@xopcai/xopc 0.0.369 → 0.0.371

package/dist/src/agent/mcp/oauth/index.js

@@ -1,6 +0,0 @@
-import { McpAuthorizationRequiredError, isMcpAuthorizationError } from "./mcp-oauth-errors.js";
-import { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey } from "./mcp-oauth-store.js";
-import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
-import { McpOAuthSession } from "./mcp-oauth-session.js";
-import { McpOAuthManager, getMcpOAuthManager } from "./mcp-oauth-manager.js";
-export { McpAuthorizationRequiredError, McpOAuthManager, McpOAuthSession, McpOAuthStore, XopcMcpOAuthClientProvider, canonicalMcpServerUrl, getMcpOAuthManager, isMcpAuthorizationError, mcpOAuthServerKey };

package/dist/src/agent/mcp/oauth/mcp-oauth-errors.d.ts

@@ -1,5 +0,0 @@
-export declare class McpAuthorizationRequiredError extends Error {
-    readonly code = "MCP_AUTHORIZATION_REQUIRED";
-    constructor(message?: string);
-}
-export declare function isMcpAuthorizationError(error: unknown): boolean;

package/dist/src/agent/mcp/oauth/mcp-oauth-errors.js

@@ -1,14 +0,0 @@
-import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-//#region src/agent/mcp/oauth/mcp-oauth-errors.ts
-var McpAuthorizationRequiredError = class extends Error {
-	code = "MCP_AUTHORIZATION_REQUIRED";
-	constructor(message = "MCP server authorization is required") {
-		super(message);
-		this.name = "McpAuthorizationRequiredError";
-	}
-};
-function isMcpAuthorizationError(error) {
-	return error instanceof UnauthorizedError || error instanceof McpAuthorizationRequiredError;
-}
-//#endregion
-export { McpAuthorizationRequiredError, isMcpAuthorizationError };

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.d.ts

@@ -1,30 +0,0 @@
-import type { Config } from '../../../config/schema.js';
-import { McpOAuthStore } from './mcp-oauth-store.js';
-import type { McpOAuthSessionSnapshot } from './mcp-oauth-types.js';
-export type McpOAuthConnectionStatus = 'not_configured' | 'disconnected' | 'authorizing' | 'connected' | 'error';
-export type McpOAuthStatus = {
-    configured: boolean;
-    status: McpOAuthConnectionStatus;
-    session?: McpOAuthSessionSnapshot;
-};
-type StartMcpOAuthParams = {
-    serverId: string;
-    rawServer: unknown;
-    cfg?: Config;
-};
-export declare class McpOAuthManager {
-    private readonly store;
-    private readonly sessionsByServerUrl;
-    private readonly pending;
-    private cancelling;
-    constructor(store?: McpOAuthStore);
-    status(serverId: string, rawServer: unknown): Promise<McpOAuthStatus>;
-    start(params: StartMcpOAuthParams): Promise<McpOAuthStatus>;
-    cancelPending(): Promise<void>;
-    private startSession;
-    disconnect(serverId: string, rawServer: unknown): Promise<McpOAuthStatus>;
-    submitCallback(serverId: string, rawServer: unknown, callbackUrl: string): Promise<McpOAuthStatus>;
-    private finishAuthorization;
-}
-export declare function getMcpOAuthManager(rawServer?: unknown): McpOAuthManager;
-export {};

