praxis-agent 0.1.0

package/dist/mcp/claude-mcp-oauth.js

@@ -0,0 +1,1053 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { execFile, spawn } from 'node:child_process';
+import { readFile, rm } from 'node:fs/promises';
+import { homedir, userInfo } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { auth, } from '@modelcontextprotocol/sdk/client/auth.js';
+import { writeFileAtomically } from '../platform/atomic-write.js';
+import { ExclusiveFileLease } from '../platform/exclusive-file-lease.js';
+const execFileAsync = promisify(execFile);
+const CREDENTIAL_SERVICE = 'Claude Code-credentials';
+const MAX_CREDENTIAL_BYTES = 2 * 1024 * 1024;
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const LOCK_WAIT_MS = 10_000;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function validExpiresAt(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function normalizeRecord(value) {
+    if (!isRecord(value))
+        return undefined;
+    const serverName = stringValue(value.serverName);
+    const serverUrl = stringValue(value.serverUrl);
+    if (!serverName || !serverUrl)
+        return undefined;
+    const discovery = isRecord(value.discoveryState)
+        ? {
+            ...(stringValue(value.discoveryState.authorizationServerUrl)
+                ? {
+                    authorizationServerUrl: value.discoveryState
+                        .authorizationServerUrl,
+                }
+                : {}),
+            ...(typeof value.discoveryState.oauthMetadataFound === 'boolean'
+                ? { oauthMetadataFound: value.discoveryState.oauthMetadataFound }
+                : {}),
+        }
+        : undefined;
+    return {
+        serverName,
+        serverUrl,
+        accessToken: stringValue(value.accessToken) ?? '',
+        ...(discovery === undefined ? {} : { discoveryState: discovery }),
+        ...(stringValue(value.clientId)
+            ? { clientId: value.clientId }
+            : {}),
+        ...(stringValue(value.clientSecret)
+            ? { clientSecret: value.clientSecret }
+            : {}),
+        ...(stringValue(value.redirectUri)
+            ? { redirectUri: value.redirectUri }
+            : {}),
+        ...(stringValue(value.refreshToken)
+            ? { refreshToken: value.refreshToken }
+            : {}),
+        ...(validExpiresAt(value.expiresAt) === undefined
+            ? {}
+            : { expiresAt: value.expiresAt }),
+        ...(stringValue(value.scope) ? { scope: value.scope } : {}),
+    };
+}
+function stableServerConfig(server) {
+    return JSON.stringify({
+        type: server.type,
+        url: server.url,
+        headers: server.headers ?? {},
+    });
+}
+export function mcpOAuthRecordKey(server) {
+    const digest = createHash('sha256')
+        .update(stableServerConfig(server))
+        .digest('hex')
+        .slice(0, 16);
+    return `${server.name}|${digest}`;
+}
+export function mcpOAuthCredentialService(configRoot) {
+    const canonical = resolve(configRoot);
+    const defaultRoot = resolve(join(homedir(), '.claude'));
+    if (canonical === defaultRoot)
+        return CREDENTIAL_SERVICE;
+    const digest = createHash('sha256')
+        .update(canonical)
+        .digest('hex')
+        .slice(0, 8);
+    return `${CREDENTIAL_SERVICE}-${digest}`;
+}
+function credentialPath(configRoot) {
+    return join(resolve(configRoot), '.credentials.json');
+}
+function parseEnvelope(source) {
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch (error) {
+        throw new Error('Invalid MCP OAuth credential JSON', { cause: error });
+    }
+    if (!isRecord(value))
+        throw new Error('MCP OAuth credentials must be an object');
+    const envelope = { ...value };
+    if (envelope.mcpOAuth !== undefined && !isRecord(envelope.mcpOAuth)) {
+        throw new Error('MCP OAuth credentials mcpOAuth must be an object');
+    }
+    return envelope;
+}
+function sourceHash(source) {
+    return createHash('sha256').update(source).digest('hex');
+}
+function isSourceHash(value) {
+    return typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
+}
+function parsePluginSecretTransactionJournal(value) {
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        typeof value.settingsPath !== 'string' ||
