pi-cloudflare 0.1.0

package/dist/oauth.js

@@ -0,0 +1,135 @@
+import { randomBytes, createHash } from 'node:crypto';
+function base64Url(bytes) {
+    return Buffer.from(bytes)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+export function pkceChallengeFor(verifier) {
+    return base64Url(createHash('sha256').update(verifier).digest());
+}
+export function generatePkcePair() {
+    const verifier = base64Url(randomBytes(32));
+    return { verifier, challenge: pkceChallengeFor(verifier) };
+}
+export function generateState() {
+    return base64Url(randomBytes(16));
+}
+async function fetchJson(url) {
+    const response = await fetch(url, { headers: { Accept: 'application/json' } });
+    if (!response.ok) {
+        throw new Error(`GET ${url} failed with ${response.status}`);
+    }
+    return response.json();
+}
+export async function discoverAuthServer(mcpUrl) {
+    const challenge = await fetch(mcpUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'ping' }),
+    });
+    if (challenge.status !== 401) {
+        throw new Error(`Expected 401 auth challenge from ${mcpUrl}, got ${challenge.status}`);
+    }
+    const wwwAuth = challenge.headers.get('www-authenticate') ?? '';
+    const metadataUrl = /resource_metadata="([^"]+)"/.exec(wwwAuth)?.[1];
+    if (!metadataUrl)
+        throw new Error(`No resource metadata advertised by ${mcpUrl}`);
+    const resource = (await fetchJson(metadataUrl));
+    const issuer = resource.authorization_servers?.[0];
+    if (!issuer)
+        throw new Error(`No authorization server advertised by ${mcpUrl}`);
+    const metadata = (await fetchJson(`${issuer.replace(/\/$/, '')}/.well-known/oauth-authorization-server`));
+    if (!metadata.authorization_endpoint || !metadata.token_endpoint) {
+        throw new Error(`Incomplete OAuth metadata from ${issuer}`);
+    }
+    return {
+        issuer,
+        authorizationEndpoint: metadata.authorization_endpoint,
+        tokenEndpoint: metadata.token_endpoint,
+        registrationEndpoint: metadata.registration_endpoint,
+    };
+}
+export async function registerClient(registrationEndpoint, redirectUri) {
+    const response = await fetch(registrationEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            redirect_uris: [redirectUri],
+            grant_types: ['authorization_code', 'refresh_token'],
+            token_endpoint_auth_method: 'none',
+            client_name: 'pi-cloudflare',
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`Client registration failed with ${response.status}`);
+    }
+    const body = (await response.json());
+    if (!body.client_id)
+        throw new Error('Registration response had no client_id');
+    return { clientId: body.client_id, tokenEndpoint: registrationEndpoint };
+}
+export function buildAuthorizeUrl(options) {
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        code_challenge: options.challenge,
+        code_challenge_method: 'S256',
+        state: options.state,
+        resource: options.resource,
+    });
+    return `${options.authorizationEndpoint}?${params.toString()}`;
+}
+export async function exchangeCode(options) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: options.clientId,
+        code: options.code,
+        redirect_uri: options.redirectUri,
+        code_verifier: options.verifier,
+    });
+    const response = await fetch(options.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token exchange failed with ${response.status}`);
+    }
+    return readTokens(await response.json());
+}
+export async function refreshAccessToken(options) {
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: options.clientId,
+        refresh_token: options.refreshToken,
+    });
+    const response = await fetch(options.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token refresh failed with ${response.status}`);
+    }
+    const tokens = readTokens(await response.json());
+    return {
+        ...tokens,
+        refreshToken: tokens.refreshToken ?? options.refreshToken,
+    };
+}
+function readTokens(body) {
+    const record = body;
+    if (typeof record.access_token !== 'string' || !record.access_token) {
+        throw new Error('Token response had no access_token');
+    }
+    const lifetime = typeof record.expires_in === 'number' ? record.expires_in : 3600;
+    return {
+        accessToken: record.access_token,
+        refreshToken: typeof record.refresh_token === 'string' ? record.refresh_token : undefined,
+        expiresAt: Date.now() + Math.max(lifetime - 60, 0) * 1000,
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAoBrD,SAAS,SAAS,CAAC,KAA0B;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;AACnC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAA;IAC/D,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;IACjF,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,CAG7C,CAAA;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAC/B,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,yCAAyC,CACtE,CAKA,CAAA;IACD,IAAI,CAAC,QAAQ,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO;QACL,MAAM;QACN,qBAAqB,EAAE,QAAQ,CAAC,sBAAsB;QACtD,aAAa,EAAE,QAAQ,CAAC,cAAc;QACtC,oBAAoB,EAAE,QAAQ,CAAC,qBAAqB;KACrD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,eAAe;SAC7B,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC9E,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAOjC;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,cAAc,EAAE,OAAO,CAAC,SAAS;QACjC,qBAAqB,EAAE,MAAM;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAA;IACF,OAAO,GAAG,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAMlC;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,OAAO,CAAC,QAAQ;KAChC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAIxC;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;KAC1D,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,MAAM,MAAM,GAAG,IAAiF,CAAA;IAChG,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACzF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI;KAC1D,CAAA;AACH,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,29 @@
+import type { ServerConnection } from './client.js';
+export interface ToolRegistration {
+    name: string;
+    label: string;
+    description: string;
+    parameters: unknown;
+    execute: (toolCallId: string, params: Record<string, unknown>, signal: AbortSignal | undefined) => Promise<{
+        content: unknown[];
+        isError?: boolean;
+    }>;
+}
+interface UpstreamTool {
+    name: string;
+    description?: string | undefined;
+    inputSchema: Record<string, unknown>;
+}
+/**
+ * Build pi tool registrations for one upstream server. Pure function over
+ * injected dependencies so it unit tests without network or a pi session.
+ */
+export declare function buildToolRegistrations(prefix: string, tools: UpstreamTool[], callUpstream: (name: string, params: Record<string, unknown>) => Promise<unknown>): ToolRegistration[];
+/** Prefix every tool of every connected server; names stay unique per server. */
+export declare function buildAllRegistrations(connections: Array<{
+    prefix: string;
+    tools: UpstreamTool[];
+    callTool: ServerConnection['callTool'];
+}>): ToolRegistration[];
+export {};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,WAAW,GAAG,SAAS,KAC5B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAcD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,EAAE,EACrB,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAChF,gBAAgB,EAAE,CAiBpB;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAA;CACvC,CAAC,GACD,gBAAgB,EAAE,CAIpB"}

