mindweave 2.4.2 → 2.4.5

package/dist/mcp/oauth/flow.js

@@ -0,0 +1,398 @@
+/**
+ * flow.ts — the network half of authorization: ask who issues tokens, get a client id,
+ * send the user to approve, redeem the code, and refresh it later.
+ *
+ * `metadata.ts` decides WHAT to fetch and how to read the answers; this file does the
+ * fetching and the four POSTs. Split that way because the branching is all in the
+ * parsing, and a test that has to stand up an HTTP server to check a fallback ordering is
+ * a test nobody keeps working.
+ *
+ * ONE RULE RUNS THROUGH ALL OF IT: every step reports the sentence a user can act on. An
+ * authorization failure is not a stack trace and is very rarely OUR bug — it is a
+ * consent screen that was declined, a server without dynamic registration, a token that
+ * was revoked in a dashboard an hour ago. The error strings here are the product.
+ */
+import { authServerUrls, protectedResourceUrls, readAuthServerMetadata, readResourceMetadata, supportsS256, } from "./metadata.js";
+/** How long any single metadata or token request may take. Generous rather than snappy:
+ *  an authorization server is very often a cold serverless function, and a discovery that
+ *  gives up at five seconds fails for a reason that has nothing to do with the user. */
+const REQUEST_TIMEOUT_MS = 30_000;
+export class TokenRequestError extends Error {
+    kind;
+    constructor(message, kind) {
+        super(message);
+        this.kind = kind;
+        this.name = "TokenRequestError";
+    }
+}
+/**
+ * Error codes that MEAN `invalid_grant` without saying it.
+ *
+ * Not pedantry: at least one widely used provider answers a dead refresh token with its
+ * own vocabulary, and treating that as an unknown failure means never clearing a
+ * credential that will never work again — the user sits in a silent retry loop instead of
+ * being offered the sign-in that would fix it.
+ */
+const INVALID_GRANT_ALIASES = new Set(["invalid_refresh_token", "expired_refresh_token", "token_expired"]);
+/** Statuses worth trying again. 408/429 and the 5xx family are the server saying "not
+ *  now" rather than "no". */
+function transientStatus(status) {
+    return status === 408 || status === 429 || status >= 500;
+}
+/** A thrown error that is the network rather than the server: a timeout, a reset, a DNS
+ *  failure. All of them are "try again", none of them say anything about the credential. */
+export function isTransientNetworkError(error) {
+    if (error instanceof TokenRequestError)
+        return error.kind === "transient";
+    const message = String(error?.message ?? error).toLowerCase();
+    return /timeout|timed out|etimedout|econnreset|econnrefused|enotfound|eai_again|socket hang up|network|fetch failed|aborted/.test(message);
+}
+/** What the client calls itself when it registers. Not a brand exercise: an
+ *  authorization server shows this string on the consent screen and in the user's list of
+ *  connected applications, so it has to say which program is asking. */
+const CLIENT_NAME = "Mindweave";
+async function getJson(url, fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    timer.unref?.();
+    try {
+        const response = await fetchImpl(url, { headers: { accept: "application/json" }, signal: controller.signal });
+        if (!response.ok)
+            return null;
+        return (await response.json());
+    }
+    catch {
+        // A candidate URL that 404s, times out or is not JSON is not an error, it is a
+        // candidate that was wrong — the caller has more to try.
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Walk the chain: the 401's metadata URL (or the well-known guesses) to the resource
+ * document, the resource document to its authorization servers, and each of those to its
+ * own metadata.
+ *
+ * FALLS THROUGH TO THE SERVER ITSELF when there is no resource document anywhere. A great
+ * many deployed servers are their own authorization server and publish RFC 8414 metadata
+ * directly, having never implemented the newer RFC 9728 layer at all, and refusing those
+ * would be refusing a large part of the ecosystem to honour a document nobody promised.
