@slashfi/agents-sdk 0.39.0 → 0.40.1

package/dist/cjs/config-store.js

@@ -0,0 +1,727 @@
+"use strict";
+/**
+ * ADK Config Store — programmatic API for managing registries and refs.
+ *
+ * Provides a `createAdk(fs, options?)` factory that returns an object
+ * with `registry.*` and `ref.*` namespaces. Backed by a pluggable
+ * FsStore so it works with local filesystem (CLI) or VCS (atlas).
+ *
+ * @example
+ * ```typescript
+ * import { createAdk, createLocalFsStore } from '@slashfi/agents-sdk';
+ *
+ * const adk = createAdk(createLocalFsStore());
+ * await adk.registry.add({ url: 'https://registry.slash.com', name: 'slash' });
+ * await adk.registry.browse('slash');
+ * await adk.ref.add({ ref: 'notion', registry: 'slash' });
+ * await adk.ref.call('notion', 'notion-search', { query: 'hello' });
+ * ```
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAdk = createAdk;
+const define_config_js_1 = require("./define-config.js");
+const registry_consumer_js_1 = require("./registry-consumer.js");
+const crypto_js_1 = require("./crypto.js");
+const mcp_client_js_1 = require("./mcp-client.js");
+const CONFIG_PATH = "consumer-config.json";
+const SECRET_PREFIX = "secret:";
+// ============================================
+// Internal helpers
+// ============================================
+function refName(entry) {
+    return (0, define_config_js_1.normalizeRef)(entry).name;
+}
+function registryDisplayName(r) {
+    return typeof r === "string" ? r : (r.name ?? r.url);
+}
+function registryUrl(r) {
+    return typeof r === "string" ? r : r.url;
+}
+function findRegistry(registries, nameOrUrl) {
+    return registries.find((r) => {
+        if (typeof r === "string")
+            return r === nameOrUrl;
+        return (r.name ?? r.url) === nameOrUrl || r.url === nameOrUrl;
+    });
+}
+/**
+ * Walk an object and decrypt any string values starting with "secret:".
+ */
+async function decryptConfigSecrets(obj, encryptionKey) {
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (typeof value === "string" && value.startsWith(SECRET_PREFIX)) {
+            result[key] = await (0, crypto_js_1.decryptSecret)(value.slice(SECRET_PREFIX.length), encryptionKey);
+        }
+        else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+            result[key] = await decryptConfigSecrets(value, encryptionKey);
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+// ============================================
+// Factory
+// ============================================
+function createAdk(fs, options = {}) {
+    async function readConfig() {
+        const content = await fs.readFile(CONFIG_PATH);
+        if (!content)
+            return {};
+        try {
+            return JSON.parse(content);
+        }
+        catch {
+            return {};
+        }
+    }
+    async function writeConfig(config) {
+        await fs.writeFile(CONFIG_PATH, JSON.stringify(config, null, 2));
+    }
+    /**
+     * Store a secret value in a ref's config, encrypted if encryptionKey is set.
+     * The value is stored inline as "secret:<encrypted>" in consumer-config.json.
