@1mcp/agent 0.39.0-beta.2 → 0.39.0-beta.4

package/build/sdk/legacy/auth/sdkOAuthClientProvider.js

@@ -1,243 +1,666 @@
-import { randomUUID } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash, createHmac, randomBytes, randomUUID } from 'node:crypto';
+import { authoritySlot, matchesAuthorityContext, OAUTH_ATTEMPT_TTL_MS, oauthAuthorityError, OAuthAuthorizationDeniedError, oauthDigest, sameAuthority, } from '../../../auth/oauthAuthority.js';
+import { createOAuthEndpointFetch, validateOAuthEndpoint } from '../../../auth/oauthEndpointFetch.js';
 import { ClientSessionRepository } from '../../../auth/storage/clientSessionRepository.js';
-import { FileStorageService } from '../../../auth/storage/fileStorageService.js';
+import { createUpstreamOAuthStorage } from '../../../auth/storage/upstreamOAuthStorage.js';
 import { AUTH_CONFIG } from '../../../constants.js';
-import logger from '../../../logger/logger.js';
-/**
- * SDK-compatible OAuth client provider that replaces the custom implementation.
- *
- * This provider implements the OAuth 2.1 Authorization Code Grant flow using
- * the SDK's OAuthClientProvider interface while maintaining compatibility with
- * the existing session storage system.
- */
+import { AgentConfigManager } from '../../../core/server/agentConfig.js';
+import { OAuthClientInformationFullSchema, OAuthTokensSchema, } from '../shared/auth.js';
+/** Shared by the released modern and legacy SDK adapters. SDK cache objects are never authority. */
 export class SDKOAuthClientProvider {
-    _clientMetadata;
-    _clientInfo;
-    _tokens;
-    _codeVerifier;
-    _state;
-    sessionRepository;
-    fileStorage;
     serverName;
     config;
-    _authorizationUrl;
+    sessionRepository;
+    fileStorage;
+    context;
+    slot;
+    record;
+    verifiers = new Map();
+    callbacks = new AsyncLocalStorage();
+    authorizationAttempt;
+    callbackTail = Promise.resolve();
+    operations = new AsyncLocalStorage();
+    sseEndpoint;
+    tokenRequests = new WeakMap();
+    tokenResponses = new Map();
+    registrationResponses = new Map();
+    discoveryResponses = new Map();
+    // These tickets are process-local; a random key protects secret-bearing response correlation.
+    responseKey = randomBytes(32);
+    migration;
+    shutdownSignal = new AbortController();
+    claim;
+    fetch;
     constructor(serverName, config, sessionStoragePath) {
         this.serverName = serverName;
         this.config = config;
-        // Create FileStorageService and ClientSessionRepository with 'client' subdirectory
-        this.fileStorage = new FileStorageService(sessionStoragePath, AUTH_CONFIG.CLIENT.SESSION.SUBDIR);
+        const runtimeScope = AgentConfigManager.getInstance().get('runtimeScopeStoragePath');
+        this.fileStorage = createUpstreamOAuthStorage({
+            baseDir: sessionStoragePath,
+            runtimeScope: typeof runtimeScope === 'string' ? runtimeScope : undefined,
+            mode: AgentConfigManager.getInstance().get('auth').credentialStore ?? 'file',
+        });
         this.sessionRepository = new ClientSessionRepository(this.fileStorage);
-        // Set up client metadata for registration with better defaults
-        this._clientMetadata = {
-            client_name: `1MCP Agent - ${serverName}`,
-            redirect_uris: [config.redirectUrl || ''],
+        this.context = config.authority;
+        this.slot = this.context ? authoritySlot(this.context) : undefined;
+        const restore = () => {
+            if (this.slot && this.context) {
+                const stored = this.sessionRepository.getBound(this.slot);
+                if (stored && matchesAuthorityContext(stored.authority, this.context)) {
+                    if (!config.issuer || config.issuer === stored.authority.issuer)
+                        this.record = stored;
+                }
+            }
+            return this.slot ? (this.sessionRepository.getClaim(this.slot)?.generation ?? null) : null;
+        };
+        const alreadyReady = this.fileStorage.isReady();
+        const observed = alreadyReady ? restore() : null;
+        this.migration = this.fileStorage.ready().then(async () => {
+            const observedGeneration = alreadyReady ? observed : restore();
+            // Quarantine preserves unbound ownership: moving secrets never grants an authority.