+        !isAbsolute(value.settingsPath) ||
+        !(value.settingsBeforeHash === null ||
+            isSourceHash(value.settingsBeforeHash)) ||
+        !isSourceHash(value.settingsAfterHash) ||
+        !isRecord(value.snapshot) ||
+        !isRecord(value.snapshot.envelope) ||
+        (value.snapshot.fileSource !== undefined &&
+            typeof value.snapshot.fileSource !== 'string') ||
+        (value.snapshot.keychainEnvelope !== undefined &&
+            !isRecord(value.snapshot.keychainEnvelope)) ||
+        !isRecord(value.nextEnvelope)) {
+        throw new Error('Invalid plugin configuration transaction journal');
+    }
+    return value;
+}
+function credentialAccount() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return process.env.USER ?? 'user';
+    }
+}
+async function readFileEnvelope(path) {
+    try {
+        const source = await readFile(path, 'utf8');
+        if (Buffer.byteLength(source) > MAX_CREDENTIAL_BYTES) {
+            throw new Error('MCP OAuth credential file exceeds 2 MiB');
+        }
+        return parseEnvelope(source);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        throw error;
+    }
+}
+async function readFileEnvelopeSource(path) {
+    try {
+        const source = await readFile(path, 'utf8');
+        if (Buffer.byteLength(source) > MAX_CREDENTIAL_BYTES) {
+            throw new Error('MCP OAuth credential file exceeds 2 MiB');
+        }
+        return source;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+async function readKeychainEnvelope(service) {
+    try {
+        const result = await execFileAsync('security', ['find-generic-password', '-a', credentialAccount(), '-s', service, '-w'], { maxBuffer: MAX_CREDENTIAL_BYTES });
+        return parseEnvelope(result.stdout);
+    }
+    catch (error) {
+        const code = error.code;
+        const detail = [
+            String(error),
+            String(error.stderr ?? ''),
+        ].join('\n');
+        if (code === 'ENOENT' ||
+            /could not be found|SecKeychainSearchCopyNext/u.test(detail)) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+async function writeKeychainEnvelope(service, envelope) {
+    const source = JSON.stringify(envelope);
+    if (Buffer.byteLength(source) > MAX_CREDENTIAL_BYTES) {
+        throw new Error('MCP OAuth credentials exceed 2 MiB');
+    }
+    await new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn('security', [
+            'add-generic-password',
+            '-U',
+            '-a',
+            credentialAccount(),
+            '-s',
+            service,
+            '-w',
+        ], { stdio: ['pipe', 'ignore', 'ignore'] });
+        let settled = false;
+        const rejectSafely = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            const error = new Error('Unable to update macOS Keychain credentials');
+            if (code !== undefined)
+                error.code = code;
+            rejectPromise(error);
+        };
+        child.once('error', (error) => rejectSafely(error.code));
+        child.once('close', (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (code === 0)
+                resolvePromise();
+            else
+                rejectPromise(new Error('Unable to update macOS Keychain credentials'));
+        });
+        child.stdin.once('error', () => rejectSafely());
+        child.stdin.end(`${source}\n`);
+    });
+}
+async function deleteKeychainEnvelope(service) {
+    try {
+        await execFileAsync('security', ['delete-generic-password', '-a', credentialAccount(), '-s', service], { maxBuffer: MAX_CREDENTIAL_BYTES });
+    }
+    catch (error) {
+        const code = error.code;
+        const detail = [
+            String(error),
+            String(error.stderr ?? ''),
+        ].join('\n');
+        if (code === 'ENOENT' ||
+            /could not be found|SecKeychainSearchCopyNext/u.test(detail)) {
+            return;
+        }
+        throw error;
+    }
+}
+export class ClaudeMcpOAuthStore {
+    configRoot;
+    useKeychain;
+    service;
+    lease;
+    constructor(options) {
+        this.configRoot = resolve(options.configRoot);
+        this.useKeychain =
+            options.useKeychain ??
