apex-code 0.0.1-alpha.8 → 0.0.4

package/dist/core/mcp/oauth/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/flow.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,2BAA2B,EAAkB,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAElF,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAU5C,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AACtC,6FAA6F;AAC7F,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,aAAa,GAAG,WAAW,CAAC;AAgBlC;;;;GAIG;AACH,MAAM,gBAAgB;IACZ,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,WAAW,GAAG,EAAE,CAAC;IACT,MAAM,CAAqB;IAC3B,WAAW,CAAuC;IAE1D,KAAK,CAAC,KAAK,GAAkB;QAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,cAAc,CAAC,+CAA+C,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;IAAA,CACtE;IAEO,MAAM,CAAC,OAAwB,EAAE,QAAwB,EAAQ;QACxE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAAC;YACjD,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YAC7D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAA,CACnB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,oBAAoB,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YAC9B,OAAO;QACR,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAAA,CAChB;IAED,gFAAgF;IAChF,IAAI,CAAC,SAAiB,EAAmB;QACxC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,cAAc,CAAC,mBAAmB,SAAS,2CAA2C,CAAC,CAAC,CAAC;YAAA,CACpG,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YAAA,CACd,CAAC;QAAA,CACF,CAAC,CAAC;IAAA,CACH;IAED,KAAK,GAAkB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAAA,CAC/D;CACD;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B,EAA+B;IAChG,MAAM,IAAI,GAAqB;QAC9B,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK;QAC9C,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG;QAClC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,kBAAkB;KACxD,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEvB,IAAI,eAAmC,CAAC;QACxC,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAClF,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;QACnE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;gBACpC,MAAM,IAAI,cAAc,CACvB,iCAAiC,OAAO,CAAC,UAAU,4HAA4H,QAAQ,CAAC,WAAW,0BAA0B,CAC7N,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC;gBACvC,oBAAoB,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBAC5D,UAAU,EAAE,6BAA2B,OAAO,CAAC,UAAU,GAAG;gBAC5D,YAAY,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACpC,KAAK,EAAE,IAAI,CAAC,KAAK;aACjB,CAAC,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QAChC,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC7D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,IAAI,CAAC,KAAK,CAAC,cAAc,OAAO,CAAC,UAAU,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC;YACJ,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACR,mEAAmE;QACpE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;YAC7C,aAAa,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC9C,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ;YACR,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,gBAAgB,GAAG,IAAI,GAAG,cAAc,CAAC;QAC9E,MAAM,UAAU,GAAe;YAC9B,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,KAAK,CAAC,WAAW;YACzB,sEAAsE;YACtE,OAAO,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YACjC,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ;SACR,CAAC;QACF,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/F,OAAO,EAAE,SAAS,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IACC,KAAK,YAAY,cAAc;YAC/B,KAAK,YAAY,mBAAmB;YACpC,KAAK,YAAY,kBAAkB,EAClC,CAAC;YACF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,mBAAmB,OAAO,CAAC,UAAU,aAAa,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;YAAS,CAAC;QACV,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AAAA,CACD","sourcesContent":["/**\n * The user-initiated OAuth authorization flow for one MCP server: authorization-code\n * with PKCE against a loopback callback listener that exists only for the duration of\n * the flow. Per ADR 0023's posture, nothing here is reachable from a tool call — the\n * command is the only entry point.\n */\n\nimport { randomBytes } from \"node:crypto\";\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { discoverAuthorizationServer, type FetchLike, OAuthDiscoveryError, oauthErrorMessage } from \"./discover.ts\";\nimport { mcpCredentialKey } from \"./mcp-token.ts\";\nimport { createPkcePair } from \"./pkce.ts\";\nimport { registerClient } from \"./register.ts\";\nimport { exchangeAuthorizationCode, TokenEndpointError } from \"./token-client.ts\";\n\nexport class OAuthFlowError extends Error {}\n\nexport interface McpOAuthFlowDeps {\n\tprint: (line: string) => void;\n\topenBrowser: (url: string) => void;\n\tfetch: FetchLike;\n\tnow: () => number;\n\ttimeoutMs: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60_000;\n/** Store the token as expiring a minute early, so in-flight calls never ride it to death. */\nconst EXPIRY_SKEW_MS = 60_000;\nconst CALLBACK_PATH = \"/callback\";\n\nexport interface McpOAuthFlowOptions {\n\tserverName: string;\n\tserverUrl: string;\n\tcredentials: CredentialStore;\n\t/** A manually registered client id; skips dynamic registration when present. */\n\tclientId?: string;\n\tclientSecret?: string;\n\tdeps?: Partial<McpOAuthFlowDeps>;\n}\n\nexport interface McpOAuthFlowResult {\n\texpiresAt: number;\n}\n\n/**\n * Accepts exactly one callback carrying the issued `state`, then stops. A request with\n * the wrong state is answered 400 and the listener stays available for the real one;\n * after the right one, the socket is closed before the flow proceeds to the exchange.\n */\nclass LoopbackCallback {\n\treadonly state = randomBytes(16).toString(\"base64url\");\n\tredirectUri = \"\";\n\tprivate server: Server | undefined;\n\tprivate resolveCode: ((code: string) => void) | undefined;\n\n\tasync start(): Promise<void> {\n\t\tconst server = createServer((request, response) => this.handle(request, response));\n\t\tawait new Promise<void>((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n\t\tconst address = server.address();\n\t\tif (address === null || typeof address === \"string\") {\n\t\t\tthrow new OAuthFlowError(\"could not bind the loopback callback listener\");\n\t\t}\n\t\tthis.server = server;\n\t\tthis.redirectUri = `http://127.0.0.1:${address.port}${CALLBACK_PATH}`;\n\t}\n\n\tprivate handle(request: IncomingMessage, response: ServerResponse): void {\n\t\tconst respond = (status: number, body: string) => {\n\t\t\tresponse.writeHead(status, { \"content-type\": \"text/plain\" });\n\t\t\tresponse.end(body);\n\t\t};\n\t\tconst port = this.server?.address();\n\t\tconst origin = `http://127.0.0.1:${port !== null && typeof port === \"object\" ? port.port : 0}`;\n\t\tconst url = new URL(String(request.url), origin);\n\t\tif (url.pathname !== CALLBACK_PATH) {\n\t\t\trespond(404, \"not found\");\n\t\t\treturn;\n\t\t}\n\t\tif (url.searchParams.get(\"state\") !== this.state) {\n\t\t\trespond(400, \"invalid state\");\n\t\t\treturn;\n\t\t}\n\t\tconst code = url.searchParams.get(\"code\");\n\t\tif (!code) {\n\t\t\trespond(400, \"missing code\");\n\t\t\treturn;\n\t\t}\n\t\trespond(200, \"Authorization complete. You can close this tab.\");\n\t\tconst resolve = this.resolveCode;\n\t\tthis.resolveCode = undefined;\n\t\tresolve?.(code);\n\t}\n\n\t/** Resolves with the authorization code, or rejects when the flow times out. */\n\tcode(timeoutMs: number): Promise<string> {\n\t\treturn new Promise<string>((resolve, reject) => {\n\t\t\tconst timer = setTimeout(() => {\n\t\t\t\treject(new OAuthFlowError(`timed out after ${timeoutMs} ms waiting for authorization to complete`));\n\t\t\t}, timeoutMs);\n\t\t\tthis.resolveCode = (code) => {\n\t\t\t\tclearTimeout(timer);\n\t\t\t\tresolve(code);\n\t\t\t};\n\t\t});\n\t}\n\n\tclose(): Promise<void> {\n\t\tconst server = this.server;\n\t\tif (!server) return Promise.resolve();\n\t\treturn new Promise((resolve) => server.close(() => resolve()));\n\t}\n}\n\nexport async function runMcpOAuthFlow(options: McpOAuthFlowOptions): Promise<McpOAuthFlowResult> {\n\tconst deps: McpOAuthFlowDeps = {\n\t\tprint: options.deps?.print ?? ((line: string) => console.log(line)),\n\t\topenBrowser: options.deps?.openBrowser ?? (() => {}),\n\t\tfetch: options.deps?.fetch ?? globalThis.fetch,\n\t\tnow: options.deps?.now ?? Date.now,\n\t\ttimeoutMs: options.deps?.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n\t};\n\tconst callback = new LoopbackCallback();\n\ttry {\n\t\tawait callback.start();\n\n\t\tlet wwwAuthenticate: string | undefined;\n\t\ttry {\n\t\t\tconst probe = await deps.fetch(new URL(options.serverUrl), { redirect: \"error\" });\n\t\t\twwwAuthenticate = probe.headers.get(\"www-authenticate\") ?? undefined;\n\t\t} catch {\n\t\t\t// The probe is advisory; discovery falls back to well-known URIs.\n\t\t}\n\t\tconst metadata = await discoverAuthorizationServer({\n\t\t\tserverUrl: options.serverUrl,\n\t\t\twwwAuthenticate,\n\t\t\tfetch: deps.fetch,\n\t\t});\n\n\t\tlet clientId = options.clientId;\n\t\tif (!clientId) {\n\t\t\tif (!metadata.registrationEndpoint) {\n\t\t\t\tthrow new OAuthFlowError(\n\t\t\t\t\t`The authorization server for \"${options.serverName}\" supports no dynamic client registration, so this needs manual client registration: register a client with redirect URI ${callback.redirectUri} and pass its client id.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst registered = await registerClient({\n\t\t\t\tregistrationEndpoint: new URL(metadata.registrationEndpoint),\n\t\t\t\tclientName: `Apex Code — MCP server \"${options.serverName}\"`,\n\t\t\t\tredirectUris: [callback.redirectUri],\n\t\t\t\tfetch: deps.fetch,\n\t\t\t});\n\t\t\tclientId = registered.clientId;\n\t\t}\n\n\t\tconst pkce = createPkcePair();\n\t\tconst authorizeUrl = new URL(metadata.authorizationEndpoint);\n\t\tauthorizeUrl.searchParams.set(\"response_type\", \"code\");\n\t\tauthorizeUrl.searchParams.set(\"client_id\", clientId);\n\t\tauthorizeUrl.searchParams.set(\"redirect_uri\", callback.redirectUri);\n\t\tauthorizeUrl.searchParams.set(\"code_challenge\", pkce.challenge);\n\t\tauthorizeUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n\t\tauthorizeUrl.searchParams.set(\"state\", callback.state);\n\t\tauthorizeUrl.searchParams.set(\"resource\", options.serverUrl);\n\n\t\tdeps.print(`Authorize \"${options.serverName}\" by opening: ${authorizeUrl}`);\n\t\ttry {\n\t\t\tdeps.openBrowser(authorizeUrl.toString());\n\t\t} catch {\n\t\t\t// The URL is printed either way; opening a browser is best-effort.\n\t\t}\n\n\t\tconst code = await callback.code(deps.timeoutMs);\n\t\tconst token = await exchangeAuthorizationCode({\n\t\t\ttokenEndpoint: new URL(metadata.tokenEndpoint),\n\t\t\tcode,\n\t\t\tverifier: pkce.verifier,\n\t\t\tredirectUri: callback.redirectUri,\n\t\t\tclientId,\n\t\t\tclientSecret: options.clientSecret,\n\t\t\tresource: options.serverUrl,\n\t\t\tfetch: deps.fetch,\n\t\t});\n\n\t\tconst expiresAt = deps.now() + token.expiresInSeconds * 1000 - EXPIRY_SKEW_MS;\n\t\tconst credential: Credential = {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: token.accessToken,\n\t\t\t// An absent rotation keeps the refresh token the server still honors.\n\t\t\trefresh: token.refreshToken ?? \"\",\n\t\t\texpires: expiresAt,\n\t\t\ttokenEndpoint: metadata.tokenEndpoint,\n\t\t\tresource: options.serverUrl,\n\t\t\tclientId,\n\t\t};\n\t\tawait options.credentials.modify(mcpCredentialKey(options.serverName), async () => credential);\n\t\treturn { expiresAt };\n\t} catch (error) {\n\t\tif (\n\t\t\terror instanceof OAuthFlowError ||\n\t\t\terror instanceof OAuthDiscoveryError ||\n\t\t\terror instanceof TokenEndpointError\n\t\t) {\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new OAuthFlowError(`OAuth flow for \"${options.serverName}\" failed: ${oauthErrorMessage(error)}`);\n\t} finally {\n\t\tawait callback.close();\n\t}\n}\n"]}

