@superblocksteam/gateway 2.0.178-next.2 → 2.0.179-next.0

package/README.md

@@ -9,7 +9,10 @@ Builder tools (`upload_artifact`, `start_app`, `edit_app`,
 `get_preview_status`, `get_integration_metadata`, `publish_app`) plus customer
 Admin tools from `@superblocksteam/mcp-server` share this process.
 
-The MCP host owns process lifecycle: it spawns `superblocks mcp serve`. The
+The MCP host owns process lifecycle: it spawns `superblocks mcp serve`, or this
+package's `superblocks-gateway` bin, which runs the same stdio entry without the
+CLI. Pass `--browser-login` (or set `SUPERBLOCKS_MCP_BROWSER_LOGIN=true`) to
+offer browser sign-in when no session is saved. The
 unified Gateway has no foreground HTTP `/mcp`, no OAuth resource server, and no
 linked-grant exchange. Browser login uses authorization code + PKCE to obtain
 Server-audience access tokens. Personal API keys remain supported through

package/dist/auth/cli-session.d.ts

@@ -0,0 +1,24 @@
+export type CliGatewayAuth = {
+    superblocksBaseUrl?: string;
+    token?: string;
+};
+export type CliGatewaySession = {
+    apiKey: string;
+    getAccessToken?: () => Promise<string>;
+    serverUrl: string;
+    sessionKey?: string;
+};
+export declare const NOT_LOGGED_IN_MESSAGE = "Not logged in to Superblocks. Run: superblocks mcp login (or superblocks login for a personal API key).";
+/**
+ * Identity for unified MCP tools: the already-logged-in CLI user. Does not mint a
+ * second PAT or talk to a grant-exchange endpoint.
+ */
+export declare function resolveCliGatewaySession(auth: CliGatewayAuth | undefined, env?: NodeJS.ProcessEnv): CliGatewaySession;
+/**
+ * Point the Gateway process at the same control plane the CLI session uses,
+ * unless the operator already set SUPERBLOCKS_SERVER_URL. For a remote login
+ * (EE / SaaS) also default GATEWAY_BASE_URL so edit/preview URLs are not
+ * localhost:3000. A loopback session keeps the split local UI port.
+ */
+export declare function applyCliGatewaySessionToEnv(session: CliGatewaySession, env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=cli-session.d.ts.map

package/dist/auth/cli-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-session.d.ts","sourceRoot":"","sources":["../../src/auth/cli-session.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,qBAAqB,4GACyE,CAAC;AAE5G;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,GAAG,SAAS,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,CAUnB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,IAAI,CAcN"}

package/dist/auth/cli-session.js

@@ -0,0 +1,46 @@
+export const NOT_LOGGED_IN_MESSAGE = "Not logged in to Superblocks. Run: superblocks mcp login (or superblocks login for a personal API key).";
+/**
+ * Identity for unified MCP tools: the already-logged-in CLI user. Does not mint a
+ * second PAT or talk to a grant-exchange endpoint.
+ */
+export function resolveCliGatewaySession(auth, env = process.env) {
+    const apiKey = env.SUPERBLOCKS_API_TOKEN?.trim() || auth?.token?.trim();
+    if (!apiKey) {
+        throw new Error(NOT_LOGGED_IN_MESSAGE);
+    }
+    const serverUrl = env.SUPERBLOCKS_SERVER_URL?.trim() ||
+        auth?.superblocksBaseUrl?.trim() ||
+        "http://localhost:8080";
+    return { apiKey, serverUrl };
+}
+/**
+ * Point the Gateway process at the same control plane the CLI session uses,
+ * unless the operator already set SUPERBLOCKS_SERVER_URL. For a remote login
+ * (EE / SaaS) also default GATEWAY_BASE_URL so edit/preview URLs are not
+ * localhost:3000. A loopback session keeps the split local UI port.
+ */
+export function applyCliGatewaySessionToEnv(session, env = process.env) {
+    if (!env.SUPERBLOCKS_SERVER_URL?.trim()) {
+        env.SUPERBLOCKS_SERVER_URL = session.serverUrl;
+    }
+    if (!env.GATEWAY_SERVER_URL?.trim()) {
+        env.GATEWAY_SERVER_URL = session.serverUrl;
+    }
+    if (!env.GATEWAY_UI_BASE_URL?.trim() &&
+        !env.GATEWAY_BASE_URL?.trim() &&
+        !isLoopbackOrigin(session.serverUrl)) {
+        env.GATEWAY_BASE_URL = session.serverUrl;
+    }
+}
+function isLoopbackOrigin(url) {
+    try {
+        const hostname = new URL(url).hostname;
+        return (hostname === "localhost" ||
+            hostname === "127.0.0.1" ||
+            hostname === "[::1]");
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=cli-session.js.map