+ */
+export async function discover(serverUrl, challenge, fetchImpl = fetch, 
+/** A metadata document named in the config, for a server that publishes none of the
+ *  discovery documents. Tried alone: if someone went to the trouble of naming it, a
+ *  silent fallback to guessing would hide the fact that it was wrong. */
+configuredMetadataUrl) {
+    if (configuredMetadataUrl) {
+        const meta = readAuthServerMetadata(await getJson(configuredMetadataUrl, fetchImpl));
+        if (!meta)
+            throw new Error(`no usable OAuth metadata at the configured authServerMetadataUrl (${configuredMetadataUrl})`);
+        if (!supportsS256(meta))
+            throw new Error(`${configuredMetadataUrl} does not offer PKCE with S256, which is required to sign in safely`);
+        return { authServer: meta, resource: null };
+    }
+    const resourceCandidates = challenge.resourceMetadata
+        ? [challenge.resourceMetadata, ...protectedResourceUrls(serverUrl)]
+        : protectedResourceUrls(serverUrl);
+    let resource = null;
+    for (const candidate of resourceCandidates) {
+        const parsed = readResourceMetadata(await getJson(candidate, fetchImpl));
+        if (parsed) {
+            resource = parsed;
+            break;
+        }
+    }
+    const issuers = resource ? resource.authorizationServers : [new URL(serverUrl).origin, serverUrl];
+    for (const issuer of issuers) {
+        for (const candidate of authServerUrls(issuer)) {
+            const meta = readAuthServerMetadata(await getJson(candidate, fetchImpl));
+            if (!meta)
+                continue;
+            if (!supportsS256(meta)) {
+                throw new Error(`${issuer} does not offer PKCE with S256, which is required to sign in safely`);
+            }
+            return { authServer: meta, resource };
+        }
+    }
+    throw new Error(resource
+        ? `this server names an authorization server (${issuers[0] ?? "unknown"}) that publishes no usable OAuth metadata`
+        : "this server asked for authorization but publishes no OAuth metadata, so there is nothing to sign in to");
+}
+/**
+ * Register as a new client (RFC 7591), because a CLI has no client id until it asks for
+ * one and there is nowhere to type one in.
+ *
+ * An authorization server with no registration endpoint is a genuine wall, and the error
+ * says so plainly rather than implying a retry would help: that server expects a client
+ * id created by hand in its dashboard, which is a different feature and a different
+ * conversation.
+ */
+export async function registerClient(meta, redirect, fetchImpl = fetch) {
+    if (!meta.registrationEndpoint) {
+        throw new Error("this authorization server does not support automatic client registration");
+    }
+    const response = await fetchImpl(meta.registrationEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({
+            client_name: CLIENT_NAME,
+            redirect_uris: [redirect],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            // A public client: see pkce.ts for why a CLI cannot hold a secret. Servers that
+            // issue one anyway are handled — we store it — but we do not claim to be able to
+            // keep it.
+            token_endpoint_auth_method: "none",
+            application_type: "native",
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`could not register with the authorization server (${response.status}): ${await errorText(response)}`);
+    }
+    const body = (await response.json());
+    const clientId = typeof body.client_id === "string" ? body.client_id : "";
+    if (!clientId)
+        throw new Error("the authorization server registered us but issued no client id");
+    const out = { clientId };
+    if (typeof body.client_secret === "string" && body.client_secret)
+        out.clientSecret = body.client_secret;
+    return out;
+}
+/** The URL to open in the browser (pure). */
+export function authorizeUrl(options) {
+    const url = new URL(options.meta.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", options.clientId);
+    url.searchParams.set("redirect_uri", options.redirect);
+    url.searchParams.set("code_challenge", options.pkce.challenge);
+    url.searchParams.set("code_challenge_method", options.pkce.method);
+    url.searchParams.set("state", options.state);
+    if (options.scope)
+        url.searchParams.set("scope", options.scope);
+    if (options.resource)
+        url.searchParams.set("resource", options.resource);
+    return url.toString();
+}
+async function postToken(endpoint, form, fetchImpl, signal) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    timer.unref?.();
+    const onAbort = () => controller.abort();
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted)
+        controller.abort();
+    let response;
+    let raw;
+    try {
+        response = await fetchImpl(endpoint, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+            body: form.toString(),
+            signal: controller.signal,
+        });
+        raw = await response.text();
+    }
+    catch (error) {
+        // Never reached the server, or did not finish. Says nothing about the credential.