package/dist/core/mcp/oauth/mcp-token.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The MCP credential seam: how an MCP server's OAuth token is keyed, read, and
+ * refreshed through the session's existing `CredentialStore`.
+ *
+ * Which store instance that is depends on where the session runs. On the host it is
+ * `AuthStorage` (direct, lock-serialized writes); in a sandboxed child it is
+ * `SandboxAuthStorage` (reads from the read-only projection, writes through the
+ * supervisor-mediated channel, ADR 0015). A session with neither has a read-only
+ * store whose `modify` throws, which is the fail-closed path: refresh never
+ * silently degrades to "pretend it worked".
+ */
+import type { CredentialStore } from "@earendil-works/pi-ai";
+import type { McpServerConfig } from "../types.ts";
+import { type FetchLike } from "./discover.ts";
+export declare function mcpCredentialKey(serverName: string): string;
+/** Extra fields carried on the `OAuthCredential` index signature, written by the flow. */
+interface McpTokenExtras {
+    tokenEndpoint?: string;
+    resource?: string;
+    clientId?: string;
+}
+export interface StoredServerToken {
+    accessToken: string;
+    /** Empty when the server issued no refresh token; refresh is impossible then. */
+    refreshToken: string;
+    expiresAt: number;
+    extras: McpTokenExtras;
+}
+export declare class McpOAuthRequiredError extends Error {
+}
+export declare class McpOAuthRefreshError extends Error {
+    /** "refused": the server said no; "unavailable": the path to the store or network failed. */
+    stage: "refused" | "unavailable";
+    constructor(message: string, stage: "refused" | "unavailable");
+}
+export declare function authRequired(serverName: string): McpOAuthRequiredError;
+export declare function readServerToken(credentials: CredentialStore, serverName: string): Promise<StoredServerToken | undefined>;
+/**
+ * Returns a current access token for the server, refreshing first when the stored one
+ * is at the edge of expiry. Throws `McpOAuthRequiredError` when nothing is stored and
+ * `McpOAuthRefreshError` when a refresh cannot be completed; both name the auth
+ * command in their message.
+ */
+export declare function ensureFreshServerToken(options: {
+    server: McpServerConfig;
+    credentials: CredentialStore;
+    now?: () => number;
+    fetch?: FetchLike;
+}): Promise<string>;
+export {};
+//# sourceMappingURL=mcp-token.d.ts.map

