@wirecat/zoom-cli 0.56.0 → 0.57.0

package/dist/bundle/chunk-Z4TZ6TAF.js

@@ -0,0 +1,288 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  ACCESS_SECONDS,
+  REFRESH_SECONDS,
+  readStored
+} from "./chunk-G4VZDINN.js";
+import {
+  OAuthError,
+  OAuthErrorCode
+} from "./chunk-5D4AEUVA.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_typescript@7.0.2_vi_80b586dbc8b099637a6e461856c2ee6b/node_modules/@wirecat/cli-core/dist/mcp/http/oauth.js
+import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+var AUTH_CODE_MS = 60 * 1e3;
+var LOGIN_CODE_MS = 10 * 60 * 1e3;
+var WRONG_TRIES = 5;
+var WRONG_CODE_WAIT_MS = 3e4;
+var MAX_CLIENTS = 10;
+var CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+var hash = /* @__PURE__ */ __name((value) => createHash("sha256").update(value).digest("base64url"), "hash");
+var secret = /* @__PURE__ */ __name(() => randomBytes(32).toString("base64url"), "secret");
+var same = /* @__PURE__ */ __name((given, expected) => {
+  const left = Buffer.from(given);
+  const right = Buffer.from(expected);
+  return left.byteLength === right.byteLength && timingSafeEqual(left, right);
+}, "same");
+var tokenFile = /* @__PURE__ */ __name((path) => ({
+  read: /* @__PURE__ */ __name(() => readStored(path), "read"),
+  write: /* @__PURE__ */ __name((stored) => {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    const temporary = `${path}.${randomBytes(16).toString("hex")}.tmp`;
+    writeFileSync(temporary, JSON.stringify(stored), { mode: 384, flag: "wx" });
+    chmodSync(temporary, 384);
+    renameSync(temporary, path);
+  }, "write")
+}), "tokenFile");
+var revokeAll = /* @__PURE__ */ __name((path) => rmSync(path, { force: true }), "revokeAll");
+var json = /* @__PURE__ */ __name((body, status = 200) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json", "cache-control": "no-store" }
+}), "json");
+var oauthError = /* @__PURE__ */ __name((error, description, status = 400) => json({ error, error_description: description }, status), "oauthError");
+var escapeHtml = /* @__PURE__ */ __name((value) => value.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`), "escapeHtml");
+var redirectAllowed = /* @__PURE__ */ __name((uri) => {
+  try {
+    const url = new URL(uri);
+    if (url.hash)
+      return false;
+    return url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname);
+  } catch {
+    return false;
+  }
+}, "redirectAllowed");
+var ownerLogin = /* @__PURE__ */ __name(({ issuer, resource, file, appName, onCode, now = /* @__PURE__ */ __name(() => Date.now(), "now") }) => {
+  const store = tokenFile(file);
+  const codes = /* @__PURE__ */ new Map();
+  let login = { value: "", expires: 0 };
+  let wrong = 0;
+  let retryAt = 0;
+  let renewal;
+  const freshCode = /* @__PURE__ */ __name(() => {
+    const part = /* @__PURE__ */ __name(() => Array.from({ length: 4 }, () => CODE_ALPHABET[randomInt(CODE_ALPHABET.length)]).join(""), "part");
+    login = { value: `${part()}-${part()}`, expires: now() + LOGIN_CODE_MS };
+    clearTimeout(renewal);
+    renewal = setTimeout(freshCode, LOGIN_CODE_MS);
+    renewal.unref();
+    onCode(login.value, new Date(login.expires));
+  }, "freshCode");
+  freshCode();
+  const base = issuer.pathname.replace(/\/+$/, "");
+  const endpoint = /* @__PURE__ */ __name((path) => new URL(`${base}${path}`, issuer.origin).href, "endpoint");
+  const metadata = {
+    issuer: issuer.href,
+    authorization_endpoint: endpoint("/authorize"),
+    token_endpoint: endpoint("/token"),
+    registration_endpoint: endpoint("/register"),
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    code_challenge_methods_supported: ["S256"],
+    token_endpoint_auth_methods_supported: ["none", "client_secret_post", "client_secret_basic"]