+                (process.platform === 'darwin' &&
+                    process.env.PRAXIS_MCP_OAUTH_STORE !== 'file');
+        this.service = mcpOAuthCredentialService(this.configRoot);
+        this.lease = new ExclusiveFileLease(join(this.configRoot, '.mcp-oauth.lock'));
+    }
+    async read(server) {
+        return this.withLock(async () => {
+            const envelope = await this.readEnvelope();
+            return normalizeRecord(envelope.mcpOAuth?.[mcpOAuthRecordKey(server)]);
+        });
+    }
+    async mutate(server, update) {
+        return this.withLock(async () => {
+            const envelope = await this.readEnvelope();
+            const entries = isRecord(envelope.mcpOAuth)
+                ? { ...envelope.mcpOAuth }
+                : {};
+            const key = mcpOAuthRecordKey(server);
+            const current = normalizeRecord(entries[key]);
+            const next = update(current);
+            if (next === undefined)
+                delete entries[key];
+            else
+                entries[key] = next;
+            if (Object.keys(entries).length === 0)
+                delete envelope.mcpOAuth;
+            else
+                envelope.mcpOAuth = entries;
+            await this.writeEnvelope(envelope);
+            return next;
+        });
+    }
+    async clear(server) {
+        await this.mutate(server, () => undefined);
+    }
+    async readClientSecret(server) {
+        return this.withLock(async () => {
+            const envelope = await this.readEnvelope();
+            return stringValue(envelope.mcpOAuthClientConfig?.[mcpOAuthRecordKey(server)]
+                ?.clientSecret);
+        });
+    }
+    async saveClientSecret(server, clientSecret) {
+        await this.withLock(async () => {
+            const envelope = await this.readEnvelope();
+            const existing = isRecord(envelope.mcpOAuthClientConfig)
+                ? { ...envelope.mcpOAuthClientConfig }
+                : {};
+            const key = mcpOAuthRecordKey(server);
+            const current = isRecord(existing[key]) ? existing[key] : {};
+            existing[key] = { ...current, clientSecret };
+            envelope.mcpOAuthClientConfig = existing;
+            await this.writeEnvelope(envelope);
+        });
+    }
+    async readPluginSecrets(pluginId) {
+        return this.withLock(async () => {
+            const envelope = await this.readEnvelope();
+            const stored = envelope.pluginSecrets?.[pluginId];
+            if (!isRecord(stored))
+                return {};
+            return Object.fromEntries(Object.entries(stored).filter((entry) => typeof entry[1] === 'string'));
+        });
+    }
+    async updatePluginSecrets(pluginId, values, removeKeys = []) {
+        await this.withLock(async () => {
+            const envelope = await this.readEnvelope();
+            const all = isRecord(envelope.pluginSecrets)
+                ? { ...envelope.pluginSecrets }
+                : {};
+            const stored = all[pluginId];
+            const current = isRecord(stored)
+                ? Object.fromEntries(Object.entries(stored).filter((entry) => typeof entry[1] === 'string'))
+                : {};
+            const before = JSON.stringify(current);
+            for (const key of removeKeys)
+                delete current[key];
+            Object.assign(current, values);
+            if (JSON.stringify(current) === before)
+                return;
+            if (Object.keys(current).length === 0)
+                delete all[pluginId];
+            else
+                all[pluginId] = current;
+            if (Object.keys(all).length === 0)
+                delete envelope.pluginSecrets;
+            else {
+                envelope.pluginSecrets = all;
+            }
+            await this.writeEnvelope(envelope);
+        });
+    }
+    async updatePluginSecretsTransaction(updates, prepareCommit) {
+        await this.withLock(async () => {
+            const snapshot = await this.captureCredentialSnapshot();
+            const original = snapshot.envelope;
+            const all = isRecord(original.pluginSecrets)
+                ? { ...original.pluginSecrets }
+                : {};
+            let changed = false;
+            for (const update of updates) {
+                const stored = all[update.pluginId];
+                const current = isRecord(stored)
+                    ? Object.fromEntries(Object.entries(stored).filter((entry) => typeof entry[1] === 'string'))
+                    : {};
+                const before = JSON.stringify(current);
+                for (const key of update.removeKeys ?? [])
+                    delete current[key];
+                Object.assign(current, update.values);
+                if (JSON.stringify(current) === before)
+                    continue;
+                changed = true;
+                if (Object.keys(current).length === 0)
+                    delete all[update.pluginId];
+                else
+                    all[update.pluginId] = current;
+            }
+            const next = { ...original };
+            if (Object.keys(all).length === 0)
+                delete next.pluginSecrets;
+            else {
+                next.pluginSecrets = all;
+            }
+            const commit = await prepareCommit();
+            const journal = {
+                version: 1,
+                settingsPath: resolve(commit.path),
+                settingsBeforeHash: commit.beforeSource === undefined
+                    ? null
+                    : sourceHash(commit.beforeSource),
+                settingsAfterHash: sourceHash(commit.afterSource),
+                snapshot,
+                nextEnvelope: next,
+            };
+            try {
+                if (changed) {
+                    await this.writePluginSecretTransactionJournal(journal);
+                    await this.writeEnvelope(next);
+                }
