toolhome 0.5.0

package/dist/server/upstream/manager.js

@@ -0,0 +1,324 @@
+import { ProtocolError, } from '@modelcontextprotocol/client';
+import { AppError, errorMessage } from '../domain/errors.js';
+import { UpstreamAdapter, } from './adapter.js';
+export class UpstreamManager {
+    #adapters = new Map();
+    #refreshing = new Map();
+    #listeners = new Set();
+    #recovering = new Map();
+    #store;
+    #credentials;
+    #logger;
+    #closed = false;
+    constructor(store, credentials, logger) {
+        this.#store = store;
+        this.#credentials = credentials;
+        this.#logger = logger;
+    }
+    subscribe(listener) {
+        this.#listeners.add(listener);
+        return () => this.#listeners.delete(listener);
+    }
+    async execute(serverId, request, context, clientCapabilities, transforms = {}) {
+        const server = this.#requireServer(serverId, true);
+        const adapter = await this.#adapterFor(server);
+        try {
+            const result = await adapter.execute(request, {
+                context,
+                clientCapabilities,
+                ...transforms,
+            });
+            this.#markReady(server, adapter);
+            return result;
+        }
+        catch (error) {
+            if (this.#isConnectionFailure(error))
+                this.#markFailure(server, error);
+            throw error;
+        }
+    }
+    async notify(serverId, notification, context, clientCapabilities) {
+        const server = this.#requireServer(serverId, true);
+        const adapter = await this.#adapterFor(server);
+        await adapter.notify(notification, clientCapabilities, { context, clientCapabilities });
+    }
+    async notifyDetached(serverId, notification, clientCapabilities) {
+        const server = this.#requireServer(serverId, true);
+        const adapter = await this.#adapterFor(server);
+        await adapter.notify(notification, clientCapabilities);
+    }
+    async subscribeResources(serverId, uris, clientCapabilities) {
+        const server = this.#requireServer(serverId, true);
+        const adapter = await this.#adapterFor(server);
+        return adapter.subscribeResources(uris, clientCapabilities);
+    }
+    refresh(serverId) {
+        const existing = this.#refreshing.get(serverId);
+        if (existing)
+            return existing;
+        const operation = this.#refreshNow(serverId).finally(() => this.#refreshing.delete(serverId));
+        this.#refreshing.set(serverId, operation);
+        return operation;
+    }
+    async restart(serverId) {
+        const server = this.#requireServer(serverId, false);
+        const refreshing = this.#refreshing.get(serverId);
+        const managed = this.#adapters.get(serverId);
+        if (managed)
+            await managed.adapter.restart();
+        await refreshing?.catch(() => undefined);
+        const state = this.#store.getRuntimeState(serverId);
+        this.#saveRuntime(server, {
+            status: 'connecting',
+            processId: null,
+            restartCount: (state?.restartCount ?? 0) + 1,
+            lastError: null,
+        });
+        return this.refresh(serverId);
+    }
+    async remove(serverId) {
+        const managed = this.#adapters.get(serverId);
+        this.#adapters.delete(serverId);
+        if (managed)
+            await managed.adapter.close();
+    }
+    async invalidate(serverId) {
+        const refreshing = this.#refreshing.get(serverId);
+        await this.remove(serverId);
+        await refreshing?.catch(() => undefined);
+        this.#store.deleteSnapshot(serverId);
+        const server = this.#store.getServer(serverId);
+        if (server) {
+            this.#saveRuntime(server, {
+                status: server.enabled ? 'unknown' : 'disabled',
+                protocolVersion: null,
+                protocolEra: null,
+                processId: null,
+                lastError: null,
+            });
+        }
+        this.#emitCapabilityChanges(serverId);
+    }
+    async close() {
+        this.#closed = true;
+        const adapters = [...this.#adapters.values()];
+        this.#adapters.clear();
+        await Promise.allSettled(adapters.map((item) => item.adapter.close()));
+        await Promise.allSettled([...this.#refreshing.values(), ...this.#recovering.values()]);
+    }
+    async #refreshNow(serverId) {
+        const server = this.#requireServer(serverId, false);
+        const adapter = await this.#adapterFor(server);
+        this.#saveRuntime(server, { status: 'connecting', lastError: null });
+        try {
+            const previous = this.#store.getSnapshot(serverId);
+            const snapshot = await adapter.discoverSnapshot(previous?.version ?? 0);
