serverName}" is disabled`);
-    const authority = operationAuthority ?? captureOAuthAuthority(serverName);
-    authority();
-    const runtime = getRuntime(options);
-    const runtimeState = getRuntimeState(runtime);
-    const config = definition ? extractOAuthConfig(definition) : {};
-    const authStorageOptions = options.authStorageOptions ?? {};
-    const signal = combineAbortSignals(runtime.signal, options.signal);
-    const generation = runtimeState.generation;
-    throwIfAborted(signal);
-    if (config.grantType === "client_credentials") {
-        const storedAuth = await getAuthForUrl(serverName, serverUrl, authStorageOptions);
-        authority();
-        if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {
-            clearClientInfo(serverName, authStorageOptions);
-            clearCodeVerifier(serverName, authStorageOptions);
-            clearOAuthState(serverName, authStorageOptions);
-        }
-        authority();
-        const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
-            onRedirect: async () => {
-                throw new Error("Browser redirect is not used for client_credentials flow");
-            },
-        }, authStorageOptions, runtime.signal, undefined, authority);
-        try {
-            const fetchFn = createOAuthFetch(serverUrl, pluginAwareOAuthHeaders(definition), signal);
-            authProvider.setAuthFetch(fetchFn);
-            const discovery = applyOAuthConfig(await probeAuthDiscovery(serverUrl, definition, signal), config);
-            authority();
-            throwIfAborted(signal);
-            const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery, fetchFn }), signal);
-            authority();
-            throwIfAborted(signal);
-            if (result !== "AUTHORIZED") {
-                throw new UnauthorizedError("Failed to authorize");
-            }
-            return { authorizationUrl: "" };
-        }
-        finally {
-            authProvider.deactivate();
-        }
-    }
-    const existingPendingAuth = runtimeState.pendingAuths.get(getPendingAuthKey(serverName, authStorageOptions));
-    if (existingPendingAuth?.serverUrl === serverUrl) {
-        existingPendingAuth.authority();
-        return { authorizationUrl: existingPendingAuth.authorizationUrl };
-    }
-    const redirectTarget = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined;
-    const manualRedirect = redirectTarget?.mode === "manual";
-    const oauthState = generateState();
-    if (!manualRedirect) {
-        try {
-            await ensureCallbackServer({
-                strictPort: redirectTarget?.mode === "local"
-                    ? !redirectTarget.dynamicPort
-                    : Boolean(config.clientId),
-                oauthState,
-                reserveState: true,
-                ...(redirectTarget?.mode === "local"
-                    ? {
-                        ...(redirectTarget.port !== undefined ? { port: redirectTarget.port } : {}),
-                        callbackHost: redirectTarget.callbackHost,
-                        callbackPath: redirectTarget.callbackPath,
-                    }
-                    : {}),
-            });
-            authority();
-            throwIfAborted(signal);
-            if (redirectTarget?.mode === "local" && redirectTarget.dynamicPort) {
-                config.redirectUri = redirectTarget.resolveRedirectUri(getOAuthCallbackPort());
-            }
-        }
-        catch (error) {
-            releaseCallbackServer(oauthState);
-            try {
-                await cleanupAndReleaseCallbackServerIfIdle(() => {
-                    if (hasOAuthAuthority(authority))
-                        clearOAuthState(serverName, authStorageOptions);
-                });
-            }
-            catch (cleanupError) {
-                throw new AggregateError([error, cleanupError], "OAuth startup cleanup failed");
-            }
-            throw error;
-        }
-    }
-    let capturedUrl;
-    authority();
-    const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
-        onRedirect: async (url) => {
-            capturedUrl = url;
-        },
-    }, authStorageOptions, runtime.signal, oauthState, authority);
-    try {
-        const storedAuth = await getAuthForUrl(serverName, serverUrl, authStorageOptions);
-        authority();
-        if (storedAuth?.clientInfo && !config.clientId) {
-            if (!storedAuth.tokens) {
-                clearClientInfo(serverName, authStorageOptions);
-                clearCodeVerifier(serverName, authStorageOptions);
-                clearOAuthState(serverName, authStorageOptions);
-            }
-            else {
-                const redirectUris = storedAuth.clientInfo.redirectUris;
-                const redirectUriMatches = Array.isArray(redirectUris)
-                    && redirectUris.includes(authProvider.redirectUrl ?? "");
-                if (!redirectUriMatches && !storedAuth.tokens.refreshToken) {
-                    // A stale redirect URI only blocks the interactive leg; refresh does
-                    // not send redirect_uri, so keep refresh-capable credentials intact.