package/dist/core/mcp/oauth/mcp-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.d.ts","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/mcp-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAA+B,KAAK,SAAS,EAAqB,MAAM,eAAe,CAAC;AAW/F,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,0FAA0F;AAC1F,UAAU,cAAc;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;CACvB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,6FAA6F;IAC7F,KAAK,EAAE,SAAS,GAAG,aAAa,CAAC;IAEjC,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,aAAa,EAG5D;CACD;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,qBAAqB,CAItE;AAqBD,wBAAsB,eAAe,CACpC,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAGxC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACrD,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,eAAe,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8ElB","sourcesContent":["/**\n * The MCP credential seam: how an MCP server's OAuth token is keyed, read, and\n * refreshed through the session's existing `CredentialStore`.\n *\n * Which store instance that is depends on where the session runs. On the host it is\n * `AuthStorage` (direct, lock-serialized writes); in a sandboxed child it is\n * `SandboxAuthStorage` (reads from the read-only projection, writes through the\n * supervisor-mediated channel, ADR 0015). A session with neither has a read-only\n * store whose `modify` throws, which is the fail-closed path: refresh never\n * silently degrades to \"pretend it worked\".\n */\n\nimport type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport type { McpServerConfig } from \"../types.ts\";\nimport { discoverAuthorizationServer, type FetchLike, oauthErrorMessage } from \"./discover.ts\";\nimport {\n\trefreshAccessToken,\n\tTokenEndpointError,\n\tTokenEndpointUnreachableError,\n\ttype TokenResponse,\n} from \"./token-client.ts\";\n\n/** Refresh this long before expiry so an in-flight call never rides a dying token. */\nconst REFRESH_SKEW_MS = 60_000;\n\nexport function mcpCredentialKey(serverName: string): string {\n\treturn `mcp/${serverName}`;\n}\n\n/** Extra fields carried on the `OAuthCredential` index signature, written by the flow. */\ninterface McpTokenExtras {\n\ttokenEndpoint?: string;\n\tresource?: string;\n\tclientId?: string;\n}\n\nexport interface StoredServerToken {\n\taccessToken: string;\n\t/** Empty when the server issued no refresh token; refresh is impossible then. */\n\trefreshToken: string;\n\texpiresAt: number;\n\textras: McpTokenExtras;\n}\n\nexport class McpOAuthRequiredError extends Error {}\n\nexport class McpOAuthRefreshError extends Error {\n\t/** \"refused\": the server said no; \"unavailable\": the path to the store or network failed. */\n\tstage: \"refused\" | \"unavailable\";\n\n\tconstructor(message: string, stage: \"refused\" | \"unavailable\") {\n\t\tsuper(message);\n\t\tthis.stage = stage;\n\t}\n}\n\nexport function authRequired(serverName: string): McpOAuthRequiredError {\n\treturn new McpOAuthRequiredError(\n\t\t`MCP server \"${serverName}\" requires OAuth and has no stored authorization. Run \\`apex-code mcp auth ${serverName}\\` to authorize it, then retry.`,\n\t);\n}\n\nfunction extrasOf(credential: Credential): McpTokenExtras {\n\tif (credential.type !== \"oauth\") return {};\n\tconst extras: McpTokenExtras = {};\n\tif (typeof credential.tokenEndpoint === \"string\") extras.tokenEndpoint = credential.tokenEndpoint;\n\tif (typeof credential.resource === \"string\") extras.resource = credential.resource;\n\tif (typeof credential.clientId === \"string\") extras.clientId = credential.clientId;\n\treturn extras;\n}\n\nfunction toStoredToken(credential: Credential): StoredServerToken | undefined {\n\tif (credential.type !== \"oauth\") return undefined;\n\treturn {\n\t\taccessToken: credential.access,\n\t\trefreshToken: credential.refresh,\n\t\texpiresAt: credential.expires,\n\t\textras: extrasOf(credential),\n\t};\n}\n\nexport async function readServerToken(\n\tcredentials: CredentialStore,\n\tserverName: string,\n): Promise<StoredServerToken | undefined> {\n\tconst credential: Credential | undefined = await credentials.read(mcpCredentialKey(serverName));\n\treturn credential ? toStoredToken(credential) : undefined;\n}\n\n/**\n * Returns a current access token for the server, refreshing first when the stored one\n * is at the edge of expiry. Throws `McpOAuthRequiredError` when nothing is stored and\n * `McpOAuthRefreshError` when a refresh cannot be completed; both name the auth\n * command in their message.\n */\nexport async function ensureFreshServerToken(options: {\n\tserver: McpServerConfig;\n\tcredentials: CredentialStore;\n\tnow?: () => number;\n\tfetch?: FetchLike;\n}): Promise<string> {\n\tconst { server, credentials } = options;\n\tconst now = options.now ?? Date.now;\n\tconst serverName = server.name;\n\tconst stored = await readServerToken(credentials, serverName);\n\tif (!stored) throw authRequired(serverName);\n\tif (stored.expiresAt - REFRESH_SKEW_MS > now()) return stored.accessToken;\n\tif (!stored.refreshToken) {\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" authorization has expired and no refresh token was issued. Run \\`apex-code mcp auth ${serverName}\\` to authorize it again.`,\n\t\t\t\"refused\",\n\t\t);\n\t}\n\tif (server.transport.kind !== \"http\") {\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" is not an HTTP server; run \\`apex-code mcp auth ${serverName}\\`.`,\n\t\t\t\"refused\",\n\t\t);\n\t}\n\tconst resource = stored.extras.resource ?? server.transport.url;\n\n\tlet tokenEndpoint = stored.extras.tokenEndpoint;\n\tif (!tokenEndpoint) {\n\t\tconst metadata = await discoverAuthorizationServer({ serverUrl: server.transport.url, fetch: options.fetch });\n\t\ttokenEndpoint = metadata.tokenEndpoint;\n\t}\n\n\tlet refreshed: TokenResponse;\n\ttry {\n\t\trefreshed = await refreshAccessToken({\n\t\t\ttokenEndpoint: new URL(tokenEndpoint),\n\t\t\trefreshToken: stored.refreshToken,\n\t\t\tclientId: stored.extras.clientId ?? `apex-code-mcp-${serverName}`,\n\t\t\tresource,\n\t\t\tfetch: options.fetch,\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof TokenEndpointError && error.code === \"invalid_grant\") {\n\t\t\tthrow new McpOAuthRefreshError(\n\t\t\t\t`MCP server \"${serverName}\" rejected its refresh token. Run \\`apex-code mcp auth ${serverName}\\` to authorize it again.`,\n\t\t\t\t\"refused\",\n\t\t\t);\n\t\t}\n\t\tif (error instanceof TokenEndpointUnreachableError) {\n\t\t\tthrow new McpOAuthRefreshError(`MCP server \"${serverName}\" refresh failed: ${error.message}`, \"unavailable\");\n\t\t}\n\t\tif (error instanceof TokenEndpointError) {\n\t\t\tthrow new McpOAuthRefreshError(`MCP server \"${serverName}\" refresh failed: ${error.message}`, \"refused\");\n\t\t}\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" refresh failed: ${oauthErrorMessage(error)}`,\n\t\t\t\"unavailable\",\n\t\t);\n\t}\n\n\tconst expiresAt = now() + refreshed.expiresInSeconds * 1000 - REFRESH_SKEW_MS;\n\tconst credential: Credential = {\n\t\ttype: \"oauth\",\n\t\taccess: refreshed.accessToken,\n\t\t// No rotation: keep the refresh token the server still honors.\n\t\trefresh: refreshed.refreshToken ?? stored.refreshToken,\n\t\texpires: expiresAt,\n\t\ttokenEndpoint,\n\t\tresource,\n\t\tclientId: stored.extras.clientId,\n\t};\n\ttry {\n\t\tawait credentials.modify(mcpCredentialKey(serverName), async () => credential);\n\t} catch (error) {\n\t\t// The fresh access token works for this connection, but the store could not\n\t\t// record the rotation — for a sandboxed child, that is the channel refusing.\n\t\t// Fail this call closed rather than run ahead of what the store knows.\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" was refreshed but the session cannot store the new token: ${oauthErrorMessage(error)}`,\n\t\t\t\"unavailable\",\n\t\t);\n\t}\n\treturn refreshed.accessToken;\n}\n"]}

package/dist/core/mcp/oauth/mcp-token.js

@@ -0,0 +1,129 @@
+/**
+ * The MCP credential seam: how an MCP server's OAuth token is keyed, read, and
+ * refreshed through the session's existing `CredentialStore`.
+ *
+ * Which store instance that is depends on where the session runs. On the host it is
+ * `AuthStorage` (direct, lock-serialized writes); in a sandboxed child it is
+ * `SandboxAuthStorage` (reads from the read-only projection, writes through the
+ * supervisor-mediated channel, ADR 0015). A session with neither has a read-only
+ * store whose `modify` throws, which is the fail-closed path: refresh never
+ * silently degrades to "pretend it worked".
+ */
+import { discoverAuthorizationServer, oauthErrorMessage } from "./discover.js";
+import { refreshAccessToken, TokenEndpointError, TokenEndpointUnreachableError, } from "./token-client.js";
+/** Refresh this long before expiry so an in-flight call never rides a dying token. */
+const REFRESH_SKEW_MS = 60_000;
+export function mcpCredentialKey(serverName) {
+    return `mcp/${serverName}`;
+}
+export class McpOAuthRequiredError extends Error {
+}
+export class McpOAuthRefreshError extends Error {
+    /** "refused": the server said no; "unavailable": the path to the store or network failed. */
+    stage;
+    constructor(message, stage) {
+        super(message);
+        this.stage = stage;
+    }
+}
+export function authRequired(serverName) {
+    return new McpOAuthRequiredError(`MCP server "${serverName}" requires OAuth and has no stored authorization. Run \`apex-code mcp auth ${serverName}\` to authorize it, then retry.`);
+}
+function extrasOf(credential) {
+    if (credential.type !== "oauth")
+        return {};
+    const extras = {};
+    if (typeof credential.tokenEndpoint === "string")
+        extras.tokenEndpoint = credential.tokenEndpoint;
+    if (typeof credential.resource === "string")
+        extras.resource = credential.resource;
+    if (typeof credential.clientId === "string")
+        extras.clientId = credential.clientId;
+    return extras;
+}
+function toStoredToken(credential) {
+    if (credential.type !== "oauth")
+        return undefined;
+    return {
+        accessToken: credential.access,
+        refreshToken: credential.refresh,
+        expiresAt: credential.expires,
+        extras: extrasOf(credential),
+    };
+}
+export async function readServerToken(credentials, serverName) {
+    const credential = await credentials.read(mcpCredentialKey(serverName));
+    return credential ? toStoredToken(credential) : undefined;
+}
+/**
+ * Returns a current access token for the server, refreshing first when the stored one
+ * is at the edge of expiry. Throws `McpOAuthRequiredError` when nothing is stored and
+ * `McpOAuthRefreshError` when a refresh cannot be completed; both name the auth
+ * command in their message.
+ */
+export async function ensureFreshServerToken(options) {
+    const { server, credentials } = options;
+    const now = options.now ?? Date.now;
+    const serverName = server.name;
+    const stored = await readServerToken(credentials, serverName);
+    if (!stored)
+        throw authRequired(serverName);
+    if (stored.expiresAt - REFRESH_SKEW_MS > now())
+        return stored.accessToken;
+    if (!stored.refreshToken) {
+        throw new McpOAuthRefreshError(`MCP server "${serverName}" authorization has expired and no refresh token was issued. Run \`apex-code mcp auth ${serverName}\` to authorize it again.`, "refused");
+    }
+    if (server.transport.kind !== "http") {
+        throw new McpOAuthRefreshError(`MCP server "${serverName}" is not an HTTP server; run \`apex-code mcp auth ${serverName}\`.`, "refused");
+    }
+    const resource = stored.extras.resource ?? server.transport.url;
+    let tokenEndpoint = stored.extras.tokenEndpoint;
+    if (!tokenEndpoint) {
+        const metadata = await discoverAuthorizationServer({ serverUrl: server.transport.url, fetch: options.fetch });
+        tokenEndpoint = metadata.tokenEndpoint;
+    }
+    let refreshed;
+    try {
+        refreshed = await refreshAccessToken({
+            tokenEndpoint: new URL(tokenEndpoint),
+            refreshToken: stored.refreshToken,
+            clientId: stored.extras.clientId ?? `apex-code-mcp-${serverName}`,
+            resource,
+            fetch: options.fetch,
+        });
+    }
+    catch (error) {
+        if (error instanceof TokenEndpointError && error.code === "invalid_grant") {
+            throw new McpOAuthRefreshError(`MCP server "${serverName}" rejected its refresh token. Run \`apex-code mcp auth ${serverName}\` to authorize it again.`, "refused");
+        }
+        if (error instanceof TokenEndpointUnreachableError) {
+            throw new McpOAuthRefreshError(`MCP server "${serverName}" refresh failed: ${error.message}`, "unavailable");
+        }
+        if (error instanceof TokenEndpointError) {
+            throw new McpOAuthRefreshError(`MCP server "${serverName}" refresh failed: ${error.message}`, "refused");
+        }
+        throw new McpOAuthRefreshError(`MCP server "${serverName}" refresh failed: ${oauthErrorMessage(error)}`, "unavailable");
+    }
+    const expiresAt = now() + refreshed.expiresInSeconds * 1000 - REFRESH_SKEW_MS;
+    const credential = {
+        type: "oauth",
+        access: refreshed.accessToken,
+        // No rotation: keep the refresh token the server still honors.
+        refresh: refreshed.refreshToken ?? stored.refreshToken,
+        expires: expiresAt,
+        tokenEndpoint,
+        resource,
+        clientId: stored.extras.clientId,
+    };
+    try {
+        await credentials.modify(mcpCredentialKey(serverName), async () => credential);
+    }
+    catch (error) {
+        // The fresh access token works for this connection, but the store could not
+        // record the rotation — for a sandboxed child, that is the channel refusing.
+        // Fail this call closed rather than run ahead of what the store knows.
+        throw new McpOAuthRefreshError(`MCP server "${serverName}" was refreshed but the session cannot store the new token: ${oauthErrorMessage(error)}`, "unavailable");
+    }
+    return refreshed.accessToken;
+}
+//# sourceMappingURL=mcp-token.js.map