+        throw new TokenRequestError(`could not reach the authorization server: ${String(error?.message ?? error)}`, "transient");
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+    }
+    let body = {};
+    try {
+        body = JSON.parse(raw);
+    }
+    catch {
+        // Not JSON. Only meaningful if the status already said no.
+    }
+    // AN ERROR CAN ARRIVE WITH A 200. At least one widely used provider answers every
+    // request with 200 and puts the failure in the body, so status alone is not the test —
+    // a body carrying `error` is an error whatever the status line claims.
+    const declared = typeof body.error === "string" ? body.error : "";
+    if (!response.ok || declared) {
+        const code = INVALID_GRANT_ALIASES.has(declared) ? "invalid_grant" : declared;
+        const description = typeof body.error_description === "string" ? body.error_description : "";
+        const kind = code === "invalid_grant" ? "invalid_grant" : transientStatus(response.status) ? "transient" : "other";
+        const detail = [code, description].filter(Boolean).join(": ") || clip(raw) || response.statusText || "no detail";
+        throw new TokenRequestError(`the authorization server refused the request (${response.status}): ${detail}`, kind);
+    }
+    const accessToken = typeof body.access_token === "string" ? body.access_token : "";
+    if (!accessToken)
+        throw new TokenRequestError("the authorization server returned no access token", "other");
+    const out = { accessToken };
+    if (typeof body.refresh_token === "string" && body.refresh_token)
+        out.refreshToken = body.refresh_token;
+    if (typeof body.scope === "string" && body.scope)
+        out.scope = body.scope;
+    // `expires_in` is seconds from now. Converted to an absolute moment here because that
+    // is what survives being written to a file and read back tomorrow.
+    if (typeof body.expires_in === "number" && Number.isFinite(body.expires_in)) {
+        out.expiresAt = Date.now() + body.expires_in * 1000;
+    }
+    else if (out.refreshToken) {
+        // The server did not say, but gave us a way to renew. An hour is the near-universal
+        // default, and assuming it means we refresh QUIETLY on schedule rather than finding
+        // out through a 401 that sends the user back to a browser. Without a refresh token
+        // the guess would buy nothing, so it is not made: see `isExpired`.
+        out.expiresAt = Date.now() + 3_600_000;
+    }
+    return out;
+}
+/** Redeem the authorization code for tokens. */
+export async function exchangeCode(options, fetchImpl = fetch) {
+    const form = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: options.code,
+        redirect_uri: options.redirect,
+        client_id: options.clientId,
+        code_verifier: options.verifier,
+    });
+    if (options.clientSecret)
+        form.set("client_secret", options.clientSecret);
+    if (options.resource)
+        form.set("resource", options.resource);
+    return postToken(options.meta.tokenEndpoint, form, fetchImpl);
+}
+/**
+ * Trade a refresh token for a new access token.
+ *
+ * The refresh token is CARRIED FORWARD when the server does not send a new one: many
+ * rotate them and many do not, and dropping the old one on a server that does not would
+ * sign the user out an hour later for no reason.
+ */
+export async function refreshTokens(options, fetchImpl = fetch) {
+    const form = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: options.refreshToken,
+        client_id: options.clientId,
+    });
+    if (options.clientSecret)
+        form.set("client_secret", options.clientSecret);
+    if (options.resource)
+        form.set("resource", options.resource);
+    // RETRIED, unlike the code exchange. A refresh happens on its own, without anyone
+    // watching, against a server that may be briefly rate limiting or restarting — and the
+    // cost of giving up early is not a slow request, it is a credential thrown away and a
+    // browser round trip the user has to notice. The code exchange is not retried because
+    // an authorization code is single-use: a second attempt with the same code is refused
+    // by definition, and the user is right there and can simply try again.
+    let last;
+    for (let attempt = 1; attempt <= REFRESH_ATTEMPTS; attempt++) {
+        try {
+            const tokens = await postToken(options.tokenEndpoint, form, fetchImpl);
+            // Carried forward when the server sends no new one: many rotate refresh tokens and
+            // many do not, and dropping the old one on a server that does not would sign the
+            // user out an hour later for no reason.