-                    clearClientInfo(serverName, authStorageOptions);
-                    clearCodeVerifier(serverName, authStorageOptions);
-                    clearOAuthState(serverName, authStorageOptions);
-                }
-            }
-        }
-        throwIfAborted(signal);
-        const getHeaders = pluginAwareOAuthHeaders(definition);
-        const fetchFn = createOAuthFetch(serverUrl, getHeaders, signal);
-        authProvider.setAuthFetch(fetchFn);
-        const discovery = applyOAuthConfig(await probeAuthDiscovery(serverUrl, definition, signal), config);
-        authority();
-        throwIfAborted(signal);
-        const result = await abortable(runSdkAuth(authProvider, { serverUrl, ...discovery, fetchFn }), signal);
-        authority();
-        throwIfAborted(signal);
-        if (result === "AUTHORIZED") {
-            authProvider.deactivate();
-            releaseCallbackServer(oauthState);
-            clearOAuthState(serverName, authStorageOptions);
-            await stopCallbackServerIfIdle();
-            authority();
-            return { authorizationUrl: "" };
-        }
-        if (!capturedUrl) {
-            throw new UnauthorizedError("OAuth authorization URL was not provided");
-        }
-        await setPendingAuth(runtime, serverName, {
-            serverName,
-            authProvider,
-            serverUrl,
-            authorizationUrl: capturedUrl.toString(),
-            manualRedirect,
-            ...(manualRedirect ? { manualCompletionController: new AbortController() } : {}),
-            discovery,
-            getHeaders,
-            authStorageOptions,
-            authority,
-        }, oauthState, signal, generation);
-        authority();
-        return { authorizationUrl: capturedUrl.toString() };
-    }
-    catch (error) {
-        authProvider.deactivate();
-        try {
-            await clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, authStorageOptions);
-        }
-        catch (cleanupError) {
-            throw new AggregateError([error, cleanupError], "OAuth startup cleanup failed");
-        }
-        throw error;
-    }
-}
-async function setPendingAuth(runtime, serverName, pendingAuth, oauthState, signal, generation = getRuntimeState(runtime).generation) {
-    const state = getRuntimeState(runtime);
-    const key = getPendingAuthKey(serverName, pendingAuth.authStorageOptions);
-    pendingAuth.authority();
-    await clearPendingAuth(runtime, serverName, undefined, pendingAuth.authStorageOptions);
-    pendingAuth.authority();
-    throwIfAborted(signal);
-    if (generation !== state.generation)
-        throw new Error("OAuth runtime stopped");
-    state.pendingAuths.set(key, pendingAuth);
-    state.pendingAuthStates.set(key, oauthState);
-    const cleanupTimer = setTimeout(() => {
-        void clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, pendingAuth.authStorageOptions, new Error("OAuth authorization timeout - authorization took too long")).catch(error => {
-            console.error(`MCP Auth: Timed-out flow cleanup failed: ${formatTerminalError(error)}`);
-        });
-    }, MANUAL_AUTH_TIMEOUT_MS);
-    cleanupTimer.unref?.();
-    state.pendingAuthCleanupTimers.set(key, cleanupTimer);
-}
-async function clearPendingAuth(runtime, serverName, oauthState, fallbackStorageOptions = {}, reason = new Error("Authorization cancelled")) {
-    const state = getRuntimeState(runtime);
-    const key = getPendingAuthKey(serverName, fallbackStorageOptions);
-    const pendingState = state.pendingAuthStates.get(key);
-    if (oauthState && pendingState !== oauthState) {
-        cancelPendingCallback(oauthState);
-        return;
-    }
-    const { pendingAuth } = detachPending(state, key, reason);
-    const authStorageOptions = pendingAuth?.authStorageOptions ?? fallbackStorageOptions;
-    const stateToRelease = pendingState ?? oauthState;
-    if (stateToRelease) {
-        if (!pendingState)
-            cancelPendingCallback(stateToRelease);
-        if (pendingAuth && hasOAuthAuthority(pendingAuth.authority)) {
-            const storedState = getOAuthState(serverName, authStorageOptions);
-            if (storedState === stateToRelease)
-                clearOAuthState(serverName, authStorageOptions);