+            await this.sessionRepository.quarantine(serverName);
+            if (this.slot && this.context)
+                this.claim = await this.sessionRepository.claimContext(this.slot, this.context, observedGeneration, this.shutdownSignal.signal);
+        });
+        void this.migration.catch(() => undefined);
+        this.fetch = createOAuthEndpointFetch({
+            resource: this.context?.route.url ?? 'https://invalid.invalid/',
+            issuer: this.config.issuer,
+            isResource: (url) => url.href === this.context?.route.url || url.href === this.sseEndpoint,
+            acceptSseEndpoint: this.context?.route.kind === 'sse'
+                ? (endpoint) => {
+                    const configured = new URL(this.context.route.url);
+                    const target = new URL(endpoint, configured);
+                    if (target.origin !== configured.origin || target.username || target.password || target.hash)
+                        throw oauthAuthorityError();
+                    this.sseEndpoint = target.href;
+                }
+                : undefined,
+            beforeRequest: (url, init) => this.prepareFetch(url, init),
+            pinDestination: async (host, addresses, init) => {
+                await this.migration;
+                if (!this.slot || !this.claim)
+                    throw oauthAuthorityError();
+                await this.sessionRepository.pinDestination(this.slot, this.tokenRequests.get(init)?.generation ?? this.claim, host, addresses);
+            },
+            onFailure: (resourceRequest) => {
+                const operation = this.operations.getStore();
+                if (!resourceRequest && operation)
+                    operation.failed = true;
+            },
+            response: (value, _url, init) => {
+                const ticket = this.tokenRequests.get(init);
+                if (!ticket)
+                    return;
+                if (ticket.kind === 'token') {
+                    const tokens = { ...value };
+                    if (tokens.refresh_token === undefined)
+                        tokens.refresh_token = new URLSearchParams(String(init.body ?? '')).get('refresh_token') ?? undefined;
+                    const key = this.responseDigest(OAuthTokensSchema.parse(tokens));
+                    this.recordResponse(this.responseMap('token'), key, ticket);
+                }
+                else if (ticket.kind === 'registration') {
+                    const key = this.responseDigest(OAuthClientInformationFullSchema.parse({ ...this.clientMetadata, ...value }));
+                    this.recordResponse(this.responseMap('registration'), key, ticket);
+                }
+            },
+            metadata: (value, url, init) => {
+                const validated = this.validateMetadata(value, url);
+                const ticket = this.tokenRequests.get(init);
+                if (typeof value.issuer === 'string' && ticket)
+                    this.recordResponse(this.responseMap('discovery'), this.discoveryKey(value), ticket);
+                return validated;
+            },
+        });
+    }
+    get redirectUrl() {
+        return this.config.redirectUrl || '';
+    }
+    get clientMetadataUrl() {
+        return this.config.clientMetadataUrl;
+    }
+    get clientMetadata() {
+        return {
+            client_name: `1MCP Agent - ${this.serverName}`,
+            redirect_uris: [this.redirectUrl],
             grant_types: ['authorization_code', 'refresh_token'],
             response_types: ['code'],
-            token_endpoint_auth_method: config.clientSecret ? 'client_secret_post' : 'none',
-            scope: config.scopes?.join(' ') || AUTH_CONFIG.CLIENT.OAUTH.DEFAULT_SCOPES.join(' '),
+            token_endpoint_auth_method: this.config.clientSecret ? 'client_secret_post' : 'none',
+            scope: this.config.scopes?.join(' ') ?? AUTH_CONFIG.CLIENT.OAUTH.DEFAULT_SCOPES.join(' '),
         };
-        logger.debug(`OAuth client configured for ${this.serverName} with redirect URL configured: ${!!this._clientMetadata.redirect_uris?.[0]}`);
-        // Load existing client info and tokens if available
-        this.loadPersistedData();
-        // Seed client info from a pre-registered clientId so the SDK skips Dynamic
-        // Client Registration for servers without a registration_endpoint (e.g. Slack).
-        // Guarded so persisted client info always wins.