+     */
+    async function storeRefSecret(name, key, value) {
+        const stored = options.encryptionKey
+            ? `${SECRET_PREFIX}${await (0, crypto_js_1.encryptSecret)(value, options.encryptionKey)}`
+            : value;
+        const config = await readConfig();
+        const refs = (config.refs ?? []).map((r) => {
+            if (refName(r) !== name)
+                return r;
+            return { ...r, config: { ...r.config, [key]: stored } };
+        });
+        await writeConfig({ ...config, refs });
+    }
+    async function readRefSecret(name, key) {
+        const config = await readConfig();
+        const entry = (config.refs ?? []).find((r) => refName(r) === name);
+        const value = entry?.config?.[key];
+        if (typeof value !== "string")
+            return null;
+        if (value.startsWith(SECRET_PREFIX) && options.encryptionKey) {
+            return (0, crypto_js_1.decryptSecret)(value.slice(SECRET_PREFIX.length), options.encryptionKey);
+        }
+        return value;
+    }
+    const PENDING_OAUTH_PATH = "pending-oauth.json";
+    async function readPendingOAuth() {
+        const content = await fs.readFile(PENDING_OAUTH_PATH);
+        if (!content)
+            return {};
+        try {
+            return JSON.parse(content);
+        }
+        catch {
+            return {};
+        }
+    }
+    async function writePendingOAuth(pending) {
+        await fs.writeFile(PENDING_OAUTH_PATH, JSON.stringify(pending, null, 2));
+    }
+    async function storePendingOAuth(state, data) {
+        const pending = await readPendingOAuth();
+        pending[state] = data;
+        await writePendingOAuth(pending);
+    }
+    async function consumePendingOAuth(state) {
+        const pending = await readPendingOAuth();
+        const data = pending[state] ?? null;
+        if (data) {
+            delete pending[state];
+            await writePendingOAuth(pending);
+        }
+        return data;
+    }
+    /** Call an MCP server directly with a bearer token (bypasses registry). */
+    async function callMcpDirect(serverUrl, toolName, params, token) {
+        const url = serverUrl.replace(/\/$/, "");
+        const headers = {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            Authorization: `Bearer ${token}`,
+        };
+        let reqId = 0;
+        let sessionId;
+        async function rpc(method, rpcParams) {
+            const reqHeaders = { ...headers, ...(sessionId ? { "Mcp-Session-Id": sessionId } : {}) };
+            const res = await globalThis.fetch(url, {
+                method: "POST",
+                headers: reqHeaders,
+                body: JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: ++reqId,
+                    method,
+                    ...(rpcParams && { params: rpcParams }),
+                }),
+            });
+            if (!res.ok) {
+                throw new Error(`MCP ${method} failed (${res.status}): ${await res.text().catch(() => "unknown")}`);
+            }
+            const contentType = res.headers.get("content-type") ?? "";
+            // Capture session ID from response
+            const newSessionId = res.headers.get("mcp-session-id");
+            if (newSessionId)
+                sessionId = newSessionId;
+            // SSE response — parse events to find the JSON-RPC result
+            if (contentType.includes("text/event-stream")) {
+                const text = await res.text();
+                const lines = text.split("\n");
+                for (const line of lines) {
+                    if (line.startsWith("data: ")) {
+                        try {
+                            const json = JSON.parse(line.slice(6));
+                            if (json.id === reqId) {
+                                if (json.error)
+                                    throw new Error(`MCP RPC error: ${json.error.message}`);
+                                return json.result;
+                            }
+                        }
+                        catch (e) {
+                            if (e instanceof Error && e.message.startsWith("MCP RPC"))
+                                throw e;
+                        }
+                    }
+                }
+                return undefined;
+            }
+            const json = await res.json();
+            if (json.error)
+                throw new Error(`MCP RPC error: ${json.error.message}`);
+            return json.result;
+        }
+        try {
+            await rpc("initialize", {
+                protocolVersion: "2024-11-05",
+                capabilities: {},
+                clientInfo: { name: "adk", version: "1.0.0" },
+            });
+            await rpc("notifications/initialized").catch(() => { });
+            const result = await rpc("tools/call", { name: toolName, arguments: params });
+            const textContent = result?.content?.find((c) => c.type === "text");
+            if (textContent?.text) {
+                try {
+                    return { success: true, result: JSON.parse(textContent.text) };
+                }
+                catch {
+                    return { success: true, result: textContent.text };
+                }
+            }
+            return { success: true, result };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    function callbackUrl() {
+        const port = options.oauthCallbackPort ?? 8919;
+        return options.oauthCallbackUrl ?? `http://localhost:${port}/callback`;
+    }
+    /** Try fetching a URL directly as OAuth metadata (it may already be a discovery URL). */
+    async function tryFetchOAuthMetadata(url) {
+        try {
+            const res = await globalThis.fetch(url);
+            if (!res.ok)
+                return null;
+            const data = await res.json();
+            if (data.authorization_endpoint && data.token_endpoint) {
+                return data;
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Build a registryConsumer from the current config.
+     * Decrypts secret: values in registry headers/auth before connecting.