+  };
+  const issue = /* @__PURE__ */ __name((stored, clientId) => {
+    const access = secret();
+    const refresh = secret();
+    const seconds = Math.floor(now() / 1e3);
+    stored.tokens = stored.tokens.filter((one) => one.expiresAt > seconds);
+    stored.tokens.push({ hash: hash(access), kind: "access", clientId, expiresAt: seconds + ACCESS_SECONDS }, { hash: hash(refresh), kind: "refresh", clientId, expiresAt: seconds + REFRESH_SECONDS });
+    store.write(stored);
+    return json({ access_token: access, token_type: "Bearer", expires_in: ACCESS_SECONDS, refresh_token: refresh });
+  }, "issue");
+  const clientOf = /* @__PURE__ */ __name((stored, request, form) => {
+    let id = form.get("client_id") ?? "";
+    let given = form.get("client_secret") ?? void 0;
+    const basic = request.headers.get("authorization");
+    if (basic?.startsWith("Basic ")) {
+      const [user = "", password = ""] = Buffer.from(basic.slice(6), "base64").toString().split(":");
+      id = decodeURIComponent(user);
+      given = decodeURIComponent(password);
+    }
+    const client = stored.clients.find((one) => one.id === id);
+    if (!client)
+      return void 0;
+    if (client.authMethod === "none")
+      return client;
+    return given !== void 0 && client.secretHash && same(hash(given), client.secretHash) ? client : void 0;
+  }, "clientOf");
+  const register = /* @__PURE__ */ __name(async (request) => {
+    const body = await request.json().catch(() => null);
+    const uris = Array.isArray(body?.redirect_uris) ? body.redirect_uris.filter((one) => typeof one === "string") : [];
+    if (uris.length === 0 || !uris.every(redirectAllowed))
+      return oauthError("invalid_redirect_uri", "redirect_uris must be https URLs");
+    const requested = body?.token_endpoint_auth_method;
+    const authMethod = requested === "client_secret_post" || requested === "client_secret_basic" ? requested : "none";
+    const clientSecret = authMethod === "none" ? void 0 : secret();
+    const name = typeof body?.client_name === "string" ? body.client_name.slice(0, 100) : void 0;
+    const client = {
+      id: secret(),
+      redirectUris: uris,
+      authMethod,
+      issuedAt: Math.floor(now() / 1e3),
+      ...name ? { name } : {},
+      ...clientSecret ? { secretHash: hash(clientSecret) } : {}
+    };
+    const stored = store.read();
+    const seconds = Math.floor(now() / 1e3);
+    const holding = new Set(stored.tokens.filter((one) => one.expiresAt > seconds).map((one) => one.clientId));
+    stored.clients.push(client);
+    while (stored.clients.length > MAX_CLIENTS) {
+      const idle = stored.clients.findIndex((one) => !holding.has(one.id));
+      if (idle === -1)
+        return oauthError("invalid_client_metadata", "too many logged-in apps \u2014 run mcp revoke first");
+      stored.clients.splice(idle, 1);
+    }
+    store.write(stored);
+    return json({
+      client_id: client.id,
+      client_id_issued_at: client.issuedAt,
+      redirect_uris: uris,
+      token_endpoint_auth_method: authMethod,
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      ...name ? { client_name: name } : {},
+      ...clientSecret ? { client_secret: clientSecret, client_secret_expires_at: 0 } : {}
+    }, 201);
+  }, "register");
+  const page = /* @__PURE__ */ __name((params, client, message) => {
+    const hidden = ["response_type", "client_id", "redirect_uri", "code_challenge", "code_challenge_method", "state"].map((name) => `<input type="hidden" name="${name}" value="${escapeHtml(params.get(name) ?? "")}">`).join("");
+    const who = escapeHtml(client.name ?? "an application");
+    const target = new URL(params.get("redirect_uri") ?? "");