+            if (!tokens.refreshToken)
+                tokens.refreshToken = options.refreshToken;
+            return tokens;
+        }
+        catch (error) {
+            last = error;
+            const retryable = error instanceof TokenRequestError ? error.kind === "transient" : isTransientNetworkError(error);
+            if (!retryable || attempt === REFRESH_ATTEMPTS)
+                throw error;
+            await sleep(REFRESH_BACKOFF_MS * 2 ** (attempt - 1));
+        }
+    }
+    throw last;
+}
+/** Three tries at 1s and 2s apart. Enough to ride out a restart or a rate limit, short
+ *  enough that a genuinely dead server does not hold a request for a minute. */
+const REFRESH_ATTEMPTS = 3;
+const REFRESH_BACKOFF_MS = 1_000;
+function sleep(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref?.();
+    });
+}
+/**
+ * Tell the authorization server a token is finished with (RFC 7009).
+ *
+ * BEST EFFORT, and deliberately so: signing out has already succeeded locally by the time
+ * this runs, and a server that does not implement revocation, or is simply down, must not
+ * turn "signed out" into an error. What this buys is that a token we stop using also
+ * stops WORKING, rather than remaining valid on the server until it expires.
+ *
+ * The client id goes in the BODY rather than an Authorization header, which is what RFC
+ * 7009 asks of a public client: the header is for the resource owner, not for identifying
+ * which client is revoking.
+ */
+export async function revokeToken(options, fetchImpl = fetch) {
+    const post = async (form, headers) => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+        timer.unref?.();
+        try {
+            return await fetchImpl(options.revocationEndpoint, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded", ...headers },
+                body: form.toString(),
+                signal: controller.signal,
+            });
+        }
+        catch {
+            return null; // best effort — see above
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    const form = new URLSearchParams({ token: options.token, token_type_hint: options.hint });
+    // RFC 7009 §2.1 wants client authentication, and WHICH form matters. A client holding a
+    // secret is confidential, and strict authorization servers refuse a confidential
+    // client's token being revoked by something presenting as public — so a secret goes as
+    // HTTP Basic, the default RFC 6749 §2.3.1 form, rather than in the body. A public client
+    // identifies itself with `client_id` in the body and nothing else.
+    const headers = {};
+    if (options.clientSecret) {
+        const basic = Buffer.from(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`).toString("base64");
+        headers.authorization = `Basic ${basic}`;
+    }
+    else {
+        form.set("client_id", options.clientId);
+    }
+    const response = await post(form, headers);
+    if (!response || response.ok || response.status !== 401)
+        return;
+    // Some servers are not RFC 7009 compliant and want the access token as a Bearer instead.
+    // RFC 6749 §2.3.1 forbids presenting two client authentication methods at once, so the
+    // body credential is dropped before switching.
+    if (!options.accessToken)
+        return;
+    const retry = new URLSearchParams({ token: options.token, token_type_hint: options.hint });
+    await post(retry, { authorization: `Bearer ${options.accessToken}` });
+}
+/** An OAuth error body names `error` and `error_description`; anything else is shown
+ *  as-is, clipped, because an HTML error page in a terminal helps nobody. */
+async function errorText(response) {
+    let raw = "";
+    try {
+        raw = await response.text();
+    }
+    catch {
+        return response.statusText || "no detail";
+    }
+    try {
+        const body = JSON.parse(raw);
+        const error = typeof body.error === "string" ? body.error : "";
+        const description = typeof body.error_description === "string" ? body.error_description : "";
+        if (error || description)
+            return [error, description].filter(Boolean).join(": ");
+    }
+    catch {
+        // Not JSON; fall through to the clipped body.
