@nodetool-ai/websocket 0.7.0-rc.22 → 0.8.1

package/dist/oauth/www-authenticate.js

@@ -0,0 +1,33 @@
+/**
+ * `WWW-Authenticate` challenge for an unauthenticated or invalid request to
+ * `/mcp`, per the MCP authorization spec § "WWW-Authenticate".
+ */
+/** Lowercase scheme + host, no trailing slash — mirrors metadata.ts. */
+function normalizeOrigin(publicUrl) {
+    const url = new URL(publicUrl);
+    const scheme = url.protocol.toLowerCase();
+    const host = url.host.toLowerCase();
+    let path = url.pathname;
+    if (path === "/") {
+        path = "";
+    }
+    else if (path.endsWith("/")) {
+        path = path.slice(0, -1);
+    }
+    return `${scheme}//${host}${path}`;
+}
+export function buildBearerChallenge(input) {
+    // RFC 9728 path insertion: the well-known prefix sits at the HOST ROOT
+    // and the issuer's path is inserted after it. For an issuer with no path
+    // this is `<origin>/.well-known/oauth-protected-resource/mcp`; for
+    // https://host/base it is
+    // `https://host/.well-known/oauth-protected-resource/base/mcp` — NOT
+    // `<issuer>/.well-known/…`, which no route serves.
+    const base = normalizeOrigin(input.publicUrl);
+    const origin = new URL(base).origin;
+    const issuerPath = base.slice(origin.length);
+    const resourceMetadata = `${origin}/.well-known/oauth-protected-resource${issuerPath}/mcp`;
+    const errorPart = input.error ? `, error="${input.error}"` : "";
+    return `Bearer resource_metadata="${resourceMetadata}", scope="mcp"${errorPart}`;
+}
+//# sourceMappingURL=www-authenticate.js.map

package/dist/oauth/www-authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"www-authenticate.js","sourceRoot":"","sources":["../../src/oauth/www-authenticate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wEAAwE;AACxE,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,0BAA0B;IAC1B,qEAAqE;IACrE,mDAAmD;IACnD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,GAAG,MAAM,wCAAwC,UAAU,MAAM,CAAC;IAC3F,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,6BAA6B,gBAAgB,iBAAiB,SAAS,EAAE,CAAC;AACnF,CAAC"}

package/dist/oauth-api.d.ts

@@ -17,6 +17,25 @@ interface OAuthStateData {
     createdAt: number;
 }
 export declare const oauthStateStore: Map<string, OAuthStateData>;
+/** Logins awaiting a pasted redirect address, keyed by their CSRF state. */
+export declare const pendingCodexLogins: Map<string, {
+    userId: string;
+    codeVerifier: string;
+    createdAt: number;
+}>;
+/**
+ * Read `code` and `state` out of what the user pastes back — the whole address
+ * the browser was sent to, or just its query string. The state is required: it
+ * is the CSRF check, and a bare code cannot be tied to the login it belongs to.
+ */
+export declare function parseCodexRedirect(input: string): {
+    code: string;
+    state: string;
+};
+/** Abort and tear down any in-flight Codex login listener. Idempotent. */
+export declare function closeActiveCodexCallbackServer(): Promise<void>;
+/** Abort and tear down any in-flight Claude login. Idempotent. */
+export declare function closeActiveClaudeLogin(): Promise<void>;
 /**
  * Handle an OAuth API request.
  *

package/dist/oauth-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-api.d.ts","sourceRoot":"","sources":["../src/oauth-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsBH,wBAAgB,gBAAgB,IAAI;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAMA;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,eAAe,6BAAoC,CAAC;AAwwBjE;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,MAAM,GACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA6B1B"}
+{"version":3,"file":"oauth-api.d.ts","sourceRoot":"","sources":["../src/oauth-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmEH,wBAAgB,gBAAgB;;;EAM/B;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,eAAe,6BAAoC,CAAC;AAoxBjE,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB;YAEnB,MAAM;kBAAgB,MAAM;eAAa,MAAM;EACxD,CAAC;AAWJ;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAwBA;AAgBD,0EAA0E;AAC1E,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAMpE;AA4QD,kEAAkE;AAClE,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM5D;AAgPD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,MAAM,GACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyD1B"}