@slashfi/agents-sdk 0.90.2 → 0.90.5

package/dist/cjs/config-store.js

@@ -480,6 +480,159 @@ function createAdk(fs, options = {}) {
             });
         };
     }
+    /**
+     * Call-time credential lookup: stored ref config first, then the host
+     * `resolveCredentials` callback. Does not persist resolved values.
+     */
+    async function resolveCallCredential(ctx, field) {
+        const stored = await readRefSecret(ctx.name, field);
+        if (stored)
+            return stored;
+        return makeTryResolve(ctx)(field);
+    }
+    const CALL_BEARER_FIELDS = ["access_token", "api_key", "token"];
+    function isBearerAuthField(field) {
+        return CALL_BEARER_FIELDS.includes(field);
+    }
+    /** Legacy cache entries may omit `outbound`; these are never call-time creds. */
+    const LEGACY_CONNECT_ONLY_FIELDS = new Set([
+        "client_id",
+        "client_secret",
+        "refresh_token",
+    ]);
+    function isCallOutboundAuthField(field, info) {
+        if (info.outbound === false)
+            return false;
+        if (info.outbound === true)
+            return true;
+        return !LEGACY_CONNECT_ONLY_FIELDS.has(field);
+    }
+    function readRegistryDeclaredAuthFields(security) {
+        if (!security || typeof security !== "object")
+            return undefined;
+        const raw = security.authFields;
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return undefined;
+        const out = {};
+        for (const [field, meta] of Object.entries(raw)) {
+            if (!meta || typeof meta !== "object" || Array.isArray(meta))
+                continue;
+            const m = meta;
+            if (typeof m.required !== "boolean" || typeof m.automated !== "boolean") {
+                continue;
+            }
+            out[field] = { required: m.required, automated: m.automated };
+            if (typeof m.outbound === "boolean") {
+                out[field].outbound = m.outbound;
+            }
+        }
+        return Object.keys(out).length > 0 ? out : undefined;
+    }
+    async function mergeRegistryDeclaredAuthFields(fields, declared, canResolve, configKeys, refConfig) {
+        if (!declared)
+            return fields;
+        const next = {};
+        for (const [field, meta] of Object.entries(declared)) {
+            next[field] = {
+                required: meta.required,
+                automated: meta.automated,
+                present: configKeys.includes(field) || hasCredentialField(refConfig, field),
+                resolvable: await canResolve(field),
+                ...(meta.format && { format: meta.format }),
+                ...(meta.parts && { parts: meta.parts }),
+                ...(meta.outbound === false && { outbound: false }),
+            };
+        }
+        return next;
+    }
+    function bearerFieldSatisfied(accessToken, refConfig, field) {
+        if (accessToken)
+            return true;
+        return hasCredentialField(refConfig, field);
+    }
+    function fallbackCallAuthFields() {
+        return {
+            access_token: { required: true, automated: true },
+            api_key: { required: false, automated: true },
+            token: { required: false, automated: true },
+        };
+    }
+    function headerFieldSatisfied(headers, field) {
+        const wanted = normalizeCredentialKey(field);
+        return Object.keys(headers).some((key) => normalizeCredentialKey(key) === wanted);
+    }
+    function resolveHeaderNameForField(field, refConfig) {
+        const wanted = normalizeCredentialKey(field);
+        const configHeaders = refConfig.headers;
+        if (configHeaders &&
+            typeof configHeaders === "object" &&
+            !Array.isArray(configHeaders)) {
+            for (const key of Object.keys(configHeaders)) {
+                if (normalizeCredentialKey(key) === wanted)
+                    return key;
+            }
+        }
+        // x_api_key → X-API-KEY (registry codegen declares the canonical name;
+        // env-resolved keys use the normalized storage field name).
+        return field
+            .split("_")
+            .filter(Boolean)
+            .map((part) => part.toUpperCase())
+            .join("-");
+    }
+    /**
+     * Supplement call-time credentials from `resolveCredentials` when they
+     * are not already present in consumer-config. Stored values and config
+     * headers win — this only fills gaps. Walks cached `authFields` as the
+     * source of truth (registry-declared when auth-status has run).
