@p4code/cli 0.8.4 → 0.8.5

package/dist/bin.mjs

@@ -43,7 +43,7 @@ if (isEntrypoint({
 		const { runAcpMcpCliFastPath } = await import("./AcpMcpStdioBridge-CD9BQr2l.mjs");
 		await runAcpMcpCliFastPath(command, process.argv.slice(3));
 	} else {
-		const { runCli } = await import("./binCli-Bgjc_5FL.mjs");
+		const { runCli } = await import("./binCli-D9Qk_k5i.mjs");
 		runCli();
 	}
 }

package/dist/{binCli-Bgjc_5FL.mjs → binCli-D9Qk_k5i.mjs}

@@ -14902,7 +14902,7 @@ const make$228 = () => {
 const layer$242 = sync$2(NetService, make$228);
 //#endregion
 //#region package.json
-var version$2 = "0.8.4";
+var version$2 = "0.8.5";
 //#endregion
 //#region src/cli/acpMcpBridge.ts
 /**
@@ -40728,7 +40728,9 @@ const McpServerTarget = Struct({ serverId: McpServerId });
 const McpServerOAuthStartInput = Struct({
 	serverId: McpServerId,
 	/** The origin the client reaches this server on; the OAuth redirect returns there. */
-	origin: TrimmedNonEmptyString
+	origin: TrimmedNonEmptyString,
+	/** Sign in through the browser again even when the stored grant still works. */
+	reauthenticate: optionalKey(Boolean$5)
 });
 const McpServerOAuthStartResult = Struct({ authorizationUrl: NullOr(String$7) });
 /**
@@ -40767,9 +40769,11 @@ var McpRegistryRpcError = class extends TaggedError$1()("McpRegistryRpcError", {
 		"discover",
 		"import"
 	]),
+	/** `rejected`: the server's authorization server refused to register P4 Code as a client. */
 	reason: Literals$2([
 		"not-found",
 		"invalid",
+		"rejected",
 		"failed"
 	]),
 	cause: optional$9(Defect())
@@ -285892,15 +285896,18 @@ const MCP_CLIENT_OAUTH_CALLBACK_PATH = "/oauth/mcp-client/callback";
 const PENDING_TTL_MS = 6e5;
 /** Refresh a token this close to its expiry before handing it to a provider. */
 const REFRESH_MARGIN_MS = 3e5;
+const BACKGROUND_REFRESH_REDIRECT_URL = "http://localhost/p4code-background-refresh";
 var McpClientOAuthError = class extends TaggedError$1()("McpClientOAuthError", {
 	operation: Literals$2([
 		"start",
 		"complete",
 		"sign-out"
 	]),
+	/** `client-rejected`: dynamic client registration was refused, as allowlisting servers such as Figma do. */
 	reason: Literals$2([
 		"invalid-origin",
 		"unknown-state",
+		"client-rejected",
 		"authorization",
 		"storage"
 	]),
@@ -285939,16 +285946,23 @@ const make$77 = gen$1(function* () {
 	const makeProvider = (input) => {
 		let grant = input.grant;
 		let tokensSaved = false;
+		let changed = false;
 		let authorizationUrl;
+		let registrationRejected = false;
+		const fetchFn = async (url, init) => {
+			const response = await fetch(url, init);
+			if (init?.method === "POST" && typeof init.body === "string" && init.body.includes("\"redirect_uris\"") && (response.status === 401 || response.status === 403)) registrationRejected = true;
+			return response;
+		};
 		return {
 			provider: {
 				get redirectUrl() {
-					return input.redirectUrl;
+					return input.redirectUrl ?? BACKGROUND_REFRESH_REDIRECT_URL;
 				},
 				get clientMetadata() {
 					return {
 						client_name: "P4 Code",
-						redirect_uris: input.redirectUrl === void 0 ? [] : [input.redirectUrl],
+						redirect_uris: input.redirectUrl === null ? [] : [input.redirectUrl],
 						grant_types: ["authorization_code", "refresh_token"],
 						response_types: ["code"],
 						token_endpoint_auth_method: "none"
@@ -285956,19 +285970,32 @@ const make$77 = gen$1(function* () {
 				},
 				...input.state === void 0 ? {} : { state: () => input.state },
 				clientInformation: () => grant.clientInformation,
-				saveClientInformation: (clientInformation) => {
+				...input.redirectUrl === null ? {} : { saveClientInformation: (clientInformation) => {
 					grant = {
 						...grant,
 						clientInformation
 					};
-				},
-				tokens: () => grant.tokens,
+					changed = true;
+				} },
+				tokens: () => input.ignoreTokens ? void 0 : grant.tokens,
 				saveTokens: (tokens) => {
 					grant = {
 						...grant,
 						tokens
 					};
 					tokensSaved = true;
+					changed = true;
+				},
+				invalidateCredentials: (scope) => {
+					if (scope === "all" || scope === "client") {
+						const { clientInformation: _, ...rest } = grant;
+						grant = rest;
+					}
+					if (scope === "all" || scope === "tokens") {
+						const { tokens: _, savedAt: __, ...rest } = grant;
+						grant = rest;
+					}
+					changed = true;
 				},
 				redirectToAuthorization: (url) => {
 					authorizationUrl = url.toString();