-        }
-    }
-}
-function detachPending(state, key, reason) {
-    const pendingAuth = state.pendingAuths.get(key);
-    const oauthState = state.pendingAuthStates.get(key);
-    const timer = state.pendingAuthCleanupTimers.get(key);
-    if (timer)
-        clearTimeout(timer);
-    state.pendingAuthCleanupTimers.delete(key);
-    state.pendingAuths.delete(key);
-    state.pendingAuthStates.delete(key);
-    pendingAuth?.manualCompletionController?.abort(reason);
-    pendingAuth?.authProvider.deactivate();
-    if (oauthState)
-        cancelPendingCallback(oauthState);
-    return { pendingAuth, oauthState };
-}
-async function clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, fallbackStorageOptions = {}, reason) {
-    await cleanupAndReleaseCallbackServerIfIdle(() => clearPendingAuth(runtime, serverName, oauthState, fallbackStorageOptions, reason));
-}
-async function cleanupAndReleaseCallbackServerIfIdle(cleanup) {
-    let cleanupFailure;
-    try {
-        await cleanup();
-    }
-    catch (error) {
-        cleanupFailure = { error };
-    }
-    try {
-        await stopCallbackServerIfIdle();
-    }
-    catch (releaseError) {
-        if (cleanupFailure) {
-            throw new AggregateError([cleanupFailure.error, releaseError], "OAuth callback cleanup failed");
-        }
-        throw releaseError;
-    }
-    if (cleanupFailure)
-        throw cleanupFailure.error;
-}
-function detachPendingAuthsForServer(serverName, reason) {
-    for (const runtime of activeRuntimes) {
-        const state = getRuntimeState(runtime);
-        for (const [key, pendingAuth] of state.pendingAuths) {
-            if (pendingAuth.serverName !== serverName)
-                continue;
-            if (state.pendingAuths.get(key) !== pendingAuth)
-                continue;
-            detachPending(state, key, reason);
-        }
-    }
-}
-function getSearchParamsFromInput(input) {
-    try {
-        const url = new URL(input);
-        const params = new URLSearchParams(url.search);
-        if (url.hash) {
-            const hash = url.hash.startsWith("#") ? url.hash.slice(1) : url.hash;
-            const hashParams = new URLSearchParams(hash);
-            for (const [key, value] of hashParams) {
-                if (!params.has(key))
-                    params.set(key, value);
-            }
-        }
-        return params;
-    }
-    catch {
-        const query = input.includes("?") ? input.slice(input.indexOf("?") + 1) : input;
-        const params = new URLSearchParams(query.startsWith("#") ? query.slice(1) : query);
-        return params.has("code") || params.has("state") || params.has("error") ? params : undefined;
-    }
-}
-/**
- * Extract an OAuth authorization code (and the RFC 9207 `iss` parameter, when
- * present) from either a raw code, a query string, or the full localhost
- * redirect URL copied from the browser address bar.
- */
-export function parseAuthorizationRedirectInput(input, expectedState) {
-    const trimmed = input.trim();
-    if (!trimmed) {
-        throw new Error("Authorization code or redirect URL is required");
-    }
-    const params = getSearchParamsFromInput(trimmed);
-    if (params) {
-        const error = params.get("error");
-        if (error) {
-            const description = params.get("error_description");
-            throw new Error(description ? `${error}: ${description}` : error);
-        }
-        const state = params.get("state");
-        if (expectedState && !state) {
-            throw new Error("OAuth state missing from redirect URL");
-        }
-        if (expectedState && state !== expectedState) {
-            throw new Error("OAuth state mismatch - potential CSRF attack");
-        }
-        const code = params.get("code");
-        if (code) {
-            const iss = params.get("iss");
-            return { code, ...(iss !== null ? { iss } : {}) };
-        }
-    }
-    if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {
-        return { code: trimmed };
-    }
-    throw new Error("Could not find an OAuth authorization code in the provided input");
-}
-/**
- * Extract an OAuth authorization code from either a raw code, a query string,
- * or the full localhost redirect URL copied from the browser address bar.