+     */
+    async function resolveAllCallCredentials(opts) {
+        if (!options.resolveCredentials) {
+            return {
+                accessToken: opts.accessToken,
+                resolvedHeaders: opts.resolvedHeaders,
+            };
+        }
+        let accessToken = opts.accessToken;
+        let resolvedHeaders = opts.resolvedHeaders;
+        const { ctx, refConfig } = opts;
+        const cache = await readRegistryCache();
+        const authFields = cache.refs[ctx.name]?.authFields ?? fallbackCallAuthFields();
+        for (const [field, info] of Object.entries(authFields)) {
+            if (!isCallOutboundAuthField(field, info))
+                continue;
+            if (!info.required && !info.automated)
+                continue;
+            if (isBearerAuthField(field)) {
+                if (bearerFieldSatisfied(accessToken, refConfig, field))
+                    continue;
+                const value = await resolveCallCredential(ctx, field);
+                if (value)
+                    accessToken = accessToken ?? value;
+                continue;
+            }
+            if (hasCredentialField(refConfig, field))
+                continue;
+            if (resolvedHeaders && headerFieldSatisfied(resolvedHeaders, field)) {
+                continue;
+            }
+            const value = await resolveCallCredential(ctx, field);
+            if (!value)
+                continue;
+            resolvedHeaders = resolvedHeaders ?? {};
+            if (!headerFieldSatisfied(resolvedHeaders, field)) {
+                resolvedHeaders[resolveHeaderNameForField(field, refConfig)] = value;
+            }
+        }
+        if (!accessToken) {
+            const username = await resolveCallCredential(ctx, "username");
+            const password = await resolveCallCredential(ctx, "password");
+            if (username && password) {
+                accessToken = btoa(`${username}:${password}`);
+            }
+        }
+        return { accessToken, resolvedHeaders };
+    }
     /**
      * Resolve OAuth client credentials (client_id + client_secret) for a
      * ref. Walks: `resolveCredentials` callback → per-ref VCS storage.
@@ -671,6 +824,79 @@ function createAdk(fs, options = {}) {
             return null;
         }
     }
+    /**
+     * Resolve OAuth server metadata from a registry security scheme.
+     * Shared by `ref.auth` and `ref.refreshToken` so both paths discover
+     * token endpoints the same way — explicit manifest URLs, RFC 8414
+     * discovery via `discoveryUrl`, authorization-server discovery, and
+     * finally the MCP upstream URL for redirect-mode agents.
+     */
+    async function resolveOAuthMetadataFromSecurity(security, opts) {
+        if (!security || security.type !== "oauth2")
+            return null;
+        const securityExt = security;
+        const authCodeFlow = securityExt.flows?.authorizationCode;
+        const explicitEndpoint = authCodeFlow?.refreshUrl ?? authCodeFlow?.tokenUrl;
+        if (explicitEndpoint) {
+            const flowScopes = authCodeFlow
+                ?.scopes;
+            const authUrl = authCodeFlow?.authorizationUrl;
+            return {
+                issuer: authUrl
+                    ? new URL(authUrl).origin
+                    : new URL(explicitEndpoint).origin,
+                authorization_endpoint: authUrl ?? explicitEndpoint,
+                token_endpoint: explicitEndpoint,
+                scopes_supported: flowScopes ? Object.keys(flowScopes) : undefined,
+            };
+        }
+        if (securityExt.discoveryUrl) {
+            const fromDiscovery = (await tryFetchOAuthMetadata(securityExt.discoveryUrl)) ??