package/dist/auth/cli-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-session.js","sourceRoot":"","sources":["../../src/auth/cli-session.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,qBAAqB,GAChC,yGAAyG,CAAC;AAE5G;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAgC,EAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,SAAS,GACb,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;QAClC,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAChC,uBAAuB,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA0B,EAC1B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,EAAE,CAAC;QACxC,GAAG,CAAC,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IAC7C,CAAC;IACD,IACE,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QAChC,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QAC7B,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,EACpC,CAAC;QACD,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,OAAO,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { runMcpLogin } from "./login.js";
+export { McpOAuthSessionStore } from "./mcp-oauth-session.js";
+export { McpServerSelectionStore } from "./mcp-server-selection.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,4 @@
+export { runMcpLogin } from "./login.js";
+export { McpOAuthSessionStore } from "./mcp-oauth-session.js";
+export { McpServerSelectionStore } from "./mcp-server-selection.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/auth/login.d.ts

@@ -0,0 +1,18 @@
+import { McpOAuthSessionStore } from "./mcp-oauth-session.js";
+import { McpServerSelectionStore } from "./mcp-server-selection.js";
+export declare function runMcpLogin(options?: {
+    env?: NodeJS.ProcessEnv;
+    fetch?: typeof fetch;
+    forceLogin?: boolean;
+    loadAuth?: () => Promise<{
+        superblocksBaseUrl?: string;
+    } | undefined>;
+    oauthStore?: McpOAuthSessionStore;
+    openBrowser?: (url: string) => Promise<void>;
+    redirectPort?: number;
+    serverSelection?: McpServerSelectionStore;
+    serverUrl?: string;
+    sessionId?: string;
+    signal?: AbortSignal;
+}): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,oBAAoB,EAGrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAOpE,wBAAsB,WAAW,CAC/B,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACtE,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACjB,GACL,OAAO,CAAC,IAAI,CAAC,CAqHf"}

