@1mcp/agent 0.37.0 → 0.38.1

package/build/sdk/legacy/auth/sdkOAuthClientProvider.d.ts

@@ -0,0 +1,98 @@
+import { OAuthClientProvider } from '../client/auth.js';
+import type { OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '../shared/auth.js';
+/**
+ * OAuth client configuration for connecting to downstream MCP servers
+ */
+export interface OAuthClientConfig {
+    clientId?: string;
+    clientSecret?: string;
+    scopes?: string[];
+    redirectUrl: string;
+}
+/**
+ * SDK-compatible OAuth client provider that replaces the custom implementation.
+ *
+ * This provider implements the OAuth 2.1 Authorization Code Grant flow using
+ * the SDK's OAuthClientProvider interface while maintaining compatibility with
+ * the existing session storage system.
+ */
+export declare class SDKOAuthClientProvider implements OAuthClientProvider {
+    private _clientMetadata;
+    private _clientInfo?;
+    private _tokens?;
+    private _codeVerifier?;
+    private _state?;
+    private sessionRepository;
+    private fileStorage;
+    private serverName;
+    private config;
+    private _authorizationUrl?;
+    constructor(serverName: string, config: OAuthClientConfig, sessionStoragePath?: string);
+    get redirectUrl(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    /**
+     * Returns current client registration information
+     */
+    clientInformation(): OAuthClientInformationFull | undefined;
+    /**
+     * Saves client registration information from dynamic registration
+     */
+    saveClientInformation(clientInfo: OAuthClientInformationFull): void;
+    /**
+     * Returns current OAuth tokens
+     */
+    tokens(): OAuthTokens | undefined;
+    /**
+     * Saves OAuth tokens after successful authorization
+     */
+    saveTokens(tokens: OAuthTokens): void;
+    /**
+     * Invalidates persisted OAuth credentials as requested by the MCP SDK.
+     */
+    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): void;
+    /**
+     * Stores authorization URL instead of prompting user in console
+     */
+    redirectToAuthorization(authorizationUrl: URL): void;
+    /**
+     * Gets the current authorization URL
+     */
+    getAuthorizationUrl(): string | undefined;
+    /**
+     * Clears the stored authorization URL
+     */
+    clearAuthorizationUrl(): void;
+    /**
+     * Saves PKCE code verifier for the authorization session
+     */
+    saveCodeVerifier(codeVerifier: string): void;
+    /**
+     * Returns the PKCE code verifier for token exchange
+     */
+    codeVerifier(): string | Promise<string>;
+    /**
+     * Returns the OAuth state parameter for CSRF protection
+     */
+    state(): string | Promise<string>;
+    /**
+     * Custom resource validation (optional)
+     */
+    validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
+    /**
+     * Load persisted OAuth data from unified client session storage
+     */
+    private loadPersistedData;
+    /**
+     * Persist all OAuth data to unified client session storage
+     */
+    private persistAllData;
+    /**
+     * Check if OAuth tokens are expired
+     */
+    private isTokenExpired;
+    /**
+     * Clean up resources
+     */
+    shutdown(): void;
+}
+//# sourceMappingURL=sdkOAuthClientProvider.d.ts.map

package/build/sdk/legacy/auth/sdkOAuthClientProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthClientProvider.d.ts","sourceRoot":"","sources":["../../../../src/sdk/legacy/auth/sdkOAuthClientProvider.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAEnH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,WAAW,CAAC,CAA6B;IACjD,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,iBAAiB,CAAC,CAAS;gBAEvB,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,MAAM;IAqCtF,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;OAEG;IACH,iBAAiB,IAAI,0BAA0B,GAAG,SAAS;IAI3D;;OAEG;IACH,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,IAAI;IAMnE;;OAEG;IACH,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAMrC;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI;IA4B1F;;OAEG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI;IAIpD;;OAEG;IACH,mBAAmB,IAAI,MAAM,GAAG,SAAS;IAIzC;;OAEG;IACH,qBAAqB,IAAI,IAAI;IAI7B;;OAEG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAK5C;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACH,KAAK,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQjC;;OAEG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAS/F;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiCzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAwBtB;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;IACH,QAAQ,IAAI,IAAI;CAOjB"}