package/dist/core/mcp/oauth/mcp-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-token.js","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/mcp-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,2BAA2B,EAAkB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,sFAAsF;AACtF,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAU;IAC5D,OAAO,OAAO,UAAU,EAAE,CAAC;AAAA,CAC3B;AAiBD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,6FAA6F;IAC7F,KAAK,CAA4B;IAEjC,YAAY,OAAe,EAAE,KAAgC,EAAE;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAAA,CACnB;CACD;AAED,MAAM,UAAU,YAAY,CAAC,UAAkB,EAAyB;IACvE,OAAO,IAAI,qBAAqB,CAC/B,eAAe,UAAU,8EAA8E,UAAU,iCAAiC,CAClJ,CAAC;AAAA,CACF;AAED,SAAS,QAAQ,CAAC,UAAsB,EAAkB;IACzD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,IAAI,OAAO,UAAU,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAClG,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACnF,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACnF,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,aAAa,CAAC,UAAsB,EAAiC;IAC7E,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO;QACN,WAAW,EAAE,UAAU,CAAC,MAAM;QAC9B,YAAY,EAAE,UAAU,CAAC,OAAO;QAChC,SAAS,EAAE,UAAU,CAAC,OAAO;QAC7B,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC;KAC5B,CAAC;AAAA,CACF;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,WAA4B,EAC5B,UAAkB,EACuB;IACzC,MAAM,UAAU,GAA2B,MAAM,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IAChG,OAAO,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC1D;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C,EAAmB;IACnB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,eAAe,UAAU,yFAAyF,UAAU,2BAA2B,EACvJ,SAAS,CACT,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,oBAAoB,CAC7B,eAAe,UAAU,qDAAqD,UAAU,KAAK,EAC7F,SAAS,CACT,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;IAEhE,IAAI,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;IAChD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9G,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;IACxC,CAAC;IAED,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,kBAAkB,CAAC;YACpC,aAAa,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC;YACrC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,iBAAiB,UAAU,EAAE;YACjE,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK;SACpB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3E,MAAM,IAAI,oBAAoB,CAC7B,eAAe,UAAU,0DAA0D,UAAU,2BAA2B,EACxH,SAAS,CACT,CAAC;QACH,CAAC;QACD,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;YACpD,MAAM,IAAI,oBAAoB,CAAC,eAAe,UAAU,qBAAqB,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACzC,MAAM,IAAI,oBAAoB,CAAC,eAAe,UAAU,qBAAqB,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,eAAe,UAAU,qBAAqB,iBAAiB,CAAC,KAAK,CAAC,EAAE,EACxE,aAAa,CACb,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,gBAAgB,GAAG,IAAI,GAAG,eAAe,CAAC;IAC9E,MAAM,UAAU,GAAe;QAC9B,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS,CAAC,WAAW;QAC7B,+DAA+D;QAC/D,OAAO,EAAE,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;QACtD,OAAO,EAAE,SAAS;QAClB,aAAa;QACb,QAAQ;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;KAChC,CAAC;IACF,IAAI,CAAC;QACJ,MAAM,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,4EAA4E;QAC5E,+EAA6E;QAC7E,uEAAuE;QACvE,MAAM,IAAI,oBAAoB,CAC7B,eAAe,UAAU,+DAA+D,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAClH,aAAa,CACb,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,CAAC;AAAA,CAC7B","sourcesContent":["/**\n * The MCP credential seam: how an MCP server's OAuth token is keyed, read, and\n * refreshed through the session's existing `CredentialStore`.\n *\n * Which store instance that is depends on where the session runs. On the host it is\n * `AuthStorage` (direct, lock-serialized writes); in a sandboxed child it is\n * `SandboxAuthStorage` (reads from the read-only projection, writes through the\n * supervisor-mediated channel, ADR 0015). A session with neither has a read-only\n * store whose `modify` throws, which is the fail-closed path: refresh never\n * silently degrades to \"pretend it worked\".\n */\n\nimport type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport type { McpServerConfig } from \"../types.ts\";\nimport { discoverAuthorizationServer, type FetchLike, oauthErrorMessage } from \"./discover.ts\";\nimport {\n\trefreshAccessToken,\n\tTokenEndpointError,\n\tTokenEndpointUnreachableError,\n\ttype TokenResponse,\n} from \"./token-client.ts\";\n\n/** Refresh this long before expiry so an in-flight call never rides a dying token. */\nconst REFRESH_SKEW_MS = 60_000;\n\nexport function mcpCredentialKey(serverName: string): string {\n\treturn `mcp/${serverName}`;\n}\n\n/** Extra fields carried on the `OAuthCredential` index signature, written by the flow. */\ninterface McpTokenExtras {\n\ttokenEndpoint?: string;\n\tresource?: string;\n\tclientId?: string;\n}\n\nexport interface StoredServerToken {\n\taccessToken: string;\n\t/** Empty when the server issued no refresh token; refresh is impossible then. */\n\trefreshToken: string;\n\texpiresAt: number;\n\textras: McpTokenExtras;\n}\n\nexport class McpOAuthRequiredError extends Error {}\n\nexport class McpOAuthRefreshError extends Error {\n\t/** \"refused\": the server said no; \"unavailable\": the path to the store or network failed. */\n\tstage: \"refused\" | \"unavailable\";\n\n\tconstructor(message: string, stage: \"refused\" | \"unavailable\") {\n\t\tsuper(message);\n\t\tthis.stage = stage;\n\t}\n}\n\nexport function authRequired(serverName: string): McpOAuthRequiredError {\n\treturn new McpOAuthRequiredError(\n\t\t`MCP server \"${serverName}\" requires OAuth and has no stored authorization. Run \\`apex-code mcp auth ${serverName}\\` to authorize it, then retry.`,\n\t);\n}\n\nfunction extrasOf(credential: Credential): McpTokenExtras {\n\tif (credential.type !== \"oauth\") return {};\n\tconst extras: McpTokenExtras = {};\n\tif (typeof credential.tokenEndpoint === \"string\") extras.tokenEndpoint = credential.tokenEndpoint;\n\tif (typeof credential.resource === \"string\") extras.resource = credential.resource;\n\tif (typeof credential.clientId === \"string\") extras.clientId = credential.clientId;\n\treturn extras;\n}\n\nfunction toStoredToken(credential: Credential): StoredServerToken | undefined {\n\tif (credential.type !== \"oauth\") return undefined;\n\treturn {\n\t\taccessToken: credential.access,\n\t\trefreshToken: credential.refresh,\n\t\texpiresAt: credential.expires,\n\t\textras: extrasOf(credential),\n\t};\n}\n\nexport async function readServerToken(\n\tcredentials: CredentialStore,\n\tserverName: string,\n): Promise<StoredServerToken | undefined> {\n\tconst credential: Credential | undefined = await credentials.read(mcpCredentialKey(serverName));\n\treturn credential ? toStoredToken(credential) : undefined;\n}\n\n/**\n * Returns a current access token for the server, refreshing first when the stored one\n * is at the edge of expiry. Throws `McpOAuthRequiredError` when nothing is stored and\n * `McpOAuthRefreshError` when a refresh cannot be completed; both name the auth\n * command in their message.\n */\nexport async function ensureFreshServerToken(options: {\n\tserver: McpServerConfig;\n\tcredentials: CredentialStore;\n\tnow?: () => number;\n\tfetch?: FetchLike;\n}): Promise<string> {\n\tconst { server, credentials } = options;\n\tconst now = options.now ?? Date.now;\n\tconst serverName = server.name;\n\tconst stored = await readServerToken(credentials, serverName);\n\tif (!stored) throw authRequired(serverName);\n\tif (stored.expiresAt - REFRESH_SKEW_MS > now()) return stored.accessToken;\n\tif (!stored.refreshToken) {\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" authorization has expired and no refresh token was issued. Run \\`apex-code mcp auth ${serverName}\\` to authorize it again.`,\n\t\t\t\"refused\",\n\t\t);\n\t}\n\tif (server.transport.kind !== \"http\") {\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" is not an HTTP server; run \\`apex-code mcp auth ${serverName}\\`.`,\n\t\t\t\"refused\",\n\t\t);\n\t}\n\tconst resource = stored.extras.resource ?? server.transport.url;\n\n\tlet tokenEndpoint = stored.extras.tokenEndpoint;\n\tif (!tokenEndpoint) {\n\t\tconst metadata = await discoverAuthorizationServer({ serverUrl: server.transport.url, fetch: options.fetch });\n\t\ttokenEndpoint = metadata.tokenEndpoint;\n\t}\n\n\tlet refreshed: TokenResponse;\n\ttry {\n\t\trefreshed = await refreshAccessToken({\n\t\t\ttokenEndpoint: new URL(tokenEndpoint),\n\t\t\trefreshToken: stored.refreshToken,\n\t\t\tclientId: stored.extras.clientId ?? `apex-code-mcp-${serverName}`,\n\t\t\tresource,\n\t\t\tfetch: options.fetch,\n\t\t});\n\t} catch (error) {\n\t\tif (error instanceof TokenEndpointError && error.code === \"invalid_grant\") {\n\t\t\tthrow new McpOAuthRefreshError(\n\t\t\t\t`MCP server \"${serverName}\" rejected its refresh token. Run \\`apex-code mcp auth ${serverName}\\` to authorize it again.`,\n\t\t\t\t\"refused\",\n\t\t\t);\n\t\t}\n\t\tif (error instanceof TokenEndpointUnreachableError) {\n\t\t\tthrow new McpOAuthRefreshError(`MCP server \"${serverName}\" refresh failed: ${error.message}`, \"unavailable\");\n\t\t}\n\t\tif (error instanceof TokenEndpointError) {\n\t\t\tthrow new McpOAuthRefreshError(`MCP server \"${serverName}\" refresh failed: ${error.message}`, \"refused\");\n\t\t}\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" refresh failed: ${oauthErrorMessage(error)}`,\n\t\t\t\"unavailable\",\n\t\t);\n\t}\n\n\tconst expiresAt = now() + refreshed.expiresInSeconds * 1000 - REFRESH_SKEW_MS;\n\tconst credential: Credential = {\n\t\ttype: \"oauth\",\n\t\taccess: refreshed.accessToken,\n\t\t// No rotation: keep the refresh token the server still honors.\n\t\trefresh: refreshed.refreshToken ?? stored.refreshToken,\n\t\texpires: expiresAt,\n\t\ttokenEndpoint,\n\t\tresource,\n\t\tclientId: stored.extras.clientId,\n\t};\n\ttry {\n\t\tawait credentials.modify(mcpCredentialKey(serverName), async () => credential);\n\t} catch (error) {\n\t\t// The fresh access token works for this connection, but the store could not\n\t\t// record the rotation — for a sandboxed child, that is the channel refusing.\n\t\t// Fail this call closed rather than run ahead of what the store knows.\n\t\tthrow new McpOAuthRefreshError(\n\t\t\t`MCP server \"${serverName}\" was refreshed but the session cannot store the new token: ${oauthErrorMessage(error)}`,\n\t\t\t\"unavailable\",\n\t\t);\n\t}\n\treturn refreshed.accessToken;\n}\n"]}