package/dist/auth/login.js

@@ -0,0 +1,124 @@
+import { randomUUID } from "node:crypto";
+import open from "open";
+import { getLocalTokenWithUrlIfExists } from "@superblocksteam/util/login";
+import { assertMcpOAuthServerConfig, McpOAuthSessionStore, normalizeMcpServerUrl, parseNativeOAuthConfig, } from "./mcp-oauth-session.js";
+import { McpServerSelectionStore } from "./mcp-server-selection.js";
+import { NativeOAuthClient, } from "./native-oauth.js";
+export async function runMcpLogin(options = {}) {
+    if (options.signal?.aborted)
+        throw new Error("MCP browser login cancelled.");
+    const env = options.env ?? process.env;
+    const loadAuth = options.loadAuth ?? getLocalTokenWithUrlIfExists;
+    const oauthStore = options.oauthStore ?? new McpOAuthSessionStore();
+    const serverSelection = options.serverSelection ??
+        McpServerSelectionStore.beside(oauthStore.filePath);
+    const chosenServerUrl = options.serverUrl?.trim();
+    const pinnedServerUrl = env.SUPERBLOCKS_SERVER_URL?.trim() || env.SUPERBLOCKS_BASE_URL?.trim();
+    const serverUrl = normalizeMcpServerUrl(chosenServerUrl ||
+        pinnedServerUrl ||
+        (await serverSelection.resolve(oauthStore)) ||
+        (await loadAuth())?.superblocksBaseUrl ||
+        "https://app.superblocks.com");
+    const request = options.fetch ?? fetch;
+    let config;
+    let configStatus;
+    try {
+        const response = await request(`${serverUrl}/api/v1/mcp/oauth/config`, {
+            redirect: "error",
+            signal: AbortSignal.any([
+                AbortSignal.timeout(30_000),
+                ...(options.signal ? [options.signal] : []),
+            ]),
+        });
+        configStatus = response.status;
+        if (!response.ok)
+            throw new Error();
+        const body = await response.json();
+        config = parseNativeOAuthConfig(isRecord(body) ? body.data : undefined);
+    }
+    catch {
+        if (options.signal?.aborted)
+            throw new Error("MCP browser login cancelled.");
+        const reason = configStatus === undefined
+            ? "network error"
+            : configStatus >= 200 && configStatus < 300
+                ? "invalid response"
+                : `HTTP ${configStatus}`;
+        throw new Error(`Could not load MCP browser login configuration. Check the server URL and OAuth setup. (${reason})`);
+    }
+    assertMcpOAuthServerConfig(serverUrl, config);
+    const client = new NativeOAuthClient(config, { fetch: request });
+    let tokens;
+    try {
+        tokens = await client.authorize({
+            forceLogin: options.forceLogin,
+            openBrowser: options.openBrowser ??
+                (async (url) => {
+                    await open(url);
+                }),
+            redirectPort: options.redirectPort,
+            signal: options.signal,
+        });
+    }
+    catch (error) {
+        if (options.signal?.aborted)
+            throw new Error("MCP browser login cancelled.");
+        throw error;
+    }
+    let identityStatus;
+    try {
+        const response = await request(`${serverUrl}/api/v1/users/me`, {
+            headers: { Authorization: `Bearer ${tokens.accessToken}` },
+            redirect: "error",
+            signal: AbortSignal.any([
+                AbortSignal.timeout(30_000),
+                ...(options.signal ? [options.signal] : []),
+            ]),
+        });
+        identityStatus = response.status;
+        if (!response.ok)
+            throw new Error();
+        const body = await response.json();
+        if (!isRecord(body) ||
+            !isRecord(body.data) ||
+            !isRecord(body.data.user) ||
+            typeof body.data.user.id !== "string" ||
+            !body.data.user.id.trim()) {
+            throw new Error();
+        }
+    }
+    catch {
+        if (options.signal?.aborted)
+            throw new Error("MCP browser login cancelled.");
+        const reason = identityStatus === undefined
+            ? "network error"
+            : identityStatus >= 200 && identityStatus < 300
+                ? "invalid response"
+                : `HTTP ${identityStatus}`;
+        throw new Error(`Server did not accept the browser login. Check your account and deployment. (${reason})`);
+    }
+    if (options.signal?.aborted)
+        throw new Error("MCP browser login cancelled.");
+    const pinned = !chosenServerUrl && Boolean(pinnedServerUrl);
+    await oauthStore.save({
+        config,
+        ...(pinned ? { pinned } : {}),
+        serverUrl,
+        sessionId: options.sessionId ?? randomUUID(),
+        tokens,
+    }, options.signal, pinned
+        ? {}
+        : { alongside: () => saveChosenServer(serverSelection, serverUrl) });
+}
+async function saveChosenServer(serverSelection, serverUrl) {
+    try {
+        await serverSelection.save(serverUrl);
+    }
+    catch (error) {
+        throw new Error(`Could not save the chosen server to ${serverSelection.filePath}. Fix or remove that file, then sign in again.`, { cause: error });
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAO,GAYH,EAAE;IAEN,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,4BAA4B,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,oBAAoB,EAAE,CAAC;IACpE,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe;QACvB,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,eAAe,GACnB,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,SAAS,GAAG,qBAAqB,CACrC,eAAe;QACb,eAAe;QACf,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC,MAAM,QAAQ,EAAE,CAAC,EAAE,kBAAkB;QACtC,6BAA6B,CAChC,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,IAAI,MAAyB,CAAC;IAC9B,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,0BAA0B,EAAE;YACrE,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;gBACtB,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;SACH,CAAC,CAAC;QACH,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,MAAM,MAAM,GACV,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,YAAY,IAAI,GAAG,IAAI,YAAY,GAAG,GAAG;gBACzC,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,QAAQ,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,0FAA0F,MAAM,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACb,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC,CAAC;YACJ,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,SAAS,kBAAkB,EAAE;YAC7D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;YAC1D,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;gBACtB,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;SACH,CAAC,CAAC;QACH,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC;YACf,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YACpB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ;YACrC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EACzB,CAAC;YACD,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,MAAM,MAAM,GACV,cAAc,KAAK,SAAS;YAC1B,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,cAAc,IAAI,GAAG,IAAI,cAAc,GAAG,GAAG;gBAC7C,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,QAAQ,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,gFAAgF,MAAM,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,UAAU,CAAC,IAAI,CACnB;QACE,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE;QAC5C,MAAM;KACP,EACD,OAAO,CAAC,MAAM,EACd,MAAM;QACJ,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,eAAe,EAAE,SAAS,CAAC,EAAE,CACtE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,eAAwC,EACxC,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uCAAuC,eAAe,CAAC,QAAQ,gDAAgD,EAC/G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/mcp-oauth-session.d.ts