+            this.#store.saveSnapshot(snapshot);
+            if (previous?.fingerprint !== snapshot.fingerprint)
+                this.#emitCapabilityChanges(serverId);
+            this.#saveRuntime(server, {
+                status: server.enabled ? 'ready' : 'disabled',
+                protocolVersion: snapshot.protocolVersion,
+                protocolEra: snapshot.protocolEra,
+                processId: adapter.processId(),
+                lastSuccessAt: new Date().toISOString(),
+                lastError: null,
+            });
+            this.#store.appendEvent({
+                level: 'info',
+                type: 'server.refreshed',
+                serverId,
+                message: `Refreshed ${server.slug}`,
+                detail: {
+                    protocolVersion: snapshot.protocolVersion,
+                    protocolEra: snapshot.protocolEra,
+                    tools: snapshot.tools.length,
+                    resources: snapshot.resources.length,
+                    prompts: snapshot.prompts.length,
+                },
+            });
+            return snapshot;
+        }
+        catch (error) {
+            this.#markFailure(server, error);
+            throw error;
+        }
+    }
+    async #adapterFor(server) {
+        if (this.#closed)
+            throw new AppError('upstream_closed', 'Upstream manager is closed', 503);
+        const existing = this.#adapters.get(server.id);
+        if (existing?.updatedAt === server.updatedAt)
+            return existing.adapter;
+        if (existing)
+            await existing.adapter.close();
+        const adapter = new UpstreamAdapter(server, this.#credentials, this.#logger, (event) => this.#onEvent(event));
+        this.#adapters.set(server.id, { updatedAt: server.updatedAt, adapter });
+        return adapter;
+    }
+    #onEvent(event) {
+        if (this.#closed)
+            return;
+        if (event.type === 'stderr') {
+            this.#store.appendEvent({
+                level: 'debug',
+                type: 'server.stderr',
+                serverId: event.serverId,
+                message: event.message,
+                detail: {},
+            });
+            return;
+        }
+        if (event.type === 'connection_closed') {
+            if (this.#recovering.has(event.serverId))
+                return;
+            const operation = this.#recover(event.serverId).finally(() => this.#recovering.delete(event.serverId));
+            this.#recovering.set(event.serverId, operation);
+            return;
+        }
+        if (event.type === 'resource_updated') {
+            for (const listener of this.#listeners)
+                listener(event);
+            return;
+        }
+        void this.refresh(event.serverId)
+            .then(() => undefined)
+            .catch((error) => {
+            this.#logger.warn('Capability refresh after list change failed', {
+                serverId: event.serverId,
+                error: errorMessage(error),
+            });
+        });
+    }
+    async #recover(serverId) {
+        const server = this.#store.getServer(serverId);
+        if (!server)
+            return;
+        const refreshing = this.#refreshing.get(serverId);
+        await this.remove(serverId);
+        await refreshing?.catch(() => undefined);
+        if (this.#closed)
+            return;
+        const state = this.#store.getRuntimeState(serverId);
+        const restart = server.kind === 'home' && server.enabled && server.settings.restart !== 'never';
+        this.#store.appendEvent({
+            level: 'warn',
+            type: 'server.connection_closed',
+            serverId,
+            message: `Connection to ${server.slug} closed`,
+            detail: { restart },
+        });
+        if (!restart) {
+            this.#saveRuntime(server, {
+                status: server.enabled ? 'unreachable' : 'disabled',
+                processId: null,
+                lastError: 'Upstream connection closed',
+            });
+            return;
+        }
+        this.#saveRuntime(server, {
+            status: 'connecting',
+            processId: null,
+            restartCount: (state?.restartCount ?? 0) + 1,
+            lastError: null,
+        });
+        try {
+            await this.refresh(serverId);
+        }
+        catch (error) {
+            this.#saveRuntime(server, {
+                status: 'start-failed',
+                processId: null,
+                lastError: errorMessage(error),
+            });
+        }
+    }
+    #emitCapabilityChanges(serverId) {
+        for (const listener of this.#listeners) {
+            listener({ type: 'tools_changed', serverId });
+            listener({ type: 'prompts_changed', serverId });