package/dist/core/mcp/oauth/pkce.d.ts

@@ -0,0 +1,12 @@
+/**
+ * PKCE (RFC 7636), the S256 method only. Every MCP authorization server is required
+ * to support it, and a verifier that never travels with the code is the only thing
+ * standing between a callback URL and a token, so there is no plain fallback here.
+ */
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+}
+export declare function pkceChallenge(verifier: string): string;
+export declare function createPkcePair(random?: (size: number) => Buffer): PkcePair;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/core/mcp/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/pkce.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,cAAc,CAAC,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAoB,GAAG,QAAQ,CAGvF","sourcesContent":["import { createHash, randomBytes } from \"node:crypto\";\n\n/**\n * PKCE (RFC 7636), the S256 method only. Every MCP authorization server is required\n * to support it, and a verifier that never travels with the code is the only thing\n * standing between a callback URL and a token, so there is no plain fallback here.\n */\n\nexport interface PkcePair {\n\tverifier: string;\n\tchallenge: string;\n}\n\n/** 48 bytes → 64 base64url characters, inside RFC 7636's 43-128 range. */\nconst VERIFIER_BYTES = 48;\n\nexport function pkceChallenge(verifier: string): string {\n\treturn createHash(\"sha256\").update(verifier, \"ascii\").digest(\"base64url\");\n}\n\nexport function createPkcePair(random: (size: number) => Buffer = randomBytes): PkcePair {\n\tconst verifier = random(VERIFIER_BYTES).toString(\"base64url\");\n\treturn { verifier, challenge: pkceChallenge(verifier) };\n}\n"]}

package/dist/core/mcp/oauth/pkce.js

@@ -0,0 +1,11 @@
+import { createHash, randomBytes } from "node:crypto";
+/** 48 bytes → 64 base64url characters, inside RFC 7636's 43-128 range. */
+const VERIFIER_BYTES = 48;
+export function pkceChallenge(verifier) {
+    return createHash("sha256").update(verifier, "ascii").digest("base64url");
+}
+export function createPkcePair(random = randomBytes) {
+    const verifier = random(VERIFIER_BYTES).toString("base64url");
+    return { verifier, challenge: pkceChallenge(verifier) };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/core/mcp/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAatD,4EAA0E;AAC1E,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAU;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAAA,CAC1E;AAED,MAAM,UAAU,cAAc,CAAC,MAAM,GAA6B,WAAW,EAAY;IACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAAA,CACxD","sourcesContent":["import { createHash, randomBytes } from \"node:crypto\";\n\n/**\n * PKCE (RFC 7636), the S256 method only. Every MCP authorization server is required\n * to support it, and a verifier that never travels with the code is the only thing\n * standing between a callback URL and a token, so there is no plain fallback here.\n */\n\nexport interface PkcePair {\n\tverifier: string;\n\tchallenge: string;\n}\n\n/** 48 bytes → 64 base64url characters, inside RFC 7636's 43-128 range. */\nconst VERIFIER_BYTES = 48;\n\nexport function pkceChallenge(verifier: string): string {\n\treturn createHash(\"sha256\").update(verifier, \"ascii\").digest(\"base64url\");\n}\n\nexport function createPkcePair(random: (size: number) => Buffer = randomBytes): PkcePair {\n\tconst verifier = random(VERIFIER_BYTES).toString(\"base64url\");\n\treturn { verifier, challenge: pkceChallenge(verifier) };\n}\n"]}

package/dist/core/mcp/oauth/register.d.ts

@@ -0,0 +1,16 @@
+import { type FetchLike } from "./discover.ts";
+export interface RegisteredClient {
+    clientId: string;
+    clientSecret: string | undefined;
+}
+/**
+ * RFC 7591 dynamic client registration. Public client only: the redirect lands on a
+ * loopback listener and there is no client secret unless the server issues one.
+ */
+export declare function registerClient(options: {
+    registrationEndpoint: URL;
+    clientName: string;
+    redirectUris: string[];
+    fetch?: FetchLike;
+}): Promise<RegisteredClient>;
+//# sourceMappingURL=register.d.ts.map

package/dist/core/mcp/oauth/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAqB,MAAM,eAAe,CAAC;AAElE,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC7C,oBAAoB,EAAE,GAAG,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoC5B","sourcesContent":["import { type FetchLike, oauthErrorMessage } from \"./discover.ts\";\n\nexport interface RegisteredClient {\n\tclientId: string;\n\tclientSecret: string | undefined;\n}\n\n/**\n * RFC 7591 dynamic client registration. Public client only: the redirect lands on a\n * loopback listener and there is no client secret unless the server issues one.\n */\nexport async function registerClient(options: {\n\tregistrationEndpoint: URL;\n\tclientName: string;\n\tredirectUris: string[];\n\tfetch?: FetchLike;\n}): Promise<RegisteredClient> {\n\tconst fetch = options.fetch ?? globalThis.fetch;\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(options.registrationEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tclient_name: options.clientName,\n\t\t\t\tredirect_uris: options.redirectUris,\n\t\t\t\tgrant_types: [\"authorization_code\"],\n\t\t\t\tresponse_types: [\"code\"],\n\t\t\t\ttoken_endpoint_auth_method: \"none\",\n\t\t\t}),\n\t\t});\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`dynamic client registration unreachable at ${options.registrationEndpoint}: ${oauthErrorMessage(error)}`,\n\t\t);\n\t}\n\tlet parsed: Record<string, unknown> = {};\n\ttry {\n\t\tconst value: unknown = await response.json();\n\t\tif (typeof value === \"object\" && value !== null) parsed = value as Record<string, unknown>;\n\t} catch {\n\t\t// Falls through to the failure below.\n\t}\n\tif (!response.ok || typeof parsed.client_id !== \"string\") {\n\t\tthrow new Error(\n\t\t\t`dynamic client registration failed at ${options.registrationEndpoint} (HTTP ${response.status})`,\n\t\t);\n\t}\n\treturn {\n\t\tclientId: parsed.client_id,\n\t\tclientSecret: typeof parsed.client_secret === \"string\" ? parsed.client_secret : undefined,\n\t};\n}\n"]}