+    const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(appName)} login</title><style>body{font:16px system-ui,sans-serif;max-width:28rem;margin:3rem auto;padding:0 1rem;color:#1d2430}input[type=text]{font:20px ui-monospace,monospace;letter-spacing:.1em;width:100%;padding:.5rem;margin:.5rem 0 1rem;box-sizing:border-box}button{font:inherit;padding:.5rem 1rem}.error{color:#b42318}</style></head><body><h1>${escapeHtml(appName)}</h1><p>An app that calls itself <strong>${who}</strong> asks to reach your messages through <code>${escapeHtml(appName)} mcp --http</code>.</p><p>After you allow it, the login goes to <strong>${escapeHtml(target.host)}</strong>. Allow only if that is the app you are connecting, such as chatgpt.com or claude.ai.</p><p>Type the code shown in WireCat Desktop, or in the terminal where the server runs. If you did not start this login, close this page.</p>${message ? `<p class="error">${escapeHtml(message)}</p>` : ""}<form method="post" action="${escapeHtml(`${base}/authorize`)}">${hidden}<label>Login code<input type="text" name="login_code" autocomplete="off" autofocus required></label><button type="submit">Allow</button></form></body></html>`;
+    return new Response(html, {
+      status: message ? 400 : 200,
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "x-frame-options": "DENY",
+        "content-security-policy": `default-src 'none'; style-src 'unsafe-inline'; form-action 'self' ${target.origin}; frame-ancestors 'none'`,
+        // no-referrer makes the browser post this form with `Origin: null`, which the Origin check refuses.
+        "referrer-policy": "same-origin"
+      }
+    });
+  }, "page");
+  const authorize = /* @__PURE__ */ __name(async (request) => {
+    const params = request.method === "POST" ? new URLSearchParams(await request.text()) : new URL(request.url).searchParams;
+    const stored = store.read();
+    const client = stored.clients.find((one) => one.id === params.get("client_id"));
+    const redirectUri = params.get("redirect_uri") ?? "";
+    if (!client?.redirectUris.includes(redirectUri))
+      return new Response("Unknown client or redirect address.", { status: 400 });
+    if (params.get("response_type") !== "code" || params.get("code_challenge_method") !== "S256" || !params.get("code_challenge"))
+      return new Response("This server needs response_type=code and PKCE with S256.", { status: 400 });
+    if (request.method !== "POST")
+      return page(params, client);
+    const throttled = /* @__PURE__ */ __name(() => new Response("Too many wrong codes. Wait, then try the new code.", {
+      status: 429,
+      headers: { "retry-after": String(Math.ceil((retryAt - now()) / 1e3)) }
+    }), "throttled");
+    if (wrong >= WRONG_TRIES) {
+      if (now() < retryAt)
+        return throttled();
+      wrong = 0;
+      freshCode();
+    }
+    const typed = (params.get("login_code") ?? "").trim().toUpperCase();
+    if (login.expires < now()) {
+      freshCode();
+      return page(params, client, "The code expired. A new one is shown in WireCat Desktop and in the terminal.");
+    }
+    if (!same(typed, login.value)) {
+      wrong += 1;
+      if (wrong >= WRONG_TRIES) {
+        retryAt = now() + WRONG_CODE_WAIT_MS;
+        return throttled();
+      }
+      return page(params, client, `Wrong code. Each code works for one login: after an app logs in, a new one appears in WireCat Desktop and in "${appName} mcp server status". ${WRONG_TRIES - wrong} tries left.`);
+    }
+    wrong = 0;
+    freshCode();
+    const code = secret();
+    codes.set(hash(code), {
+      clientId: client.id,
+      redirectUri,
+      challenge: params.get("code_challenge") ?? "",
+      expires: now() + AUTH_CODE_MS
+    });
+    const target = new URL(redirectUri);