+                (await (0, mcp_client_js_1.discoverOAuthMetadata)(securityExt.discoveryUrl));
+            if (fromDiscovery)
+                return fromDiscovery;
+        }
+        const authUrl = authCodeFlow?.authorizationUrl;
+        if (authUrl) {
+            let metadata = await tryFetchOAuthMetadata(authUrl);
+            if (!metadata) {
+                metadata = await (0, mcp_client_js_1.discoverOAuthMetadata)(new URL(authUrl).origin);
+            }
+            if (metadata)
+                return metadata;
+        }
+        const serverUrl = opts?.serverUrl;
+        if (serverUrl) {
+            let metadata = await (0, mcp_client_js_1.discoverOAuthMetadata)(serverUrl);
+            if (!metadata) {
+                metadata = await (0, mcp_client_js_1.discoverOAuthMetadata)(serverUrl.replace(/\/(mcp|sse)$/, ""));
+            }
+            if (metadata)
+                return metadata;
+        }
+        return null;
+    }
+    function resolveClientAuthMethod(security, metadata) {
+        const flowAuth = security.flows?.authorizationCode?.clientAuth;
+        if (flowAuth)
+            return flowAuth;
+        const supported = metadata?.token_endpoint_auth_methods_supported;
+        if (supported?.length === 1 && supported[0] === "client_secret_basic") {
+            return "client_secret_basic";
+        }
+        const tokenEndpoint = metadata?.token_endpoint;
+        if (tokenEndpoint) {
+            try {
+                if (new URL(tokenEndpoint).hostname === "api.x.com") {
+                    return "client_secret_basic";
+                }
+            }
+            catch {
+                /* ignore malformed token endpoint */
+            }
+        }
+        return "client_secret_post";
+    }
     /**
      * Build a registryConsumer from the current config.
      * Decrypts secret: values in registry headers/auth before connecting.
@@ -771,7 +997,8 @@ function createAdk(fs, options = {}) {
         if (!found)
             return false;
         for (const r of registries) {
-            if (typeof r !== "string" && (registryDisplayName(r) === nameOrUrl || registryUrl(r) === nameOrUrl)) {
+            if (typeof r !== "string" &&
+                (registryDisplayName(r) === nameOrUrl || registryUrl(r) === nameOrUrl)) {
                 await mutate(r);
             }
         }
@@ -1542,7 +1769,7 @@ function createAdk(fs, options = {}) {
             const entry = findRef(config.refs ?? [], name);
             if (!entry)
                 throw new Error(`Ref "${name}" not found`);
-            const accessToken = (await readRefSecret(name, "access_token")) ??
+            let accessToken = (await readRefSecret(name, "access_token")) ??
                 (await readRefSecret(name, "api_key")) ??
                 (await readRefSecret(name, "token"));
             // Resolve custom headers from config (e.g. { "X-API-Key": "secret:..." })
@@ -1589,6 +1816,16 @@ function createAdk(fs, options = {}) {
                     }
                 }
             }
+            if (options.resolveCredentials) {
+                const supplemented = await resolveAllCallCredentials({
+                    ctx: { name, entry, security: null },
+                    refConfig,
+                    accessToken,
+                    resolvedHeaders,
+                });
+                accessToken = supplemented.accessToken;
+                resolvedHeaders = supplemented.resolvedHeaders;
+            }
             const doCall = async (token) => {
                 // Direct MCP only for redirect/proxy agents with an MCP upstream.
                 // API-mode agents must go through the registry (it does REST translation).