+            listener({ type: 'resources_changed', serverId });
+        }
+    }
+    #requireServer(serverId, requireEnabled) {
+        const server = this.#store.getServer(serverId);
+        if (!server)
+            throw new AppError('server_not_found', 'Server not found', 404);
+        if (requireEnabled && !server.enabled) {
+            throw new AppError('server_disabled', `Server ${server.slug} is disabled`, 503);
+        }
+        return server;
+    }
+    #markReady(server, adapter) {
+        const state = this.#store.getRuntimeState(server.id);
+        if (state?.status === 'ready')
+            return;
+        const snapshot = this.#store.getSnapshot(server.id);
+        this.#saveRuntime(server, {
+            status: server.enabled ? 'ready' : 'disabled',
+            protocolVersion: snapshot?.protocolVersion ?? null,
+            protocolEra: snapshot?.protocolEra ?? null,
+            processId: adapter.processId(),
+            lastSuccessAt: new Date().toISOString(),
+            lastError: null,
+        });
+    }
+    #markFailure(server, error) {
+        const message = errorMessage(error);
+        const lower = message.toLowerCase();
+        const status = lower.includes('401') || lower.includes('unauthorized') ? 'auth-required' : 'unreachable';
+        this.#saveRuntime(server, { status, lastError: message });
+        this.#store.appendEvent({
+            level: 'error',
+            type: 'server.error',
+            serverId: server.id,
+            message: `Server ${server.slug} failed`,
+            detail: { error: message },
+        });
+    }
+    #saveRuntime(server, patch) {
+        const current = this.#store.getRuntimeState(server.id);
+        return this.#store.saveRuntimeState({
+            serverId: server.id,
+            status: patch.status ?? current?.status ?? 'unknown',
+            protocolVersion: patch.protocolVersion === undefined
+                ? (current?.protocolVersion ?? null)
+                : patch.protocolVersion,
+            protocolEra: patch.protocolEra === undefined ? (current?.protocolEra ?? null) : patch.protocolEra,
+            processId: patch.processId === undefined ? (current?.processId ?? null) : patch.processId,
+            restartCount: patch.restartCount ?? current?.restartCount ?? 0,
+            lastSuccessAt: patch.lastSuccessAt ?? current?.lastSuccessAt ?? null,
+            lastError: patch.lastError === undefined ? (current?.lastError ?? null) : patch.lastError,
+            updatedAt: new Date().toISOString(),
+        });
+    }
+    #isConnectionFailure(error) {
+        if (ProtocolError.isInstance(error))
+            return false;
+        if (error instanceof AppError) {
+            if (error.code === 'upstream_jsonrpc_error')
+                return false;
+            if ([
+                'upstream_closed',
+                'upstream_restarted',
+                'upstream_stream_ended',
+                'upstream_timeout',
+            ].includes(error.code)) {
+                return true;
+            }
+        }
+        const message = errorMessage(error).toLowerCase();
+        return [
+            'econnrefused',
+            'econnreset',
+            'enotfound',
+            'fetch failed',
+            'socket',
+            'connection closed',
+            'unauthorized',
+            'status 401',
+            'status 403',
+        ].some((fragment) => message.includes(fragment));
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/server/upstream/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/upstream/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAId,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAI7D,OAAO,EACL,eAAe,GAIhB,MAAM,cAAc,CAAC;AAUtB,MAAM,OAAO,eAAe;IACjB,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,WAAW,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC7D,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,CAAQ;IACd,YAAY,CAAqB;IACjC,OAAO,CAAS;IACzB,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,KAAY,EAAE,WAA+B,EAAE,MAAc;QACvE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,SAAS,CAAC,QAA+B;QACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,OAAwB,EACxB,OAAsB,EACtB,kBAAsC,EACtC,UAAU,GAAqB,EAAE;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE;gBAC5C,OAAO;gBACP,kBAAkB;gBAClB,GAAG,UAAU;aACd,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,YAA0B,EAC1B,OAAsB,EACtB,kBAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,YAA0B,EAC1B,kBAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,QAAgB,EAChB,IAAc,EACd,kBAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;gBACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;gBAC/C,eAAe,EAAE,IAAI;gBACrB