+    target.searchParams.set("code", code);
+    const state = params.get("state");
+    if (state)
+      target.searchParams.set("state", state);
+    target.searchParams.set("iss", issuer.href);
+    return new Response(null, { status: 302, headers: { location: target.href, "cache-control": "no-store" } });
+  }, "authorize");
+  const token = /* @__PURE__ */ __name(async (request) => {
+    const form = new URLSearchParams(await request.text());
+    const stored = store.read();
+    const client = clientOf(stored, request, form);
+    if (!client)
+      return oauthError("invalid_client", "unknown client or wrong secret", 401);
+    const requestedResource = form.get("resource");
+    if (requestedResource && requestedResource !== resource.href)
+      return oauthError("invalid_target", "this server issues tokens only for its own MCP endpoint");
+    if (form.get("grant_type") === "authorization_code") {
+      const key = hash(form.get("code") ?? "");
+      const entry = codes.get(key);
+      codes.delete(key);
+      const verifier2 = form.get("code_verifier") ?? "";
+      const challenge = createHash("sha256").update(verifier2).digest("base64url");
+      if (!entry || entry.expires < now() || entry.clientId !== client.id || entry.redirectUri !== form.get("redirect_uri") || !same(challenge, entry.challenge))
+        return oauthError("invalid_grant", "the code is wrong, used or expired");
+      return issue(stored, client.id);
+    }
+    if (form.get("grant_type") === "refresh_token") {
+      const key = hash(form.get("refresh_token") ?? "");
+      const seconds = Math.floor(now() / 1e3);
+      const found = stored.tokens.find((one) => one.kind === "refresh" && one.hash === key);
+      if (!found || found.clientId !== client.id || found.expiresAt <= seconds)
+        return oauthError("invalid_grant", "the refresh token is wrong, used or expired");
+      stored.tokens = stored.tokens.filter((one) => one !== found);
+      return issue(stored, client.id);
+    }
+    return oauthError("unsupported_grant_type", "use authorization_code or refresh_token");
+  }, "token");
+  const verifier = {
+    verifyAccessToken: /* @__PURE__ */ __name(async (presented) => {
+      const seconds = Math.floor(now() / 1e3);
+      const stored = store.read();
+      const found = stored.tokens.find((one) => one.kind === "access" && one.hash === hash(presented));
+      if (!found || found.expiresAt <= seconds)
+        throw new OAuthError(OAuthErrorCode.InvalidToken, "the token is unknown or expired");
+      const clientName = stored.clients.find((one) => one.id === found.clientId)?.name;
+      return {
+        token: presented,
+        clientId: found.clientId,
+        scopes: [],
+        expiresAt: found.expiresAt,
+        resource,
+        ...clientName ? { extra: { clientName } } : {}
+      };
+    }, "verifyAccessToken")
+  };
+  return {
+    code: /* @__PURE__ */ __name(() => login.value, "code"),
+    close: /* @__PURE__ */ __name(() => clearTimeout(renewal), "close"),
+    metadata,
+    verifier,
+    handle: /* @__PURE__ */ __name(async (request, path = new URL(request.url).pathname) => {
+      if (path === `${base}/register` && request.method === "POST")
+        return register(request);
+      if (path === `${base}/authorize` && (request.method === "GET" || request.method === "POST"))
+        return authorize(request);
+      if (path === `${base}/token` && request.method === "POST")
+        return token(request);
+      return void 0;
+    }, "handle")
+  };
+}, "ownerLogin");
+
+export {
+  revokeAll,
+  ownerLogin
+};

package/dist/bundle/chunk-ZVVMGPBJ.js

@@ -0,0 +1,50 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __name,
+  __require,
+  __commonJS,
+  __export,
+  __toESM
+};