@@ -285981,14 +286008,23 @@ const make$77 = gen$1(function* () {
 					return input.pendingEntry.codeVerifier;
 				}
 			},
+			fetchFn,
 			/** The grant to persist, stamped with `now` when the SDK saved new tokens. */
 			current: (now) => tokensSaved ? {
 				...grant,
 				savedAt: now
 			} : grant,
-			authorizationUrl: () => authorizationUrl
+			authorizationUrl: () => authorizationUrl,
+			registrationRejected: () => registrationRejected,
+			/** Whether the SDK saved or dropped anything, so an unchanged grant is not written back. */
+			changed: () => changed
 		};
 	};
+	const authorizationError = (operation, session, cause) => new McpClientOAuthError({
+		operation,
+		reason: session.registrationRejected() ? "client-rejected" : "authorization",
+		cause
+	});
 	const prunePending = (now) => {
 		for (const [state, entry] of pending) if (entry.expiresAt <= now) pending.delete(state);
 	};
@@ -286014,15 +286050,15 @@ const make$77 = gen$1(function* () {
 			grant,
 			redirectUrl,
 			pendingEntry: entry,
-			state
+			state,
+			ignoreTokens: input.reauthenticate === true
 		});
 		const result = yield* tryPromise({
-			try: () => auth(session.provider, { serverUrl: input.serverUrl }),
-			catch: (cause) => new McpClientOAuthError({
-				operation: "start",
-				reason: "authorization",
-				cause
-			})
+			try: () => auth(session.provider, {
+				serverUrl: input.serverUrl,
+				fetchFn: session.fetchFn
+			}),
+			catch: (cause) => authorizationError("start", session, cause)
 		});
 		yield* writeGrant(input.serverId, session.current(yield* currentTimeMillis)).pipe(mapError((cause) => new McpClientOAuthError({
 			operation: "start",
@@ -286055,13 +286091,10 @@ const make$77 = gen$1(function* () {
 		yield* tryPromise({
 			try: () => auth(session.provider, {
 				serverUrl: entry.serverUrl,
-				authorizationCode: input.code
+				authorizationCode: input.code,
+				fetchFn: session.fetchFn
 			}),
-			catch: (cause) => new McpClientOAuthError({
-				operation: "complete",
-				reason: "authorization",
-				cause
-			})
+			catch: (cause) => authorizationError("complete", session, cause)
 		});
 		yield* writeGrant(entry.serverId, session.current(yield* currentTimeMillis)).pipe(mapError((cause) => new McpClientOAuthError({
 			operation: "complete",
@@ -286075,7 +286108,12 @@ const make$77 = gen$1(function* () {
 		reason: "storage",
 		cause
 	})));
-	const authState = (serverId) => readGrant(serverId).pipe(map$11((grant) => isSome(grant) && grant.value.tokens?.access_token ? "signed-in" : "signed-out"));
+	const authState = (serverId) => gen$1(function* () {
+		const grant = getOrUndefined(yield* readGrant(serverId));
+		const tokens = grant?.tokens;
+		if (!tokens?.access_token) return "signed-out";
+		return tokens.expires_in !== void 0 && grant?.savedAt !== void 0 && grant.savedAt + tokens.expires_in * 1e3 <= (yield* currentTimeMillis) && !tokens.refresh_token ? "signed-out" : "signed-in";
+	});
 	const accessToken = (input) => gen$1(function* () {
 		const stored = yield* readGrant(input.serverId);
 		if (isNone(stored) || stored.value.serverUrl !== input.serverUrl) return none$2();
@@ -286088,19 +286126,15 @@ const make$77 = gen$1(function* () {
 		if (!tokens.refresh_token) return none$2();
 		const session = makeProvider({
 			grant,
-			redirectUrl: void 0
+			redirectUrl: null
 		});
 		const refreshed = yield* tryPromise({
 			try: () => auth(session.provider, { serverUrl: input.serverUrl }),
-			catch: (cause) => new McpClientOAuthError({
-				operation: "start",
-				reason: "authorization",
-				cause
-			})
+			catch: (cause) => authorizationError("start", session, cause)
 		}).pipe(option$1);
-		if (isNone(refreshed) || refreshed.value !== "AUTHORIZED") return none$2();
 		const updated = session.current(yield* currentTimeMillis);
-		yield* writeGrant(input.serverId, updated).pipe(ignore$2);
+		if (session.changed()) yield* writeGrant(input.serverId, updated).pipe(ignore$2);
+		if (isNone(refreshed) || refreshed.value !== "AUTHORIZED") return none$2();
 		return fromNullishOr(updated.tokens?.access_token);
 	});
 	return McpClientOAuth.of({
@@ -286154,6 +286188,12 @@ var McpRegistrySettingsError = class extends TaggedError$1()("McpRegistrySetting
 	}
 };
 /**
+* Whether signing in can fix a 401: an OAuth server, or a remote server with
+* no headers of its own. Provider configs usually omit that a remote server
+* uses OAuth, so an imported one arrives as `auth: "none"`.