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.js

@@ -1,276 +0,0 @@
-import { createLogger } from "../../../utils/logger/index.js";
-import { init_logger } from "../../../utils/logger.js";
-import { init_global_singleton, resolveGlobalSingleton } from "../../../utils/global-singleton.js";
-import { resolveConnectorSecretReferences } from "../../../connectors/secret-store.js";
-import { recordPluginMcpHealth } from "../../../extensions/agent-plugins/health.js";
-import { redactSensitiveUrlLikeString } from "../../../utils/redact-sensitive-url.js";
-import { resolveMcpTransportConfig } from "../mcp-transport-config.js";
-import { isMcpAuthorizationError } from "./mcp-oauth-errors.js";
-import { McpOAuthStore, canonicalMcpServerUrl } from "./mcp-oauth-store.js";
-import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
-import { pluginOAuthScope } from "../../../extensions/agent-plugins/plugin-oauth-scope.js";
-import { resolveMcpTransport } from "../mcp-transport.js";
-import { disposeAllSessionMcpRuntimes } from "../bundle-mcp-runtime.js";
-import { McpOAuthSession } from "./mcp-oauth-session.js";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-//#region src/agent/mcp/oauth/mcp-oauth-manager.ts
-init_logger();
-init_global_singleton();
-const log = createLogger("Mcp:OAuth");
-const MCP_OAUTH_MANAGER_KEY = Symbol.for("xopc.mcpOAuthManager");
-function createClient() {
-	return new Client({
-		name: "xopc-mcp-oauth",
-		version: "0.0.0"
-	});
-}
-async function connectClient(client, resolved) {
-	await new Promise((resolve, reject) => {
-		const timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`MCP server connection timed out after ${resolved.connectionTimeoutMs}ms`)), resolved.connectionTimeoutMs);
-		client.connect(resolved.transport).then(() => {
-			clearTimeout(timer);
-			resolve();
-		}, (error) => {
-			clearTimeout(timer);
-			reject(error);
-		});
-	});
-}
-async function closeConnection(client, resolved) {
-	await client.close().catch(() => {});
-	await resolved.transport.close().catch(() => {});
-	resolved.detachStderr?.();
-}
-function isAuthorizing(snapshot) {
-	return [
-		"starting",
-		"waiting_browser",
-		"exchanging_code"
-	].includes(snapshot.status);
-}
-var McpOAuthManager = class {
-	store;
-	sessionsByServerUrl = /* @__PURE__ */ new Map();
-	pending = /* @__PURE__ */ new Set();
-	cancelling = false;
-	constructor(store = new McpOAuthStore()) {
-		this.store = store;
-	}
-	async status(serverId, rawServer) {
-		const resolved = resolveMcpTransportConfig(serverId, rawServer);
-		if (!resolved || resolved.kind !== "http" || !resolved.auth) return {
-			configured: false,
-			status: "not_configured"
-		};
-		const session = this.sessionsByServerUrl.get(canonicalMcpServerUrl(resolved.url))?.snapshot();
-		if (session) {
-			if (isAuthorizing(session)) return {
-				configured: true,
-				status: "authorizing",
-				session
-			};
-			if (session.status === "failed" || session.status === "expired") return {
-				configured: true,
-				status: "error",
-				session
-			};
-			if (session.status === "connected") return {
-				configured: true,
-				status: "connected",
-				session
-			};
-		}
-		return {
-			configured: true,
-			status: (await this.store.load(resolved.url))?.tokens ? "connected" : "disconnected",
-			session
-		};
-	}
-	async start(params) {
-		if (this.cancelling) throw new Error("OAuth connections are being cleared");
-		const task = this.startSession(params);
-		this.pending.add(task);
-		try {
-			return await task;
-		} finally {
-			this.pending.delete(task);
-		}
-	}
-	async cancelPending() {
-		this.cancelling = true;
-		try {
-			await Promise.all([...this.sessionsByServerUrl.values()].map((session) => session.close()));
-			await Promise.allSettled([...this.pending]);
-			this.sessionsByServerUrl.clear();
-		} finally {
-			this.cancelling = false;
-		}
-	}
-	async startSession(params) {
-		const rawServer = await resolveConnectorSecretReferences(params.rawServer);
-		if (this.cancelling) throw new Error("OAuth connections are being cleared");
-		const resolvedConfig = resolveMcpTransportConfig(params.serverId, rawServer);
-		if (!resolvedConfig || resolvedConfig.kind !== "http" || !resolvedConfig.auth) throw new Error(`MCP server "${params.serverId}" is not configured for OAuth`);
-		const serverUrl = new URL(resolvedConfig.url);
-		const conversationId = canonicalMcpServerUrl(serverUrl);
-		const previous = this.sessionsByServerUrl.get(conversationId);
-		if (previous && isAuthorizing(previous.snapshot())) return this.status(params.serverId, params.rawServer);
-		if (previous) await previous.close();
-		const session = new McpOAuthSession(params.serverId, serverUrl);
-		this.sessionsByServerUrl.set(conversationId, session);
-		try {
-			await session.start();
-		} catch (error) {
-			this.sessionsByServerUrl.delete(conversationId);
-			throw error;
-		}
-		try {
-			await this.store.update(serverUrl, (current) => current ? {
-				...current,
-				clientInformation: void 0,
-				tokens: void 0,
-				tokensSavedAt: void 0
-			} : void 0);
-		} catch (error) {
-			session.fail(error);