+     */
+    async function buildConsumer(registryFilter) {
+        const config = await readConfig();
+        let registries = config.registries ?? [];
+        if (registryFilter) {
+            const target = findRegistry(registries, registryFilter);
+            if (!target) {
+                throw new Error(`Registry "${registryFilter}" not found. Available: ${registries.map(registryDisplayName).join(", ")}`);
+            }
+            registries = [target];
+        }
+        // Decrypt secret: values in registry entries if encryption key is set
+        const resolved = options.encryptionKey
+            ? await Promise.all(registries.map(async (r) => {
+                if (typeof r === "string")
+                    return r;
+                const decrypted = await decryptConfigSecrets(r, options.encryptionKey);
+                return decrypted;
+            }))
+            : registries;
+        return (0, registry_consumer_js_1.createRegistryConsumer)({ registries: resolved, refs: config.refs ?? [] }, { token: options.token });
+    }
+    // ==========================================
+    // Registry API
+    // ==========================================
+    const registry = {
+        async add(entry) {
+            const config = await readConfig();
+            const alias = entry.name ?? entry.url;
+            const registries = (config.registries ?? []).filter((r) => registryDisplayName(r) !== alias);
+            registries.push(entry);
+            await writeConfig({ ...config, registries });
+        },
+        async remove(nameOrUrl) {
+            const config = await readConfig();
+            if (!config.registries?.length)
+                return false;
+            const before = config.registries.length;
+            const registries = config.registries.filter((r) => registryDisplayName(r) !== nameOrUrl && registryUrl(r) !== nameOrUrl);
+            if (registries.length === before)
+                return false;
+            await writeConfig({ ...config, registries });
+            return true;
+        },
+        async list() {
+            const config = await readConfig();
+            return (config.registries ?? []).map((r) => typeof r === "string" ? { url: r } : r);
+        },
+        async get(name) {
+            const config = await readConfig();
+            const target = findRegistry(config.registries ?? [], name);
+            if (!target)
+                return null;
+            return typeof target === "string" ? { url: target } : target;
+        },
+        async update(name, updates) {
+            const config = await readConfig();
+            if (!config.registries?.length)
+                return false;
+            let found = false;
+            const registries = config.registries.map((r) => {
+                const rName = registryDisplayName(r);
+                if (rName !== name && registryUrl(r) !== name)
+                    return r;
+                found = true;
+                const existing = typeof r === "string" ? { url: r } : { ...r };
+                if (updates.url)
+                    existing.url = updates.url;
+                if (updates.name)
+                    existing.name = updates.name;
+                if (updates.auth)
+                    existing.auth = updates.auth;
+                if (updates.headers)
+                    existing.headers = { ...existing.headers, ...updates.headers };
+                return existing;
+            });
+            if (!found)
+                return false;
+            await writeConfig({ ...config, registries });
+            return true;
+        },
+        async browse(name, query) {
+            const consumer = await buildConsumer(name);
+            const config = await readConfig();
+            const target = findRegistry(config.registries ?? [], name);
+            const url = target ? registryUrl(target) : name;
+            return consumer.browse(url, query);
+        },
+        async inspect(name) {
+            const consumer = await buildConsumer(name);
+            const config = await readConfig();
+            const target = findRegistry(config.registries ?? [], name);
+            const url = target ? registryUrl(target) : name;
+            return consumer.discover(url);
+        },
+        async test(name) {
+            const config = await readConfig();
+            const registries = config.registries ?? [];
+            const targets = name
+                ? registries.filter((r) => registryDisplayName(r) === name || registryUrl(r) === name)
+                : registries;
+            const results = await Promise.allSettled(targets.map(async (r) => {
+                const url = registryUrl(r);
+                const rName = registryDisplayName(r);
+                try {
+                    const consumer = await (0, registry_consumer_js_1.createRegistryConsumer)({ registries: [r] }, { token: options.token });
+                    const disc = await consumer.discover(url);
+                    return { name: rName, url, status: "active", issuer: disc.issuer };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : "unknown";
+                    return { name: rName, url, status: "error", error: msg };
+                }
+            }));