+    }
+    return clip(raw) || response.statusText || "no detail";
+}
+/** One line, bounded. A wall of HTML in a terminal helps nobody. */
+function clip(raw) {
+    const flat = raw.replace(/\s+/g, " ").trim();
+    return flat.length > 200 ? `${flat.slice(0, 199)}…` : flat;
+}
+//# sourceMappingURL=flow.js.map

package/dist/mcp/oauth/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../src/mcp/oauth/flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,GAIb,MAAM,eAAe,CAAC;AAMvB;;wFAEwF;AACxF,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAalC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B;IAFX,YACE,OAAe,EACN,IAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAAa;QAG1B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC,CAAC;AAE3G;6BAC6B;AAC7B,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,KAAK,YAAY,iBAAiB;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,OAAO,qHAAqH,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7I,CAAC;AAED;;wEAEwE;AACxE,MAAM,WAAW,GAAG,WAAW,CAAC;AAOhC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,SAAoB;IACtD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACvE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,yDAAyD;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,SAAiB,EACjB,SAAwB,EACxB,YAAuB,KAAK;AAC5B;;yEAEyE;AACzE,qBAA8B;IAE9B,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,OAAO,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,qBAAqB,GAAG,CAAC,CAAC;QAC1H,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,qBAAqB,qEAAqE,CAAC,CAAC;QACxI,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,kBAAkB,GAAG,SAAS,CAAC,gBAAgB;QACnD,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAErC,IAAI,QAAQ,GAA4B,IAAI,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,GAAG,MAAM,CAAC;YAClB,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,qEAAqE,CAAC,CAAC;YAClG,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,QAAQ;QACN,CAAC,CAAC,8CAA8C,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,2CAA2C;QAClH,CAAC,CAAC,wGAAwG,CAC7G,CAAC;AACJ,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB,EAAE,QAAgB,EAAE,YAAuB,KAAK;IAC3G,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,WAAW;YACxB,aAAa,EAAE,CAAC,QAAQ,CAAC;YACzB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,gFAAgF;YAChF,iFAAiF;YACjF,WAAW;YACX,0BAA0B,EAAE,MAAM;YAClC,gBAAgB,EAAE,QAAQ;SAC3B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,CAAC,MAAM,MAAM,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACjG,MAAM,GAAG,GAAuB,EAAE,QAAQ,EAAE,CAAC;IAC7C,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa;QAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxG,OAAO,GAAG,CAAC;AACb,CAAC;AAaD,6CAA6C;AAC7C,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAUD,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAqB,EAAE,SAAoB,EAAE,MAAoB;IAC1G,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACvE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC/C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,OAAO;QAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAExC,IAAI,QAAkB,CAAC;IACvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kFAAkF;QAClF,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACtI,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IAED,kFAAkF;IAClF,uFAAuF;IACvF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,GAAgB,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAChI,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,IAAI,WAAW,CAAC;QACjH,MAAM,IAAI,iBAAiB,CAAC,iDAAiD,QAAQ,CAAC,MAAM,MAAM,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,EAAE,OAAO,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAa,EAAE,WAAW,EAAE,CAAC;IACtC,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa;QAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxG,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzE,sFAAsF;IACtF,mEAAmE;IACnE,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,CAAC;SAAM,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5B,oFAAoF;QACpF,oFAAoF;QACpF,mFAAmF;QACnF,mEAAmE;QACnE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAYD,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB,EAAE,YAAuB,KAAK;IACvF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,QAAQ;QAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,QAAQ;KAChC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAuB,EAAE,YAAuB,KAAK;IACvF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,SAAS,EAAE,OAAO,CAAC,QAAQ;KAC5B,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7D,kFAAkF;IAClF,uFAAuF;IACvF,sFAAsF;IACtF,sFAAsF;IACtF,sFAAsF;IACtF,uEAAuE;IACvE,IAAI,IAAa,CAAC;IAClB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACvE,mFAAmF;YACnF,iFAAiF;YACjF,wCAAwC;YACxC,IAAI,CAAC,MAAM,CAAC,YAAY;gBAAE,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YACrE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,SAAS,GAAG,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACnH,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YAC5D,MAAM,KAAK,CAAC,kBAAkB,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,CAAC;AACb,CAAC;AAED;gFACgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB,EAAE,YAAuB,KAAK;IACpF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAqB,EAAE,OAA+B,EAA4B,EAAE;QACtG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACvE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,GAAG,OAAO,EAAE;gBAC5E,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,0BAA0B;QACzC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,wFAAwF;IACxF,iFAAiF;IACjF,uFAAuF;IACvF,yFAAyF;IACzF,mEAAmE;IACnE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpI,OAAO,CAAC,aAAa,GAAG,SAAS,KAAK,EAAE,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEhE,yFAAyF;IACzF,uFAAuF;IACvF,+CAA+C;IAC/C,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO;IACjC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;6EAC6E;AAC7E,KAAK,UAAU,SAAS,CAAC,QAAkB;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,UAAU,IAAI,WAAW,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,IAAI,KAAK,IAAI,WAAW;YAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,IAAI,WAAW,CAAC;AACzD,CAAC;AAED,oEAAoE;AACpE,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}

package/dist/mcp/oauth/index.js

@@ -0,0 +1,243 @@
+/**
+ * index.ts — the one door the rest of Mindweave uses to authorize an MCP server.