-        if (!this._clientInfo && config.clientId) {
-            this._clientInfo = {
-                ...this._clientMetadata,
-                client_id: config.clientId,
-                client_secret: config.clientSecret,
+    }
+    clientInformation(ctx) {
+        this.checkIssuer(ctx);
+        if (this.record)
+            this.requireCurrent();
+        if (this.config.clientId) {
+            return {
+                ...this.clientMetadata,
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                ...(this.record ? { issuer: this.record.authority.issuer } : {}),
             };
         }
+        const record = this.current();
+        if (!record?.clientInfo)
+            return undefined;
+        try {
+            return {
+                ...OAuthClientInformationFullSchema.parse(JSON.parse(record.clientInfo)),
+                issuer: record.authority.issuer,
+            };
+        }
+        catch {
+            throw oauthAuthorityError();
+        }
     }
-    get redirectUrl() {
-        return this.config.redirectUrl || '';
+    async saveClientInformation(clientInfo, ctx) {
+        this.assertOperation();
+        this.checkIssuer(ctx);
+        const record = this.requireCurrent();
+        const stamped = clientInfo;
+        if (stamped.issuer && stamped.issuer !== record.authority.issuer)
+            throw oauthAuthorityError();
+        if (this.config.clientId)
+            return;
+        const parsed = OAuthClientInformationFullSchema.parse({ ...this.clientMetadata, ...clientInfo });
+        const key = this.responseDigest(parsed);
+        const ticket = this.responseMap('registration').get(key);
+        this.responseMap('registration').delete(key);
+        if (!ticket && parsed.client_id !== this.config.clientMetadataUrl)
+            throw oauthAuthorityError();
+        if (ticket && (ticket.ambiguous || ticket.generation !== record.generation))
+            throw oauthAuthorityError();
+        this.record = await this.sessionRepository.updateBound(this.slot, record.generation, (current) => {
+            if (ticket && current.revision !== ticket.revision)
+                throw oauthAuthorityError();
+            current.clientInfo = JSON.stringify(parsed);
+            current.revision++;
+        }, ticket?.requestVersion ?? this.operations.getStore()?.requestVersion);
+        this.advanceOperation();
+    }
+    tokens(ctx) {
+        this.checkIssuer(ctx);
+        const record = this.current();
+        if (!record?.tokens)
+            return undefined;
+        try {
+            return { ...OAuthTokensSchema.parse(JSON.parse(record.tokens)), issuer: record.authority.issuer };
+        }
+        catch {
+            throw oauthAuthorityError();
+        }
+    }
+    async saveTokens(tokens, ctx) {
+        this.assertOperation();
+        this.checkIssuer(ctx);
+        const record = this.requireCurrent();
+        const stamped = tokens;
+        if (stamped.issuer && stamped.issuer !== record.authority.issuer)
+            throw oauthAuthorityError();
+        const parsed = OAuthTokensSchema.parse(tokens);
+        if (this.config.scopes && parsed.scope?.split(' ').some((scope) => !this.config.scopes.includes(scope)))
+            throw oauthAuthorityError();
+        const responseKey = this.responseDigest(parsed);
+        const ticket = this.responseMap('token').get(responseKey);
+        this.responseMap('token').delete(responseKey);
+        if (!ticket || ticket.ambiguous || ticket.generation !== record.generation)
+            this.rejectOperation();
+        const expectedRevision = ticket.revision;
+        this.record = await this.sessionRepository.updateBound(this.slot, record.generation, (current) => {
+            if (current.revision !== expectedRevision)
+                throw oauthAuthorityError();
+            current.tokens = JSON.stringify(parsed);
+            current.revision++;
+        }, ticket.requestVersion);
+        this.authorizationAttempt = undefined;
+    }
+    async invalidateCredentials(scope) {
+        const record = this.current();
+        this.authorizationAttempt = undefined;
+        this.verifiers.clear();
+        if (!record)
+            return;
+        this.record = await this.sessionRepository.updateBound(this.slot, record.generation, (current) => {
+            current.generation = randomUUID();
+            current.revision++;
+            current.attempts = {};
+            if (scope !== 'verifier')
+                current.tokens = undefined;
+            if (scope === 'all' || scope === 'client' || scope === 'discovery')
+                current.clientInfo = undefined;
+            if (scope === 'all' || scope === 'discovery')
+                current.discovery = '';
+        });
+        this.claim = this.record.generation;
+        // In-flight work retains its old revision and cannot publish into this generation.
+    }
+    state() {
+        return randomUUID();
+    }
+    saveCodeVerifier(verifier) {
+        if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier) || this.verifiers.size >= 32)
+            throw oauthAuthorityError();
+        this.verifiers.set(createHash('sha256').update(verifier).digest('base64url'), verifier);
+    }
+    codeVerifier() {
+        const callback = this.callbacks.getStore();
+        if (!callback || callback.generation !== this.requireCurrent().generation)
+            throw oauthAuthorityError();
+        return callback.verifier;
+    }
+    async redirectToAuthorization(url) {
+        this.assertOperation();
+        const record = this.requireCurrent();
+        const target = new URL(url);
+        const state = target.searchParams.get('state');
+        const challenge = target.searchParams.get('code_challenge');
+        const verifier = challenge ? this.verifiers.get(challenge) : undefined;
+        target.search = '';
+        const endpoint = new URL(record.authority.authorizationEndpoint);
+        endpoint.search = '';
+        if (target.href !== endpoint.href ||
+            !state ||
+            !verifier ||
+            url.searchParams.get('redirect_uri') !== this.redirectUrl ||
+            url.searchParams.get('resource') !== record.authority.resource)
+            throw oauthAuthorityError();
+        this.assertScopes(url.searchParams.get('scope'));
+        await this.sessionRepository.addAttempt(this.slot, record.generation, state, {
+            authority: record.authority,
+            generation: record.generation,
+            redirect: this.redirectUrl,
+            verifier,
+            createdAt: Date.now(),
+            expires: Date.now() + OAUTH_ATTEMPT_TTL_MS,
+            consumed: false,
+        });
+        this.verifiers.delete(challenge);
+        this.authorizationAttempt = { url: url.toString(), key: oauthDigest(state) };
     }
-    get clientMetadata() {
-        return this._clientMetadata;
-    }
-    /**
-     * Returns current client registration information
-     */
-    clientInformation() {
-        return this._clientInfo;
-    }
-    /**
-     * Saves client registration information from dynamic registration
-     */
-    saveClientInformation(clientInfo) {
-        this._clientInfo = clientInfo;
-        this.persistAllData();
-        logger.info(`OAuth client registered for ${this.serverName}: ${clientInfo.client_id}`);
-    }
-    /**
-     * Returns current OAuth tokens
-     */
-    tokens() {
-        return this._tokens;
-    }
-    /**
-     * Saves OAuth tokens after successful authorization
-     */
-    saveTokens(tokens) {
-        this._tokens = tokens;
-        this.persistAllData();
-        logger.info(`OAuth tokens saved for ${this.serverName}`);
-    }
-    /**
-     * Invalidates persisted OAuth credentials as requested by the MCP SDK.