package/build/sdk/legacy/auth/sdkOAuthClientProvider.js

@@ -0,0 +1,243 @@
+import { randomUUID } from 'node:crypto';
+import { ClientSessionRepository } from '../../../auth/storage/clientSessionRepository.js';
+import { FileStorageService } from '../../../auth/storage/fileStorageService.js';
+import { AUTH_CONFIG } from '../../../constants.js';
+import logger from '../../../logger/logger.js';
+/**
+ * SDK-compatible OAuth client provider that replaces the custom implementation.
+ *
+ * This provider implements the OAuth 2.1 Authorization Code Grant flow using
+ * the SDK's OAuthClientProvider interface while maintaining compatibility with
+ * the existing session storage system.
+ */
+export class SDKOAuthClientProvider {
+    _clientMetadata;
+    _clientInfo;
+    _tokens;
+    _codeVerifier;
+    _state;
+    sessionRepository;
+    fileStorage;
+    serverName;
+    config;
+    _authorizationUrl;
+    constructor(serverName, config, sessionStoragePath) {
+        this.serverName = serverName;
+        this.config = config;
+        // Create FileStorageService and ClientSessionRepository with 'client' subdirectory
+        this.fileStorage = new FileStorageService(sessionStoragePath, AUTH_CONFIG.CLIENT.SESSION.SUBDIR);
+        this.sessionRepository = new ClientSessionRepository(this.fileStorage);
+        // Set up client metadata for registration with better defaults
+        this._clientMetadata = {
+            client_name: `1MCP Agent - ${serverName}`,
+            redirect_uris: [config.redirectUrl || ''],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: config.clientSecret ? 'client_secret_post' : 'none',
+            scope: config.scopes?.join(' ') || AUTH_CONFIG.CLIENT.OAUTH.DEFAULT_SCOPES.join(' '),
+        };
+        logger.debug(`OAuth client configured for ${this.serverName} with redirect URL configured: ${!!this._clientMetadata.redirect_uris?.[0]}`);
+        // Load existing client info and tokens if available
+        this.loadPersistedData();
+        // Seed client info from a pre-registered clientId so the SDK skips Dynamic
+        // Client Registration for servers without a registration_endpoint (e.g. Slack).
+        // Guarded so persisted client info always wins.
+        if (!this._clientInfo && config.clientId) {
+            this._clientInfo = {
+                ...this._clientMetadata,
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+            };
+        }
+    }
+    get redirectUrl() {
+        return this.config.redirectUrl || '';
+    }
+    get clientMetadata() {
+        return this._clientMetadata;
+    }
+    /**
+     * Returns current client registration information
+     */
+    clientInformation() {
+        return this._clientInfo;
+    }
+    /**
+     * Saves client registration information from dynamic registration
+     */
+    saveClientInformation(clientInfo) {
+        this._clientInfo = clientInfo;
+        this.persistAllData();
+        logger.info(`OAuth client registered for ${this.serverName}: ${clientInfo.client_id}`);
+    }
+    /**
+     * Returns current OAuth tokens
+     */
+    tokens() {
+        return this._tokens;
+    }
+    /**
+     * Saves OAuth tokens after successful authorization
+     */
+    saveTokens(tokens) {
+        this._tokens = tokens;
+        this.persistAllData();
+        logger.info(`OAuth tokens saved for ${this.serverName}`);
+    }
+    /**
+     * Invalidates persisted OAuth credentials as requested by the MCP SDK.
+     */
+    invalidateCredentials(scope) {
+        switch (scope) {
+            case 'all':
+                this._clientInfo = undefined;
+                this._tokens = undefined;
+                this._codeVerifier = undefined;
+                this._state = undefined;
+                this._authorizationUrl = undefined;
+                break;
+            case 'client':
+                this._clientInfo = undefined;
+                break;
+            case 'tokens':
+                this._tokens = undefined;
+                this._state = undefined;
+                this._authorizationUrl = undefined;
+                break;
+            case 'verifier':
+                this._codeVerifier = undefined;
+                break;
+            case 'discovery':
+                return;
+        }
+        this.persistAllData();
+        logger.info(`OAuth credentials invalidated for ${this.serverName}: ${scope}`);
+    }
+    /**
+     * Stores authorization URL instead of prompting user in console
+     */
+    redirectToAuthorization(authorizationUrl) {
+        this._authorizationUrl = authorizationUrl.toString();
+    }
+    /**
+     * Gets the current authorization URL
+     */
+    getAuthorizationUrl() {
+        return this._authorizationUrl;
+    }
+    /**
+     * Clears the stored authorization URL
+     */
+    clearAuthorizationUrl() {
+        this._authorizationUrl = undefined;
+    }
+    /**
+     * Saves PKCE code verifier for the authorization session
+     */
+    saveCodeVerifier(codeVerifier) {
+        this._codeVerifier = codeVerifier;
+        this.persistAllData();
+    }
+    /**
+     * Returns the PKCE code verifier for token exchange
+     */
+    codeVerifier() {
+        return this._codeVerifier || '';
+    }
+    /**
+     * Returns the OAuth state parameter for CSRF protection
+     */
+    state() {
+        if (!this._state) {
+            this._state = randomUUID();
+            this.persistAllData();
+        }
+        return this._state;
+    }
+    /**
+     * Custom resource validation (optional)
+     */
+    async validateResourceURL(serverUrl, resource) {
+        const url = typeof serverUrl === 'string' ? new URL(serverUrl) : serverUrl;
+        // Basic validation - can be extended for specific requirements
+        if (resource && !resource.startsWith(url.origin)) {
+            return undefined;
+        }
+        return url;
+    }
+    /**
+     * Load persisted OAuth data from unified client session storage
+     */
+    loadPersistedData() {
+        const clientSession = this.sessionRepository.get(this.serverName);
+        if (clientSession) {
+            // Load client info
+            if (clientSession.clientInfo) {
+                this._clientInfo = JSON.parse(clientSession.clientInfo);
+            }
+            // Load tokens
+            if (clientSession.tokens) {
+                this._tokens = JSON.parse(clientSession.tokens);
+                // Check if tokens are expired
+                if (this._tokens && this.isTokenExpired(this._tokens)) {
+                    logger.warn(`OAuth tokens expired for ${this.serverName}, clearing`);
+                    this._tokens = undefined;
+                    this.persistAllData();
+                }
+            }
+            // Load code verifier
+            if (clientSession.codeVerifier) {
+                this._codeVerifier = clientSession.codeVerifier;
+            }
+            // Load state
+            if (clientSession.state) {
+                this._state = clientSession.state;
+            }
+        }
+    }
+    /**
+     * Persist all OAuth data to unified client session storage
+     */
+    persistAllData() {
+        // Calculate the longest TTL based on the data we have
+        let maxTtl = AUTH_CONFIG.CLIENT.OAUTH.TTL_MS; // Default to 30 days
+        // If we have tokens, use their expiry time
+        if (this._tokens && this._tokens.expires_in) {
+            const tokenTtl = this._tokens.expires_in * 1000;
+            maxTtl = Math.max(maxTtl, tokenTtl);
+        }
+        // Code verifier and state have shorter TTL, but we keep them for completeness
+        const clientSessionData = {
+            serverName: this.serverName,
+            clientInfo: this._clientInfo ? JSON.stringify(this._clientInfo) : undefined,
+            tokens: this._tokens ? JSON.stringify(this._tokens) : undefined,
+            codeVerifier: this._codeVerifier,
+            state: this._state,
+            expires: Date.now() + maxTtl,
+            createdAt: Date.now(),
+        };
+        this.sessionRepository.save(this.serverName, clientSessionData, maxTtl);
+    }
+    /**
+     * Check if OAuth tokens are expired
+     */
+    isTokenExpired(tokens) {
+        if (!tokens.expires_in) {
+            return false; // No expiration info, assume valid
+        }
+        // This is a simple check - in practice, you might want to store the issued_at time
+        // For now, we'll rely on the session storage TTL for expiration
+        return false;
+    }
+    /**
+     * Clean up resources
+     */
+    shutdown() {
+        // Clean up temporary session data by clearing verifier and state
+        this._codeVerifier = undefined;
+        this._state = undefined;
+        this.persistAllData();
+        this.fileStorage.shutdown();
+    }
+}
+//# sourceMappingURL=sdkOAuthClientProvider.js.map