+ *
+ * Everything under `oauth/` is a step; this is the sequence. Two entry points, and the
+ * split between them is the whole design:
+ *
+ *  - `authHeaders()` runs on EVERY request and must be silent, fast and never open a
+ *    browser. It hands back a token if one is stored, refreshes it first if it has
+ *    expired, and returns nothing at all if there is no credential — a request with no
+ *    Authorization header is how we learn a server wants one, so failing to produce a
+ *    token is a normal outcome rather than an error.
+ *  - `authenticate()` runs when a PERSON asked for it, and is the only thing allowed to
+ *    open a browser and hold a port. It never runs on its own: a connection that hits a
+ *    401 goes to `needs-auth` and STOPS. A background retry that pops a browser window
+ *    for a server the user forgot they configured is a worse outcome than a server that
+ *    plainly says it needs signing in.
+ *
+ * An expired refresh is treated as no credential rather than as a failure: refresh tokens
+ * are revoked from dashboards all the time, and the right response is to offer signing in
+ * again, not to report a broken connection.
+ */
+import { spawn } from "node:child_process";
+import { authorizeUrl, discover, exchangeCode, isTransientNetworkError, refreshTokens, registerClient, revokeToken, TokenRequestError } from "./flow.js";
+import { createPkce, randomState } from "./pkce.js";
+import { findAvailablePort, redirectUri, waitForCallback } from "./callback.js";
+import { clearAuth, isExpired, readAuth, serverKey, writeAuth } from "./tokenStore.js";
+import { clientSecretFor } from "../config.js";
+export { serverKey, clearAuth } from "./tokenStore.js";
+export { parseWwwAuthenticate } from "./metadata.js";
+/**
+ * The Authorization header for a server, or `{}` when there is nothing stored.
+ *
+ * Refreshes in place and persists the result, so a long session does not accumulate one
+ * expired token per hour. A refresh that fails is classified before anything is thrown
+ * away: only `invalid_grant` — the refresh token itself being dead — clears the
+ * credential. See the catch below for why both directions of that judgement are costly.
+ */
+export async function authHeaders(name, config, fetchImpl = fetch) {
+    const key = serverKey(name, config);
+    const stored = await readAuth(key);
+    if (!stored)
+        return {};
+    if (!isExpired(stored))
+        return { authorization: `Bearer ${stored.accessToken}` };
+    if (!stored.refreshToken) {
+        await clearAuth(key);
+        return {};
+    }
+    try {
+        const refreshed = await refreshTokens({
+            tokenEndpoint: stored.tokenEndpoint,
+            clientId: stored.clientId,
+            ...(stored.clientSecret ? { clientSecret: stored.clientSecret } : {}),
+            refreshToken: stored.refreshToken,
+            ...(stored.resource ? { resource: stored.resource } : {}),
+        }, fetchImpl);
+        const next = {
+            ...stored,
+            accessToken: refreshed.accessToken,
+            ...(refreshed.refreshToken ? { refreshToken: refreshed.refreshToken } : {}),
+            ...(refreshed.expiresAt ? { expiresAt: refreshed.expiresAt } : {}),
+            ...(refreshed.scope ? { scope: refreshed.scope } : {}),
+        };
+        await writeAuth(key, next);
+        return { authorization: `Bearer ${next.accessToken}` };
+    }
+    catch (error) {
+        // WHAT KIND of failure decides whether the credential survives, and getting this
+        // wrong in either direction is expensive: clear too eagerly and a dropped packet
+        // signs the user out, keep too stubbornly and a revoked token is re-sent forever
+        // while the sign-in that would fix it is never offered.
