@nooticr/mcp 1.26.19

package/dist/shared/nooticr.js

@@ -0,0 +1,249 @@
+/**
+ * Runtime-agnostic nooticr API client — the single source of truth for the
+ * Node package (`@nooticr/mcp`) and the Cloudflare Worker (mcp.nooticr.com).
+ *
+ * Only Web-standard APIs are used (fetch, crypto, atob), so both runtimes
+ * import this same module: no duplicated client logic to keep in sync. Token
+ * storage lives behind the `TokenProvider` interface — a credentials file for
+ * the Node CLI, a KV-backed session for the Worker.
+ */
+export class NooticrError extends Error {
+    status;
+    code;
+    paywall;
+    body;
+    constructor(status, message, opts = {}) {
+        super(message);
+        this.name = "NooticrError";
+        this.status = status;
+        this.code = opts.code;
+        this.paywall = opts.paywall;
+        this.body = opts.body;
+    }
+}
+/**
+ * Extracts the `exp` claim (epoch seconds) from an nooticr JWT without
+ * verifying the signature — enough to decide whether to refresh before the
+ * 15-minute access token expires.
+ */
+export function jwtExpiry(token) {
+    try {
+        const payload = token.split(".")[1];
+        if (!payload)
+            return undefined;
+        const pad = payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
+        const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/") + pad);
+        const claims = JSON.parse(json);
+        return typeof claims.exp === "number" ? claims.exp : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export class NooticrClient {
+    baseUrl;
+    tokenProvider;
+    /** Stable per-call key so a retried tool call is billed once. */
+    idempotencyKey;
+    constructor(baseUrl, tokenProvider, idempotencyKey) {
+        this.baseUrl = baseUrl.replace(/\/+$/, "");
+        this.tokenProvider = tokenProvider;
+        this.idempotencyKey = idempotencyKey;
+    }
+    async request(method, path, opts = {}) {
+        const doRequest = async (accessToken) => {
+            const headers = {};
+            if (opts.body !== undefined) {
+                headers["content-type"] = "application/json";
+            }
+            // Billed calls carry the key so the backend charges a retry once. A
+            // redeploy or dropped stream mid-call leaves the client with no result,
+            // and its retry must not cost the user a second time.
+            if (opts.idempotent && this.idempotencyKey) {
+                headers["idempotency-key"] = this.idempotencyKey;
+            }
+            if (accessToken) {
+                headers.authorization = `Bearer ${accessToken}`;
+            }
+            return fetch(`${this.baseUrl}${path}`, {
+                method,
+                headers,
+                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+            });
+        };
+        let token = opts.token;
+        if (opts.auth && !token) {
+            token = await this.tokenProvider.getAccessToken();
+        }
+        if (opts.auth && !token) {
+            throw new NooticrError(401, "No nooticr access token available.");
+        }
+        let res = await doRequest(token);
+        if (res.status === 401 && opts.auth && this.tokenProvider.onUnauthorized) {
+            const refreshed = await this.tokenProvider.onUnauthorized();
+            if (refreshed) {
+                token = await this.tokenProvider.getAccessToken();
+                res = await doRequest(token);
+            }
+        }
+        return this.normalizeResponse(res, path);
+    }
+    async normalizeResponse(res, path) {
+        const text = await res.text();
+        let body;
+        try {
+            body = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            body = undefined;
+        }
+        const json = (body ?? {});
+        const errorMessage = typeof json.error === "string"
+            ? json.error
+            : // Name the endpoint: a bare status code says nothing about which
+                // call failed, and these surface to the user as tool errors.
+                `nooticr API error (${res.status}) from ${path}`;
+        if (res.status >= 200 && res.status < 300) {
+            return body;
+        }
+        if (res.status === 402) {
+            throw new NooticrError(402, errorMessage, {
+                paywall: {
+                    reason: typeof json.reason === "string" ? json.reason : undefined,
+                    used: typeof json.used === "number" ? json.used : undefined,
+                    max: typeof json.max === "number" ? json.max : undefined,
+                    cost: typeof json.cost === "number" ? json.cost : undefined,
+                },
+                body,
+            });
+        }
+        throw new NooticrError(res.status, errorMessage, {
+            code: typeof json.code === "string" ? json.code : undefined,
+            body,
+        });
+    }
+    async startVideoAnalysis(url, appId) {
+        const res = await this.request("POST", "/mcp/analyze-post", {
+            auth: true,
+            body: appId !== undefined ? { url, appId } : { url },
+        });
+        const inline = Array.isArray(res?._inlineImages)
+            ? res._inlineImages
+            : undefined;
+        const job = res;
+        return { ...job, inlineImages: inline };
+    }
+    /**
+     * Proxies a generic nooticr backend MCP tool (`get_social_media`,
+     * `discover_social_videos`, `understand_social_post`, …) through
+     * `POST /mcp` JSON-RPC. The backend enforces per-user credit billing;
+     * tool-level failures surface as NooticrError with the backend message.