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE,WAAW,KAAK,QAAQ,CAAC,WAAW;gBAAE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAC1F,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;gBACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;gBAC7C,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;gBAC9B,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACvC,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,kBAAkB;gBACxB,QAAQ;gBACR,OAAO,EAAE,aAAa,MAAM,CAAC,IAAI,EAAE;gBACnC,MAAM,EAAE;oBACN,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;oBAC5B,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM;oBACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;iBACjC;aACF,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAoB;QACpC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACtE,IAAI,QAAQ;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACrF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CACrB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,KAAoB;QAC3B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAO;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CACxC,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACtC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU;gBAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC9B,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACtB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,0BAA0B;YAChC,QAAQ;YACR,OAAO,EAAE,iBAAiB,MAAM,CAAC,IAAI,SAAS;YAC9C,MAAM,EAAE,EAAE,OAAO,EAAE;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;gBACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;gBACnD,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,4BAA4B;aACxC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC;YAC5C,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;gBACxB,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB,CAAC,QAAgB;QACrC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,QAAQ,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9C,QAAQ,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChD,QAAQ,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,cAAc,CAAC,QAAgB,EAAE,cAAuB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,UAAU,MAAM,CAAC,IAAI,cAAc,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,UAAU,CAAC,MAAoB,EAAE,OAAwB;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,MAAM,KAAK,OAAO;YAAE,OAAO;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YAC7C,eAAe,EAAE,QAAQ,EAAE,eAAe,IAAI,IAAI;YAClD,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;YAC9B,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAoB,EAAE,KAAc;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GACV,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC;QAC5F,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACtB,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO,EAAE,UAAU,MAAM,CAAC,IAAI,SAAS;YACvC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAoB,EAAE,KAA4B;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAClC,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,SAAS;YACpD,eAAe,EACb,KAAK,CAAC,eAAe,KAAK,SAAS;gBACjC,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC;gBACpC,CAAC,CAAC,KAAK,CAAC,eAAe;YAC3B,WAAW,EACT,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW;YACtF,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YACzF,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,OAAO,EAAE,YAAY,IAAI,CAAC;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;YACpE,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YACzF,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,CAAC,KAAc;QACjC,IAAI,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB;gBAAE,OAAO,KAAK,CAAC;YAC1D,IACE;gBACE,iBAAiB;gBACjB,oBAAoB;gBACpB,uBAAuB;gBACvB,kBAAkB;aACnB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EACtB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO;YACL,cAAc;YACd,YAAY;YACZ,WAAW;YACX,cAAc;YACd,QAAQ;YACR,mBAAmB;YACnB,cAAc;YACd,YAAY;YACZ,YAAY;SACb,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/server/upstream/oauth-provider.d.ts

@@ -0,0 +1,38 @@
+import { type OAuthClientInformationContext, type OAuthClientMetadata, type OAuthClientProvider, type OAuthDiscoveryState, type StoredOAuthClientInformation, type StoredOAuthTokens } from '@modelcontextprotocol/client';
+import type { Store } from '../storage/store.js';
+export interface StoredOAuthProviderOptions {
+    /**
+     * Whether to advertise URL-based client metadata (RFC 9728
+     * `client_id_metadata_document_supported`) to upstream authorization
+     * servers. When disabled, dynamic client registration is used instead.
+     * Some providers (e.g. Cloudflare's hosted MCP) fail to fetch metadata
+     * documents from proxied origins, so DCR is the reliable fallback.