+        const kind = error instanceof TokenRequestError ? error.kind : isTransientNetworkError(error) ? "transient" : "other";
+        if (kind !== "invalid_grant") {
+            // Not the credential's fault. Send nothing this time — the request will 401 and the
+            // connection will say so — but keep what we have for the next attempt.
+            return {};
+        }
+        // `invalid_grant` usually means the refresh token is dead. It also means exactly this
+        // when ANOTHER Mindweave session refreshed a moment ago on a server that rotates
+        // refresh tokens: ours became invalid because theirs succeeded. Re-reading before
+        // clearing is what tells the two apart, and without it a second open session is a
+        // reliable way to sign yourself out of the first.
+        const current = await readAuth(key);
+        if (current && current.accessToken !== stored.accessToken && !isExpired(current)) {
+            return { authorization: `Bearer ${current.accessToken}` };
+        }
+        await clearAuth(key);
+        return {};
+    }
+}
+/** How long to let the browser get on with it before offering the raw URL. Long enough
+ *  that a working launch never shows it, short enough that someone staring at a terminal
+ *  which appears to have done nothing is not left guessing. */
+const URL_FALLBACK_DELAY_MS = 4_000;
+/**
+ * Sign in to one server, end to end, and persist what comes back.
+ *
+ * The port is bound BEFORE the authorize URL is built, because the redirect URI is part
+ * of what gets signed into the request and part of what the client registers with, so it
+ * has to be the real one rather than a guess corrected later.
+ */
+export async function authenticate(options) {
+    const { name, config, challenge = {}, onUrl, signal, fetchImpl = fetch, openUrl = openInBrowser } = options;
+    if (config.type !== "http")
+        throw new Error("only http servers can be signed in to; a local command server has no authorization server");
+    const key = serverKey(name, config);
+    const overrides = config.oauth;
+    const { authServer, resource } = await discover(config.url, challenge, fetchImpl, overrides?.authServerMetadataUrl);
+    // A hand-registered client has an EXACT redirect URI recorded against it, so a
+    // configured client id and a configured port travel together — the random port the
+    // automatic flow picks would not match what was registered.
+    const port = overrides?.callbackPort ?? (await findAvailablePort());
+    const redirect = redirectUri(port);
+    // Three ways to have a client id, in order of how deliberate they are: named in the
+    // config by someone who registered it by hand, carried over from a previous sign-in, or
+    // registered now. Registering afresh on every attempt leaves a trail of one-shot clients
+    // on the authorization server, and several of them start refusing once that list gets long.
+    const configuredSecret = clientSecretFor(name);
+    const previous = await readAuth(key);
+    const registration = overrides?.clientId
+        ? { clientId: overrides.clientId, ...(configuredSecret ? { clientSecret: configuredSecret } : {}) }
+        : previous?.clientId && previous.tokenEndpoint === authServer.tokenEndpoint
+            ? { clientId: previous.clientId, ...(previous.clientSecret ?? configuredSecret ? { clientSecret: previous.clientSecret ?? configuredSecret } : {}) }
+            : await registerClient(authServer, redirect, fetchImpl);
+    const pkce = createPkce();
+    const state = randomState();
+    const scope = scopeFor(challenge, resource, authServer);
+    const url = authorizeUrl({
+        meta: authServer,
+        clientId: registration.clientId,
+        redirect,
+        pkce,
+        state,
+        ...(scope ? { scope } : {}),
+        ...(resource?.resource ? { resource: resource.resource } : {}),
+    });
+    // Start listening BEFORE the browser is told where to go. A fast redirect arriving at a
+    // port nobody is on yet is a flow that fails for no reason the user can see.
+    const waiting = waitForCallback({ port, state, ...(signal ? { signal } : {}) });
+    openUrl(url);
+    // THE URL IS A FALLBACK, NOT THE INSTRUCTION. It is 400 characters of query string, and
+    // printing it up front means every successful sign-in — the overwhelming majority —
+    // dumps a wall of unreadable text into the transcript to say something the browser
+    // window already said better. So it waits: if the browser opened, the callback lands
+    // first and the URL is never shown. If nothing opened, a few seconds of silence is
+    // exactly when someone starts wondering what to do, and that is when it appears.