+            return results.map((r) => r.status === "fulfilled"
+                ? r.value
+                : { name: "unknown", url: "unknown", status: "error", error: "unknown" });
+        },
+    };
+    // ==========================================
+    // Ref API
+    // ==========================================
+    const ref = {
+        async add(entry) {
+            const config = await readConfig();
+            const name = refName(entry);
+            const refs = (config.refs ?? []).filter((r) => refName(r) !== name);
+            refs.push(entry);
+            await writeConfig({ ...config, refs });
+            // Check security requirements
+            let security = null;
+            try {
+                const consumer = await buildConsumer();
+                const info = await consumer.inspect(entry.ref);
+                if (info?.security)
+                    security = info.security;
+            }
+            catch {
+                // Non-fatal — registry might be unreachable
+            }
+            return { security };
+        },
+        async remove(name) {
+            const config = await readConfig();
+            if (!config.refs?.length)
+                return false;
+            const before = config.refs.length;
+            const refs = config.refs.filter((r) => refName(r) !== name);
+            if (refs.length === before)
+                return false;
+            await writeConfig({ ...config, refs });
+            return true;
+        },
+        async list() {
+            const config = await readConfig();
+            return (config.refs ?? []).map(define_config_js_1.normalizeRef);
+        },
+        async get(name) {
+            const config = await readConfig();
+            return (config.refs ?? []).find((r) => refName(r) === name) ?? null;
+        },
+        async update(name, updates) {
+            const config = await readConfig();
+            if (!config.refs?.length)
+                return false;
+            let found = false;
+            const refs = config.refs.map((r) => {
+                if (refName(r) !== name)
+                    return r;
+                found = true;
+                const updated = { ...r };
+                if (updates.url)
+                    updated.url = updates.url;
+                if (updates.as)
+                    updated.as = updates.as;
+                if (updates.scheme)
+                    updated.scheme = updates.scheme;
+                if (updates.config)
+                    updated.config = { ...updated.config, ...updates.config };
+                if (updates.sourceRegistry)
+                    updated.sourceRegistry = updates.sourceRegistry;
+                return updated;
+            });
+            if (!found)
+                return false;
+            await writeConfig({ ...config, refs });
+            return true;
+        },
+        async inspect(name, opts) {
+            const config = await readConfig();
+            const entry = (config.refs ?? []).find((r) => refName(r) === name);
+            if (!entry)
+                throw new Error(`Ref "${name}" not found`);
+            const consumer = await buildConsumer();
+            return consumer.inspect(entry.ref, undefined, opts);
+        },
+        async call(name, tool, params) {
+            const config = await readConfig();
+            const entry = (config.refs ?? []).find((r) => refName(r) === name);
+            if (!entry)
+                throw new Error(`Ref "${name}" not found`);
+            const accessToken = await readRefSecret(name, "access_token");
+            // If we have a direct access_token from OAuth, call the agent's MCP server
+            // directly instead of going through the registry
+            if (accessToken) {
+                const info = await ref.inspect(name);
+                // Use upstream URL from registry if available, fall back to deriving from OAuth URL
+                const upstream = info?.upstream;
+                const security = info?.security;
+                const mcpUrl = upstream
+                    ?? (security?.flows?.authorizationCode?.authorizationUrl
+                        ? `${new URL(security.flows.authorizationCode.authorizationUrl).origin}/mcp`
+                        : null);
+                if (mcpUrl) {
+                    return callMcpDirect(mcpUrl, tool, params ?? {}, accessToken);
+                }
+            }
+            const consumer = await buildConsumer();
+            const reg = consumer.registries()[0];
+            if (!reg)
+                throw new Error("No registry available");
+            return consumer.callRegistry(reg, {
+                action: "execute_tool",
+                path: entry.ref,
+                tool,
+                params: params ?? {},
+            });
+        },
+        async resources(name) {
+            const config = await readConfig();
+            const entry = (config.refs ?? []).find((r) => refName(r) === name);
+            if (!entry)
+                throw new Error(`Ref "${name}" not found`);
+            const consumer = await buildConsumer();
+            const reg = consumer.registries()[0];
+            if (!reg)
+                throw new Error("No registry available");
