@oharness/engine 0.1.0

package/dist/mcp/manager.js

@@ -0,0 +1,325 @@
+import { McpAuthRequiredError, errorMessage } from "../core/errors.js";
+import { normalizeObjectSchema } from "../util/schema.js";
+import { matchPattern } from "../tools/registry.js";
+import { createLogger } from "../util/logger.js";
+import { McpClient } from "./client.js";
+import { mcpAuthHeaders } from "./oauth.js";
+import { expandSecrets } from "./secrets.js";
+/**
+ * Owns every MCP connection and turns their tools into harness tools.
+ *
+ * Names are namespaced `mcp__<server>__<tool>` so two servers can expose a
+ * `search` tool without colliding, and so permission rules can target a whole
+ * server with one pattern.
+ */
+/** Minimum gap between reconnect attempts for one server. */
+const RECONNECT_COOLDOWN_MS = 5_000;
+export class McpManager {
+    clients = new Map();
+    errors = new Map();
+    toolsByServer = new Map();
+    configs = new Map();
+    /** In-flight reconnects, so concurrent tool calls share one attempt. */
+    reconnecting = new Map();
+    /** When a reconnect last *failed*, for backing off a dead server. */
+    lastFailure = new Map();
+    /** Servers that answered 401, and what they said about where to log in. */
+    challenges = new Map();
+    logger;
+    authStore;
+    constructor(logger, authStore) {
+        this.logger = (logger ?? createLogger("mcp")).child("manager");
+        if (authStore)
+            this.authStore = authStore;
+    }
+    /**
+     * Connect every configured server. A server that fails to start is recorded
+     * and skipped — one broken MCP config should not take the agent down.
+     */
+    async connectAll(configs) {
+        await Promise.all(Object.entries(configs).map(([name, config]) => this.connect(name, config)));
+        return this.status();
+    }
+    async connect(name, config) {
+        await this.disconnect(name);
+        // Kept so a server that dies mid-session can be brought back without the
+        // caller having to hold onto its configuration.
+        this.configs.set(name, config);
+        const client = new McpClient(name, config, this.logger, this.authFor(config));
+        try {
+            await client.connect();
+            this.challenges.delete(name);
+            const definitions = await client.listTools();
+            const allowed = config.allowedTools;
+            const tools = definitions
+                .filter((def) => !allowed?.length || allowed.some((p) => matchPattern(def.name, p)))
+                .map((def) => this.adaptTool(name, client, def));
+            this.clients.set(name, client);
+            this.toolsByServer.set(name, tools);
+            this.errors.delete(name);
+            this.logger.info("registered tools", { server: name, count: tools.length });
+            return tools;
+        }
+        catch (err) {
+            if (err instanceof McpAuthRequiredError) {
+                this.challenges.set(name, {
+                    url: err.url,
+                    ...(err.challenge ? { challenge: err.challenge } : {}),
+                });
+                this.errors.set(name, "not authorized yet");
+                this.logger.info("authorization required", { server: name });
+            }
+            else {
+                const message = errorMessage(err);
+                this.errors.set(name, message);
+                this.logger.warn("connection failed", { server: name, error: message });
+            }
+            await client.close().catch(() => { });
+            return [];
+        }
+    }
+    /** Permanently remove a server: closes it and forgets how to restart it. */
+    async remove(name) {
+        await this.disconnect(name);
+        this.configs.delete(name);
+        this.errors.delete(name);
+        this.challenges.delete(name);
+    }
+    /** What a server asked for when it refused, if it refused. */
+    authChallenge(name) {
+        return this.challenges.get(name);
+    }
+    /** The configuration a server was connected with, for a caller that needs it. */
+    configFor(name) {
+        return this.configs.get(name);
+    }
+    /**
+     * The per-request header resolver for one server.
+     *
+     * Only HTTP servers have anywhere to put a bearer token, and only a manager
+     * that was given a store has anywhere to keep one.
+     */
+    authFor(config) {
+        const store = this.authStore;
+        if (!store || config.type !== "http")
+            return undefined;
+        const resolved = expandSecrets(config);
+        const url = resolved.type === "http" ? resolved.url : config.url;
+        return () => mcpAuthHeaders(url, store);
+    }
+    async disconnect(name) {
+        const client = this.clients.get(name);
+        if (!client)
+            return;
+        this.clients.delete(name);
+        this.toolsByServer.delete(name);
+        await client.close().catch(() => { });
+    }
+    async closeAll() {
+        await Promise.all([...this.clients.keys()].map((name) => this.disconnect(name)));
+    }
+    /**
+     * Bring a dropped server back.