@@ -0,0 +1,46 @@
+import { type NativeOAuthConfig, type OAuthTokens } from "./native-oauth.js";
+export type StoredMcpOAuthSession = {
+    config: NativeOAuthConfig;
+    /** The environment, not the user, chose this login's server. */
+    pinned?: true;
+    serverUrl: string;
+    sessionId: string;
+    tokens: OAuthTokens;
+};
+export declare const MCP_OAUTH_FILE_SUFFIX = ".mcp-oauth";
+export declare class McpOAuthStoreReadError extends Error {
+}
+export declare class McpOAuthSessionStore {
+    private readonly options;
+    readonly filePath: string;
+    constructor(options?: {
+        fetch?: typeof fetch;
+        filePath?: string;
+        now?: () => number;
+    });
+    read(): Promise<StoredMcpOAuthSession | undefined>;
+    /**
+     * Saves the session. `alongside` runs first under the same lock, so a
+     * write that must agree with the session commits in the same order as it,
+     * and its failure leaves the previous session in place.
+     */
+    save(session: StoredMcpOAuthSession, signal?: AbortSignal, { alongside }?: {
+        alongside?: () => Promise<void>;
+    }): Promise<void>;
+    clear(): Promise<void>;
+    getSession(serverUrl?: string): Promise<{
+        apiKey: string;
+        getAccessToken: () => Promise<string>;
+        serverUrl: string;
+        sessionKey: string;
+    } | undefined>;
+    private accessToken;
+    /** Runs `operation` while no other process can change the saved login. */
+    withLock<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+    private acquireLock;
+    private write;
+}
+export declare function normalizeMcpServerUrl(value: string): string;
+export declare function parseNativeOAuthConfig(value: unknown): NativeOAuthConfig;
+export declare function assertMcpOAuthServerConfig(serverUrl: string, config: NativeOAuthConfig): void;
+//# sourceMappingURL=mcp-oauth-session.d.ts.map

package/dist/auth/mcp-oauth-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-session.d.ts","sourceRoot":"","sources":["../../src/auth/mcp-oauth-session.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,gEAAgE;IAChE,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAEpD,qBAAa,oBAAoB;IAI7B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YACmB,OAAO,GAAE;QACxB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KACf,EAIP;IAEK,IAAI,IAAI,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAiDvD;IAED;;;;OAIG;IACG,IAAI,CACR,OAAO,EAAE,qBAAqB,EAC9B,MAAM,CAAC,EAAE,WAAW,EACpB,EAAE,SAAS,EAAE,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAO,GACtD,OAAO,CAAC,IAAI,CAAC,CAMf;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;IAEK,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM;;;;;mBAclC;YAEa,WAAW;IA0BzB,0EAA0E;IACpE,QAAQ,CAAC,CAAC,EACd,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAUZ;YAEa,WAAW;YA+BX,KAAK;CAYpB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CA8BxE;AAcD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,GACxB,IAAI,CAoCN"}

