pi-cloudflare 0.1.0

package/README.md

@@ -0,0 +1,67 @@
+# pi-cloudflare
+
+One install for Cloudflare-driven agent work: **skills + MCP tools + setup
+helper** in a single pi package.
+
+- **Skills** (12 vendored from the official
+  [cloudflare/skills](https://github.com/cloudflare/skills) repo: `cloudflare`,
+  `wrangler`, `workers-best-practices`, `durable-objects`, `agents-sdk`,
+  `cloudflare-email-service`, `cloudflare-one`, `cloudflare-one-migrations`,
+  `sandbox-stable`, `sandbox-next`, `sandbox-migrate-to-next`,
+  `turnstile-spin`). Refresh with `scripts/sync-skills.sh`
+  (kept as a script, not vendored twice).
+- **MCP tools** — all five official Cloudflare MCP servers, proxied with
+  per-server prefixes (a server that is down or unauthorized is skipped with
+  a warning instead of failing the session):
+
+  | Tools           | Server                                          |
+  | --------------- | ----------------------------------------------- |
+  | `cf_api_*`      | Cloudflare API (2,500+ endpoints)               |
+  | `cf_docs_*`     | Developer documentation (works without a token) |
+  | `cf_bindings_*` | Workers primitives guidance                     |
+  | `cf_builds_*`   | Workers Builds insights                         |
+  | `cf_obs_*`      | Workers logs/metrics/traces                     |
+
+## Install
+
+```bash
+pi install npm:pi-cloudflare   # once published
+pi install /path/to/pi-cloudflare  # from source
+```
+
+Tools and skills register on the **next** session start.
+
+## Authenticate (one-time browser OAuth)
+
+```bash
+pi-cloudflare-setup                    # authorize missing servers
+pi-cloudflare-setup --only builds    # re-auth specific servers
+```
+
+Each Cloudflare MCP server is its own OAuth issuer, so approval happens
+once per server (docs needs none): the command opens one tab per server,
+you approve, and tokens (with refresh) are stored owner-only in
+`~/.pi/cloudflare-tokens.json`. The extension refreshes them silently
+before expiry, and setup skips servers that are still fresh. If a server
+later rejects its token, rerun setup (with `--only` for just that one).
+Nothing is ever logged or committed.
+
+## Configure (optional)
+
+In `~/.pi/agent/settings.json`:
+
+```jsonc
+{
+  "pi-cloudflare": {
+    "servers": { "builds": false }, // disable individual servers
+    "connectTimeoutMs": 30000,
+  },
+}
+```
+
+## Development
+
+```bash
+npm install
+npm test    # typecheck + unit tests (mocked, no network)
+```