+     */
+    async callTool(name, args) {
+        const rpc = await this.request("POST", "/mcp", {
+            auth: true,
+            idempotent: true,
+            body: {
+                jsonrpc: "2.0",
+                id: Date.now(),
+                method: "tools/call",
+                params: { name, arguments: args },
+            },
+        });
+        if (rpc && typeof rpc === "object" && rpc.error !== undefined && rpc.error !== null) {
+            const err = rpc.error;
+            throw new NooticrError(err.code === -32002 ? 402 : 400, typeof err.message === "string" ? err.message : "nooticr MCP tool call failed");
+        }
+        const result = (rpc.result ?? {});
+        if (result.isError) {
+            const text = result.content
+                ?.filter((c) => c.type === "text")
+                .map((c) => String(c.text ?? ""))
+                .join("\n");
+            throw new NooticrError(400, text || "nooticr MCP tool call failed");
+        }
+        return {
+            contentBlocks: result.content ?? [],
+            structured: result.structuredContent,
+        };
+    }
+    async getJob(jobId) {
+        return this.request("GET", `/ai/analyze-post?jobId=${encodeURIComponent(jobId)}`, {
+            auth: true,
+        });
+    }
+    async me() {
+        return this.request("GET", "/auth/me", { auth: true });
+    }
+    async exchangeCompletionCode(code, workspaceId) {
+        return NooticrClient.exchangeCode(this.baseUrl, code, workspaceId);
+    }
+    /** Starts a Google sign-in for the given redirect URL; returns the Google redirectUrl. */
+    async startGoogleSignIn(redirect) {
+        return this.request("POST", "/auth/google/start", {
+            auth: false,
+            body: { redirect },
+        });
+    }
+    async login(email, password) {
+        return NooticrClient.login(this.baseUrl, email, password);
+    }
+    async refresh(refreshToken) {
+        return NooticrClient.refreshSession(this.baseUrl, refreshToken);
+    }
+    static async login(baseUrl, email, password) {
+        const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/auth/login`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ email, password }),
+        });
+        const body = await parseJsonBody(res);
+        if (res.status >= 200 && res.status < 300) {
+            return body;
+        }
+        throw new NooticrError(res.status, typeof body?.error === "string"
+            ? body.error
+            : `Login failed (${res.status})`, { body });
+    }
+    /** Exchanges an nooticr one-time completion code (MCP login flow) for a session. */
+    static async exchangeCode(baseUrl, code, workspaceId) {
+        const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/auth/oauth/complete`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(workspaceId !== undefined ? { code, workspaceId } : { code }),
+        });
+        const body = await parseJsonBody(res);
+        if (res.status >= 200 && res.status < 300) {
+            return body;
+        }
+        throw new NooticrError(res.status, typeof body?.error === "string"
+            ? body.error
+            : `Code exchange failed (${res.status})`, { body });
+    }
+    /** Redeems a refresh token for a fresh nooticr session (rotating the refresh token). */
+    static async refreshSession(baseUrl, refreshToken) {
+        const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/auth/refresh`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ refreshToken }),
+        });
+        const body = await parseJsonBody(res);
+        const json = (body ?? {});
+        if (res.status >= 200 && res.status < 300) {
+            if (!json || typeof json.accessToken !== "string") {
+                throw new NooticrError(500, "Refresh succeeded but returned no access token.");
+            }
+            return body;
+        }
+        throw new NooticrError(res.status, typeof json.error === "string" ? json.error : `Refresh failed (${res.status})`, { body });
+    }
+}
+async function parseJsonBody(res) {
+    const text = await res.text();
+    try {
+        return text ? JSON.parse(text) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/shared/oauth.js

@@ -0,0 +1,132 @@
+/**
+ * Runtime-agnostic OAuth 2.0 / PKCE primitives shared by the Node package
+ * (`@nooticr/mcp`) and the Cloudflare Worker (mcp.nooticr.com). Web-standard
+ * APIs only (crypto, atob), so the worker's KV-backed OAuth flow and the
+ * node `OAuthManager` validate the same way by construction.