package/dist/auth/mcp-oauth-session.js

@@ -0,0 +1,247 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { promisify } from "node:util";
+import lockfile from "lockfile";
+import { resolveAuthFilePath } from "@superblocksteam/util/login";
+import { NativeOAuthClient, OAuthRefreshError, } from "./native-oauth.js";
+export const MCP_OAUTH_FILE_SUFFIX = ".mcp-oauth";
+export class McpOAuthStoreReadError extends Error {
+}
+export class McpOAuthSessionStore {
+    options;
+    filePath;
+    constructor(options = {}) {
+        this.options = options;
+        this.filePath =
+            options.filePath ?? `${resolveAuthFilePath()}${MCP_OAUTH_FILE_SUFFIX}`;
+    }
+    async read() {
+        let contents;
+        try {
+            contents = await readFile(this.filePath, "utf8");
+        }
+        catch (error) {
+            if (error instanceof Error && "code" in error && error.code === "ENOENT")
+                return undefined;
+            throw new McpOAuthStoreReadError("Could not read MCP browser login. Run: superblocks mcp login");
+        }
+        try {
+            const value = JSON.parse(contents);
+            if (!isRecord(value) ||
+                typeof value.serverUrl !== "string" ||
+                typeof value.sessionId !== "string" ||
+                !value.sessionId ||
+                !isRecord(value.tokens))
+                throw new Error();
+            const { accessToken, expiresAt, refreshToken } = value.tokens;
+            if (typeof accessToken !== "string" ||
+                !accessToken ||
+                typeof expiresAt !== "number" ||
+                !Number.isFinite(expiresAt) ||
+                (refreshToken !== undefined &&
+                    (typeof refreshToken !== "string" || !refreshToken.trim())))
+                throw new Error();
+            const config = parseNativeOAuthConfig(value.config);
+            assertMcpOAuthServerConfig(value.serverUrl, config);
+            return {
+                config,
+                ...(value.pinned === true ? { pinned: true } : {}),
+                serverUrl: normalizeMcpServerUrl(value.serverUrl),
+                sessionId: value.sessionId,
+                tokens: {
+                    accessToken,
+                    expiresAt,
+                    ...(refreshToken !== undefined && { refreshToken }),
+                },
+            };
+        }
+        catch {
+            throw new McpOAuthStoreReadError("Invalid MCP browser login. Run: superblocks mcp login");
+        }
+    }
+    /**
+     * Saves the session. `alongside` runs first under the same lock, so a
+     * write that must agree with the session commits in the same order as it,
+     * and its failure leaves the previous session in place.
+     */
+    async save(session, signal, { alongside } = {}) {
+        await this.withLock(async () => {
+            signal?.throwIfAborted();
+            await alongside?.();
+            return this.write(session);
+        }, signal);
+    }
+    async clear() {
+        await this.withLock(() => rm(this.filePath, { force: true }));
+    }
+    async getSession(serverUrl) {
+        const session = await this.read();
+        if (!session ||
+            (serverUrl && normalizeMcpServerUrl(serverUrl) !== session.serverUrl))
+            return undefined;
+        const getAccessToken = () => this.accessToken(session);
+        return {
+            apiKey: await getAccessToken(),
+            getAccessToken,
+            serverUrl: session.serverUrl,
+            sessionKey: `oauth:${session.sessionId}`,
+        };
+    }
+    async accessToken(expected) {
+        return this.withLock(async () => {
+            const session = await this.read();
+            if (!session ||
+                session.sessionId !== expected.sessionId ||
+                session.serverUrl !== expected.serverUrl)
+                throw new Error("Saved Superblocks login changed outside this task. Call Login to confirm the account.");
+            if (session.tokens.expiresAt > (this.options.now ?? Date.now)() + 60_000)
+                return session.tokens.accessToken;
+            if (!session.tokens.refreshToken)
+                throw new OAuthRefreshError("MCP browser login required. Call the Login tool, or run superblocks mcp login and restart the MCP host.");
+            const tokens = await new NativeOAuthClient(session.config, this.options).refresh(session.tokens.refreshToken);
+            await this.write({ ...session, tokens });
+            return tokens.accessToken;
+        });
+    }
+    /** Runs `operation` while no other process can change the saved login. */
+    async withLock(operation, signal) {
+        await mkdir(dirname(this.filePath), { mode: 0o700, recursive: true });