package/build/sdk/legacy/auth/sdkOAuthClientProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthClientProvider.js","sourceRoot":"","sources":["../../../../src/sdk/legacy/auth/sdkOAuthClientProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAc3C;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACzB,eAAe,CAAsB;IACrC,WAAW,CAA8B;IACzC,OAAO,CAAe;IACtB,aAAa,CAAU;IACvB,MAAM,CAAU;IAChB,iBAAiB,CAA0B;IAC3C,WAAW,CAAqB;IAChC,UAAU,CAAS;IACnB,MAAM,CAAoB;IAC1B,iBAAiB,CAAU;IAEnC,YAAY,UAAkB,EAAE,MAAyB,EAAE,kBAA2B;QACpF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,mFAAmF;QACnF,IAAI,CAAC,WAAW,GAAG,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjG,IAAI,CAAC,iBAAiB,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvE,+DAA+D;QAC/D,IAAI,CAAC,eAAe,GAAG;YACrB,WAAW,EAAE,gBAAgB,UAAU,EAAE;YACzC,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YACzC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;YAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;SACrF,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,+BAA+B,IAAI,CAAC,UAAU,kCAAkC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAC5H,CAAC;QAEF,oDAAoD;QACpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,2EAA2E;QAC3E,gFAAgF;QAChF,gDAAgD;QAChD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,GAAG;gBACjB,GAAG,IAAI,CAAC,eAAe;gBACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,UAAsC;QAC1D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAmB;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAA6D;QACjF,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;gBAC7B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBAC/B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACxB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBACnC,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;gBAC7B,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACxB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBACnC,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBAC/B,MAAM;YACR,KAAK,WAAW;gBACd,OAAO;QACX,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAoB;QACnC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAuB,EAAE,QAAiB;QAClE,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,+DAA+D;QAC/D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,mBAAmB;YACnB,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAA+B,CAAC;YACxF,CAAC;YAED,cAAc;YACd,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAgB,CAAC;gBAE/D,8BAA8B;gBAC9B,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,UAAU,YAAY,CAAC,CAAC;oBACrE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;oBACzB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,YAAY,CAAC;YAClD,CAAC;YAED,aAAa;YACb,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,sDAAsD;QACtD,IAAI,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,qBAAqB;QAEnE,2CAA2C;QAC3C,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,8EAA8E;QAC9E,MAAM,iBAAiB,GAAsB;YAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/D,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,MAAmB;QACxC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,mCAAmC;QACnD,CAAC;QAED,mFAAmF;QACnF,gEAAgE;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,iEAAiE;QACjE,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/build/sdk/legacy/auth/sdkOAuthServerProvider.d.ts