-			throw error;
-		}
-		let provider;
-		let resolved;
-		try {
-			provider = new XopcMcpOAuthClientProvider({
-				serverUrl,
-				clientId: resolvedConfig.auth.clientId,
-				store: this.store,
-				interaction: {
-					redirectUrl: session.redirectUrl,
-					state: session.state,
-					onRedirect: (authorizationUrl) => session.setAuthorizationUrl(authorizationUrl)
-				}
-			});
-			resolved = await resolveMcpTransport(params.serverId, rawServer, params.cfg, {
-				oauthProvider: provider,
-				oauthStore: this.store
-			});
-		} catch (error) {
-			session.fail(error);
-			return this.status(params.serverId, params.rawServer);
-		}
-		if (!resolved || resolved.transportType !== "streamable-http") {
-			session.fail(/* @__PURE__ */ new Error("MCP OAuth requires a streamable HTTP transport"));
-			await resolved?.transport.close().catch(() => {});
-			return this.status(params.serverId, params.rawServer);
-		}
-		const client = createClient();
-		try {
-			await connectClient(client, resolved);
-			if (session.snapshot().status === "cancelled") {
-				await this.store.delete(serverUrl);
-				await closeConnection(client, resolved);
-				return {
-					configured: true,
-					status: "disconnected"
-				};
-			}
-			session.complete();
-			recordPluginMcpHealth(rawServer, "ready");
-			await closeConnection(client, resolved);
-			await disposeAllSessionMcpRuntimes();
-		} catch (error) {
-			if (session.snapshot().status === "cancelled") {
-				await this.store.delete(serverUrl);
-				await closeConnection(client, resolved);
-			} else if (!isMcpAuthorizationError(error) || !session.snapshot().authorizationUrl) {
-				session.fail(error);
-				await closeConnection(client, resolved);
-			} else {
-				const task = this.finishAuthorization({
-					session,
-					provider,
-					client,
-					resolved,
-					params: {
-						...params,
-						rawServer
-					}
-				});
-				this.pending.add(task);
-				task.finally(() => this.pending.delete(task));
-			}
-		}
-		return this.status(params.serverId, params.rawServer);
-	}
-	async disconnect(serverId, rawServer) {
-		const resolved = resolveMcpTransportConfig(serverId, rawServer);
-		if (!resolved || resolved.kind !== "http" || !resolved.auth) throw new Error(`MCP server "${serverId}" is not configured for OAuth`);
-		const conversationId = canonicalMcpServerUrl(resolved.url);
-		const session = this.sessionsByServerUrl.get(conversationId);
-		this.sessionsByServerUrl.delete(conversationId);
-		if (session) await session.close();
-		await this.store.delete(resolved.url);
-		recordPluginMcpHealth(rawServer, "authorization_required");
-		await disposeAllSessionMcpRuntimes();
-		return {
-			configured: true,
-			status: "disconnected"
-		};
-	}
-	async submitCallback(serverId, rawServer, callbackUrl) {
-		const resolved = resolveMcpTransportConfig(serverId, rawServer);
-		if (!resolved || resolved.kind !== "http") throw new Error("Unknown OAuth server");
-		const session = this.sessionsByServerUrl.get(canonicalMcpServerUrl(resolved.url));
-		if (!session) throw new Error("OAuth session not found");
-		session.submitCallback(callbackUrl);
-		return this.status(serverId, rawServer);
-	}
-	async finishAuthorization(context) {
-		const { session, provider, client, resolved, params } = context;
-		try {
-			const code = await session.waitForCode();
-			await resolved.transport.finishAuth(code);
-			if (session.snapshot().status === "cancelled") {
-				await this.store.delete(session.serverUrl);
-				await closeConnection(client, resolved);
-				return;
-			}
-			await closeConnection(client, resolved);
-			const authenticated = await resolveMcpTransport(params.serverId, params.rawServer, params.cfg, {
-				oauthProvider: provider,
-				oauthStore: this.store
-			});
-			if (!authenticated) throw new Error("MCP transport could not be created after authorization");
-			const authenticatedClient = createClient();
-			try {
-				await connectClient(authenticatedClient, authenticated);
-			} finally {
-				await closeConnection(authenticatedClient, authenticated);
-			}
-			if (session.snapshot().status === "cancelled") {
-				await this.store.delete(session.serverUrl);
-				return;
-			}
-			session.complete();
-			recordPluginMcpHealth(params.rawServer, "ready");
-			await disposeAllSessionMcpRuntimes();
-		} catch (error) {
-			if (session.snapshot().status === "cancelled") {
-				await this.store.delete(session.serverUrl);
-				await closeConnection(client, resolved);
-				return;
-			}
-			session.fail(error);
-			await closeConnection(client, resolved);
-			log.warn({
-				err: error,
-				phase: "mcp.oauth_finish",
-				serverId: params.serverId
-			}, `MCP OAuth failed for server "${params.serverId}": ${redactSensitiveUrlLikeString(error instanceof Error ? error.message : String(error))}`);
-		}
-	}
-};
-function getMcpOAuthManager(rawServer) {
-	const scope = pluginOAuthScope(rawServer);
-	return resolveGlobalSingleton(scope ? Symbol.for(`xopc.mcpOAuthManager:${scope}`) : MCP_OAUTH_MANAGER_KEY, () => new McpOAuthManager(new McpOAuthStore(scope)));
-}
-//#endregion
-export { McpOAuthManager, getMcpOAuthManager };