+                const committed = await writeFileAtomically(journal.settingsPath, commit.afterSource);
+                if (!committed)
+                    throw new Error('Plugin settings write was interrupted');
+                if (changed)
+                    await this.deletePluginSecretTransactionJournal();
+            }
+            catch (error) {
+                if (changed) {
+                    try {
+                        await this.recoverPluginSecretTransaction(journal);
+                    }
+                    catch (rollbackError) {
+                        throw new AggregateError([error, rollbackError], 'Plugin configuration failed and credential rollback failed');
+                    }
+                }
+                throw error;
+            }
+        });
+    }
+    async deletePluginSecrets(pluginId) {
+        await this.withLock(async () => {
+            const envelope = await this.readEnvelope();
+            if (!isRecord(envelope.pluginSecrets))
+                return;
+            const prefix = `${pluginId}/`;
+            const remaining = Object.fromEntries(Object.entries(envelope.pluginSecrets).filter(([key]) => key !== pluginId && !key.startsWith(prefix)));
+            if (Object.keys(remaining).length ===
+                Object.keys(envelope.pluginSecrets).length)
+                return;
+            if (Object.keys(remaining).length === 0)
+                delete envelope.pluginSecrets;
+            else {
+                envelope.pluginSecrets = remaining;
+            }
+            await this.writeEnvelope(envelope);
+        });
+    }
+    async readEnvelope() {
+        if (this.useKeychain) {
+            const keychain = await readKeychainEnvelope(this.service);
+            if (keychain !== undefined)
+                return keychain;
+        }
+        return readFileEnvelope(credentialPath(this.configRoot));
+    }
+    pluginSecretTransactionPath() {
+        return join(this.configRoot, 'praxis', 'transactions', 'plugin-config.json');
+    }
+    pluginSecretTransactionService() {
+        return `${this.service}-plugin-config-transaction`;
+    }
+    async readPluginSecretTransactionJournal() {
+        if (this.useKeychain) {
+            const stored = await readKeychainEnvelope(this.pluginSecretTransactionService());
+            if (stored !== undefined)
+                return parsePluginSecretTransactionJournal(stored);
+        }
+        try {
+            const source = await readFile(this.pluginSecretTransactionPath(), 'utf8');
+            if (Buffer.byteLength(source) > MAX_CREDENTIAL_BYTES) {
+                throw new Error('Plugin configuration transaction exceeds 2 MiB');
+            }
+            return parsePluginSecretTransactionJournal(JSON.parse(source));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            if (error instanceof SyntaxError) {
+                throw new Error('Invalid plugin configuration transaction journal', {
+                    cause: error,
+                });
+            }
+            throw error;
+        }
+    }
+    async writePluginSecretTransactionJournal(journal) {
+        const source = `${JSON.stringify(journal, null, 2)}\n`;
+        if (Buffer.byteLength(source) > MAX_CREDENTIAL_BYTES) {
+            throw new Error('Plugin configuration transaction exceeds 2 MiB');
+        }
+        if (this.useKeychain) {
+            try {
+                await writeKeychainEnvelope(this.pluginSecretTransactionService(), journal);
+                await rm(this.pluginSecretTransactionPath(), { force: true });
+                return;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        const committed = await writeFileAtomically(this.pluginSecretTransactionPath(), source);
+        if (!committed)
+            throw new Error('Plugin configuration transaction write was interrupted');
+    }
+    async deletePluginSecretTransactionJournal() {
+        const failures = [];
+        if (this.useKeychain) {
+            try {
+                await deleteKeychainEnvelope(this.pluginSecretTransactionService());
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        try {
+            await rm(this.pluginSecretTransactionPath(), { force: true });
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1) {
+            throw new AggregateError(failures, 'Plugin configuration transaction cleanup failed');
+        }
+    }
+    async recoverPluginSecretTransaction(knownJournal) {
+        const journal = knownJournal ?? (await this.readPluginSecretTransactionJournal());
+        if (journal === undefined)
+            return;
+        let settingsSource;
+        try {
+            settingsSource = await readFile(journal.settingsPath, 'utf8');
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'ENOENT' && code !== 'ENOTDIR')
+                throw error;
+        }
+        const settingsHash = settingsSource === undefined ? null : sourceHash(settingsSource);
+        if (settingsHash === journal.settingsAfterHash) {
+            await this.writeEnvelope(journal.nextEnvelope);
+        }
+        else if (settingsHash === journal.settingsBeforeHash) {
+            await this.restoreCredentialSnapshot(journal.snapshot);
+        }
+        else {
+            throw new Error(`Plugin configuration transaction conflicts with ${journal.settingsPath}`);
+        }
+        await this.deletePluginSecretTransactionJournal();
+    }
+    async captureCredentialSnapshot() {
+        const fileSource = await readFileEnvelopeSource(credentialPath(this.configRoot));
+        if (!this.useKeychain) {
+            return {
+                envelope: fileSource === undefined ? {} : parseEnvelope(fileSource),
+                ...(fileSource === undefined ? {} : { fileSource }),
+            };
+        }
+        const keychainEnvelope = await readKeychainEnvelope(this.service);
+        return {
+            envelope: keychainEnvelope ??