- */
-export function parseAuthorizationCodeInput(input, expectedState) {
-    return parseAuthorizationRedirectInput(input, expectedState).code;
-}
-function waitForManualCompletionCancellation(signal) {
-    return new Promise((_, reject) => {
-        const rejectFromSignal = () => {
-            reject(signal.reason instanceof Error ? signal.reason : new Error("Authorization cancelled"));
-        };
-        if (signal.aborted) {
-            rejectFromSignal();
-            return;
-        }
-        signal.addEventListener("abort", rejectFromSignal, { once: true });
-    });
-}
-/**
- * Wait for either the localhost callback or a manually pasted redirect URL.
- * The manual input prompt is dismissed as soon as either path finishes.
- */
-export async function waitForAuthorizationResponse(callbackPromise, authorizationUrl, expectedState, onAuthorizationInput, signal) {
-    if (!onAuthorizationInput) {
-        return {
-            input: await abortable(callbackPromise, signal),
-            source: "callback",
-        };
-    }
-    const inputController = new AbortController();
-    try {
-        const response = await abortable(Promise.race([
-            callbackPromise.then((input) => ({ input, source: "callback" })),
-            onAuthorizationInput(authorizationUrl, inputController.signal).then((input) => ({
-                input,
-                source: "manual",
-            })),
-        ]), signal);
-        if (response.source === "callback")
-            return response;
-        if (!response.input?.trim())
-            throw new Error("OAuth authentication cancelled");
-        if (!getSearchParamsFromInput(response.input.trim())) {
-            throw new Error("Paste the full OAuth callback URL, including its code and state parameters");
-        }
-        return {
-            input: parseAuthorizationRedirectInput(response.input, expectedState),
-            source: "manual",
-        };
-    }
-    finally {
-        inputController.abort();
-    }
-}
-/**
- * Complete OAuth authentication from manual user input.
- */
-export async function completeAuthFromInput(serverName, input, options = {}) {
-    const runtime = getRuntime(options);
-    const runtimeState = getRuntimeState(runtime);
-    const fallbackAuthStorageOptions = options.authStorageOptions ?? {};
-    const signal = combineAbortSignals(runtime.signal, options.signal);
-    throwIfAborted(signal);
-    const key = getPendingAuthKey(serverName, fallbackAuthStorageOptions);
-    const oauthState = runtimeState.pendingAuthStates.get(key);
-    const pendingAuth = runtimeState.pendingAuths.get(key);
-    throwIfAborted(signal);
-    if (pendingAuth?.manualRedirect && !getSearchParamsFromInput(input.trim())) {
-        throw new Error("Paste the full OAuth callback URL, including its code and state parameters");
-    }
-    const parsed = parseAuthorizationRedirectInput(input, oauthState);
-    return completeAuth(serverName, parsed, options);
-}
-/**
- * Complete OAuth authentication with the authorization code.
- */
-export async function completeAuth(serverName, authorizationCode, options = {}) {
-    const runtime = getRuntime(options);
-    const runtimeState = getRuntimeState(runtime);
-    const { code, iss } = typeof authorizationCode === "string"
-        ? { code: authorizationCode, iss: undefined }
-        : authorizationCode;
-    const fallbackAuthStorageOptions = options.authStorageOptions ?? {};
-    const signal = combineAbortSignals(runtime.signal, options.signal);
-    throwIfAborted(signal);
-    const key = getPendingAuthKey(serverName, fallbackAuthStorageOptions);
-    const pendingAuth = runtimeState.pendingAuths.get(key);
-    const authStorageOptions = pendingAuth?.authStorageOptions ?? fallbackAuthStorageOptions;
-    if (!pendingAuth) {
-        throw new Error(`No pending OAuth flow for server: ${serverName}`);
-    }
-    pendingAuth.authority();
-    const oauthState = runtimeState.pendingAuthStates.get(key);
-    throwIfAborted(signal);
-    let keepPendingForRetry = false;
-    let caughtError;
-    try {
-        const fetchFn = createOAuthFetch(pendingAuth.serverUrl, pendingAuth.getHeaders, signal);
-        pendingAuth.authProvider.setAuthFetch(fetchFn);
-        const discoveryState = await pendingAuth.authProvider.discoveryState();
-        pendingAuth.authority();
-        const metadata = discoveryState?.authorizationServerMetadata;
-        const expectedIssuer = metadata?.issuer ?? discoveryState?.authorizationServerUrl;
-        const requiresIssuer = metadata
-            ?.authorization_response_iss_parameter_supported === true;
-        if (expectedIssuer !== undefined && iss === undefined && requiresIssuer) {
-            keepPendingForRetry = true;
-            throw new Error(`The authorization server for ${serverName} requires the RFC 9207 "iss" parameter. ` +