package/bin/setup.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+/**
+ * pi-cloudflare setup: one-time browser OAuth for every Cloudflare MCP
+ * server. Each server is its own OAuth issuer, so approval happens once per
+ * server (docs needs none). Tokens (with refresh) are stored owner-only in
+ * ~/.pi/cloudflare-tokens.json and refreshed automatically afterwards.
+ *
+ * Usage:
+ *   pi-cloudflare-setup                  # authorize missing/expired servers
+ *   pi-cloudflare-setup --only builds    # re-auth specific servers
+ *   pi-cloudflare-setup --only api,observability
+ *
+ * Nothing secret is ever logged or written anywhere else.
+ */
+import { connectAll } from '../dist/client.js'
+import { CLOUDFLARE_SERVERS } from '../dist/servers.js'
+import { runOAuthFlow } from '../dist/auth-flow.js'
+import { partitionServers, readTokenFile, writeTokenFile } from '../dist/token-store.js'
+
+const AUTHED_IDS = ['api', 'bindings', 'builds', 'observability']
+
+function argValue(flag) {
+  const index = process.argv.indexOf(flag)
+  return index >= 0 && index + 1 < process.argv.length ? process.argv[index + 1] : undefined
+}
+
+function parseOnly() {
+  const raw = argValue('--only')
+  if (!raw) return undefined
+  const ids = raw
+    .split(',')
+    .map((id) => id.trim())
+    .filter(Boolean)
+  const unknown = ids.filter((id) => !AUTHED_IDS.includes(id))
+  if (unknown.length > 0) {
+    console.log(`Unknown server(s): ${unknown.join(', ')}. Choose from: ${AUTHED_IDS.join(', ')}`)
+    process.exit(2)
+  }
+  return ids
+}
+
+const only = parseOnly()
+const wanted = only ?? AUTHED_IDS
+const file = readTokenFile() ?? { version: 1, servers: {} }
+const { fresh, needed } = partitionServers(wanted, file.servers)
+
+if (fresh.length > 0) {
+  console.log(`Already authorized (skipping): ${fresh.join(', ')}\n`)
+}
+if (needed.length === 0) {
+  console.log('All requested servers already authorized. Verifying...\n')
+} else {
+  console.log(
+    `Browser OAuth: ${needed.length} approval tab${needed.length === 1 ? '' : 's'} ` +
+      `(${needed.join(', ')}). Approve each; tokens stay on this machine.\n`
+  )
+  let index = 0
+  for (const id of needed) {
+    index += 1
+    const definition = CLOUDFLARE_SERVERS.find((server) => server.id === id)
+    console.log(`[${index}/${needed.length}] Approving ${id} (${definition.url})...`)
+    try {
+      const { tokens, clientId, tokenEndpoint } = await runOAuthFlow(definition)
+      file.servers[id] = { ...tokens, clientId, tokenEndpoint }
+      writeTokenFile(file.servers)
+      console.log(`[${index}/${needed.length}] ${id}: authorized and stored\n`)
+    } catch (error) {
+      console.log(
+        `[${index}/${needed.length}] ${id}: FAILED (${error instanceof Error ? error.message : String(error)})\n`
+      )
+    }
+  }
+}
+
+console.log('Verifying all servers...\n')
+const stored = readTokenFile()
+let okCount = 0
+const failed = []
+for (const definition of CLOUDFLARE_SERVERS) {
+  const token = stored?.servers[definition.id]?.accessToken
+  const [connection] = await connectAll([definition], { apiToken: token, timeoutMs: 20000 })
+  if (!connection) {
+    console.log(`- ${definition.id}: unreachable`)
+    if (AUTHED_IDS.includes(definition.id)) failed.push(definition.id)
+    continue
+  }
+  try {
+    const tools = await connection.listTools()
+    console.log(`- ${definition.id}: OK (${tools.length} tools)`)
+    okCount += 1
+  } catch {
+    console.log(`- ${definition.id}: connected but tool discovery failed`)
+    if (AUTHED_IDS.includes(definition.id)) failed.push(definition.id)
+  } finally {
+    await connection.close()
+  }
+}
+
+console.log(`\n${okCount}/5 servers working.`)
+if (failed.length > 0) {
+  console.log(`Re-authenticate with: pi-cloudflare-setup --only ${failed.join(',')}`)
+  process.exit(1)
+}

package/dist/auth-flow.d.ts

@@ -0,0 +1,15 @@
+import { type OAuthTokens } from './oauth.js';
+import type { CloudflareServerDefinition } from './servers.js';
+export interface OAuthFlowResult {
+    tokens: OAuthTokens;
+    clientId: string;
+    tokenEndpoint: string;
+}
+/**
+ * One-time browser OAuth for a single MCP server: dynamic registration,
+ * PKCE, localhost callback, code exchange. Nothing secret is logged.
+ */
+export declare function runOAuthFlow(definition: CloudflareServerDefinition, options?: {
+    timeoutMs?: number;
+}): Promise<OAuthFlowResult>;
+//# sourceMappingURL=auth-flow.d.ts.map

package/dist/auth-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flow.d.ts","sourceRoot":"","sources":["../src/auth-flow.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAkDD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,0BAA0B,EACtC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,eAAe,CAAC,CA0C1B"}