+                (fileSource === undefined ? {} : parseEnvelope(fileSource)),
+            ...(fileSource === undefined ? {} : { fileSource }),
+            ...(keychainEnvelope === undefined ? {} : { keychainEnvelope }),
+        };
+    }
+    async restoreCredentialSnapshot(snapshot) {
+        const failures = [];
+        if (this.useKeychain) {
+            try {
+                if (snapshot.keychainEnvelope === undefined) {
+                    await deleteKeychainEnvelope(this.service);
+                }
+                else {
+                    await writeKeychainEnvelope(this.service, snapshot.keychainEnvelope);
+                }
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        try {
+            const path = credentialPath(this.configRoot);
+            if (snapshot.fileSource === undefined) {
+                await rm(path, { force: true });
+            }
+            else {
+                const committed = await writeFileAtomically(path, snapshot.fileSource);
+                if (!committed)
+                    throw new Error('MCP OAuth credential rollback was interrupted');
+            }
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, 'Credential rollback failed');
+    }
+    async writeEnvelope(envelope) {
+        if (this.useKeychain) {
+            try {
+                await writeKeychainEnvelope(this.service, envelope);
+                return;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        const committed = await writeFileAtomically(credentialPath(this.configRoot), `${JSON.stringify(envelope, null, 2)}\n`);
+        if (!committed)
+            throw new Error('MCP OAuth credential write was interrupted');
+    }
+    async withLock(operation) {
+        const started = Date.now();
+        let lock = await this.lease.tryAcquire();
+        while (!lock) {
+            if (Date.now() - started >= LOCK_WAIT_MS) {
+                throw new Error('MCP OAuth credential store is locked');
+            }
+            await new Promise((resolvePromise) => setTimeout(resolvePromise, 10));
+            lock = await this.lease.tryAcquire();
+        }
+        try {
+            await this.recoverPluginSecretTransaction();
+            return await operation();
+        }
+        finally {
+            await lock.release();
+        }
+    }
+}
+function clientMetadata(serverName, redirectUri) {
+    return {
+        client_name: `Praxis (${serverName})`,
+        redirect_uris: [redirectUri],
+        response_types: ['code'],
+        grant_types: ['authorization_code', 'refresh_token'],
+        token_endpoint_auth_method: 'none',
+    };
+}
+export async function readMcpClientSecret() {
+    const envSecret = process.env.MCP_CLIENT_SECRET;
+    if (envSecret)
+        return envSecret;
+    if (!process.stdin.isTTY) {
+        throw new Error('No TTY available to prompt for client secret. Set MCP_CLIENT_SECRET env var instead.');
+    }
+    return new Promise((resolvePromise, rejectPromise) => {
+        process.stderr.write('Enter OAuth client secret: ');
+        process.stdin.setRawMode?.(true);
+        let secret = '';
+        const onData = (chunk) => {
+            const value = chunk.toString();
+            if (value === '\n' || value === '\r') {
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                process.stderr.write('\n');
+                resolvePromise(secret);
+            }
+            else if (value === '\u0003') {
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                rejectPromise(new Error('Cancelled'));
+            }
+            else if (value === '\u007f' || value === '\b') {
+                secret = secret.slice(0, -1);
+            }
+            else {
+                secret += value;
+            }
+        };
+        process.stdin.on('data', onData);
+    });
+}
+export class ClaudeMcpOAuthProvider {
+    store;
+    server;
+    redirectUri;
+    onAuthorization;
+    configuredClient;
+    codeVerifierValue;
+    stateValue;
+    recordValue;
+    constructor(store, server, redirectUri, onAuthorization, record, configuredClient) {
+        this.store = store;
+        this.server = server;
+        this.redirectUri = redirectUri;
+        this.onAuthorization = onAuthorization;
+        this.configuredClient = configuredClient;
+        this.recordValue = record;
+    }
+    get redirectUrl() {
+        return this.redirectUri;
+    }
+    get clientMetadata() {
+        return clientMetadata(this.server.name, this.redirectUri);
+    }
+    async state() {
+        this.stateValue ??= randomBytes(32).toString('base64url');
+        return this.stateValue;
+    }
+    authorizationState() {
+        if (!this.stateValue)
+            throw new Error('MCP OAuth authorization state is unavailable');
+        return this.stateValue;
+    }
+    clientInformation() {
+        if (this.recordValue?.clientId &&
+            this.recordValue.redirectUri === this.redirectUri) {