+            return consumer.callRegistry(reg, {
+                action: "list_resources",
+                path: entry.ref,
+            });
+        },
+        async read(name, uris) {
+            const config = await readConfig();
+            const entry = (config.refs ?? []).find((r) => refName(r) === name);
+            if (!entry)
+                throw new Error(`Ref "${name}" not found`);
+            const consumer = await buildConsumer();
+            const reg = consumer.registries()[0];
+            if (!reg)
+                throw new Error("No registry available");
+            return consumer.callRegistry(reg, {
+                action: "read_resources",
+                path: entry.ref,
+                uris,
+            });
+        },
+        async authStatus(name) {
+            const config = await readConfig();
+            const entry = (config.refs ?? []).find((r) => refName(r) === name);
+            if (!entry)
+                throw new Error(`Ref "${name}" not found`);
+            let security = null;
+            try {
+                const consumer = await buildConsumer();
+                const info = await consumer.inspect(entry.ref);
+                if (info?.security)
+                    security = info.security;
+            }
+            catch {
+                // Can't reach registry
+            }
+            const configKeys = Object.keys(entry.config ?? {});
+            if (!security || security.type === "none") {
+                return { name, security, complete: true, missing: [], present: configKeys };
+            }
+            const requiredFields = (() => {
+                switch (security.type) {
+                    case "oauth2": return ["access_token"];
+                    case "apiKey": return ["api_key"];
+                    case "http": return ["token"];
+                    default: return [];
+                }
+            })();
+            const missing = requiredFields.filter((f) => !configKeys.includes(f));
+            const present = requiredFields.filter((f) => configKeys.includes(f));
+            return { name, security, complete: missing.length === 0, missing, present };
+        },
+        async auth(name, opts) {
+            const status = await ref.authStatus(name);
+            const security = status.security;
+            if (!security || security.type === "none") {
+                return { type: "none", complete: true };
+            }
+            if (security.type === "apiKey") {
+                if (!opts?.apiKey)
+                    return { type: "apiKey", complete: false };
+                await storeRefSecret(name, "api_key", opts.apiKey);
+                return { type: "apiKey", complete: true };
+            }
+            if (security.type === "http") {
+                if (!opts?.apiKey)
+                    return { type: "http", complete: false };
+                await storeRefSecret(name, "token", opts.apiKey);
+                return { type: "http", complete: true };
+            }
+            if (security.type === "oauth2") {
+                const flows = security.flows;
+                const authCodeFlow = flows?.authorizationCode;
+                if (!authCodeFlow?.authorizationUrl) {
+                    return { type: "oauth2", complete: false };
+                }
+                // The authorizationUrl might be the discovery URL itself or a base URL
+                const authUrl = authCodeFlow.authorizationUrl;
+                let metadata = await tryFetchOAuthMetadata(authUrl);
+                if (!metadata) {
+                    // Try base origin
+                    const origin = new URL(authUrl).origin;
+                    metadata = await (0, mcp_client_js_1.discoverOAuthMetadata)(origin);
+                }
+                if (!metadata) {
+                    throw new Error(`Could not discover OAuth metadata from ${authUrl}`);
+                }
+                const redirectUri = callbackUrl();
+                // Dynamic client registration if supported
+                let clientId;
+                let clientSecret;
+                if (metadata.registration_endpoint) {
+                    const supportedAuthMethods = metadata.token_endpoint_auth_methods_supported ?? ["none"];
+                    const preferredMethod = supportedAuthMethods.includes("none")
+                        ? "none"
+                        : supportedAuthMethods[0] ?? "client_secret_post";
+                    const securityClientName = security.clientName;
+                    const reg = await (0, mcp_client_js_1.dynamicClientRegistration)(metadata.registration_endpoint, {
+                        clientName: securityClientName ?? options.oauthClientName ?? "adk",
+                        redirectUris: [redirectUri],
+                        grantTypes: ["authorization_code"],
+                        tokenEndpointAuthMethod: preferredMethod,
+                    });
+                    clientId = reg.clientId;
+                    clientSecret = reg.clientSecret;
+                    await storeRefSecret(name, "client_id", clientId);
+                    if (clientSecret) {
+                        await storeRefSecret(name, "client_secret", clientSecret);