+*/
+const canSignIn = (transport) => transport.type === "http" && (transport.auth === "oauth" || Object.keys(transport.headers).length === 0);
+/**
 * The registry entries a project's sessions receive, with secrets filled in.
 * OAuth servers need a token from `accessTokens`; one without a token is
 * withheld, since every call would fail until the user signs in.
@@ -286178,14 +286218,12 @@ const resolveUserMcpRegistry = (settings, projectId, accessTokens) => {
 			continue;
 		}
 		let headers = { ...transport.headers };
-		if (transport.auth === "oauth") {
-			const token = accessTokens.get(id);
-			if (token === void 0) continue;
-			headers = {
-				...headers,
-				Authorization: `Bearer ${token}`
-			};
-		}
+		const token = accessTokens.get(id);
+		if (transport.auth === "oauth" && token === void 0) continue;
+		if (token !== void 0) headers = {
+			...headers,
+			Authorization: `Bearer ${token}`
+		};
 		servers.push({
 			name: server.name,
 			disabledProviders: server.disabledProviders,
@@ -286237,7 +286275,7 @@ const makeClientTransport = (transport, token, signal) => transport.type === "st
 	}
 } });
 const classifyProbeFailure = (transport, cause, secrets, checkedAt, stderr) => {
-	if (cause instanceof UnauthorizedError || cause instanceof StreamableHTTPError && (cause.code === 401 || cause.code === 403)) return transport.type === "http" && transport.auth === "oauth" ? {
+	if (cause instanceof UnauthorizedError || cause instanceof StreamableHTTPError && (cause.code === 401 || cause.code === 403)) return canSignIn(transport) ? {
 		status: "needs-auth",
 		checkedAt
 	} : {
@@ -286270,7 +286308,7 @@ const make$76 = gen$1(function* () {
 	const self = yield* resolveSelfInvocation();
 	const health = /* @__PURE__ */ new Map();
 	const getSettings = settingsService.getSettings.pipe(mapError((cause) => new McpRegistrySettingsError({ cause })));
-	const accessTokenFor = (id, server) => server.transport.type === "http" && server.transport.auth === "oauth" ? oauth.accessToken({
+	const accessTokenFor = (id, server) => server.transport.type === "http" && canSignIn(server.transport) ? oauth.accessToken({
 		serverId: McpServerId.make(id),
 		serverUrl: server.transport.url
 	}) : succeed$1(none$2());
@@ -286295,7 +286333,9 @@ const make$76 = gen$1(function* () {
 		plugins: []
 	}))));
 	const runtimeState = (id, server) => gen$1(function* () {
-		const authState = server.transport.type === "http" && server.transport.auth === "oauth" ? yield* oauth.authState(McpServerId.make(id)) : "not-required";
+		const transport = server.transport;
+		const signIn = canSignIn(transport) ? yield* oauth.authState(McpServerId.make(id)) : "not-required";
+		const authState = transport.type === "http" && transport.auth === "oauth" ? signIn : signIn === "signed-in" ? signIn : "not-required";
 		const cached = health.get(id);
 		return {
 			health: cached !== void 0 && cached.config === transportFingerprint(server.transport) ? cached.health : { status: "unchecked" },
@@ -286361,12 +286401,13 @@ const make$76 = gen$1(function* () {
 		return yield* runtimeState(serverId, server);
 	});
 	const startSignIn = (input) => gen$1(function* () {
-		const server = yield* findServer(input.serverId);
-		if (server.transport.type !== "http" || server.transport.auth !== "oauth") return yield* new McpServerNotFoundError({ serverId: input.serverId });
+		const transport = (yield* findServer(input.serverId)).transport;
+		if (transport.type !== "http" || !canSignIn(transport)) return yield* new McpServerNotFoundError({ serverId: input.serverId });
 		return yield* oauth.start({
 			serverId: input.serverId,
-			serverUrl: server.transport.url,
-			origin: input.origin
+			serverUrl: transport.url,
+			origin: input.origin,
+			...input.reauthenticate === void 0 ? {} : { reauthenticate: input.reauthenticate }
 		});
 	});
 	const signOut = (serverId) => gen$1(function* () {
@@ -326704,7 +326745,7 @@ const layerWsRpc = (currentSession, clientOrigin, clientAnalyticsProps, previewA
 			})),
 			McpClientOAuthError: (cause) => fail$1(new McpRegistryRpcError({
 				operation: "oauth-start",
-				reason: cause.reason === "invalid-origin" ? "invalid" : "failed",
+				reason: cause.reason === "invalid-origin" ? "invalid" : cause.reason === "client-rejected" ? "rejected" : "failed",
 				cause
 			}))
 		})),
@@ -346130,4 +346171,4 @@ function runCli() {
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=binCli-Bgjc_5FL.mjs.map
+//# sourceMappingURL=binCli-D9Qk_k5i.mjs.map