package/dist/auth-flow.js

@@ -0,0 +1,90 @@
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { buildAuthorizeUrl, discoverAuthServer, exchangeCode, generatePkcePair, generateState, registerClient, } from './oauth.js';
+function waitForCallback(server, expectedState, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            server.close();
+            reject(new Error('Timed out waiting for browser approval (5 minutes)'));
+        }, timeoutMs);
+        server.on('request', (request, response) => {
+            const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+            response.writeHead(200, { 'Content-Type': 'text/html' });
+            response.end('<html><body><h1>Signed in.</h1><p>Return to your terminal; this window can be closed.</p></body></html>');
+            clearTimeout(timer);
+            server.close();
+            if (url.pathname !== '/callback') {
+                reject(new Error(`Unexpected callback path: ${url.pathname}`));
+                return;
+            }
+            if (url.searchParams.get('state') !== expectedState) {
+                reject(new Error('State mismatch: possible cross-site request, aborting'));
+                return;
+            }
+            const error = url.searchParams.get('error');
+            if (error) {
+                reject(new Error(`Authorization failed: ${error}`));
+                return;
+            }
+            const code = url.searchParams.get('code');
+            if (!code) {
+                reject(new Error('Authorization response had no code'));
+                return;
+            }
+            resolve(code);
+        });
+    });
+}
+function openBrowser(url) {
+    const opener = process.platform === 'darwin' ? 'open' : 'xdg-open';
+    const child = spawn(opener, [url], { detached: true, stdio: 'ignore' });
+    child.unref();
+    console.log(`Opened browser for approval. If nothing opened, visit:\n  ${url}\n`);
+}
+/**
+ * One-time browser OAuth for a single MCP server: dynamic registration,
+ * PKCE, localhost callback, code exchange. Nothing secret is logged.
+ */
+export async function runOAuthFlow(definition, options = {}) {
+    const metadata = await discoverAuthServer(definition.url);
+    if (!metadata.registrationEndpoint) {
+        throw new Error(`${definition.id}: server does not support dynamic client registration`);
+    }
+    const server = createServer();
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        server.close();
+        throw new Error('Could not bind localhost callback');
+    }
+    const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+    try {
+        const { clientId } = await registerClient(metadata.registrationEndpoint, redirectUri);
+        const { verifier, challenge } = generatePkcePair();
+        const state = generateState();
+        openBrowser(buildAuthorizeUrl({
+            authorizationEndpoint: metadata.authorizationEndpoint,
+            clientId,
+            redirectUri,
+            state,
+            challenge,
+            resource: definition.url,
+        }));
+        const code = await waitForCallback(server, state, options.timeoutMs ?? 5 * 60_000);
+        const tokens = await exchangeCode({
+            tokenEndpoint: metadata.tokenEndpoint,
+            clientId,
+            code,
+            redirectUri,
+            verifier,
+        });
+        return { tokens, clientId, tokenEndpoint: metadata.tokenEndpoint };
+    }
+    finally {
+        server.close();
+    }
+}
+//# sourceMappingURL=auth-flow.js.map

package/dist/auth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flow.js","sourceRoot":"","sources":["../src/auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,cAAc,GAEf,MAAM,YAAY,CAAA;AASnB,SAAS,eAAe,CACtB,MAAuC,EACvC,aAAqB,EACrB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,MAAM,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAA;QACzE,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC3D,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;YACxD,QAAQ,CAAC,GAAG,CACV,yGAAyG,CAC1G,CAAA;YACD,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,aAAa,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAA;gBAC1E,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvE,KAAK,CAAC,KAAK,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,6DAA6D,GAAG,IAAI,CAAC,CAAA;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAsC,EACtC,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,EAAE,uDAAuD,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAA;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAA;QACrF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAA;QAClD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;QAC7B,WAAW,CACT,iBAAiB,CAAC;YAChB,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS;YACT,QAAQ,EAAE,UAAU,CAAC,GAAG;SACzB,CAAC,CACH,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ;YACR,IAAI;YACJ,WAAW;YACX,QAAQ;SACT,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAA;IACpE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;AACH,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,18 @@
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { CloudflareServerDefinition } from './servers.js';
+export interface ServerConnection {
+    definition: CloudflareServerDefinition;
+    listTools: () => Promise<Tool[]>;
+    callTool: (name: string, args: Record<string, unknown>) => Promise<unknown>;
+    close: () => Promise<void>;
+}
+export declare function connectServer(definition: CloudflareServerDefinition, options: {
+    apiToken?: string | undefined;
+    timeoutMs: number;
+}): Promise<ServerConnection>;
+/** Connect every enabled server independently; failures isolate per server. */
+export declare function connectAll(definitions: readonly CloudflareServerDefinition[], options: {
+    apiToken?: string | undefined;
+    timeoutMs: number;
+}, onError?: (id: string, error: unknown) => void): Promise<ServerConnection[]>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA;AAE9D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,0BAA0B,CAAA;IACtC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3E,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAUD,wBAAsB,aAAa,CACjC,UAAU,EAAE,0BAA0B,EACtC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5D,OAAO,CAAC,gBAAgB,CAAC,CA0B3B;AAED,+EAA+E;AAC/E,wBAAsB,UAAU,CAC9B,WAAW,EAAE,SAAS,0BAA0B,EAAE,EAClD,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC7D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GAC7C,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAY7B"}