+     *
+     * A stdio server that crashes or an HTTP transport that drops used to take
+     * its tools out of commission for the rest of the session, which is a poor
+     * outcome for something as ordinary as a subprocess exiting. Attempts are
+     * deduplicated and rate-limited: several parallel tool calls hitting a dead
+     * server should produce one reconnect, not one each.
+     */
+    async reconnect(name) {
+        const existing = this.reconnecting.get(name);
+        if (existing)
+            return existing;
+        const config = this.configs.get(name);
+        if (!config)
+            return false;
+        // Back off only after a *failed* attempt. Rate-limiting every attempt
+        // meant the first legitimate reconnect after a crash was refused, because
+        // the failing call that detected the crash had already spent the window.
+        const sinceFailure = Date.now() - (this.lastFailure.get(name) ?? 0);
+        if (this.lastFailure.has(name) && sinceFailure < RECONNECT_COOLDOWN_MS)
+            return false;
+        const attempt = (async () => {
+            this.logger.info("reconnecting", { server: name });
+            try {
+                await this.connect(name, config);
+                const revived = this.clients.get(name)?.isConnected === true;
+                if (revived)
+                    this.lastFailure.delete(name);
+                else
+                    this.lastFailure.set(name, Date.now());
+                return revived;
+            }
+            catch {
+                this.lastFailure.set(name, Date.now());
+                return false;
+            }
+            finally {
+                this.reconnecting.delete(name);
+            }
+        })();
+        this.reconnecting.set(name, attempt);
+        return attempt;
+    }
+    tools() {
+        return [...this.toolsByServer.values()].flat();
+    }
+    client(name) {
+        return this.clients.get(name);
+    }
+    status() {
+        const names = new Set([
+            ...this.clients.keys(),
+            ...this.errors.keys(),
+            ...this.challenges.keys(),
+        ]);
+        return [...names].map((name) => {
+            const client = this.clients.get(name);
+            return {
+                name,
+                connected: client?.isConnected ?? false,
+                // The config, not the client: a server that failed to connect has no
+                // client to ask, and reporting every failure as stdio was a lie the
+                // authorization path made visible.
+                transport: (client?.config.type ?? this.configs.get(name)?.type ?? "stdio"),
+                toolCount: this.toolsByServer.get(name)?.length ?? 0,
+                serverVersion: client?.serverInfo?.serverInfo?.version,
+                error: this.errors.get(name),
+                ...(this.challenges.has(name) ? { needsAuth: true } : {}),
+            };
+        });
+    }
+    /** Aggregated `instructions` from servers that supplied them. */
+    serverInstructions() {
+        const out = [];
+        for (const [name, client] of this.clients) {
+            const instructions = client.serverInfo?.instructions?.trim();
+            if (instructions)
+                out.push(`## MCP server: ${name}\n${instructions}`);
+        }
+        return out;
+    }
+    // -------------------------------------------------------------------------
+    adaptTool(server, client, def) {
+        const name = mcpToolName(server, def.name);
+        const readOnly = def.annotations?.readOnlyHint === true;
+        return {
+            name,
+            description: def.description ?? def.title ?? `${def.name} (from MCP server ${server})`,
+            inputSchema: normalizeObjectSchema(def.inputSchema ?? {}),
+            // The server validates its own inputs, and re-deriving a validator from
+            // its JSON Schema would only add a second, less accurate opinion.
+            readOnly,
+            concurrencySafe: readOnly,
+            source: "mcp",
+            server,
+            renderTitle: (input) => `${server}:${def.name}(${previewArgs(input)})`,
+            execute: async (input, ctx) => {
+                const call = async () => {
+                    // Always resolve the current client: a reconnect replaces it, and
+                    // the one captured at registration time is the dead one.
+                    const live = this.clients.get(server) ?? client;
+                    const result = await live.callTool(def.name, input, ctx.signal);
+                    return convertResult(result, server);
+                };
+                try {
+                    if (this.clients.get(server)?.isConnected)
+                        return await call();
+                }
+                catch (err) {
+                    // Fall through to a reconnect: a transport error here usually means
+                    // the server went away mid-call.