+     */
+    urlClientId?: boolean;
+}
+export declare class StoredOAuthProvider implements OAuthClientProvider {
+    #private;
+    readonly clientMetadataUrl?: string;
+    constructor(store: Store, credentialId: string, publicUrl: URL, options?: StoredOAuthProviderOptions);
+    get redirectUrl(): URL;
+    get clientMetadata(): OAuthClientMetadata;
+    validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
+    state(): Promise<string>;
+    clientInformation(context?: OAuthClientInformationContext): StoredOAuthClientInformation | undefined;
+    saveClientInformation(clientInformation: StoredOAuthClientInformation): void;
+    tokens(context?: OAuthClientInformationContext): StoredOAuthTokens | undefined;
+    saveTokens(tokens: StoredOAuthTokens, context?: OAuthClientInformationContext): void;
+    redirectToAuthorization(authorizationUrl: URL): void;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+    saveAuthorizationServerUrl(authorizationServerUrl: string): void;
+    authorizationServerUrl(): string | undefined;
+    saveResourceUrl(resourceUrl: string): void;
+    resourceUrl(): string | undefined;
+    saveDiscoveryState(discoveryState: OAuthDiscoveryState): void;
+    discoveryState(): OAuthDiscoveryState | undefined;
+    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): void;
+    authorizationUrl(): string | undefined;
+    validateCallbackState(state: string): void;
+}
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/server/upstream/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../../src/upstream/oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAIjD,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,mBAAoB,YAAW,mBAAmB;;IAC7D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAKpC,YACE,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,GAAG,EACd,OAAO,GAAE,0BAA+B,EAYzC;IAED,IAAI,WAAW,IAAI,GAAG,CAErB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAaxC;IAEK,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAuB9F;IAEK,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAI7B;IAED,iBAAiB,CACf,OAAO,CAAC,EAAE,6BAA6B,GACtC,4BAA4B,GAAG,SAAS,CAc1C;IAED,qBAAqB,CAAC,iBAAiB,EAAE,4BAA4B,GAAG,IAAI,CAM3E;IAED,MAAM,CAAC,OAAO,CAAC,EAAE,6BAA6B,GAAG,iBAAiB,GAAG,SAAS,CAgB7E;IAED,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,6BAA6B,GAAG,IAAI,CAoBnF;IAED,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAKnD;IAED,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE3C;IAED,YAAY,IAAI,MAAM,CAMrB;IAED,0BAA0B,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAE/D;IAED,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAE3C;IAED,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzC;IAED,WAAW,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED,kBAAkB,CAAC,cAAc,EAAE,mBAAmB,GAAG,IAAI,CAE5D;IAED,cAAc,IAAI,mBAAmB,GAAG,SAAS,CAEhD;IAED,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,CAiCzF;IAED,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAQzC;CAeF"}

package/dist/server/upstream/oauth-provider.js

@@ -0,0 +1,225 @@
+import {} from '@modelcontextprotocol/client';
+import { randomBytes } from 'node:crypto';
+import { AppError } from '../domain/errors.js';
+import { oauthCredentialPayloadSchema } from '../domain/models.js';
+const FLOW_TTL_MS = 10 * 60 * 1_000;
+export class StoredOAuthProvider {
+    clientMetadataUrl;
+    #store;
+    #credentialId;
+    #publicUrl;
+    constructor(store, credentialId, publicUrl, options = {}) {
+        this.#store = store;
+        this.#credentialId = credentialId;
+        this.#publicUrl = publicUrl;
+        if (publicUrl.protocol === 'https:' && (options.urlClientId ?? true)) {
+            this.clientMetadataUrl = new URL(`/oauth/upstream/client/${credentialId}`, publicUrl).toString();
+        }
+        this.#payload();
+    }
+    get redirectUrl() {
+        return new URL(`/oauth/upstream/callback/${this.#credentialId}`, this.#publicUrl);
+    }
+    get clientMetadata() {
+        const payload = this.#payload();
+        return {
+            redirect_uris: [this.redirectUrl.toString()],
+            token_endpoint_auth_method: payload.clientSecret ? 'client_secret_basic' : 'none',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            client_name: 'ToolHome',
+            client_uri: this.#publicUrl.toString(),
+            software_id: 'toolhome',
+            software_version: '0.1.0',
+            ...(payload.scope === undefined ? {} : { scope: payload.scope }),
+        };
+    }
+    async validateResourceURL(serverUrl, resource) {
+        // The SDK discovers protected-resource metadata from the path-scoped
+        // well-known document, which some providers (e.g. Notion) publish with a
+        // different resource identifier than their authorization server accepts.
+        // Prefer the origin's well-known declaration when it is available, and
+        // fall back to the SDK-discovered value otherwise.
+        try {
+            const origin = new URL('/', serverUrl);
+            const response = await fetch(new URL('/.well-known/oauth-protected-resource', origin), {
+                headers: { Accept: 'application/json' },
+                redirect: 'follow',
+            });
+            if (response.ok) {
+                const body = (await response.json());
+                if (typeof body.resource === 'string' && body.resource.length > 0) {
+                    return new URL(body.resource);
+                }
+            }
+        }
+        catch {
+            // Fall through to the SDK-discovered resource.