package/dist/client.js

@@ -0,0 +1,47 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+function withTimeout(promise, ms, label) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+    });
+    return Promise.race([promise.finally(() => clearTimeout(timer)), timeout]);
+}
+export async function connectServer(definition, options) {
+    const headers = {};
+    if (options.apiToken)
+        headers['Authorization'] = `Bearer ${options.apiToken}`;
+    const transport = new StreamableHTTPClientTransport(new URL(definition.url), {
+        requestInit: { headers },
+    });
+    const client = new Client({ name: 'pi-cloudflare', version: '0.1.0' }, { capabilities: {} });
+    const timeoutMs = options.timeoutMs;
+    await withTimeout(client.connect(transport), timeoutMs, `connect ${definition.id}`);
+    return {
+        definition,
+        listTools: async () => {
+            const result = await withTimeout(client.listTools(), timeoutMs, `listTools ${definition.id}`);
+            return result.tools;
+        },
+        callTool: async (name, args) => {
+            return withTimeout(client.callTool({ name, arguments: args }), timeoutMs, `callTool ${definition.id}.${name}`);
+        },
+        close: async () => {
+            await client.close().catch(() => undefined);
+        },
+    };
+}
+/** Connect every enabled server independently; failures isolate per server. */
+export async function connectAll(definitions, options, onError) {
+    const settled = await Promise.all(definitions.map(async (definition) => {
+        try {
+            return await connectServer(definition, options);
+        }
+        catch (error) {
+            onError?.(definition.id, error);
+            return undefined;
+        }
+    }));
+    return settled.filter((connection) => Boolean(connection));
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAA;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAYlG,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,KAAa;IACpE,IAAI,KAAgD,CAAA;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAsC,EACtC,OAA6D;IAE7D,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,CAAC,QAAQ,EAAE,CAAA;IAC7E,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QAC3E,WAAW,EAAE,EAAE,OAAO,EAAE;KACzB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;IACnF,OAAO;QACL,UAAU;QACV,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,aAAa,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;YAC7F,OAAO,MAAM,CAAC,KAAK,CAAA;QACrB,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC7B,OAAO,WAAW,CAChB,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAC1C,SAAS,EACT,YAAY,UAAU,CAAC,EAAE,IAAI,IAAI,EAAE,CACpC,CAAA;QACH,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAkD,EAClD,OAA6D,EAC7D,OAA8C;IAE9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAC/B,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,EAAkC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;AAC5F,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,13 @@
+import type { CloudflareServerId } from './servers.js';
+export interface PiCloudflareConfig {
+    /** Per-server enablement. Omitted servers default to enabled. */
+    servers?: Partial<Record<CloudflareServerId, boolean>>;
+    /** Connection timeout per server in milliseconds. */
+    connectTimeoutMs?: number;
+}
+export interface ResolvedPiCloudflareConfig {
+    enabledServerIds: CloudflareServerId[];
+    connectTimeoutMs: number;
+}
+export declare function resolveConfig(config: PiCloudflareConfig | undefined): ResolvedPiCloudflareConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGtD,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAA;IACtD,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,kBAAkB,EAAE,CAAA;IACtC,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,0BAA0B,CAQhG"}