+                    this.logger.debug("tool call failed; will try reconnecting", {
+                        server,
+                        error: errorMessage(err),
+                    });
+                }
+                if (ctx.signal.aborted) {
+                    return { content: [{ type: "text", text: "aborted" }], isError: true };
+                }
+                const revived = await this.reconnect(server);
+                if (!revived) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `MCP server "${server}" is not connected and could not be restarted.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                try {
+                    return await call();
+                }
+                catch (err) {
+                    return {
+                        content: [
+                            { type: "text", text: `MCP tool ${name} failed: ${errorMessage(err)}` },
+                        ],
+                        isError: true,
+                    };
+                }
+            },
+        };
+    }
+}
+export function mcpToolName(server, tool) {
+    return `mcp__${sanitize(server)}__${sanitize(tool)}`;
+}
+/** Tool names must satisfy the strictest provider: `[a-zA-Z0-9_-]`. */
+function sanitize(value) {
+    return value.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+function convertResult(result, server) {
+    const content = [];
+    for (const block of result.content ?? []) {
+        const converted = convertContent(block, server);
+        if (converted)
+            content.push(converted);
+    }
+    if (content.length === 0 && result.structuredContent !== undefined) {
+        content.push({ type: "text", text: JSON.stringify(result.structuredContent, null, 2) });
+    }
+    if (content.length === 0) {
+        content.push({ type: "text", text: "(the tool returned no content)" });
+    }
+    return { content, isError: result.isError };
+}
+function convertContent(block, server) {
+    switch (block.type) {
+        case "text":
+            return { type: "text", text: block.text };
+        case "image":
+            return { type: "image", mimeType: block.mimeType, data: block.data };
+        case "audio":
+            // No provider takes inline audio through this path; describe it instead.
+            return { type: "text", text: `[audio ${block.mimeType} from ${server}, omitted]` };
+        case "resource": {
+            const { uri, text, mimeType } = block.resource;
+            if (text !== undefined)
+                return { type: "text", text: `<resource uri="${uri}">\n${text}\n</resource>` };
+            return { type: "text", text: `[binary resource ${uri} (${mimeType ?? "unknown"}), omitted]` };
+        }
+        case "resource_link":
+            return {
+                type: "text",
+                text: `[resource link ${block.uri}${block.name ? ` — ${block.name}` : ""}]`,
+            };
+        default:
+            return undefined;
+    }
+}
+function previewArgs(input) {
+    if (input === null || typeof input !== "object")
+        return "";
+    const entries = Object.entries(input);
+    if (entries.length === 0)
+        return "";
+    const first = entries[0];
+    const value = typeof first[1] === "string" ? first[1] : JSON.stringify(first[1]);
+    const shown = (value ?? "").slice(0, 40);
+    return entries.length === 1 ? shown : `${shown}, …`;
+}
+//# sourceMappingURL=manager.js.map

package/dist/mcp/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAwB7C;;;;;;GAMG;AACH,6DAA6D;AAC7D,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,MAAM,OAAO,UAAU;IACJ,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IACvC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC9D,wEAAwE;IACvD,YAAY,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpE,qEAAqE;IACpD,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzD,2EAA2E;IAC1D,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,MAAM,CAAS;IACf,SAAS,CAAa;IAEvC,YAAY,MAAe,EAAE,SAAqB;QAChD,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAwC;QACvD,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAC5E,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAuB;QACjD,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,yEAAyE;QACzE,gDAAgD;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;YACpC,MAAM,KAAK,GAAG,WAAW;iBACtB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;iBACnF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAEnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE;oBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,8DAA8D;IAC9D,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,iFAAiF;IACjF,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACK,OAAO,CAAC,MAAuB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACjE,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,GAAG,qBAAqB;YAAE,OAAO,KAAK,CAAC;QAErF,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,IAAI,CAAC;gBAC7D,IAAI,OAAO;oBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;;oBACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5C,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvC,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,MAAM;QACJ,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;YACpB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACrB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO;gBACL,IAAI;gBACJ,SAAS,EAAE,MAAM,EAAE,WAAW,IAAI,KAAK;gBACvC,qEAAqE;gBACrE,oEAAoE;gBACpE,mCAAmC;gBACnC