+                    }
+                }
+                else {
+                    const stored = await readRefSecret(name, "client_id");
+                    if (!stored) {
+                        throw new Error("OAuth server doesn't support dynamic client registration. " +
+                            "Store a client_id first.");
+                    }
+                    clientId = stored;
+                }
+                // State ties the callback back to this ref
+                const state = `${name}:${Date.now()}`;
+                const { url: authorizeUrl, codeVerifier } = await (0, mcp_client_js_1.buildOAuthAuthorizeUrl)({
+                    authorizationEndpoint: metadata.authorization_endpoint,
+                    clientId,
+                    redirectUri,
+                    scopes: metadata.scopes_supported,
+                    state,
+                });
+                // Persist pending state so handleCallback works across processes
+                await storePendingOAuth(state, {
+                    refName: name,
+                    codeVerifier,
+                    clientId,
+                    clientSecret,
+                    tokenEndpoint: metadata.token_endpoint,
+                    redirectUri,
+                    createdAt: Date.now(),
+                });
+                return { type: "oauth2", complete: false, authorizeUrl };
+            }
+            return { type: security.type, complete: false };
+        },
+        async authLocal(name, opts) {
+            const result = await ref.auth(name);
+            if (result.complete)
+                return { complete: true };
+            if (result.type !== "oauth2" || !result.authorizeUrl) {
+                throw new Error(`authLocal only handles OAuth2. Auth type: ${result.type}`);
+            }
+            if (opts?.onAuthorizeUrl) {
+                opts.onAuthorizeUrl(result.authorizeUrl);
+            }
+            // Spin up local callback server
+            const port = options.oauthCallbackPort ?? 8919;
+            const timeout = opts?.timeoutMs ?? 300_000;
+            const { createServer } = await Promise.resolve().then(() => __importStar(require("node:http")));
+            return new Promise((resolve, reject) => {
+                const server = createServer(async (req, res) => {
+                    const reqUrl = new URL(req.url ?? "/", `http://localhost:${port}`);
+                    if (reqUrl.pathname !== "/callback")
+                        return;
+                    const code = reqUrl.searchParams.get("code");
+                    const state = reqUrl.searchParams.get("state");
+                    if (!code || !state) {
+                        const error = reqUrl.searchParams.get("error") ?? "missing code/state";
+                        res.writeHead(400, { "Content-Type": "text/html" });
+                        res.end(`<h1>Error</h1><p>${error}</p>`);
+                        server.close();
+                        reject(new Error(`OAuth denied: ${error}`));
+                        return;
+                    }
+                    try {
+                        const cbResult = await handleCallback({ code, state });
+                        res.writeHead(200, { "Content-Type": "text/html" });
+                        res.end("<h1>Authorized!</h1><p>You can close this tab.</p>");
+                        server.close();
+                        resolve({ complete: cbResult.complete });
+                    }
+                    catch (err) {
+                        res.writeHead(500, { "Content-Type": "text/html" });
+                        res.end(`<h1>Error</h1><p>${err instanceof Error ? err.message : String(err)}</p>`);
+                        server.close();
+                        reject(err);
+                    }
+                });
+                server.listen(port);
+                const timer = setTimeout(() => {
+                    server.close();
+                    reject(new Error("OAuth callback timed out"));
+                }, timeout);
+                server.on("close", () => clearTimeout(timer));
+            });
+        },
+    };
+    // ==========================================
+    // Top-level callback handler
+    // ==========================================
+    async function handleCallback(params) {
+        const pending = await consumePendingOAuth(params.state);
+        if (!pending) {
+            throw new Error(`No pending OAuth flow for state "${params.state}".`);
+        }
+        const tokens = await (0, mcp_client_js_1.exchangeCodeForTokens)(pending.tokenEndpoint, {
+            code: params.code,
+            codeVerifier: pending.codeVerifier,
+            clientId: pending.clientId,
+            clientSecret: pending.clientSecret,
+            redirectUri: pending.redirectUri,
+        });
+        await storeRefSecret(pending.refName, "access_token", tokens.accessToken);
+        if (tokens.refreshToken) {
+            await storeRefSecret(pending.refName, "refresh_token", tokens.refreshToken);
+        }
+        return { refName: pending.refName, complete: true };
+    }
+    return { registry, ref, readConfig, writeConfig, handleCallback };
+}
+//# sourceMappingURL=config-store.js.map