package/dist/config.js

@@ -0,0 +1,10 @@
+import { CLOUDFLARE_SERVERS } from './servers.js';
+const DEFAULT_CONNECT_TIMEOUT_MS = 30_000;
+export function resolveConfig(config) {
+    const enabledServerIds = CLOUDFLARE_SERVERS.map((server) => server.id).filter((id) => config?.servers?.[id] !== false);
+    return {
+        enabledServerIds,
+        connectTimeoutMs: config?.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAcjD,MAAM,0BAA0B,GAAG,MAAM,CAAA;AAEzC,MAAM,UAAU,aAAa,CAAC,MAAsC;IAClE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAC3E,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,CACxC,CAAA;IACD,OAAO;QACL,gBAAgB;QAChB,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;KACzE,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+interface PiToolDefinition {
+    name: string;
+    label?: string;
+    description?: string;
+    parameters?: unknown;
+    execute: (toolCallId: string, params: Record<string, unknown>, signal?: AbortSignal) => Promise<unknown>;
+}
+interface PiHost {
+    registerTool: (definition: PiToolDefinition) => void;
+    on: (event: 'session_start' | 'session_shutdown', handler: (...args: never[]) => unknown) => void;
+}
+/**
+ * pi-coding-agent extension entry point.
+ *
+ * Credentials come only from per-server browser OAuth (pi-cloudflare-setup
+ * --oauth), stored owner-only in ~/.pi/cloudflare-tokens.json. The docs
+ * server needs no credential. On session_start every enabled server is
+ * connected independently and its tools registered with a `cf_<server>_`
+ * prefix; unreachable servers are skipped with a re-auth hint instead of
+ * failing the session. On session_shutdown all connections close.
+ */
+export default function piCloudflareExtension(pi: PiHost): void;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,OAAO,CAAC,CAAA;CACtB;AAED,UAAU,MAAM;IACd,YAAY,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,IAAI,CAAA;IACpD,EAAE,EAAE,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,IAAI,CAAA;CAClG;AAgDD;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAwD9D"}