+            return {
+                client_id: this.recordValue.clientId,
+                ...(this.recordValue.clientSecret
+                    ? { client_secret: this.recordValue.clientSecret }
+                    : {}),
+                redirect_uris: [this.recordValue.redirectUri ?? this.redirectUri],
+                token_endpoint_auth_method: 'none',
+            };
+        }
+        if (!this.configuredClient)
+            return undefined;
+        return {
+            client_id: this.configuredClient.clientId,
+            ...(this.configuredClient.clientSecret
+                ? { client_secret: this.configuredClient.clientSecret }
+                : {}),
+            redirect_uris: [this.redirectUri],
+            token_endpoint_auth_method: 'none',
+        };
+    }
+    async saveClientInformation(information) {
+        if (typeof information.client_id !== 'string') {
+            throw new Error('MCP OAuth client registration returned no client_id');
+        }
+        this.recordValue = await this.store.mutate(this.server, (current) => ({
+            serverName: this.server.name,
+            serverUrl: this.server.url,
+            accessToken: current?.accessToken ?? '',
+            ...(current?.discoveryState === undefined
+                ? {}
+                : { discoveryState: current.discoveryState }),
+            clientId: information.client_id,
+            ...(typeof information.client_secret === 'string'
+                ? { clientSecret: information.client_secret }
+                : {}),
+            redirectUri: this.redirectUri,
+            ...(current?.refreshToken ? { refreshToken: current.refreshToken } : {}),
+            ...(current?.expiresAt === undefined
+                ? {}
+                : { expiresAt: current.expiresAt }),
+            ...(current?.scope ? { scope: current.scope } : {}),
+        }));
+    }
+    async tokens() {
+        const record = this.recordValue ?? (await this.store.read(this.server));
+        this.recordValue = record;
+        if (!record?.accessToken)
+            return undefined;
+        const expiresIn = record.expiresAt === undefined
+            ? undefined
+            : Math.max(0, Math.floor((record.expiresAt - Date.now()) / 1000));
+        return {
+            access_token: record.accessToken,
+            token_type: 'Bearer',
+            ...(record.refreshToken ? { refresh_token: record.refreshToken } : {}),
+            ...(expiresIn === undefined ? {} : { expires_in: expiresIn }),
+            ...(record.scope ? { scope: record.scope } : {}),
+        };
+    }
+    async saveTokens(tokens) {
+        if (!tokens.access_token)
+            throw new Error('MCP OAuth token response had no access_token');
+        const expiresAt = typeof tokens.expires_in === 'number'
+            ? Date.now() + Math.max(0, tokens.expires_in) * 1000
+            : undefined;
+        this.recordValue = await this.store.mutate(this.server, (current) => ({
+            serverName: this.server.name,
+            serverUrl: this.server.url,
+            accessToken: tokens.access_token,
+            ...(current?.discoveryState === undefined
+                ? {}
+                : { discoveryState: current.discoveryState }),
+            ...(current?.clientId ? { clientId: current.clientId } : {}),
+            ...(current?.clientSecret ? { clientSecret: current.clientSecret } : {}),
+            redirectUri: current?.redirectUri ?? this.redirectUri,
+            ...(tokens.refresh_token
+                ? { refreshToken: tokens.refresh_token }
+                : current?.refreshToken
+                    ? { refreshToken: current.refreshToken }
+                    : {}),
+            ...(expiresAt === undefined ? {} : { expiresAt }),
+            ...(tokens.scope
+                ? { scope: tokens.scope }
+                : current?.scope
+                    ? { scope: current.scope }
+                    : {}),
+        }));
+    }
+    async redirectToAuthorization(url) {
+        await this.onAuthorization(url);
+    }
+    saveCodeVerifier(codeVerifier) {
+        this.codeVerifierValue = codeVerifier;
+    }
+    codeVerifier() {
+        if (!this.codeVerifierValue)
+            throw new Error('MCP OAuth code verifier is unavailable');
+        return this.codeVerifierValue;
+    }
+    async saveDiscoveryState(state) {
+        this.recordValue = await this.store.mutate(this.server, (current) => ({
+            serverName: this.server.name,
+            serverUrl: this.server.url,
+            accessToken: current?.accessToken ?? '',
+            discoveryState: {
+                ...(state.authorizationServerUrl
+                    ? { authorizationServerUrl: String(state.authorizationServerUrl) }
+                    : {}),
+                oauthMetadataFound: state.authorizationServerMetadata !== undefined,
+            },