package/dist/src/agent/mcp/oauth/mcp-oauth-provider.d.ts

@@ -1,33 +0,0 @@
-import type { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
-import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
-import { McpOAuthStore } from './mcp-oauth-store.js';
-export type McpOAuthInteraction = {
-    redirectUrl: URL;
-    state: string;
-    onRedirect: (authorizationUrl: URL) => void | Promise<void>;
-};
-export type McpOAuthClientProviderOptions = {
-    serverUrl: URL;
-    clientId?: string;
-    interaction?: McpOAuthInteraction;
-    store?: McpOAuthStore;
-};
-export declare class XopcMcpOAuthClientProvider implements OAuthClientProvider {
-    private readonly options;
-    private readonly store;
-    private codeVerifierValue?;
-    constructor(options: McpOAuthClientProviderOptions);
-    get redirectUrl(): URL;
-    get clientMetadata(): OAuthClientMetadata;
-    state(): string | undefined;
-    clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
-    saveClientInformation(clientInformation: OAuthClientInformationMixed): Promise<void>;
-    tokens(): Promise<OAuthTokens | undefined>;
-    saveTokens(tokens: OAuthTokens): Promise<void>;
-    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
-    saveCodeVerifier(codeVerifier: string): void;
-    codeVerifier(): string;
-    saveDiscoveryState(discoveryState: OAuthDiscoveryState): Promise<void>;
-    discoveryState(): Promise<OAuthDiscoveryState | undefined>;
-    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): Promise<void>;
-}