package/dist/core/mcp/oauth/register.js

@@ -0,0 +1,42 @@
+import { oauthErrorMessage } from "./discover.js";
+/**
+ * RFC 7591 dynamic client registration. Public client only: the redirect lands on a
+ * loopback listener and there is no client secret unless the server issues one.
+ */
+export async function registerClient(options) {
+    const fetch = options.fetch ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetch(options.registrationEndpoint, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                client_name: options.clientName,
+                redirect_uris: options.redirectUris,
+                grant_types: ["authorization_code"],
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+            }),
+        });
+    }
+    catch (error) {
+        throw new Error(`dynamic client registration unreachable at ${options.registrationEndpoint}: ${oauthErrorMessage(error)}`);
+    }
+    let parsed = {};
+    try {
+        const value = await response.json();
+        if (typeof value === "object" && value !== null)
+            parsed = value;
+    }
+    catch {
+        // Falls through to the failure below.
+    }
+    if (!response.ok || typeof parsed.client_id !== "string") {
+        throw new Error(`dynamic client registration failed at ${options.registrationEndpoint} (HTTP ${response.status})`);
+    }
+    return {
+        clientId: parsed.client_id,
+        clientSecret: typeof parsed.client_secret === "string" ? parsed.client_secret : undefined,
+    };
+}
+//# sourceMappingURL=register.js.map

package/dist/core/mcp/oauth/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAOlE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAKpC,EAA6B;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAChD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,WAAW,EAAE,OAAO,CAAC,UAAU;gBAC/B,aAAa,EAAE,OAAO,CAAC,YAAY;gBACnC,WAAW,EAAE,CAAC,oBAAoB,CAAC;gBACnC,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,MAAM;aAClC,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,8CAA8C,OAAO,CAAC,oBAAoB,KAAK,iBAAiB,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,GAAG,KAAgC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACR,sCAAsC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACd,yCAAyC,OAAO,CAAC,oBAAoB,UAAU,QAAQ,CAAC,MAAM,GAAG,CACjG,CAAC;IACH,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,YAAY,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KACzF,CAAC;AAAA,CACF","sourcesContent":["import { type FetchLike, oauthErrorMessage } from \"./discover.ts\";\n\nexport interface RegisteredClient {\n\tclientId: string;\n\tclientSecret: string | undefined;\n}\n\n/**\n * RFC 7591 dynamic client registration. Public client only: the redirect lands on a\n * loopback listener and there is no client secret unless the server issues one.\n */\nexport async function registerClient(options: {\n\tregistrationEndpoint: URL;\n\tclientName: string;\n\tredirectUris: string[];\n\tfetch?: FetchLike;\n}): Promise<RegisteredClient> {\n\tconst fetch = options.fetch ?? globalThis.fetch;\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(options.registrationEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tclient_name: options.clientName,\n\t\t\t\tredirect_uris: options.redirectUris,\n\t\t\t\tgrant_types: [\"authorization_code\"],\n\t\t\t\tresponse_types: [\"code\"],\n\t\t\t\ttoken_endpoint_auth_method: \"none\",\n\t\t\t}),\n\t\t});\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`dynamic client registration unreachable at ${options.registrationEndpoint}: ${oauthErrorMessage(error)}`,\n\t\t);\n\t}\n\tlet parsed: Record<string, unknown> = {};\n\ttry {\n\t\tconst value: unknown = await response.json();\n\t\tif (typeof value === \"object\" && value !== null) parsed = value as Record<string, unknown>;\n\t} catch {\n\t\t// Falls through to the failure below.\n\t}\n\tif (!response.ok || typeof parsed.client_id !== \"string\") {\n\t\tthrow new Error(\n\t\t\t`dynamic client registration failed at ${options.registrationEndpoint} (HTTP ${response.status})`,\n\t\t);\n\t}\n\treturn {\n\t\tclientId: parsed.client_id,\n\t\tclientSecret: typeof parsed.client_secret === \"string\" ? parsed.client_secret : undefined,\n\t};\n}\n"]}

package/dist/core/mcp/oauth/token-client.d.ts

@@ -0,0 +1,33 @@
+import { type FetchLike } from "./discover.ts";
+export declare class TokenEndpointError extends Error {
+    /** The OAuth `error` code from the response body, when the server sent one (e.g. invalid_grant). */
+    code: string | undefined;
+    constructor(message: string, code: string | undefined);
+}
+/** The endpoint could not be reached at all — a path problem, not a server refusal. */
+export declare class TokenEndpointUnreachableError extends TokenEndpointError {
+}
+export interface TokenResponse {
+    accessToken: string;
+    /** Absent when the server did not rotate; callers keep their previous refresh token then. */
+    refreshToken: string | undefined;
+    expiresInSeconds: number;
+}
+interface TokenEndpointOptions {
+    tokenEndpoint: URL;
+    clientId: string;
+    clientSecret?: string;
+    /** The MCP resource indicator; pins the issued token to this server (RFC 8707). */
+    resource?: string;
+    fetch?: FetchLike;
+}
+export declare function exchangeAuthorizationCode(options: TokenEndpointOptions & {
+    code: string;
+    verifier: string;
+    redirectUri: string;
+}): Promise<TokenResponse>;
+export declare function refreshAccessToken(options: TokenEndpointOptions & {
+    refreshToken: string;
+}): Promise<TokenResponse>;
+export {};
+//# sourceMappingURL=token-client.d.ts.map

package/dist/core/mcp/oauth/token-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-client.d.ts","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/token-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAqB,MAAM,eAAe,CAAC;AAElE,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,oGAAoG;IACpG,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAGpD;CACD;AAED,yFAAuF;AACvF,qBAAa,6BAA8B,SAAQ,kBAAkB;CAAG;AAExE,MAAM,WAAW,aAAa;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,oBAAoB;IAC7B,aAAa,EAAE,GAAG,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB;AA4CD,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACrF,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAEnH","sourcesContent":["import { type FetchLike, oauthErrorMessage } from \"./discover.ts\";\n\nexport class TokenEndpointError extends Error {\n\t/** The OAuth `error` code from the response body, when the server sent one (e.g. invalid_grant). */\n\tcode: string | undefined;\n\n\tconstructor(message: string, code: string | undefined) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t}\n}\n\n/** The endpoint could not be reached at all — a path problem, not a server refusal. */\nexport class TokenEndpointUnreachableError extends TokenEndpointError {}\n\nexport interface TokenResponse {\n\taccessToken: string;\n\t/** Absent when the server did not rotate; callers keep their previous refresh token then. */\n\trefreshToken: string | undefined;\n\texpiresInSeconds: number;\n}\n\ninterface TokenEndpointOptions {\n\ttokenEndpoint: URL;\n\tclientId: string;\n\tclientSecret?: string;\n\t/** The MCP resource indicator; pins the issued token to this server (RFC 8707). */\n\tresource?: string;\n\tfetch?: FetchLike;\n}\n\nasync function postTokenForm(options: TokenEndpointOptions, grant: Record<string, string>): Promise<TokenResponse> {\n\tconst fetch = options.fetch ?? globalThis.fetch;\n\tconst body = new URLSearchParams({ client_id: options.clientId, ...grant });\n\tif (options.clientSecret) body.set(\"client_secret\", options.clientSecret);\n\tif (options.resource) body.set(\"resource\", options.resource);\n\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": \"application/x-www-form-urlencoded\" },\n\t\t\tbody,\n\t\t});\n\t} catch (error) {\n\t\tthrow new TokenEndpointUnreachableError(\n\t\t\t`token endpoint unreachable at ${options.tokenEndpoint}: ${oauthErrorMessage(error)}`,\n\t\t\tundefined,\n\t\t);\n\t}\n\n\tconst text = await response.text();\n\tlet parsed: Record<string, unknown> = {};\n\ttry {\n\t\tconst value: unknown = JSON.parse(text);\n\t\tif (typeof value === \"object\" && value !== null) parsed = value as Record<string, unknown>;\n\t} catch {\n\t\t// A non-JSON error body still lands in the status branch below.\n\t}\n\tif (!response.ok) {\n\t\tconst code = typeof parsed.error === \"string\" ? parsed.error : undefined;\n\t\tthrow new TokenEndpointError(`token endpoint answered HTTP ${response.status}${code ? ` (${code})` : \"\"}`, code);\n\t}\n\tif (typeof parsed.access_token !== \"string\" || typeof parsed.expires_in !== \"number\") {\n\t\tthrow new TokenEndpointError(\"token endpoint response is missing access_token or expires_in\", undefined);\n\t}\n\treturn {\n\t\taccessToken: parsed.access_token,\n\t\trefreshToken: typeof parsed.refresh_token === \"string\" ? parsed.refresh_token : undefined,\n\t\texpiresInSeconds: parsed.expires_in,\n\t};\n}\n\nexport function exchangeAuthorizationCode(\n\toptions: TokenEndpointOptions & { code: string; verifier: string; redirectUri: string },\n): Promise<TokenResponse> {\n\treturn postTokenForm(options, {\n\t\tgrant_type: \"authorization_code\",\n\t\tcode: options.code,\n\t\tcode_verifier: options.verifier,\n\t\tredirect_uri: options.redirectUri,\n\t});\n}\n\nexport function refreshAccessToken(options: TokenEndpointOptions & { refreshToken: string }): Promise<TokenResponse> {\n\treturn postTokenForm(options, { grant_type: \"refresh_token\", refresh_token: options.refreshToken });\n}\n"]}