@@ -1700,7 +1937,7 @@ function createAdk(fs, options = {}) {
             async function canResolve(field, oauthMetadata) {
                 return (await tryResolveField(field, oauthMetadata)) !== null;
             }
-            const fields = {};
+            let fields = {};
             if (security.type === "oauth2") {
                 const securityExt = security;
                 const hasRegistration = !!securityExt.dynamicRegistration;
@@ -1734,6 +1971,7 @@ function createAdk(fs, options = {}) {
                     automated: hasRegistration,
                     present: configKeys.includes("client_id"),
                     resolvable: await canResolve("client_id", oauthMetadata),
+                    outbound: false,
                 };
                 if (needsSecret) {
                     fields.client_secret = {
@@ -1741,13 +1979,14 @@ function createAdk(fs, options = {}) {
                         automated: hasRegistration,
                         present: configKeys.includes("client_secret"),
                         resolvable: await canResolve("client_secret", oauthMetadata),
+                        outbound: false,
                     };
                 }
                 fields.access_token = {
                     required: true,
                     automated: accessTokenAutomated,
                     present: configKeys.includes("access_token"),
-                    resolvable: false,
+                    resolvable: await canResolve("access_token"),
                 };
             }
             else if (security.type === "apiKey") {
@@ -1804,7 +2043,12 @@ function createAdk(fs, options = {}) {
                         format: "basic",
                         parts: [
                             { name: "username", label: "Username", secret: false },
-                            { name: "password", label: "Password", secret: true, optional: true },
+                            {
+                                name: "password",
+                                label: "Password",
+                                secret: true,
+                                optional: true,
+                            },
                         ],
                     }),
                 };
@@ -1825,7 +2069,8 @@ function createAdk(fs, options = {}) {
                     resolvable: await canResolve("access_token"),
                 };
             }
-            const complete = Object.values(fields).every((f) => !f.required || f.present || f.resolvable);
+            fields = await mergeRegistryDeclaredAuthFields(fields, readRegistryDeclaredAuthFields(security), canResolve, configKeys, (entry.config ?? {}));
+            const complete = Object.values(fields).every((f) => !f.required || f.automated || f.present || f.resolvable);
             // Persist the slim {required, automated} per-field shape into the
             // registry cache so `isRefAuthComplete` can answer subsequent
             // host-side "is this ref ready?" checks without re-fetching the
@@ -1839,6 +2084,7 @@ function createAdk(fs, options = {}) {
                     automated: info.automated,
                     ...(info.format && { format: info.format }),
                     ...(info.parts && { parts: info.parts }),
+                    ...(info.outbound === false && { outbound: false }),
                 };
             }
             await upsertRegistryCacheAuthFields(name, entry.ref, authFields);
@@ -1936,7 +2182,9 @@ function createAdk(fs, options = {}) {
                 const isBasic = httpSec.scheme === "basic";
                 if (isBasic) {
                     const username = opts?.credentials?.["username"] ?? (await tryResolve("username"));
-                    const password = opts?.credentials?.["password"] ?? (await tryResolve("password")) ?? "";
+                    const password = opts?.credentials?.["password"] ??
+                        (await tryResolve("password")) ??
+                        "";
                     const hasUsername = username !== undefined && username !== null && username !== "";
                     if (!hasUsername) {
                         return {
@@ -1985,21 +2233,9 @@ function createAdk(fs, options = {}) {
                     };
                 }
                 const authUrl = authCodeFlow.authorizationUrl;
-                let metadata = await tryFetchOAuthMetadata(authUrl);
-                if (!metadata) {
-                    const origin = new URL(authUrl).origin;
-                    metadata = await (0, mcp_client_js_1.discoverOAuthMetadata)(origin);
-                }
-                // Fallback: construct metadata from the security scheme's explicit URLs
-                if (!metadata && authCodeFlow.tokenUrl) {
-                    const flowScopes = authCodeFlow.scopes;
-                    metadata = {
-                        issuer: new URL(authUrl).origin,
-                        authorization_endpoint: authUrl,
-                        token_endpoint: authCodeFlow.tokenUrl,
-                        scopes_supported: flowScopes ? Object.keys(flowScopes) : undefined,
-                    };
-                }