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,OAAO,CAEhE;gBACV,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC;gBACpD,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO;gBACtD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,kBAAkB;QAChB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC7D,IAAI,YAAY;gBAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,KAAK,YAAY,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4EAA4E;IAEpE,SAAS,CAAC,MAAc,EAAE,MAAiB,EAAE,GAAsB;QACzE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC;QAExD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,IAAI,qBAAqB,MAAM,GAAG;YACtF,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACzD,wEAAwE;YACxE,kEAAkE;YAClE,QAAQ;YACR,eAAe,EAAE,QAAQ;YACzB,MAAM,EAAE,KAAK;YACb,MAAM;YACN,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG;YACtE,OAAO,EAAE,KAAK,EAAE,KAAc,EAAE,GAAgB,EAAuB,EAAE;gBACvE,MAAM,IAAI,GAAG,KAAK,IAAyB,EAAE;oBAC3C,kEAAkE;oBAClE,yDAAyD;oBACzD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;oBAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBAChE,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACvC,CAAC,CAAC;gBAEF,IAAI,CAAC;oBACH,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW;wBAAE,OAAO,MAAM,IAAI,EAAE,CAAC;gBACjE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,oEAAoE;oBACpE,iCAAiC;oBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;wBAC3D,MAAM;wBACN,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACzE,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,eAAe,MAAM,gDAAgD;6BAC5E;yBACF;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,EAAE,CAAC;gBACtB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,OAAO,EAAE;4BACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,IAAI,YAAY,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE;yBACxE;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACtD,OAAO,QAAQ,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB,EAAE,MAAc;IAC9D,MAAM,OAAO,GAAkC,EAAE,CAAC;IAElD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB,EAAE,MAAc;IACvD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACvE,KAAK,OAAO;YACV,yEAAyE;YACzE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,QAAQ,SAAS,MAAM,YAAY,EAAE,CAAC;QACrF,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,IAAI,eAAe,EAAE,CAAC;YACvG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,KAAK,QAAQ,IAAI,SAAS,aAAa,EAAE,CAAC;QAChG,CAAC;QACD,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,kBAAkB,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;aAC5E,CAAC;QACJ;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC;AACtD,CAAC"}

package/dist/mcp/oauth.d.ts

@@ -0,0 +1,63 @@
+import type { AuthStore } from "../auth/store.ts";
+import type { AuthorizeResult } from "../auth/types.ts";
+/** Where a server's credential lives in the shared store. */
+export declare function mcpAuthKey(serverUrl: string): string;
+export interface McpAuthServer {
+    authorizeUrl: string;
+    tokenUrl: string;
+    /** Absent when the server does not offer dynamic registration. */
+    registrationUrl?: string;
+    /** The audience the token is bound to (RFC 8707). */
+    resource: string;
+    scope?: string;
+}
+/**
+ * Everything needed to start a login, worked out from the server's URL and
+ * whatever it said in its 401.
+ */
+export declare function discoverMcpAuth(serverUrl: string, challenge?: string): Promise<McpAuthServer>;
+/**
+ * The `resource_metadata` URL a 401 pointed at, if it pointed at one.
+ *
+ * Exported because it is the one piece of the challenge worth reading, and a
+ * caller that has the header should not have to re-derive the parse.
+ */
+export declare function resourceMetadataUrl(challenge: string | undefined): string | undefined;
+/**
+ * The resource identifier for a server URL.
+ *
+ * Query and fragment come off and the trailing slash goes, because this value
+ * has to match what the authorization server computes for the same server, and
+ * a token bound to a nearly-right audience is rejected in a way that is very
+ * hard to read.
+ */
+export declare function canonicalResource(serverUrl: string): string;
+export interface RegisteredClient {
+    clientId: string;
+    clientSecret?: string;
+}
+export declare function registerMcpClient(registrationUrl: string, redirectUri: string, scope?: string): Promise<RegisteredClient>;
+export interface McpLoginOptions {
+    serverUrl: string;
+    store: AuthStore;
+    /** The `WWW-Authenticate` header from the 401 that prompted this. */
+    challenge?: string;
+    /** A client id issued out of band, for servers that do not register. */
+    clientId?: string;
+    clientSecret?: string;
+}
+/**
+ * Begin a login. The returned `callback()` resolves when the browser comes
+ * back, and the credential is stored before it does.
+ */
+export declare function beginMcpLogin(opts: McpLoginOptions): Promise<AuthorizeResult>;
+/** Forget a server's credential; the next connection will ask again. */
+export declare function forgetMcpAuth(serverUrl: string, store: AuthStore): Promise<boolean>;
+/**
+ * The Authorization header for a server, or nothing if it has no credential.
+ *
+ * Resolved per request rather than snapshotted at connect: an access token
+ * outlives a long session by about an hour, and a header captured when the
+ * transport was built is a session that dies quietly in the middle.
+ */
+export declare function mcpAuthHeaders(serverUrl: string, store: AuthStore): Promise<Record<string, string>>;