package/dist/proxy.js

@@ -0,0 +1,39 @@
+import { Type } from 'typebox';
+function toToolContent(result) {
+    if (typeof result !== 'object' || result === null) {
+        return { content: [{ type: 'text', text: String(result) }] };
+    }
+    const record = result;
+    const content = Array.isArray(record.content) ? record.content : [];
+    const output = content.length > 0 ? content : [{ type: 'text', text: '' }];
+    return typeof record.isError === 'boolean' && record.isError
+        ? { content: output, isError: true }
+        : { content: output };
+}
+/**
+ * Build pi tool registrations for one upstream server. Pure function over
+ * injected dependencies so it unit tests without network or a pi session.
+ */
+export function buildToolRegistrations(prefix, tools, callUpstream) {
+    return tools.map((tool) => {
+        const name = `${prefix}${tool.name}`;
+        const description = tool.description?.trim()
+            ? `[${prefix.replace(/_$/, '')}] ${tool.description}`
+            : `[${prefix.replace(/_$/, '')}] ${tool.name}`;
+        return {
+            name,
+            label: name,
+            description,
+            parameters: Type.Unsafe(tool.inputSchema),
+            execute: async (_toolCallId, params) => {
+                const result = await callUpstream(tool.name, params ?? {});
+                return toToolContent(result);
+            },
+        };
+    });
+}
+/** Prefix every tool of every connected server; names stay unique per server. */
+export function buildAllRegistrations(connections) {
+    return connections.flatMap((connection) => buildToolRegistrations(connection.prefix, connection.tools, connection.callTool));
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAsB9B,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,MAAkD,CAAA;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAC1E,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO;QAC1D,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,KAAqB,EACrB,YAAiF;IAEjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE;YAC1C,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE;YACrD,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAA;QAChD,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;gBACrC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;gBAC1D,OAAO,aAAa,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;SACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CACnC,WAIE;IAEF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CACxC,sBAAsB,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,CACjF,CAAA;AACH,CAAC"}