+                const metadata = await resolveOAuthMetadataFromSecurity(security, {
+                    serverUrl: entry.url,
+                });
                 if (!metadata) {
                     throw new Error(`Could not discover OAuth metadata from ${authUrl}`);
                 }
@@ -2087,11 +2323,13 @@ function createAdk(fs, options = {}) {
                     extraParams: authorizationParams,
                 });
                 // Persist pending state so handleCallback works across processes
+                const clientAuthMethod = resolveClientAuthMethod(security, metadata);
                 await storePendingOAuth(state, {
                     refName: name,
                     codeVerifier,
                     clientId,
                     clientSecret,
+                    clientAuthMethod,
                     tokenEndpoint: metadata.token_endpoint,
                     redirectUri,
                     createdAt: Date.now(),
@@ -2227,43 +2465,43 @@ function createAdk(fs, options = {}) {
                 return null;
             const status = await ref.authStatus(name);
             const security = status.security;
-            const flows = security && "flows" in security
-                ? security.flows
-                : undefined;
-            const authCodeFlow = flows?.authorizationCode;
-            const tokenUrl = authCodeFlow?.refreshUrl ?? authCodeFlow?.tokenUrl;
-            if (!tokenUrl)
+            const metadata = await resolveOAuthMetadataFromSecurity(security, {
+                serverUrl: entry.url,
+            });
+            const tokenEndpoint = metadata?.token_endpoint;
+            if (!tokenEndpoint)
                 return null;
-            const oauthClient = await resolveOAuthClient({ name, entry, security });
+            const oauthClient = await resolveOAuthClient({
+                name,
+                entry,
+                security,
+                metadata,
+            });
             if (!oauthClient)
                 return null;
-            const { clientId, clientSecret } = oauthClient;
-            // POST to the token endpoint with grant_type=refresh_token
-            const body = new URLSearchParams({
-                grant_type: "refresh_token",
-                refresh_token: refreshToken,
-                client_id: clientId,
-            });
-            if (clientSecret) {
-                body.set("client_secret", clientSecret);
+            const clientAuthMethod = resolveClientAuthMethod(security, metadata);
+            const fetchFn = options.fetch ?? globalThis.fetch;
+            let tokens;
+            try {
+                tokens = await (0, mcp_client_js_1.refreshAccessToken)(tokenEndpoint, {
+                    refreshToken,
+                    clientId: oauthClient.clientId,
+                    clientSecret: oauthClient.clientSecret,
+                    clientAuthMethod,
+                }, fetchFn);
             }
-            const res = await globalThis.fetch(tokenUrl, {
-                method: "POST",
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body: body.toString(),
-            });
-            if (!res.ok)
-                return null;
-            const data = (await res.json());
-            const newAccessToken = data.access_token;
-            if (!newAccessToken)
+            catch {
                 return null;
-            // Store the new tokens
-            await storeRefSecret(name, "access_token", newAccessToken);
-            if (data.refresh_token && typeof data.refresh_token === "string") {
-                await storeRefSecret(name, "refresh_token", data.refresh_token);
             }
-            return { accessToken: newAccessToken };
+            await storeRefSecret(name, "access_token", tokens.accessToken);
+            if (tokens.refreshToken) {
+                await storeRefSecret(name, "refresh_token", tokens.refreshToken);
+            }
+            if (tokens.expiresIn) {
+                const expiresAt = new Date(Date.now() + tokens.expiresIn * 1000).toISOString();
+                await storeRefSecret(name, "expires_at", expiresAt);
+            }
+            return { accessToken: tokens.accessToken };
         },
     };
     // ==========================================
@@ -2274,13 +2512,15 @@ function createAdk(fs, options = {}) {
         if (!pending) {
             throw new Error(`No pending OAuth flow for state "${params.state}".`);
         }
+        const fetchFn = options.fetch ?? globalThis.fetch;
         const tokens = await (0, mcp_client_js_1.exchangeCodeForTokens)(pending.tokenEndpoint, {
             code: params.code,
             codeVerifier: pending.codeVerifier,
             clientId: pending.clientId,
             clientSecret: pending.clientSecret,
             redirectUri: pending.redirectUri,
-        });
+            clientAuthMethod: pending.clientAuthMethod,
+        }, fetchFn);
         await storeRefSecret(pending.refName, "access_token", tokens.accessToken);
         if (tokens.refreshToken) {
             await storeRefSecret(pending.refName, "refresh_token", tokens.refreshToken);