+            ...(current?.clientId ? { clientId: current.clientId } : {}),
+            ...(current?.clientSecret ? { clientSecret: current.clientSecret } : {}),
+            ...(current?.redirectUri
+                ? { redirectUri: current.redirectUri }
+                : { redirectUri: this.redirectUri }),
+            ...(current?.refreshToken ? { refreshToken: current.refreshToken } : {}),
+            ...(current?.expiresAt === undefined
+                ? {}
+                : { expiresAt: current.expiresAt }),
+            ...(current?.scope ? { scope: current.scope } : {}),
+        }));
+    }
+    async discoveryState() {
+        const state = this.recordValue?.discoveryState;
+        if (!state?.authorizationServerUrl)
+            return undefined;
+        return { authorizationServerUrl: state.authorizationServerUrl };
+    }
+    async invalidateCredentials(scope) {
+        if (scope === 'all') {
+            this.recordValue = undefined;
+            await this.store.clear(this.server);
+            return;
+        }
+        this.recordValue = await this.store.mutate(this.server, (current) => {
+            if (!current)
+                return undefined;
+            if (scope === 'tokens') {
+                const next = { ...current, accessToken: '' };
+                delete next.refreshToken;
+                delete next.expiresAt;
+                delete next.scope;
+                return next;
+            }
+            if (scope === 'client') {
+                const next = { ...current };
+                delete next.clientId;
+                delete next.clientSecret;
+                return next;
+            }
+            if (scope === 'discovery') {
+                const next = { ...current };
+                delete next.discoveryState;
+                return next;
+            }
+            if (scope === 'verifier')
+                this.codeVerifierValue = undefined;
+            return current;
+        });
+    }
+}
+export function mcpOAuthServerIdentity(name, config) {
+    const type = config.type === 'sse'
+        ? 'sse'
+        : config.type === 'http' || config.url !== undefined
+            ? 'http'
+            : undefined;
+    if (!type || typeof config.url !== 'string' || config.url.length === 0) {
+        throw new Error(`MCP server ${name} must use HTTP or SSE transport for OAuth`);
+    }
+    const headers = isStringRecord(config.headers) ? config.headers : undefined;
+    const oauth = isRecord(config.oauth) ? config.oauth : undefined;
+    const clientId = stringValue(oauth?.clientId);
+    const callbackPort = typeof oauth?.callbackPort === 'number' &&
+        Number.isFinite(oauth.callbackPort)
+        ? oauth.callbackPort
+        : undefined;
+    return {
+        name,
+        type,
+        url: config.url,
+        ...(headers ? { headers } : {}),
+        ...(clientId ? { clientId } : {}),
+        ...(callbackPort === undefined ? {} : { callbackPort }),
+    };
+}
+function isStringRecord(value) {
+    return (isRecord(value) &&
+        Object.values(value).every((item) => typeof item === 'string'));
+}
+async function listenCallbackServer(port = 0) {
+    let callbackOrigin = 'http://localhost';
+    let resolveCallback = () => undefined;
+    let rejectCallback = () => undefined;
+    const callback = new Promise((resolvePromise, rejectPromise) => {
+        resolveCallback = resolvePromise;
+        rejectCallback = rejectPromise;
+    });
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? '/', 'http://localhost');
+        if (url.pathname !== '/callback') {
+            response.writeHead(404);
+            response.end('Not found');
+            return;
+        }
+        const callbackUrl = `${callbackOrigin}${url.pathname}${url.search}`;
+        response.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+        response.end('<html><body>Praxis authorization received. You may close this tab.</body></html>');
+        resolveCallback(callbackUrl);
+    });
+    server.on('error', (error) => rejectCallback(error));
+    await new Promise((resolvePromise, rejectPromise) => {
+        server.once('listening', () => resolvePromise());
+        server.once('error', rejectPromise);
+        server.listen(port, '127.0.0.1');
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        await new Promise((resolvePromise) => server.close(() => resolvePromise()));
+        throw new Error('MCP OAuth callback server did not expose a port');
+    }
+    callbackOrigin = `http://localhost:${address.port}`;
+    return {
+        server,
+        redirectUri: `http://localhost:${address.port}/callback`,
+        wait: () => callback,
+    };
+}
+async function closeServer(server) {
+    await new Promise((resolvePromise) => server.close(() => resolvePromise()));
+}
+async function defaultOpenBrowser(url) {
+    const command = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'cmd'
+            : 'xdg-open';