+        const lockPath = `${this.filePath}.lock`;
+        await this.acquireLock(lockPath, signal);
+        try {
+            signal?.throwIfAborted();
+            return await operation();
+        }
+        finally {
+            await promisify(lockfile.unlock)(lockPath);
+        }
+    }
+    async acquireLock(lockPath, signal) {
+        const expiresAt = Date.now() + 75_000;
+        while (true) {
+            signal?.throwIfAborted();
+            try {
+                await new Promise((resolve, reject) => {
+                    lockfile.lock(lockPath, { stale: 120_000 }, (error) => {
+                        if (error)
+                            reject(error);
+                        else
+                            resolve();
+                    });
+                });
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof Error &&
+                    "code" in error &&
+                    error.code === "EEXIST"))
+                    throw error;
+                if (Date.now() >= expiresAt)
+                    throw new Error("MCP browser login is busy. Try again shortly.");
+                await delay(100, undefined, { signal });
+            }
+        }
+    }
+    async write(session) {
+        const temporaryPath = `${this.filePath}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporaryPath, JSON.stringify(session), {
+                flag: "wx",
+                mode: 0o600,
+            });
+            await rename(temporaryPath, this.filePath);
+        }
+        finally {
+            await rm(temporaryPath, { force: true });
+        }
+    }
+}
+export function normalizeMcpServerUrl(value) {
+    const url = new URL(value);
+    const loopback = ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname);
+    if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname !== "/") {
+        throw new Error("MCP server URL must be an HTTPS origin (HTTP is allowed only on loopback).");
+    }
+    return url.origin;
+}
+export function parseNativeOAuthConfig(value) {
+    if (!isRecord(value))
+        throw new Error("Invalid MCP OAuth configuration.");
+    const { audience, clientId, issuerUrl, organization } = value;
+    if (typeof audience !== "string" ||
+        !audience.trim() ||
+        typeof clientId !== "string" ||
+        !clientId.trim() ||
+        typeof issuerUrl !== "string" ||
+        !issuerUrl.trim() ||
+        (organization !== undefined &&
+            (typeof organization !== "string" || !organization.trim()))) {
+        throw new Error("Invalid MCP OAuth configuration.");
+    }
+    const issuer = new URL(issuerUrl);
+    if (issuer.protocol !== "https:" ||
+        issuer.username ||
+        issuer.password ||
+        issuer.hash ||
+        issuer.search)
+        throw new Error("MCP OAuth issuer must use HTTPS.");
+    return {
+        audience,
+        clientId,
+        issuerUrl,
+        ...(organization ? { organization } : {}),
+    };
+}
+const FIRST_PARTY_AUDIENCE = "https://superblocks/api";
+const FIRST_PARTY_CLIENTS = {
+    development: {
+        clientId: "kx2bGKgQVB2rPNROHa0MCTfS8ZPIqD5C",
+        issuerUrl: "https://login-dev.superblocks.com",
+    },
+    production: {
+        clientId: "iVC3LD0oU5kwvVP7SBUZIjRkjZyT9mAH",
+        issuerUrl: "https://login.superblocks.com",
+    },
+};
+export function assertMcpOAuthServerConfig(serverUrl, config) {
+    const hostname = new URL(serverUrl).hostname;
+    const issuer = new URL(config.issuerUrl);
+    const expected = [
+        "app.superblocks.com",
+        "eu.superblocks.com",
+        "app.superblockshq.com",
+        "api.superblocks.link",
+    ].includes(hostname)
+        ? FIRST_PARTY_CLIENTS.production
+        : hostname === "staging.superblocks.com" ||
+            hostname === "superblocks.dev" ||
+            hostname.endsWith(".superblocks.dev") ||
+            hostname === "superblocks.local" ||
+            hostname.endsWith(".superblocks.local") ||
+            ["localhost", "127.0.0.1", "[::1]"].includes(hostname)
+            ? FIRST_PARTY_CLIENTS.development
+            : undefined;
+    const firstPartyClient = expected ??
+        Object.values(FIRST_PARTY_CLIENTS).find((client) => config.clientId === client.clientId ||
+            issuer.hostname.replace(/\.+$/, "") ===
+                new URL(client.issuerUrl).hostname);
+    if (firstPartyClient &&
+        (issuer.origin !== firstPartyClient.issuerUrl ||
+            issuer.pathname !== "/" ||
+            config.clientId !== firstPartyClient.clientId ||
+            config.audience !== FIRST_PARTY_AUDIENCE ||
+            !expected)) {
+        throw new Error("MCP OAuth configuration does not match the server URL.");
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=mcp-oauth-session.js.map