-                "Paste the full redirect URL from the browser address bar (not just the authorization code).");
-        }
-        if (expectedIssuer !== undefined && iss !== undefined && iss !== expectedIssuer) {
-            throw new Error(`The OAuth authorization response issuer does not match the discovered issuer for ${serverName}.`);
-        }
-        const result = await abortable(runSdkAuth(pendingAuth.authProvider, {
-            serverUrl: pendingAuth.serverUrl,
-            authorizationCode: code,
-            ...(iss !== undefined ? { iss } : {}),
-            ...pendingAuth.discovery,
-            fetchFn,
-        }), signal);
-        pendingAuth.authority();
-        throwIfAborted(signal);
-        if (result !== "AUTHORIZED") {
-            throw new UnauthorizedError("Failed to authorize");
-        }
-        return "authenticated";
-    }
-    catch (error) {
-        caughtError = error;
-        throw error;
-    }
-    finally {
-        if (!keepPendingForRetry) {
-            try {
-                await clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, authStorageOptions);
-            }
-            catch (cleanupError) {
-                if (caughtError !== undefined) {
-                    throw new AggregateError([caughtError, cleanupError], "OAuth completion cleanup failed");
-                }
-                throw cleanupError;
-            }
-            if (caughtError === undefined)
-                pendingAuth.authority();
-        }
-    }
-}
-/**
- * Perform the complete OAuth authentication flow for a server.
- *
- * @param serverName - The name of the MCP server
- * @param serverUrl - The URL of the MCP server
- * @param definition - The server definition (optional)
- * @returns The final auth status
- */
-export async function authenticate(serverName, serverUrl, definition, options = {}) {
-    if (isServerDisabled(definition))
-        throw new Error(`MCP server "${serverName}" is disabled`);
-    const authority = captureOAuthAuthority(serverName);
-    const runtime = getRuntime(options);
-    const runtimeState = getRuntimeState(runtime);
-    const authStorageOptions = options.authStorageOptions ?? {};
-    const signal = combineAbortSignals(runtime.signal, options.signal);
-    throwIfAborted(signal);
-    const authKey = JSON.stringify([serverName, serverUrl, ...getAuthStorageIdentity(authStorageOptions)]);
-    const inFlight = runtimeState.pendingAuthentications.get(authKey);
-    if (inFlight) {
-        try {
-            inFlight.authority();
-            return inFlight.promise;
-        }
-        catch {
-            if (runtimeState.pendingAuthentications.get(authKey) === inFlight) {
-                runtimeState.pendingAuthentications.delete(authKey);
-            }
-        }
-    }
-    const operation = (async () => {
-        const { authorizationUrl } = await startAuth(serverName, serverUrl, definition, {
-            ...options,
-            ...(signal ? { signal } : {}),
-            runtime,
-        }, authority);
-        authority();
-        if (!authorizationUrl) {
-            return "authenticated";
-        }
-        let oauthState;
-        try {
-            // Get the state that was already generated and stored in startAuth().
-            // Keep this lookup and its abort check inside the cleanup boundary because
-            // startAuth already owns the pending flow at this point.
-            oauthState = runtimeState.pendingAuthStates.get(getPendingAuthKey(serverName, authStorageOptions));
-            throwIfAborted(signal);
-            if (!oauthState) {
-                throw new Error("OAuth state not found - this should not happen");
-            }
-            const pendingAuth = runtimeState.pendingAuths.get(getPendingAuthKey(serverName, authStorageOptions));
-            if (!pendingAuth) {
-                throw new Error(`No pending OAuth flow for server: ${serverName}`);
-            }
-            if (pendingAuth.manualRedirect && !options.onAuthorizationInput) {
-                throw new Error(`OAuth for ${serverName} uses a remote redirect URI. Complete it with auth-start/auth-complete or /mcp-auth.`);
-            }
-            // Register the localhost callback before opening the browser. Remote
-            // pre-registered callbacks are completed by pasting their full URL.
-            const callbackPromise = pendingAuth.manualRedirect
-                ? waitForManualCompletionCancellation(pendingAuth.manualCompletionController.signal)
-                : waitForCallback(oauthState);
-            void callbackPromise.catch(() => { });
-            // Open browser. Always surface the URL first so remote/headless users can copy it
-            // even when the OS browser handoff is unavailable or invisible.