package/dist/core/mcp/oauth/token-client.js

@@ -0,0 +1,65 @@
+import { oauthErrorMessage } from "./discover.js";
+export class TokenEndpointError extends Error {
+    /** The OAuth `error` code from the response body, when the server sent one (e.g. invalid_grant). */
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+}
+/** The endpoint could not be reached at all — a path problem, not a server refusal. */
+export class TokenEndpointUnreachableError extends TokenEndpointError {
+}
+async function postTokenForm(options, grant) {
+    const fetch = options.fetch ?? globalThis.fetch;
+    const body = new URLSearchParams({ client_id: options.clientId, ...grant });
+    if (options.clientSecret)
+        body.set("client_secret", options.clientSecret);
+    if (options.resource)
+        body.set("resource", options.resource);
+    let response;
+    try {
+        response = await fetch(options.tokenEndpoint, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body,
+        });
+    }
+    catch (error) {
+        throw new TokenEndpointUnreachableError(`token endpoint unreachable at ${options.tokenEndpoint}: ${oauthErrorMessage(error)}`, undefined);
+    }
+    const text = await response.text();
+    let parsed = {};
+    try {
+        const value = JSON.parse(text);
+        if (typeof value === "object" && value !== null)
+            parsed = value;
+    }
+    catch {
+        // A non-JSON error body still lands in the status branch below.
+    }
+    if (!response.ok) {
+        const code = typeof parsed.error === "string" ? parsed.error : undefined;
+        throw new TokenEndpointError(`token endpoint answered HTTP ${response.status}${code ? ` (${code})` : ""}`, code);
+    }
+    if (typeof parsed.access_token !== "string" || typeof parsed.expires_in !== "number") {
+        throw new TokenEndpointError("token endpoint response is missing access_token or expires_in", undefined);
+    }
+    return {
+        accessToken: parsed.access_token,
+        refreshToken: typeof parsed.refresh_token === "string" ? parsed.refresh_token : undefined,
+        expiresInSeconds: parsed.expires_in,
+    };
+}
+export function exchangeAuthorizationCode(options) {
+    return postTokenForm(options, {
+        grant_type: "authorization_code",
+        code: options.code,
+        code_verifier: options.verifier,
+        redirect_uri: options.redirectUri,
+    });
+}
+export function refreshAccessToken(options) {
+    return postTokenForm(options, { grant_type: "refresh_token", refresh_token: options.refreshToken });
+}
+//# sourceMappingURL=token-client.js.map

package/dist/core/mcp/oauth/token-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-client.js","sourceRoot":"","sources":["../../../../src/core/mcp/oauth/token-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,oGAAoG;IACpG,IAAI,CAAqB;IAEzB,YAAY,OAAe,EAAE,IAAwB,EAAE;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;CACD;AAED,yFAAuF;AACvF,MAAM,OAAO,6BAA8B,SAAQ,kBAAkB;CAAG;AAkBxE,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,KAA6B,EAA0B;IAClH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACJ,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,6BAA6B,CACtC,iCAAiC,OAAO,CAAC,aAAa,KAAK,iBAAiB,CAAC,KAAK,CAAC,EAAE,EACrF,SAAS,CACT,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,GAAG,KAAgC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACR,gEAAgE;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACtF,MAAM,IAAI,kBAAkB,CAAC,+DAA+D,EAAE,SAAS,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACzF,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACnC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,yBAAyB,CACxC,OAAuF,EAC9D;IACzB,OAAO,aAAa,CAAC,OAAO,EAAE;QAC7B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,QAAQ;QAC/B,YAAY,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAwD,EAA0B;IACpH,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;AAAA,CACpG","sourcesContent":["import { type FetchLike, oauthErrorMessage } from \"./discover.ts\";\n\nexport class TokenEndpointError extends Error {\n\t/** The OAuth `error` code from the response body, when the server sent one (e.g. invalid_grant). */\n\tcode: string | undefined;\n\n\tconstructor(message: string, code: string | undefined) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t}\n}\n\n/** The endpoint could not be reached at all — a path problem, not a server refusal. */\nexport class TokenEndpointUnreachableError extends TokenEndpointError {}\n\nexport interface TokenResponse {\n\taccessToken: string;\n\t/** Absent when the server did not rotate; callers keep their previous refresh token then. */\n\trefreshToken: string | undefined;\n\texpiresInSeconds: number;\n}\n\ninterface TokenEndpointOptions {\n\ttokenEndpoint: URL;\n\tclientId: string;\n\tclientSecret?: string;\n\t/** The MCP resource indicator; pins the issued token to this server (RFC 8707). */\n\tresource?: string;\n\tfetch?: FetchLike;\n}\n\nasync function postTokenForm(options: TokenEndpointOptions, grant: Record<string, string>): Promise<TokenResponse> {\n\tconst fetch = options.fetch ?? globalThis.fetch;\n\tconst body = new URLSearchParams({ client_id: options.clientId, ...grant });\n\tif (options.clientSecret) body.set(\"client_secret\", options.clientSecret);\n\tif (options.resource) body.set(\"resource\", options.resource);\n\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(options.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": \"application/x-www-form-urlencoded\" },\n\t\t\tbody,\n\t\t});\n\t} catch (error) {\n\t\tthrow new TokenEndpointUnreachableError(\n\t\t\t`token endpoint unreachable at ${options.tokenEndpoint}: ${oauthErrorMessage(error)}`,\n\t\t\tundefined,\n\t\t);\n\t}\n\n\tconst text = await response.text();\n\tlet parsed: Record<string, unknown> = {};\n\ttry {\n\t\tconst value: unknown = JSON.parse(text);\n\t\tif (typeof value === \"object\" && value !== null) parsed = value as Record<string, unknown>;\n\t} catch {\n\t\t// A non-JSON error body still lands in the status branch below.\n\t}\n\tif (!response.ok) {\n\t\tconst code = typeof parsed.error === \"string\" ? parsed.error : undefined;\n\t\tthrow new TokenEndpointError(`token endpoint answered HTTP ${response.status}${code ? ` (${code})` : \"\"}`, code);\n\t}\n\tif (typeof parsed.access_token !== \"string\" || typeof parsed.expires_in !== \"number\") {\n\t\tthrow new TokenEndpointError(\"token endpoint response is missing access_token or expires_in\", undefined);\n\t}\n\treturn {\n\t\taccessToken: parsed.access_token,\n\t\trefreshToken: typeof parsed.refresh_token === \"string\" ? parsed.refresh_token : undefined,\n\t\texpiresInSeconds: parsed.expires_in,\n\t};\n}\n\nexport function exchangeAuthorizationCode(\n\toptions: TokenEndpointOptions & { code: string; verifier: string; redirectUri: string },\n): Promise<TokenResponse> {\n\treturn postTokenForm(options, {\n\t\tgrant_type: \"authorization_code\",\n\t\tcode: options.code,\n\t\tcode_verifier: options.verifier,\n\t\tredirect_uri: options.redirectUri,\n\t});\n}\n\nexport function refreshAccessToken(options: TokenEndpointOptions & { refreshToken: string }): Promise<TokenResponse> {\n\treturn postTokenForm(options, { grant_type: \"refresh_token\", refresh_token: options.refreshToken });\n}\n"]}