package/dist/servers.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The Cloudflare MCP servers this extension can proxy. All are remote
+ * Streamable HTTP endpoints; authentication (when required) is a Bearer
+ * token from the environment, never from config files.
+ */
+export type CloudflareServerId = 'api' | 'docs' | 'bindings' | 'builds' | 'observability';
+export interface CloudflareServerDefinition {
+    id: CloudflareServerId;
+    /** Tool prefix, e.g. `cf_api_` for the API server. */
+    prefix: `cf_${string}_`;
+    /** Streamable HTTP endpoint. */
+    url: string;
+    /** Whether this server is expected to work without a token. */
+    public?: boolean;
+    description: string;
+}
+export declare const CLOUDFLARE_SERVERS: readonly CloudflareServerDefinition[];
+export declare function serverById(id: CloudflareServerId): CloudflareServerDefinition;
+//# sourceMappingURL=servers.d.ts.map

package/dist/servers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"servers.d.ts","sourceRoot":"","sources":["../src/servers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,eAAe,CAAA;AAEzF,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,kBAAkB,CAAA;IACtB,sDAAsD;IACtD,MAAM,EAAE,MAAM,MAAM,GAAG,CAAA;IACvB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,kBAAkB,EAAE,SAAS,0BAA0B,EAiCnE,CAAA;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,kBAAkB,GAAG,0BAA0B,CAI7E"}

package/dist/servers.js

@@ -0,0 +1,40 @@
+export const CLOUDFLARE_SERVERS = [
+    {
+        id: 'api',
+        prefix: 'cf_api_',
+        url: 'https://mcp.cloudflare.com/mcp',
+        description: 'Full Cloudflare API (2,500+ endpoints: Workers, R2, DNS, Zero Trust) via search and execute tools.',
+    },
+    {
+        id: 'docs',
+        prefix: 'cf_docs_',
+        url: 'https://docs.mcp.cloudflare.com/mcp',
+        public: true,
+        description: 'Up-to-date Cloudflare developer documentation search and fetch.',
+    },
+    {
+        id: 'bindings',
+        prefix: 'cf_bindings_',
+        url: 'https://bindings.mcp.cloudflare.com/mcp',
+        description: 'Workers primitives guidance (KV, R2, D1, Durable Objects, AI).',
+    },
+    {
+        id: 'builds',
+        prefix: 'cf_builds_',
+        url: 'https://builds.mcp.cloudflare.com/mcp',
+        description: 'Workers Builds insights and management.',
+    },
+    {
+        id: 'observability',
+        prefix: 'cf_obs_',
+        url: 'https://observability.mcp.cloudflare.com/mcp',
+        description: 'Workers logs, metrics, and traces analysis.',
+    },
+];
+export function serverById(id) {
+    const found = CLOUDFLARE_SERVERS.find((server) => server.id === id);
+    if (!found)
+        throw new Error(`Unknown Cloudflare MCP server: ${id}`);
+    return found;
+}
+//# sourceMappingURL=servers.js.map

package/dist/servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"servers.js","sourceRoot":"","sources":["../src/servers.ts"],"names":[],"mappings":"AAkBA,MAAM,CAAC,MAAM,kBAAkB,GAA0C;IACvE;QACE,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,gCAAgC;QACrC,WAAW,EACT,oGAAoG;KACvG;IACD;QACE,EAAE,EAAE,MAAM;QACV,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,qCAAqC;QAC1C,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,iEAAiE;KAC/E;IACD;QACE,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,cAAc;QACtB,GAAG,EAAE,yCAAyC;QAC9C,WAAW,EAAE,gEAAgE;KAC9E;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,MAAM,EAAE,YAAY;QACpB,GAAG,EAAE,uCAAuC;QAC5C,WAAW,EAAE,yCAAyC;KACvD;IACD;QACE,EAAE,EAAE,eAAe;QACnB,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,8CAA8C;QACnD,WAAW,EAAE,6CAA6C;KAC3D;CACF,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,EAAsB;IAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACnE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAA;IACnE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/token-store.d.ts

@@ -0,0 +1,23 @@
+import type { CloudflareServerId } from './servers.js';
+import type { OAuthTokens } from './oauth.js';
+export interface StoredServerTokens extends OAuthTokens {
+    clientId: string;
+    tokenEndpoint: string;
+}
+interface TokenFile {
+    version: 1;
+    servers: Partial<Record<CloudflareServerId, StoredServerTokens>>;
+}
+export declare function tokenFilePath(home?: string): string;
+/** Read stored per-server OAuth tokens. Missing file means not authenticated. */
+export declare function readTokenFile(home?: string): TokenFile | undefined;
+/** Persist per-server tokens with owner-only permissions. Never logs values. */
+export declare function writeTokenFile(servers: Partial<Record<CloudflareServerId, StoredServerTokens>>, home?: string): void;
+export declare function isExpired(tokens: Pick<OAuthTokens, 'expiresAt'>, skewMs?: number): boolean;
+/** Split server ids into fresh (skip) vs needing approval. */
+export declare function partitionServers(ids: CloudflareServerId[], stored: Partial<Record<CloudflareServerId, StoredServerTokens>> | undefined): {
+    fresh: CloudflareServerId[];
+    needed: CloudflareServerId[];
+};
+export {};
+//# sourceMappingURL=token-store.d.ts.map