+    const args = process.platform === 'win32'
+        ? ['/c', 'start', '', url.toString()]
+        : [url.toString()];
+    await execFileAsync(command, args, { timeout: 10_000 }).catch(() => undefined);
+}
+async function firstInputLine(readRedirectUrl) {
+    const value = await readRedirectUrl();
+    if (value.trim().length === 0)
+        throw new Error('MCP OAuth redirect URL is required');
+    return value.trim();
+}
+function callbackParameter(url, name) {
+    const values = url.searchParams.getAll(name);
+    if (values.length > 1) {
+        throw new Error(`MCP OAuth redirect URL contained multiple ${name} values`);
+    }
+    return values[0];
+}
+function validateAuthorizationCallback(value, redirectUri, expectedState) {
+    let actual;
+    try {
+        actual = new URL(value);
+    }
+    catch (error) {
+        throw new Error('MCP OAuth redirect URL is invalid', { cause: error });
+    }
+    const expected = new URL(redirectUri);
+    if (actual.origin !== expected.origin ||
+        actual.pathname !== expected.pathname) {
+        throw new Error('MCP OAuth redirect URL does not match the local callback');
+    }
+    const state = callbackParameter(actual, 'state');
+    if (!state || state !== expectedState) {
+        throw new Error('MCP OAuth redirect state did not match the authorization request');
+    }
+    return actual;
+}
+export async function authenticateMcpServer(options) {
+    const callback = await listenCallbackServer(options.callbackPort ?? options.server.callbackPort);
+    const store = new ClaudeMcpOAuthStore({ configRoot: options.configRoot });
+    const existing = await store.read(options.server);
+    const clientId = options.clientId ?? options.server.clientId;
+    const clientSecret = options.clientSecret ??
+        (clientId ? await store.readClientSecret(options.server) : undefined);
+    const provider = new ClaudeMcpOAuthProvider(store, options.server, callback.redirectUri, async (url) => {
+        options.write(`Visit this URL to authorize:\n  ${url}\n`);
+        if (!options.noBrowser) {
+            await (options.openBrowser ?? defaultOpenBrowser)(url);
+        }
+    }, existing, clientId
+        ? {
+            clientId,
+            ...(clientSecret ? { clientSecret } : {}),
+        }
+        : undefined);
+    try {
+        const result = await auth(provider, { serverUrl: options.server.url });
+        if (result === 'REDIRECT') {
+            const input = options.noBrowser
+                ? options.readRedirectUrl
+                    ? firstInputLine(options.readRedirectUrl)
+                    : callback.wait()
+                : callback.wait();
+            let timeout;
+            let redirectUrl;
+            try {
+                redirectUrl = await Promise.race([
+                    input,
+                    new Promise((_, reject) => {
+                        timeout = setTimeout(() => reject(new Error('MCP OAuth authorization timed out')), LOGIN_TIMEOUT_MS);
+                    }),
+                ]);
+            }
+            finally {
+                if (timeout)
+                    clearTimeout(timeout);
+            }
+            const parsed = validateAuthorizationCallback(redirectUrl, callback.redirectUri, provider.authorizationState());
+            const error = callbackParameter(parsed, 'error');
+            if (error) {
+                throw new Error(callbackParameter(parsed, 'error_description') ?? error);
+            }
+            const code = callbackParameter(parsed, 'code');
+            if (!code)
+                throw new Error('MCP OAuth redirect URL did not contain a code');
+            const completed = await auth(provider, {
+                serverUrl: options.server.url,
+                authorizationCode: code,
+            });
+            if (completed !== 'AUTHORIZED') {
+                throw new Error('MCP OAuth token exchange did not complete');
+            }
+        }
+        return 'AUTHORIZED';
+    }
+    finally {
+        await closeServer(callback.server);
+    }
+}
+export async function loadMcpOAuthProvider(configRoot, server) {
+    const store = new ClaudeMcpOAuthStore({ configRoot });
+    const record = await store.read(server);
+    if (!record || (!record.accessToken && !record.refreshToken))
+        return undefined;
+    const redirectUri = record.redirectUri ?? 'http://localhost:0/callback';
+    const clientSecret = server.clientId
+        ? await store.readClientSecret(server)
+        : undefined;
+    return new ClaudeMcpOAuthProvider(store, server, redirectUri, async () => {
+        throw new Error(`MCP server ${server.name} requires authentication; run praxis mcp login ${server.name}`);
+    }, record, server.clientId
+        ? {
+            clientId: server.clientId,
+            ...(clientSecret ? { clientSecret } : {}),
+        }
+        : undefined);
+}
+//# sourceMappingURL=claude-mcp-oauth.js.map