package/dist/src/agent/mcp/oauth/mcp-oauth-provider.js

@@ -1,103 +0,0 @@
-import { McpAuthorizationRequiredError } from "./mcp-oauth-errors.js";
-import { McpOAuthStore } from "./mcp-oauth-store.js";
-//#region src/agent/mcp/oauth/mcp-oauth-provider.ts
-var XopcMcpOAuthClientProvider = class {
-	store;
-	codeVerifierValue;
-	constructor(options) {
-		this.options = options;
-		this.store = options.store ?? new McpOAuthStore();
-	}
-	get redirectUrl() {
-		return this.options.interaction?.redirectUrl ?? new URL("http://127.0.0.1/oauth/callback");
-	}
-	get clientMetadata() {
-		return {
-			client_name: "XOPC",
-			client_uri: "https://xopc.ai",
-			redirect_uris: [this.redirectUrl.toString()],
-			grant_types: ["authorization_code", "refresh_token"],
-			response_types: ["code"],
-			token_endpoint_auth_method: "none"
-		};
-	}
-	state() {
-		return this.options.interaction?.state;
-	}
-	async clientInformation() {
-		if (this.options.clientId) return { client_id: this.options.clientId };
-		return (await this.store.load(this.options.serverUrl))?.clientInformation;
-	}
-	async saveClientInformation(clientInformation) {
-		await this.store.update(this.options.serverUrl, (current) => ({
-			...current,
-			version: 1,
-			serverUrl: this.options.serverUrl.toString(),
-			clientInformation,
-			updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
-		}));
-	}
-	async tokens() {
-		return (await this.store.load(this.options.serverUrl))?.tokens;
-	}
-	async saveTokens(tokens) {
-		await this.store.update(this.options.serverUrl, (current) => ({
-			...current,
-			version: 1,
-			serverUrl: this.options.serverUrl.toString(),
-			tokens,
-			tokensSavedAt: Date.now(),
-			updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
-		}));
-	}
-	async redirectToAuthorization(authorizationUrl) {
-		if (!this.options.interaction) throw new McpAuthorizationRequiredError();
-		await this.options.interaction.onRedirect(authorizationUrl);
-	}
-	saveCodeVerifier(codeVerifier) {
-		this.codeVerifierValue = codeVerifier;
-	}
-	codeVerifier() {
-		if (!this.codeVerifierValue) throw new Error("MCP OAuth code verifier is unavailable");
-		return this.codeVerifierValue;
-	}
-	async saveDiscoveryState(discoveryState) {
-		await this.store.update(this.options.serverUrl, (current) => {
-			const authorizationServerChanged = Boolean(current?.discoveryState?.authorizationServerUrl && current.discoveryState.authorizationServerUrl !== discoveryState.authorizationServerUrl);
-			return {
-				...current,
-				version: 1,
-				serverUrl: this.options.serverUrl.toString(),
-				discoveryState,
-				clientInformation: authorizationServerChanged ? void 0 : current?.clientInformation,
-				tokens: authorizationServerChanged ? void 0 : current?.tokens,
-				tokensSavedAt: authorizationServerChanged ? void 0 : current?.tokensSavedAt,
-				updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
-			};
-		});
-	}
-	async discoveryState() {
-		return (await this.store.load(this.options.serverUrl))?.discoveryState;
-	}
-	async invalidateCredentials(scope) {
-		if (scope === "verifier") {
-			this.codeVerifierValue = void 0;
-			return;
-		}
-		await this.store.update(this.options.serverUrl, (current) => {
-			if (!current) return void 0;
-			if (scope === "all") return void 0;
-			return {
-				...current,
-				...scope === "client" ? { clientInformation: void 0 } : {},
-				...scope === "tokens" ? {
-					tokens: void 0,
-					tokensSavedAt: void 0
-				} : {},
-				...scope === "discovery" ? { discoveryState: void 0 } : {}
-			};
-		});
-	}
-};
-//#endregion
-export { XopcMcpOAuthClientProvider };