package/dist/auth/mcp-oauth-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-session.js","sourceRoot":"","sources":["../../src/auth/mcp-oauth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EACL,iBAAiB,EAEjB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAW3B,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;CAAG;AAEpD,MAAM,OAAO,oBAAoB;IAIZ,OAAO;IAHjB,QAAQ,CAAS;IAE1B,YACmB,OAAO,GAIpB,EAAE;uBAJW,OAAO;QAMxB,IAAI,CAAC,QAAQ;YACX,OAAO,CAAC,QAAQ,IAAI,GAAG,mBAAmB,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBACtE,OAAO,SAAS,CAAC;YACnB,MAAM,IAAI,sBAAsB,CAC9B,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5C,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAChB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACnC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACnC,CAAC,KAAK,CAAC,SAAS;gBAChB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAEvB,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;YAC9D,IACE,OAAO,WAAW,KAAK,QAAQ;gBAC/B,CAAC,WAAW;gBACZ,OAAO,SAAS,KAAK,QAAQ;gBAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC3B,CAAC,YAAY,KAAK,SAAS;oBACzB,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBAE7D,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpD,0BAA0B,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO;gBACL,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC;gBACjD,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE;oBACN,WAAW;oBACX,SAAS;oBACT,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;iBACpD;aACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAC9B,uDAAuD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,OAA8B,EAC9B,MAAoB,EACpB,EAAE,SAAS,EAAE,GAAwC,EAAE;QAEvD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,SAAS,EAAE,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAkB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,IACE,CAAC,OAAO;YACR,CAAC,SAAS,IAAI,qBAAqB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC;YAErE,OAAO,SAAS,CAAC;QACnB,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO;YACL,MAAM,EAAE,MAAM,cAAc,EAAE;YAC9B,cAAc;YACd,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,SAAS,OAAO,CAAC,SAAS,EAAE;SACzC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAA+B;QACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,IACE,CAAC,OAAO;gBACR,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;gBACxC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;gBAExC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;YACJ,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM;gBACtE,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;gBAC9B,MAAM,IAAI,iBAAiB,CACzB,yGAAyG,CAC1G,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,iBAAiB,CACxC,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,OAAO,CACb,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,QAAQ,CACZ,SAA2B,EAC3B,MAAoB;QAEpB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;QACzC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAAgB,EAChB,MAAoB;QAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACtC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE;wBACpD,IAAI,KAAK;4BAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;4BACpB,OAAO,EAAE,CAAC;oBACjB,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,CAAC,CACC,KAAK,YAAY,KAAK;oBACtB,MAAM,IAAI,KAAK;oBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB;oBAED,MAAM,KAAK,CAAC;gBACd,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS;oBACzB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACnE,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAA8B;QAChD,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBACtD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;QACtE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,QAAQ,KAAK,GAAG,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1E,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC9D,IACE,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,QAAQ,CAAC,IAAI,EAAE;QAChB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,QAAQ,CAAC,IAAI,EAAE;QAChB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,SAAS,CAAC,IAAI,EAAE;QACjB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM;QAEb,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AACvD,MAAM,mBAAmB,GAAG;IAC1B,WAAW,EAAE;QACX,QAAQ,EAAE,kCAAkC;QAC5C,SAAS,EAAE,mCAAmC;KAC/C;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,kCAAkC;QAC5C,SAAS,EAAE,+BAA+B;KAC3C;CACO,CAAC;AAEX,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,MAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG;QACf,qBAAqB;QACrB,oBAAoB;QACpB,uBAAuB;QACvB,sBAAsB;KACvB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClB,CAAC,CAAC,mBAAmB,CAAC,UAAU;QAChC,CAAC,CAAC,QAAQ,KAAK,yBAAyB;YACpC,QAAQ,KAAK,iBAAiB;YAC9B,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACrC,QAAQ,KAAK,mBAAmB;YAChC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACvC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxD,CAAC,CAAC,mBAAmB,CAAC,WAAW;YACjC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,QAAQ;QACR,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACrC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YACnC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CACvC,CAAC;IACJ,IACE,gBAAgB;QAChB,CAAC,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,SAAS;YAC3C,MAAM,CAAC,QAAQ,KAAK,GAAG;YACvB,MAAM,CAAC,QAAQ,KAAK,gBAAgB,CAAC,QAAQ;YAC7C,MAAM,CAAC,QAAQ,KAAK,oBAAoB;YACxC,CAAC,QAAQ,CAAC,EACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/mcp-server-selection.d.ts