-            if (options.onAuthorizationUrl) {
-                await abortable(Promise.resolve(options.onAuthorizationUrl(authorizationUrl)), signal);
-            }
-            else {
-                console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\n${authorizationUrl}`);
-            }
-            try {
-                await abortable(Promise.resolve(options.openAuthorizationUrl
-                    ? options.openAuthorizationUrl(authorizationUrl)
-                    : open(authorizationUrl)), signal);
-            }
-            catch (error) {
-                if (isAbortError(error, signal))
-                    throw error;
-                console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
-            }
-            const authorizationResponse = await waitForAuthorizationResponse(callbackPromise, authorizationUrl, oauthState, options.onAuthorizationInput, signal);
-            if (authorizationResponse.source === "manual") {
-                cancelPendingCallback(oauthState);
-            }
-            // The callback server accepted only the flow-local reserved state. Manual
-            // input is checked against the same state before token exchange.
-            throwIfAborted(signal);
-            return await completeAuth(serverName, authorizationResponse.input, {
-                ...options,
-                ...(signal ? { signal } : {}),
-                runtime,
-            });
-        }
-        catch (error) {
-            if (oauthState)
-                cancelPendingCallback(oauthState);
-            try {
-                await clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, authStorageOptions);
-            }
-            catch (cleanupError) {
-                throw new AggregateError([error, cleanupError], "OAuth cancellation cleanup failed");
-            }
-            throw error;
-        }
-    })();
-    const pendingAuthentication = { promise: operation, authority };
-    runtimeState.pendingAuthentications.set(authKey, pendingAuthentication);
-    try {
-        const result = await operation;
-        authority();
-        return result;
-    }
-    finally {
-        if (runtimeState.pendingAuthentications.get(authKey) === pendingAuthentication) {
-            runtimeState.pendingAuthentications.delete(authKey);
-        }
-    }
-}
-/**
- * Get a valid access token for a server, refreshing if necessary.
- *
- * @param serverName - The name of the MCP server
- * @param serverUrl - The URL of the MCP server
- * @returns The valid tokens or null if not authenticated
- */
-export async function getValidToken(serverName, serverUrl, options = {}) {
-    const authority = captureOAuthAuthority(serverName);
-    const runtime = getRuntime(options);
-    const authStorageOptions = options.authStorageOptions ?? {};
-    const signal = combineAbortSignals(runtime.signal, options.signal);
-    throwIfAborted(signal);
-    const entry = await getAuthForUrl(serverName, serverUrl, authStorageOptions);
-    if (!hasOAuthAuthority(authority))
-        return null;
-    throwIfAborted(signal);
-    if (!entry?.tokens) {
-        return null;
-    }
-    const expired = entry.tokens.expiresAt
-        ? entry.tokens.expiresAt < Date.now() / 1000
-        : false;
-    if (expired === false) {
-        authority();
-        return entry.tokens;
-    }
-    if (expired === true && entry.tokens.refreshToken) {
-        console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`);
-        try {
-            const config = options.definition ? extractOAuthConfig(options.definition) : {};
-            const fetchFn = createOAuthFetch(serverUrl, pluginAwareOAuthHeaders(options.definition), signal);
-            authority();
-            const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
-                onRedirect: async () => { },
-            }, authStorageOptions, runtime.signal, undefined, authority);
-            try {
-                authProvider.setAuthFetch(fetchFn);
-                const clientInfo = await authProvider.clientInformation();
-                authority();
-                throwIfAborted(signal);
-                if (!clientInfo) {
-                    console.log(`MCP Auth: No client info for refresh for ${serverName}`);
-                    return null;
-                }
-                const discovery = applyOAuthConfig(await probeAuthDiscovery(serverUrl, options.definition, signal), config);
-                authority();
-                throwIfAborted(signal);
-                const result = await abortable(runSdkAuth(authProvider, {
-                    serverUrl,
-                    ...discovery,
-                    ...(options.skipIssuerMetadataValidation === true ? { skipIssuerMetadataValidation: true } : {}),
-                    fetchFn,
-                }), signal);
-                authority();
-                throwIfAborted(signal);
-                if (result !== "AUTHORIZED") {
-                    return null;
-                }
-                const refreshed = await getAuthForUrl(serverName, serverUrl, authStorageOptions);
-                authority();
-                throwIfAborted(signal);
-                return refreshed?.tokens ?? null;
-            }
-            finally {
-                authProvider.deactivate();
-            }
-        }
-        catch (error) {
-            if (isAbortError(error, signal) || error instanceof OAuthCredentialStoreError)
-                throw error;
-            console.error(`MCP Auth: Token refresh failed for ${serverName}`);
-            return null;
-        }
-    }
-    authority();
-    return null;
-}
-/**
- * Check the authentication status for a server.