+        }
+        if (resource !== undefined)
+            return new URL(resource);
+        return new URL(serverUrl);
+    }
+    async state() {
+        const state = randomBytes(32).toString('base64url');
+        this.#update({ state });
+        return state;
+    }
+    clientInformation(context) {
+        const payload = this.#payload();
+        const saved = payload.clientInformation;
+        if (saved) {
+            if (context && saved.issuer && saved.issuer !== context.issuer)
+                return undefined;
+            return saved;
+        }
+        if (!payload.clientId)
+            return undefined;
+        if (context && payload.issuer && payload.issuer !== context.issuer)
+            return undefined;
+        return {
+            client_id: payload.clientId,
+            ...(payload.clientSecret === undefined ? {} : { client_secret: payload.clientSecret }),
+            ...(payload.issuer === undefined ? {} : { issuer: payload.issuer }),
+        };
+    }
+    saveClientInformation(clientInformation) {
+        this.#update({
+            clientInformation,
+            clientId: clientInformation.client_id,
+            clientSecret: clientInformation.client_secret,
+        });
+    }
+    tokens(context) {
+        const payload = this.#payload();
+        if (!payload.accessToken)
+            return undefined;
+        if (context && payload.issuer && payload.issuer !== context.issuer)
+            return undefined;
+        const expiresIn = payload.expiresAt
+            ? Math.max(0, Math.floor((Date.parse(payload.expiresAt) - Date.now()) / 1_000))
+            : payload.expiresIn;
+        return {
+            access_token: payload.accessToken,
+            token_type: payload.tokenType,
+            ...(payload.refreshToken === undefined ? {} : { refresh_token: payload.refreshToken }),
+            ...(payload.idToken === undefined ? {} : { id_token: payload.idToken }),
+            ...(payload.scope === undefined ? {} : { scope: payload.scope }),
+            ...(expiresIn === undefined ? {} : { expires_in: expiresIn }),
+            ...(payload.issuer === undefined ? {} : { issuer: payload.issuer }),
+        };
+    }
+    saveTokens(tokens, context) {
+        const current = this.#payload();
+        const expiresAt = tokens.expires_in === undefined
+            ? undefined
+            : new Date(Date.now() + tokens.expires_in * 1_000).toISOString();
+        this.#update({
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token ?? current.refreshToken,
+            idToken: tokens.id_token,
+            tokenType: tokens.token_type,
+            expiresIn: tokens.expires_in,
+            expiresAt,
+            scope: tokens.scope ?? current.scope,
+            issuer: tokens.issuer ?? context?.issuer ?? current.issuer,
+            authorizationUrl: undefined,
+            pendingExpiresAt: undefined,
+            state: undefined,
+            codeVerifier: undefined,
+        });
+    }
+    redirectToAuthorization(authorizationUrl) {
+        this.#update({
+            authorizationUrl: authorizationUrl.toString(),
+            pendingExpiresAt: new Date(Date.now() + FLOW_TTL_MS).toISOString(),
+        });
+    }
+    saveCodeVerifier(codeVerifier) {
+        this.#update({ codeVerifier });
+    }
+    codeVerifier() {
+        const verifier = this.#payload().codeVerifier;
+        if (!verifier) {
+            throw new AppError('oauth_flow_expired', 'OAuth authorization flow has expired', 400);
+        }
+        return verifier;
+    }
+    saveAuthorizationServerUrl(authorizationServerUrl) {
+        this.#update({ authorizationServerUrl });
+    }
+    authorizationServerUrl() {
+        return this.#payload().authorizationServerUrl;
+    }
+    saveResourceUrl(resourceUrl) {
+        this.#update({ resourceUrl });
+    }
+    resourceUrl() {
+        return this.#payload().resourceUrl;
+    }
+    saveDiscoveryState(discoveryState) {
+        this.#update({ discoveryState });
+    }
+    discoveryState() {
+        return this.#payload().discoveryState;
+    }
+    invalidateCredentials(scope) {
+        if (scope === 'all' || scope === 'client') {
+            this.#update({
+                clientInformation: undefined,
+                clientId: undefined,
+                clientSecret: undefined,
+            });
+        }
+        if (scope === 'all' || scope === 'tokens') {
+            this.#update({
+                accessToken: undefined,
+                refreshToken: undefined,
+                idToken: undefined,
+                expiresAt: undefined,
+                expiresIn: undefined,
+                issuer: undefined,
+            });
+        }
+        if (scope === 'all' || scope === 'verifier') {
+            this.#update({
+                authorizationUrl: undefined,
+                pendingExpiresAt: undefined,
+                state: undefined,
+                codeVerifier: undefined,
+            });
+        }