+    const hint = setTimeout(() => onUrl?.(url), URL_FALLBACK_DELAY_MS);
+    hint.unref?.();
+    let code;
+    try {
+        ({ code } = await waiting);
+    }
+    finally {
+        clearTimeout(hint);
+    }
+    const tokens = await exchangeCode({
+        meta: authServer,
+        clientId: registration.clientId,
+        ...(registration.clientSecret ? { clientSecret: registration.clientSecret } : {}),
+        redirect,
+        code,
+        verifier: pkce.verifier,
+        ...(resource?.resource ? { resource: resource.resource } : {}),
+    }, fetchImpl);
+    await writeAuth(key, {
+        accessToken: tokens.accessToken,
+        ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+        ...(tokens.expiresAt ? { expiresAt: tokens.expiresAt } : {}),
+        ...(tokens.scope ? { scope: tokens.scope } : {}),
+        clientId: registration.clientId,
+        ...(registration.clientSecret ? { clientSecret: registration.clientSecret } : {}),
+        tokenEndpoint: authServer.tokenEndpoint,
+        // Kept so signing out can tell the server the token is finished with, rather than
+        // only forgetting it locally and leaving it valid until it expires on its own.
+        ...(authServer.revocationEndpoint ? { revocationEndpoint: authServer.revocationEndpoint } : {}),
+        ...(resource?.resource ? { resource: resource.resource } : {}),
+    });
+}
+/**
+ * Forget a server's credential, and tell the server so where it will listen.
+ *
+ * The local record goes FIRST and unconditionally. Revocation is a courtesy that makes
+ * the token stop working rather than merely stop being used, but a server that is down,
+ * or that never implemented RFC 7009, must not be able to keep someone signed in.
+ */
+export async function signOut(name, config, fetchImpl = fetch) {
+    const key = serverKey(name, config);
+    const stored = await readAuth(key);
+    await clearAuth(key);
+    if (!stored?.revocationEndpoint)
+        return;
+    const base = {
+        revocationEndpoint: stored.revocationEndpoint,
+        clientId: stored.clientId,
+        ...(stored.clientSecret ? { clientSecret: stored.clientSecret } : {}),
+    };
+    // The refresh token first: it is the one that would otherwise keep minting new access
+    // tokens long after this.
+    if (stored.refreshToken)
+        await revokeToken({ ...base, token: stored.refreshToken, hint: "refresh_token", accessToken: stored.accessToken }, fetchImpl);
+    await revokeToken({ ...base, token: stored.accessToken, hint: "access_token" }, fetchImpl);
+}
+/** Whether we hold anything for this server, without producing it. Drives whether the
+ *  manage screen offers "Sign in" or "Sign out". */
+export async function hasCredential(name, config) {
+    return (await readAuth(serverKey(name, config))) !== undefined;
+}
+/** The 401's scope, then the resource's, then the authorization server's own advertised
+ *  list. The last one is a guess and is used only because some servers reject an
+ *  authorize request carrying no scope at all. */
+function scopeFor(challenge, resource, authServer) {
+    if (challenge.scope?.trim())
+        return challenge.scope.trim();
+    if (resource?.scopesSupported?.length)
+        return resource.scopesSupported.join(" ");
+    if (authServer.scopesSupported?.length)
+        return authServer.scopesSupported.join(" ");
+    return undefined;
+}
+/**
+ * Hand a URL to whatever the user's machine calls a browser.
+ *
+ * Detached and with its streams discarded, because this must not become a child whose
+ * exit we wait on or whose output lands in the middle of the UI. A failure here is
+ * swallowed on purpose: the URL was already reported through `onUrl`, so a machine with
+ * no default browser leaves the user able to copy it rather than staring at an error
+ * about a program they did not ask us to run.
+ */
+function openInBrowser(url) {
+    try {
+        const child = process.platform === "win32"
+            ? spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore", windowsHide: true })
+            : process.platform === "darwin"
+                ? spawn("open", [url], { detached: true, stdio: "ignore" })
+                : spawn("xdg-open", [url], { detached: true, stdio: "ignore" });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        // Reported through onUrl already.
+    }
+}
+//# sourceMappingURL=index.js.map