package/dist/src/agent/mcp/oauth/mcp-oauth-session.d.ts

@@ -1,31 +0,0 @@
-import type { McpOAuthSessionSnapshot } from './mcp-oauth-types.js';
-export declare class McpOAuthSession {
-    readonly serverId: string;
-    readonly serverUrl: URL;
-    readonly id: string;
-    readonly state: string;
-    readonly createdAt: number;
-    readonly expiresAt: number;
-    private statusValue;
-    private authorizationUrlValue?;
-    private errorValue?;
-    private callbackServer?;
-    private redirectUrlValue?;
-    private settleCode?;
-    private callbackConsumed;
-    private readonly codePromise;
-    private timeout?;
-    constructor(serverId: string, serverUrl: URL, ttlMs?: number);
-    get redirectUrl(): URL;
-    start(): Promise<void>;
-    setAuthorizationUrl(url: URL): void;
-    /** Remote Gateway users can submit the browser's loopback callback URL over the authenticated API. */
-    submitCallback(url: string): void;
-    waitForCode(): Promise<string>;
-    complete(): void;
-    fail(error: unknown): void;
-    cancel(): void;
-    snapshot(): McpOAuthSessionSnapshot;
-    close(): Promise<void>;
-    private closeServer;
-}

package/dist/src/agent/mcp/oauth/mcp-oauth-session.js

@@ -1,181 +0,0 @@
-import { randomBytes, randomUUID } from "node:crypto";
-import { createServer } from "node:http";
-//#region src/agent/mcp/oauth/mcp-oauth-session.ts
-const CALLBACK_PATH = "/oauth/callback";
-const DEFAULT_SESSION_TTL_MS = 600 * 1e3;
-function callbackPage(title, message) {
-	return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><h1>${title}</h1><p>${message}</p></body></html>`;
-}
-var McpOAuthSession = class {
-	id = `mcp_oauth_${randomUUID()}`;
-	state = randomBytes(24).toString("base64url");
-	createdAt = Date.now();
-	expiresAt;
-	statusValue = "starting";
-	authorizationUrlValue;
-	errorValue;
-	callbackServer;
-	redirectUrlValue;
-	settleCode;
-	callbackConsumed = false;
-	codePromise;
-	timeout;
-	constructor(serverId, serverUrl, ttlMs = DEFAULT_SESSION_TTL_MS) {
-		this.serverId = serverId;
-		this.serverUrl = serverUrl;
-		this.expiresAt = this.createdAt + ttlMs;
-		this.codePromise = new Promise((resolve) => {
-			this.settleCode = resolve;
-		});
-	}
-	get redirectUrl() {
-		if (!this.redirectUrlValue) throw new Error("MCP OAuth callback server has not started");
-		return this.redirectUrlValue;
-	}
-	async start() {
-		if (this.callbackServer) return;
-		const server = createServer((request, response) => {
-			response.setHeader("content-type", "text/html; charset=utf-8");
-			response.setHeader("cache-control", "no-store");
-			response.setHeader("referrer-policy", "no-referrer");
-			response.setHeader("x-content-type-options", "nosniff");
-			try {
-				const callback = new URL(request.url ?? "", "http://127.0.0.1");
-				if (callback.pathname !== CALLBACK_PATH) {
-					response.statusCode = 404;
-					response.end(callbackPage("Not found", "This is not an XOPC OAuth callback."));
-					return;
-				}
-				if (callback.searchParams.get("state") !== this.state) {
-					response.statusCode = 400;
-					response.end(callbackPage("Authorization failed", "MCP OAuth state mismatch"));
-					return;
-				}
-				if (this.callbackConsumed) {
-					response.statusCode = 409;
-					response.end(callbackPage("Authorization already handled", "Return to XOPC to continue."));
-					return;
-				}
-				const oauthError = callback.searchParams.get("error");
-				const code = callback.searchParams.get("code");
-				if (oauthError || !code) {
-					const error = /* @__PURE__ */ new Error(oauthError === "access_denied" ? "Authorization was denied" : "Authorization code is missing");
-					response.statusCode = 400;
-					response.end(callbackPage("Authorization failed", error.message));
-					this.fail(error);
-					return;
-				}
-				this.callbackConsumed = true;
-				this.statusValue = "exchanging_code";
-				response.statusCode = 200;