@@ -0,0 +1,69 @@
+import { OAuthStorageService } from '../../../auth/storage/oauthStorageService.js';
+import type { OAuthRegisteredClientsStore } from '../server/auth/clients.js';
+import type { AuthorizationParams, OAuthServerProvider } from '../server/auth/provider.js';
+import type { AuthInfo } from '../server/auth/types.js';
+import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../shared/auth.js';
+import type { Response } from 'express';
+/**
+ * Implementation of SDK's OAuthServerProvider interface using the new repository architecture.
+ *
+ * This provider implements OAuth 2.1 server functionality using the MCP SDK's interfaces
+ * with the new layered storage architecture for better separation of concerns.
+ */
+export declare class SDKOAuthServerProvider implements OAuthServerProvider {
+    /**
+     * @deprecated Compatibility escape hatch for lower-level SDK/storage internals.
+     * HTTP routes should use `OAuthAuthorizationFlow` operations instead of reaching into storage.
+     */
+    oauthStorage: OAuthStorageService;
+    private configManager;
+    private _clientsStore;
+    constructor(sessionStoragePath?: string, runtimeScopeId?: string);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    /**
+     * Handles the authorization request with scope validation and user consent
+     */
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /**
+     * Determines if user consent is required for the authorization
+     */
+    private requiresUserConsent;
+    /**
+     * Renders the consent page for scope selection
+     */
+    private renderConsentPage;
+    /**
+     * Approves the authorization and redirects back to client
+     */
+    approveAuthorization(client: OAuthClientInformationFull, params: AuthorizationParams, grantedScopes: string[], res: Response): Promise<void>;
+    /**
+     * Generates the HTML for the consent page
+     */
+    private generateConsentPageHtml;
+    /**
+     * Retrieves the PKCE challenge for an authorization code
+     */
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    /**
+     * Exchanges authorization code for access token
+     */
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Atomically rotates a single-use refresh token and issues a new access token.
+     */
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Verifies access token and returns auth info with granted scopes
+     */
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    /**
+     * Revokes a token
+     */
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    private revokeFamilyAccessTokens;
+    /**
+     * Graceful shutdown
+     */
+    shutdown(): void;
+}
+//# sourceMappingURL=sdkOAuthServerProvider.d.ts.map

package/build/sdk/legacy/auth/sdkOAuthServerProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthServerProvider.d.ts","sourceRoot":"","sources":["../../../../src/sdk/legacy/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAM/E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAO1F,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,gCAAgC,CAAC;AAUxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAgFxC;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE;;;OAGG;IACI,YAAY,EAAE,mBAAmB,CAAC;IACzC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,aAAa,CAA8B;gBAEvC,kBAAkB,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM;IAQhE,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD9G;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACU,oBAAoB,CAC/B,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,MAAM,EAAE,EACvB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAoChB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA2F/B;;OAEG;IACG,6BAA6B,CAAC,MAAM,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWnH;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EAGzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAkFvB;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA+CvB;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4CzD;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC1G,OAAO,CAAC,wBAAwB;IAchC;;OAEG;IACH,QAAQ,IAAI,IAAI;CAGjB"}