@@ -0,0 +1,42 @@
+import { type McpOAuthSessionStore } from "./mcp-oauth-session.js";
+/**
+ * The Superblocks server this computer's MCP plugin uses, kept as `serverUrl`
+ * in the plugin settings file the plugin launcher also reads. It is kept apart
+ * from the browser login saved for that server, so a removed, expired, or
+ * unreadable login never sends the plugin back to the default server, and a
+ * server the user writes into the file is used even while the saved login
+ * belongs to another server.
+ */
+export declare class McpServerSelectionStore {
+    readonly filePath: string;
+    private readonly legacyFilePath?;
+    constructor(filePath: string, legacyFilePath?: string | undefined);
+    /**
+     * The plugin settings file in the browser login file's directory. A
+     * selection saved before that file existed is moved into it on first read.
+     */
+    static beside(sessionFilePath: string): McpServerSelectionStore;
+    /**
+     * The server in use: the one the user chose, else the saved browser
+     * login's server, which is recorded as the choice unless the environment
+     * pinned it. The record is written under the login's lock so a concurrent
+     * sign-in cannot save a newer login between the read and the write.
+     */
+    resolve(sessions: McpOAuthSessionStore): Promise<string | undefined>;
+    /**
+     * The server a sign-in uses once the saved browser login is gone. A login
+     * the user chose is recorded first; one the environment pinned is not.
+     */
+    withoutLogin(sessions: McpOAuthSessionStore): Promise<string | undefined>;
+    /** The selected origin, or undefined when none is saved or it is unusable. */
+    read(): Promise<string | undefined>;
+    /** Saves the selection without failing the sign-in or switch that made it. */
+    remember(serverUrl: string): Promise<void>;
+    /** Writes `serverUrl` and keeps every other plugin setting as it was. */
+    save(serverUrl: string): Promise<void>;
+    /** Once plugin.json names a server, the old file must not bring back an older one. */
+    private dropLegacySelection;
+    private moveLegacySelection;
+    private static parse;
+}
+//# sourceMappingURL=mcp-server-selection.d.ts.map

package/dist/auth/mcp-server-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-selection.d.ts","sourceRoot":"","sources":["../../src/auth/mcp-server-selection.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,wBAAwB,CAAC;AAIhC;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAFlC,YACW,QAAQ,EAAE,MAAM,EACR,cAAc,CAAC,EAAE,MAAM,YAAA,EACtC;IAEJ;;;OAGG;IACH,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,GAAG,uBAAuB,CAQ9D;IAED;;;;;OAKG;IACG,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWzE;IAED;;;OAGG;IACG,YAAY,CAChB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B;IAED,8EAA8E;IACxE,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAaxC;IAED,8EAA8E;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/C;IAED,yEAAyE;IACnE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB3C;IAED,sFAAsF;YACxE,mBAAmB;YAUnB,mBAAmB;IAejC,OAAO,CAAC,MAAM,CAAC,KAAK;CAKrB"}