- *
- * @param serverName - The name of the MCP server
- * @returns The current auth status
- */
-export async function getAuthStatus(serverName, options = {}) {
-    getRuntime(options);
-    const authStorageOptions = options.authStorageOptions ?? {};
-    const entry = getAuthEntry(serverName, authStorageOptions);
-    if (!entry?.tokens)
-        return "not_authenticated";
-    return entry.tokens.expiresAt && entry.tokens.expiresAt < Date.now() / 1000 ? "expired" : "authenticated";
-}
-/**
- * Remove all OAuth credentials for a server.
- *
- * @param serverName - The name of the MCP server
- */
-export async function removeAuth(serverName, options = {}) {
-    const runtime = getRuntime(options);
-    const signal = combineAbortSignals(runtime.signal, options.signal);
-    throwIfAborted(signal);
-    const authStorageOptions = options.authStorageOptions ?? {};
-    const releaseRevocation = beginOAuthRevocation(serverName);
-    try {
-        detachPendingAuthsForServer(serverName, new Error("Authorization cancelled by logout"));
-        const storedOAuthState = getOAuthState(serverName, authStorageOptions);
-        if (storedOAuthState)
-            cancelPendingCallback(storedOAuthState);
-        await stopCallbackServerIfIdle();
-        throwIfAborted(signal);
-        clearAllCredentials(serverName, authStorageOptions);
-        console.log(`MCP Auth: Removed credentials for ${serverName}`);
-    }
-    finally {
-        releaseRevocation();
-    }
-}
-/**
- * Check if OAuth is supported for a server configuration.
- * OAuth is supported for HTTP servers unless explicitly disabled.
- *
- * @param definition - The server definition
- * @returns True if OAuth is supported
- */
-export function supportsOAuth(definition) {
-    // OAuth requires a URL
-    if (!definition.url)
-        return false;
-    // Explicitly disabled via auth: false or oauth: false
-    if (definition.auth === false)
-        return false;
-    if (definition.oauth === false)
-        return false;
-    if (definition.auth === "oauth")
-        return true;
-    // Configured custom headers take precedence over implicit OAuth auto-detection.
-    if (definition.headers && Object.keys(definition.headers).length > 0)
-        return false;
-    // OAuth is enabled when auth is not specified (auto-detect)
-    return definition.auth === undefined;
-}
-/**
- * Initialize the OAuth system on startup.
- * OAuth callback binding is lazy and starts from startAuth() only.
- */
-export async function initializeOAuth(runtimeOrSignal) {
-    if (runtimeOrSignal && "signal" in runtimeOrSignal) {
-        runtimeOrSignal.signal.throwIfAborted();
-        activeRuntimes.add(runtimeOrSignal);
-        return runtimeOrSignal;
-    }
-    await shutdownOAuth(legacyRuntime);
-    legacyRuntime = createOAuthRuntime(runtimeOrSignal);
-    return legacyRuntime;
-}
-/**
- * Shutdown one OAuth runtime. The callback server remains process-shared while
- * another runtime has pending/reserved callback state or is still active.
- */
-export async function shutdownOAuth(runtime = legacyRuntime) {
-    const state = getRuntimeState(runtime);
-    if (state.controller.signal.aborted)
-        return;
-    state.generation += 1;
-    state.controller.abort(new Error("OAuth runtime stopped"));
-    for (const callbackState of Array.from(state.pendingAuthStates.values()))
-        cancelPendingCallback(callbackState);
-    for (const pendingAuth of Array.from(state.pendingAuths.values())) {
-        await clearPendingAuth(runtime, pendingAuth.serverName, undefined, pendingAuth.authStorageOptions);
-    }
-    state.pendingAuthentications.clear();
-    activeRuntimes.delete(runtime);
-    if (activeRuntimes.size === 0) {
-        await stopCallbackServer();
-    }
-}
-//# sourceMappingURL=mcp-auth-flow.js.map