+        if (scope === 'all' || scope === 'discovery') {
+            this.#update({
+                discoveryState: undefined,
+                authorizationServerUrl: undefined,
+                resourceUrl: undefined,
+            });
+        }
+    }
+    authorizationUrl() {
+        return this.#payload().authorizationUrl;
+    }
+    validateCallbackState(state) {
+        const payload = this.#payload();
+        if (!payload.state || payload.state !== state) {
+            throw new AppError('oauth_state_mismatch', 'OAuth callback state is invalid', 400);
+        }
+        if (!payload.pendingExpiresAt || Date.parse(payload.pendingExpiresAt) <= Date.now()) {
+            throw new AppError('oauth_flow_expired', 'OAuth authorization flow has expired', 400);
+        }
+    }
+    #payload() {
+        const payload = this.#store.getCredentialPayload(this.#credentialId);
+        if (!payload || payload.type !== 'oauth') {
+            throw new AppError('oauth_credential_invalid', 'OAuth credential is unavailable', 404);
+        }
+        return payload;
+    }
+    #update(changes) {
+        const next = oauthCredentialPayloadSchema.parse({ ...this.#payload(), ...changes });
+        this.#store.updateCredential(this.#credentialId, { payload: next });
+        return next;
+    }
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/server/upstream/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../../src/upstream/oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAON,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAA+B,MAAM,qBAAqB,CAAC;AAGhG,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAapC,MAAM,OAAO,mBAAmB;IACrB,iBAAiB,CAAU;IAC3B,MAAM,CAAQ;IACd,aAAa,CAAS;IACtB,UAAU,CAAM;IAEzB,YACE,KAAY,EACZ,YAAoB,EACpB,SAAc,EACd,OAAO,GAA+B,EAAE;QAExC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAC9B,0BAA0B,YAAY,EAAE,EACxC,SAAS,CACV,CAAC,QAAQ,EAAE,CAAC;QACf,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,GAAG,CAAC,4BAA4B,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO;YACL,aAAa,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5C,0BAA0B,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM;YACjF,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE;YACtC,WAAW,EAAE,UAAU;YACvB,gBAAgB,EAAE,OAAO;YACzB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAuB,EAAE,QAAiB;QAClE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,uCAAuC,EAAE,MAAM,CAAC,EAAE;gBACrF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;gBAC/D,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iBAAiB,CACf,OAAuC;QAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACrF,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACtF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,qBAAqB,CAAC,iBAA+C;QACnE,IAAI,CAAC,OAAO,CAAC;YACX,iBAAiB;YACjB,QAAQ,EAAE,iBAAiB,CAAC,SAAS;YACrC,YAAY,EAAE,iBAAiB,CAAC,aAAa;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAuC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACrF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;YAC/E,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QACtB,OAAO;YACL,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YACtF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,MAAyB,EAAE,OAAuC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,GACb,MAAM,CAAC,UAAU,KAAK,SAAS;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC;YACX,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY;YAC1D,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM;YAC1D,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;YAC3B,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,SAAS;SACxB,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,OAAO,CAAC;YACX,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;YAC7C,gBAAgB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,YAAY;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,0BAA0B,CAAC,sBAA8B;QACvD,IAAI,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,sBAAsB,CAAC;IAChD,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC;IACrC,CAAC;IAED,kBAAkB,CAAC,cAAmC;QACpD,IAAI,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC;IACxC,CAAC;IAED,qBAAqB,CAAC,KAA6D;QACjF,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC;gBACX,iBAAiB,EAAE,SAAS;gBAC5B,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,SAAS;aACxB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC;gBACX,WAAW,EAAE,SAAS;gBACtB,YAAY,EAAE,SAAS;gBACvB,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC;gBACX,gBAAgB,EAAE,SAAS;gBAC3B,gBAAgB,EAAE,SAAS;gBAC3B,KAAK,EAAE,SAAS;gBAChB,YAAY,EAAE,SAAS;aACxB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC;gBACX,cAAc,EAAE,SAAS;gBACzB,sBAAsB,EAAE,SAAS;gBACjC,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC;IAC1C,CAAC;IAED,qBAAqB,CAAC,KAAa;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpF,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,QAAQ;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,OAAgC;QACtC,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}