package/dist/core/mcp/runtime.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Assembles the MCP subsystem for one session, or returns undefined when nothing is
+ * configured.
+ *
+ * The undefined case is the point. A session with no `.mcp.json` builds no cache, no
+ * manager, and no tool, so its registry and static prompt prefix are identical to a
+ * build from before this subsystem existed.
+ */
+import type { McpToolOptions } from "./mcp-tool.ts";
+import type { McpConfigDiagnostic, McpConnector } from "./types.ts";
+export interface McpRuntime extends McpToolOptions {
+    diagnostics: readonly McpConfigDiagnostic[];
+    /** Connect `eager` servers and cache their tools, so they are discoverable cold. */
+    warm(): Promise<void>;
+    close(): Promise<void>;
+}
+export declare function createMcpRuntime(cwd: string, connector?: McpConnector, options?: {
+    projectTrusted?: boolean;
+}): McpRuntime | undefined;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/core/mcp/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,UAAW,SAAQ,cAAc;IACjD,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C,oFAAoF;IACpF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAC/B,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,YAA+B,EAC1C,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,UAAU,GAAG,SAAS,CAwBxB","sourcesContent":["/**\n * Assembles the MCP subsystem for one session, or returns undefined when nothing is\n * configured.\n *\n * The undefined case is the point. A session with no `.mcp.json` builds no cache, no\n * manager, and no tool, so its registry and static prompt prefix are identical to a\n * build from before this subsystem existed.\n */\n\nimport { join } from \"node:path\";\nimport { loadMcpConfig, PROJECT_CONFIG_FILENAME } from \"./config.ts\";\nimport { connectMcpServer } from \"./connector.ts\";\nimport type { McpToolOptions } from \"./mcp-tool.ts\";\nimport { McpMetadataCache } from \"./metadata-cache.ts\";\nimport { McpServerManager } from \"./server-manager.ts\";\nimport type { McpConfigDiagnostic, McpConnector } from \"./types.ts\";\n\nexport interface McpRuntime extends McpToolOptions {\n\tdiagnostics: readonly McpConfigDiagnostic[];\n\t/** Connect `eager` servers and cache their tools, so they are discoverable cold. */\n\twarm(): Promise<void>;\n\tclose(): Promise<void>;\n}\n\nexport function createMcpRuntime(\n\tcwd: string,\n\tconnector: McpConnector = connectMcpServer,\n\toptions: { projectTrusted?: boolean } = {},\n): McpRuntime | undefined {\n\tconst { servers, diagnostics } = loadMcpConfig({\n\t\tprojectPath: options.projectTrusted === false ? undefined : join(cwd, PROJECT_CONFIG_FILENAME),\n\t});\n\tif (servers.size === 0) return undefined;\n\n\tconst cache = new McpMetadataCache();\n\t// A server removed from config stops appearing in search immediately, rather than\n\t// lingering until something happens to overwrite its cache entry.\n\tcache.prune([...servers.values()]);\n\n\tconst manager = new McpServerManager({ servers, connector });\n\n\treturn {\n\t\tservers,\n\t\tcache,\n\t\tmanager,\n\t\tdiagnostics,\n\t\twarm: async () => {\n\t\t\tawait manager.warmEagerServers((server, tools) => cache.set(server, tools));\n\t\t\tcache.save();\n\t\t},\n\t\tclose: () => manager.closeAll(),\n\t};\n}\n"]}

package/dist/core/mcp/runtime.js

@@ -0,0 +1,37 @@
+/**
+ * Assembles the MCP subsystem for one session, or returns undefined when nothing is
+ * configured.
+ *
+ * The undefined case is the point. A session with no `.mcp.json` builds no cache, no
+ * manager, and no tool, so its registry and static prompt prefix are identical to a
+ * build from before this subsystem existed.
+ */
+import { join } from "node:path";
+import { loadMcpConfig, PROJECT_CONFIG_FILENAME } from "./config.js";
+import { connectMcpServer } from "./connector.js";
+import { McpMetadataCache } from "./metadata-cache.js";
+import { McpServerManager } from "./server-manager.js";
+export function createMcpRuntime(cwd, connector = connectMcpServer, options = {}) {
+    const { servers, diagnostics } = loadMcpConfig({
+        projectPath: options.projectTrusted === false ? undefined : join(cwd, PROJECT_CONFIG_FILENAME),
+    });
+    if (servers.size === 0)
+        return undefined;
+    const cache = new McpMetadataCache();
+    // A server removed from config stops appearing in search immediately, rather than
+    // lingering until something happens to overwrite its cache entry.
+    cache.prune([...servers.values()]);
+    const manager = new McpServerManager({ servers, connector });
+    return {
+        servers,
+        cache,
+        manager,
+        diagnostics,
+        warm: async () => {
+            await manager.warmEagerServers((server, tools) => cache.set(server, tools));
+            cache.save();
+        },
+        close: () => manager.closeAll(),
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/core/mcp/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/core/mcp/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAUvD,MAAM,UAAU,gBAAgB,CAC/B,GAAW,EACX,SAAS,GAAiB,gBAAgB,EAC1C,OAAO,GAAiC,EAAE,EACjB;IACzB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC;QAC9C,WAAW,EAAE,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC;KAC9F,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACrC,kFAAkF;IAClF,kEAAkE;IAClE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAE7D,OAAO;QACN,OAAO;QACP,KAAK;QACL,OAAO;QACP,WAAW;QACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,KAAK,CAAC,IAAI,EAAE,CAAC;QAAA,CACb;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;KAC/B,CAAC;AAAA,CACF","sourcesContent":["/**\n * Assembles the MCP subsystem for one session, or returns undefined when nothing is\n * configured.\n *\n * The undefined case is the point. A session with no `.mcp.json` builds no cache, no\n * manager, and no tool, so its registry and static prompt prefix are identical to a\n * build from before this subsystem existed.\n */\n\nimport { join } from \"node:path\";\nimport { loadMcpConfig, PROJECT_CONFIG_FILENAME } from \"./config.ts\";\nimport { connectMcpServer } from \"./connector.ts\";\nimport type { McpToolOptions } from \"./mcp-tool.ts\";\nimport { McpMetadataCache } from \"./metadata-cache.ts\";\nimport { McpServerManager } from \"./server-manager.ts\";\nimport type { McpConfigDiagnostic, McpConnector } from \"./types.ts\";\n\nexport interface McpRuntime extends McpToolOptions {\n\tdiagnostics: readonly McpConfigDiagnostic[];\n\t/** Connect `eager` servers and cache their tools, so they are discoverable cold. */\n\twarm(): Promise<void>;\n\tclose(): Promise<void>;\n}\n\nexport function createMcpRuntime(\n\tcwd: string,\n\tconnector: McpConnector = connectMcpServer,\n\toptions: { projectTrusted?: boolean } = {},\n): McpRuntime | undefined {\n\tconst { servers, diagnostics } = loadMcpConfig({\n\t\tprojectPath: options.projectTrusted === false ? undefined : join(cwd, PROJECT_CONFIG_FILENAME),\n\t});\n\tif (servers.size === 0) return undefined;\n\n\tconst cache = new McpMetadataCache();\n\t// A server removed from config stops appearing in search immediately, rather than\n\t// lingering until something happens to overwrite its cache entry.\n\tcache.prune([...servers.values()]);\n\n\tconst manager = new McpServerManager({ servers, connector });\n\n\treturn {\n\t\tservers,\n\t\tcache,\n\t\tmanager,\n\t\tdiagnostics,\n\t\twarm: async () => {\n\t\t\tawait manager.warmEagerServers((server, tools) => cache.set(server, tools));\n\t\t\tcache.save();\n\t\t},\n\t\tclose: () => manager.closeAll(),\n\t};\n}\n"]}

package/dist/core/mcp/schema.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The `mcp` tool's parameter schema, and the single source of its param type.
+ *
+ * It lives apart from the tool itself so the contract (`contract.ts`) can type its
+ * permission grammar against the same shape without importing the tool, which would
+ * be a cycle: the tool needs the contract.
+ */
+import { type Static, Type } from "typebox";
+export declare const mcpToolSchema: Type.TObject<{
+    search: Type.TOptional<Type.TString>;
+    server: Type.TOptional<Type.TString>;
+    describe: Type.TOptional<Type.TString>;
+    tool: Type.TOptional<Type.TString>;
+    args: Type.TOptional<Type.TUnknown>;
+}>;
+export type McpToolParams = Static<typeof mcpToolSchema>;
+export interface McpToolDetails {
+    action: "search" | "describe" | "list" | "call";
+    server: string | undefined;
+    tool: string | undefined;
+}
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/mcp/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,eAAO,MAAM,aAAa;;;;;;EAmBxB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB","sourcesContent":["/**\n * The `mcp` tool's parameter schema, and the single source of its param type.\n *\n * It lives apart from the tool itself so the contract (`contract.ts`) can type its\n * permission grammar against the same shape without importing the tool, which would\n * be a cycle: the tool needs the contract.\n */\n\nimport { type Static, Type } from \"typebox\";\n\nexport const mcpToolSchema = Type.Object({\n\tsearch: Type.Optional(\n\t\tType.String({\n\t\t\tdescription:\n\t\t\t\t\"Find tools across configured MCP servers by keyword. Reads a local cache, so it works without starting a server.\",\n\t\t}),\n\t),\n\tserver: Type.Optional(\n\t\tType.String({ description: \"Restrict a search to one server, or list that server's tools when used alone.\" }),\n\t),\n\tdescribe: Type.Optional(\n\t\tType.String({ description: 'Show one tool\\'s full input schema. Qualified as \"<server>:<tool>\".' }),\n\t),\n\ttool: Type.Optional(\n\t\tType.String({\n\t\t\tdescription: 'The tool to call, qualified as \"<server>:<tool>\". Requires the server to be reachable.',\n\t\t}),\n\t),\n\targs: Type.Optional(Type.Unknown({ description: \"Arguments for the called tool, matching its input schema.\" })),\n});\n\nexport type McpToolParams = Static<typeof mcpToolSchema>;\n\nexport interface McpToolDetails {\n\taction: \"search\" | \"describe\" | \"list\" | \"call\";\n\tserver: string | undefined;\n\ttool: string | undefined;\n}\n"]}