package/dist/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,UAAU,SAAS;IACjB,OAAO,EAAE,CAAC,CAAA;IACV,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAA;CACjE;AAED,wBAAgB,aAAa,CAAC,IAAI,SAAY,GAAG,MAAM,CAEtD;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,SAAY,GAAG,SAAS,GAAG,SAAS,CAUrE;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,EAChE,IAAI,SAAY,GACf,IAAI,CAON;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,SAAS,GAAG,OAAO,CAE1F;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,EAAE,EACzB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,GAAG,SAAS,GAC1E;IAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAAC,MAAM,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAS/D"}

package/dist/token-store.js

@@ -0,0 +1,47 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export function tokenFilePath(home = homedir()) {
+    return join(home, '.pi', 'cloudflare-tokens.json');
+}
+/** Read stored per-server OAuth tokens. Missing file means not authenticated. */
+export function readTokenFile(home = homedir()) {
+    const path = tokenFilePath(home);
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (parsed?.version !== 1 || typeof parsed.servers !== 'object')
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Persist per-server tokens with owner-only permissions. Never logs values. */
+export function writeTokenFile(servers, home = homedir()) {
+    const path = tokenFilePath(home);
+    mkdirSync(join(home, '.pi'), { recursive: true });
+    writeFileSync(path, JSON.stringify({ version: 1, servers }, null, 2) + '\n', {
+        mode: 0o600,
+    });
+    chmodSync(path, 0o600);
+}
+export function isExpired(tokens, skewMs = 30_000) {
+    return Date.now() + skewMs >= tokens.expiresAt;
+}
+/** Split server ids into fresh (skip) vs needing approval. */
+export function partitionServers(ids, stored) {
+    const fresh = [];
+    const needed = [];
+    for (const id of ids) {
+        const entry = stored?.[id];
+        if (entry && !isExpired(entry))
+            fresh.push(id);
+        else
+            needed.push(id);
+    }
+    return { fresh, needed };
+}
+//# sourceMappingURL=token-store.js.map

package/dist/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAehC,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAA;AACpD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAc,CAAA;QAClE,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjF,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAC5B,OAAgE,EAChE,IAAI,GAAG,OAAO,EAAE;IAEhB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAC3E,IAAI,EAAE,KAAK;KACZ,CAAC,CAAA;IACF,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAsC,EAAE,MAAM,GAAG,MAAM;IAC/E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,SAAS,CAAA;AAChD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,MAA2E;IAE3E,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,MAAM,MAAM,GAAyB,EAAE,CAAA;IACvC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC"}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "pi-cloudflare",
+  "version": "0.1.0",
+  "description": "Pi extension proxying Cloudflare's official MCP servers (API, docs, bindings, builds, observability) with cf_ prefixed tools.",
+  "keywords": [
+    "pi-package",
+    "pi",
+    "extension",
+    "cloudflare",
+    "mcp"
+  ],
+  "license": "Apache-2.0",
+  "author": "0xPlayerOne",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/0xPlayerOne/pi-cloudflare.git"
+  },
+  "homepage": "https://github.com/0xPlayerOne/pi-cloudflare#readme",
+  "bugs": "https://github.com/0xPlayerOne/pi-cloudflare/issues",
+  "type": "module",
+  "engines": {
+    "node": "^20.19.0 || ^22.12.0 || >=23"
+  },
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": {
+      "default": "./package.json"
+    }
+  },
+  "files": [
+    "dist",
+    "skills",
+    "README.md"
+  ],
+  "pi": {
+    "extensions": [
+      "./dist/index.js"
+    ],
+    "skills": [
+      "./skills"
+    ]
+  },
+  "bin": {
+    "pi-cloudflare-setup": "./bin/setup.mjs"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "npm run build",
+    "test": "node --test test/config.test.mjs test/servers.test.mjs test/proxy.test.mjs test/oauth.test.mjs test/token-store.test.mjs",
+    "pretest": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.17.0",
+    "typebox": "*"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.0"
+  }
+}