-				response.end(callbackPage("Authorization complete", "Return to XOPC to finish connecting the MCP server."));
-				this.settleCode?.({ code });
-				this.settleCode = void 0;
-			} catch {
-				const error = /* @__PURE__ */ new Error("MCP OAuth callback could not be processed");
-				response.statusCode = 500;
-				response.end(callbackPage("Authorization failed", error.message));
-				this.fail(error);
-			}
-		});
-		this.callbackServer = server;
-		try {
-			this.redirectUrlValue = await new Promise((resolve, reject) => {
-				server.once("error", reject);
-				server.listen(0, "127.0.0.1", () => {
-					server.removeListener("error", reject);
-					const address = server.address();
-					if (!address || typeof address === "string") {
-						reject(/* @__PURE__ */ new Error("MCP OAuth callback server did not expose a TCP port"));
-						return;
-					}
-					resolve(new URL(`http://127.0.0.1:${address.port}${CALLBACK_PATH}`));
-				});
-			});
-		} catch (error) {
-			this.callbackServer = void 0;
-			server.close();
-			throw error;
-		}
-		this.timeout = setTimeout(() => {
-			this.statusValue = "expired";
-			this.errorValue = "MCP OAuth session expired";
-			this.settleCode?.({ error: new Error(this.errorValue) });
-			this.settleCode = void 0;
-			this.closeServer();
-		}, Math.max(1, this.expiresAt - Date.now()));
-		this.timeout.unref?.();
-	}
-	setAuthorizationUrl(url) {
-		this.authorizationUrlValue = url.toString();
-		this.statusValue = "waiting_browser";
-	}
-	/** Remote Gateway users can submit the browser's loopback callback URL over the authenticated API. */
-	submitCallback(url) {
-		const callback = new URL(url);
-		if (callback.origin !== this.redirectUrl.origin || callback.pathname !== CALLBACK_PATH || callback.searchParams.get("state") !== this.state) throw new Error("MCP OAuth callback mismatch");
-		if (this.statusValue !== "waiting_browser" || this.callbackConsumed || Date.now() >= this.expiresAt) throw new Error("MCP OAuth session is not waiting for a callback");
-		const code = callback.searchParams.get("code");
-		if (!code || callback.searchParams.has("error")) throw new Error("MCP OAuth authorization code is missing or denied");
-		this.callbackConsumed = true;
-		this.statusValue = "exchanging_code";
-		this.settleCode?.({ code });
-		this.settleCode = void 0;
-	}
-	async waitForCode() {
-		const result = await this.codePromise;
-		if (result.error) throw result.error;
-		if (!result.code) throw new Error("MCP OAuth authorization code is unavailable");
-		return result.code;
-	}
-	complete() {
-		this.statusValue = "connected";
-		this.errorValue = void 0;
-		this.closeServer();
-	}
-	fail(error) {
-		this.statusValue = "failed";
-		this.errorValue = error instanceof Error ? error.message : String(error);
-		this.settleCode?.({ error: error instanceof Error ? error : new Error(String(error)) });
-		this.settleCode = void 0;
-		this.closeServer();
-	}
-	cancel() {
-		if ([
-			"connected",
-			"failed",
-			"expired",
-			"cancelled"
-		].includes(this.statusValue)) return;
-		this.statusValue = "cancelled";
-		this.settleCode?.({ error: /* @__PURE__ */ new Error("MCP OAuth session cancelled") });
-		this.settleCode = void 0;
-		this.closeServer();
-	}
-	snapshot() {
-		return {
-			id: this.id,
-			serverId: this.serverId,
-			serverUrl: this.serverUrl.toString(),
-			status: this.statusValue,
-			authorizationUrl: this.authorizationUrlValue,
-			error: this.errorValue,
-			createdAt: this.createdAt,
-			expiresAt: this.expiresAt
-		};
-	}
-	async close() {
-		this.cancel();
-		await this.closeServer();
-	}
-	async closeServer() {
-		if (this.timeout) clearTimeout(this.timeout);
-		this.timeout = void 0;
-		const server = this.callbackServer;
-		this.callbackServer = void 0;
-		if (!server) return;
-		await new Promise((resolve) => server.close(() => resolve()));
-	}
-};
-//#endregion
-export { McpOAuthSession };