+ */
+/**
+ * Scopes this server grants.
+ *
+ * These describe what access a client is actually asking for, so a reviewer
+ * (or a user on the consent screen) can map them to the tool list:
+ *   social:read    — read public posts, transcripts, comments, creators,
+ *                    sounds and hashtags on the supported networks
+ *   credits:spend  — run the AI tools and open a checkout, both of which
+ *                    draw on the account's credit balance
+ *
+ * The server previously advertised a single `analyze:video`, which described
+ * about a fifth of what the tools do. Scopes are carried on the session but
+ * never used to reject a call, so tokens issued under the old value keep
+ * working; LEGACY_SCOPE is kept so that stays deliberate rather than
+ * accidental.
+ */
+export const SCOPES = ["social:read", "credits:spend"];
+/** Space-delimited form, for an `authorize` request. */
+export const SCOPE = SCOPES.join(" ");
+/** Issued before the scopes above existed. Still honoured. */
+export const LEGACY_SCOPE = "analyze:video";
+/**
+ * The scopes an authorization request may ask for, split out of the request's
+ * space-delimited `scope` parameter.
+ *
+ * Shared because the worker and the node package each validated this
+ * separately and drifted: the worker compared every individual scope against
+ * the joined string, so once there was more than one scope nothing could ever
+ * match and every authorization was refused with invalid_scope.
+ *
+ * Returns the scopes that are not recognised — empty means the request is fine.
+ * LEGACY_SCOPE is accepted alongside the current ones: clients connected
+ * before the split still ask for it, and refusing it would break every
+ * existing installation on upgrade.
+ */
+export function parseScopes(scope) {
+    return (scope ?? "").split(/\s+/).filter(Boolean);
+}
+export function unsupportedScopes(scope) {
+    const accepted = new Set([...SCOPES, LEGACY_SCOPE]);
+    return parseScopes(scope).filter((s) => !accepted.has(s));
+}
+export function isLoopbackUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "http:")
+        return false;
+    const host = parsed.hostname;
+    return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+}
+/** redirect_uri must be loopback (http://localhost|127.0.0.1|[::1]) or any https URL. */
+export function isAllowedRedirectUri(uri) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol === "https:")
+        return true;
+    if (parsed.protocol === "http:" && isLoopbackUrl(uri))
+        return true;
+    return false;
+}
+/** RFC 7636 S256 PKCE check (SHA-256 + base64url compare). */
+export async function verifyPkce(codeVerifier, codeChallenge) {
+    if (!codeVerifier || !codeChallenge)
+        return false;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+    const bytes = new Uint8Array(digest);
+    let s = "";
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    const b64 = btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return b64 === codeChallenge;
+}
+export function randomToken(bytes = 32) {
+    const buf = new Uint8Array(bytes);
+    crypto.getRandomValues(buf);
+    let s = "";
+    for (const b of buf)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function authorizationServerMetadata(publicUrl, opts = {}) {
+    return {
+        issuer: publicUrl,
+        authorization_endpoint: `${publicUrl}/authorize`,
+        token_endpoint: `${publicUrl}/token`,
+        // Clients try CIMD before DCR when both are on offer, which is the point:
+        // Dynamic Client Registration is deprecated (MCP 2026-07-28), and without
+        // this flag every client fell through to it. The registration endpoint
+        // stays for clients that only know the old way.
+        client_id_metadata_document_supported: true,
+        ...(opts.registration
+            ? { registration_endpoint: `${publicUrl}/register` }
+            : {}),
+        response_types_supported: ["code"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: [...SCOPES],
+        grant_types_supported: ["authorization_code"],
+    };
+}
+export function protectedResourceMetadata(publicUrl) {
+    return {
+        resource: `${publicUrl}/mcp`,
+        authorization_servers: [publicUrl],
+    };
+}
+export function escapeHtml(input) {
+    return input
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+export function generateState() {
+    return crypto.randomUUID();
+}