package/dist/index.js

@@ -0,0 +1,109 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { connectServer } from './client.js';
+import { refreshAccessToken } from './oauth.js';
+import { resolveConfig } from './config.js';
+import { buildAllRegistrations } from './proxy.js';
+import { CLOUDFLARE_SERVERS } from './servers.js';
+import { isExpired, readTokenFile, writeTokenFile } from './token-store.js';
+function loadUserConfig() {
+    try {
+        const raw = readFileSync(join(homedir(), '.pi', 'agent', 'settings.json'), 'utf8');
+        const parsed = JSON.parse(raw);
+        return parsed['pi-cloudflare'];
+    }
+    catch {
+        return undefined;
+    }
+}
+function warn(message) {
+    console.warn(`[pi-cloudflare] ${message}`);
+}
+/** Refresh an OAuth token that is expired (or nearly so), persisting the result. */
+async function ensureFreshToken(entry) {
+    const stored = entry.stored;
+    if (!stored)
+        return undefined;
+    if (!isExpired(stored) || !stored.refreshToken)
+        return stored.accessToken;
+    const fresh = await refreshAccessToken({
+        tokenEndpoint: stored.tokenEndpoint,
+        clientId: stored.clientId,
+        refreshToken: stored.refreshToken,
+    });
+    entry.stored = { ...stored, ...fresh };
+    const file = readTokenFile() ?? { version: 1, servers: {} };
+    file.servers[entry.definition.id] = entry.stored;
+    writeTokenFile(file.servers);
+    await entry.connection?.close().catch(() => undefined);
+    entry.connection = await connectServer(entry.definition, {
+        apiToken: entry.stored.accessToken,
+        timeoutMs: 30_000,
+    });
+    return entry.stored.accessToken;
+}
+/**
+ * pi-coding-agent extension entry point.
+ *
+ * Credentials come only from per-server browser OAuth (pi-cloudflare-setup
+ * --oauth), stored owner-only in ~/.pi/cloudflare-tokens.json. The docs
+ * server needs no credential. On session_start every enabled server is
+ * connected independently and its tools registered with a `cf_<server>_`
+ * prefix; unreachable servers are skipped with a re-auth hint instead of
+ * failing the session. On session_shutdown all connections close.
+ */
+export default function piCloudflareExtension(pi) {
+    let entries = [];
+    pi.on('session_start', async () => {
+        for (const entry of entries) {
+            await entry.connection?.close().catch(() => undefined);
+        }
+        entries = [];
+        const config = resolveConfig(loadUserConfig());
+        const file = readTokenFile();
+        const definitions = CLOUDFLARE_SERVERS.filter((server) => config.enabledServerIds.includes(server.id));
+        for (const definition of definitions) {
+            const entry = { definition };
+            try {
+                entry.stored = file?.servers[definition.id];
+                await ensureFreshToken(entry);
+                entry.connection = await connectServer(definition, {
+                    apiToken: entry.stored?.accessToken,
+                    timeoutMs: config.connectTimeoutMs,
+                });
+                const tools = await entry.connection.listTools();
+                const registrations = buildAllRegistrations([
+                    {
+                        prefix: definition.prefix,
+                        tools,
+                        callTool: async (name, params) => {
+                            if (!entry.connection)
+                                throw new Error(`${definition.id}: not connected`);
+                            return entry.connection.callTool(name, params);
+                        },
+                    },
+                ]);
+                for (const registration of registrations) {
+                    pi.registerTool({
+                        ...registration,
+                        execute: async (toolCallId, params, signal) => {
+                            await ensureFreshToken(entry);
+                            return registration.execute(toolCallId, params, signal);
+                        },
+                    });
+                }
+                entries.push(entry);
+            }
+            catch (error) {
+                warn(`${definition.id}: unavailable (${error instanceof Error ? error.message : String(error)}). Re-run pi-cloudflare-setup --oauth to re-authenticate.`);
+                await entry.connection?.close().catch(() => undefined);
+            }
+        }
+    });
+    pi.on('session_shutdown', async () => {
+        await Promise.all(entries.map((entry) => entry.connection?.close().catch(() => undefined)));
+        entries = [];
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAAE,aAAa,EAAyB,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAmC,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAA2B,MAAM,kBAAkB,CAAA;AA6BpG,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAChD,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,gBAAgB,CAAC,KAAkB;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC,WAAW,CAAA;IACzE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IACtC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAA;IAChD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACtD,KAAK,CAAC,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE;QACvD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;QAClC,SAAS,EAAE,MAAM;KAClB,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,CAAA;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAU;IACtD,IAAI,OAAO,GAAkB,EAAE,CAAA;IAE/B,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,GAAG,EAAE,CAAA;QACZ,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;QAC5B,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAC5C,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAgB,EAAE,UAAU,EAAE,CAAA;YACzC,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAC3C,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;gBAC7B,KAAK,CAAC,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;oBACjD,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW;oBACnC,SAAS,EAAE,MAAM,CAAC,gBAAgB;iBACnC,CAAC,CAAA;gBACF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAA;gBAChD,MAAM,aAAa,GAAuB,qBAAqB,CAAC;oBAC9D;wBACE,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,KAAK;wBACL,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;4BAC/B,IAAI,CAAC,KAAK,CAAC,UAAU;gCAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAA;4BACzE,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;wBAChD,CAAC;qBACF;iBACF,CAAC,CAAA;gBACF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;oBACzC,EAAE,CAAC,YAAY,CAAC;wBACd,GAAG,YAAY;wBACf,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;4BAC5C,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;4BAC7B,OAAO,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBACzD,CAAC;qBACF,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CACF,GAAG,UAAU,CAAC,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CACpJ,CAAA;gBACD,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC3F,OAAO,GAAG,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,44 @@
+export interface OAuthServerMetadata {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint?: string;
+}
+export interface RegisteredClient {
+    clientId: string;
+    tokenEndpoint: string;
+}
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+}
+export declare function pkceChallengeFor(verifier: string): string;
+export declare function generatePkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function generateState(): string;
+export declare function discoverAuthServer(mcpUrl: string): Promise<OAuthServerMetadata>;
+export declare function registerClient(registrationEndpoint: string, redirectUri: string): Promise<RegisteredClient>;
+export declare function buildAuthorizeUrl(options: {
+    authorizationEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    challenge: string;
+    resource: string;
+}): string;
+export declare function exchangeCode(options: {
+    tokenEndpoint: string;
+    clientId: string;
+    code: string;
+    redirectUri: string;
+    verifier: string;
+}): Promise<OAuthTokens>;
+export declare function refreshAccessToken(options: {
+    tokenEndpoint: string;
+    clientId: string;
+    refreshToken: string;
+}): Promise<OAuthTokens>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,qBAAqB,EAAE,MAAM,CAAA;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;CAClB;AAUD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,gBAAgB,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAG1E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAUD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmCrF;AAED,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,CAWT;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBvB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBvB"}