-     */
-    invalidateCredentials(scope) {
-        switch (scope) {
-            case 'all':
-                this._clientInfo = undefined;
-                this._tokens = undefined;
-                this._codeVerifier = undefined;
-                this._state = undefined;
-                this._authorizationUrl = undefined;
-                break;
-            case 'client':
-                this._clientInfo = undefined;
-                break;
-            case 'tokens':
-                this._tokens = undefined;
-                this._state = undefined;
-                this._authorizationUrl = undefined;
-                break;
-            case 'verifier':
-                this._codeVerifier = undefined;
-                break;
-            case 'discovery':
-                return;
-        }
-        this.persistAllData();
-        logger.info(`OAuth credentials invalidated for ${this.serverName}: ${scope}`);
-    }
-    /**
-     * Stores authorization URL instead of prompting user in console
-     */
-    redirectToAuthorization(authorizationUrl) {
-        this._authorizationUrl = authorizationUrl.toString();
-    }
-    /**
-     * Gets the current authorization URL
-     */
     getAuthorizationUrl() {
-        return this._authorizationUrl;
+        return this.authorizationAttempt?.url;
+    }
+    /** Only a live, unconsumed attempt owned by this provider can be resumed. */
+    getPendingAuthorizationUrl() {
+        const authorization = this.authorizationAttempt;
+        if (!authorization)
+            return undefined;
+        const record = this.current();
+        if (!record)
+            return undefined;
+        // The durable key was bound to this URL at creation, before it was exposed
+        // through transport/provider APIs. Resumption never reinterprets a URL.
+        const attempt = record.attempts[authorization.key];
+        if (!attempt || attempt.consumed || attempt.expires <= Date.now())
+            return undefined;
+        if (attempt.generation !== record.generation || !sameAuthority(attempt.authority, record.authority))
+            return undefined;
+        if (attempt.redirect !== this.redirectUrl)
+            return undefined;
+        return this.authorizationAttempt?.url;
     }
-    /**
-     * Clears the stored authorization URL
-     */
     clearAuthorizationUrl() {
-        this._authorizationUrl = undefined;
-    }
-    /**
-     * Saves PKCE code verifier for the authorization session
-     */
-    saveCodeVerifier(codeVerifier) {
-        this._codeVerifier = codeVerifier;
-        this.persistAllData();
-    }
-    /**
-     * Returns the PKCE code verifier for token exchange
-     */
-    codeVerifier() {
-        return this._codeVerifier || '';
+        this.authorizationAttempt = undefined;
     }
-    /**
-     * Returns the OAuth state parameter for CSRF protection
-     */
-    state() {
-        if (!this._state) {
-            this._state = randomUUID();
-            this.persistAllData();
-        }
-        return this._state;
+    /** Validation and durable consumption happen before the SDK can see a code, for both eras. */
+    async withAuthorizationCallback(response, operation) {
+        const run = async () => {
+            await this.migration;
+            const record = this.requireCurrent();
+            for (const key of ['state', 'code', 'iss', 'error', 'redirect_uri']) {
+                if (response.getAll(key).length > 1)
+                    throw oauthAuthorityError();
+            }
+            const state = response.get('state');
+            if (!state)
+                throw oauthAuthorityError();
+            const attempt = await this.sessionRepository.consumeAttempt(this.slot, record.generation, state, (candidate) => {
+                if (!sameAuthority(candidate.authority, record.authority) ||
+                    candidate.generation !== record.generation ||
+                    candidate.redirect !== this.redirectUrl)
+                    throw oauthAuthorityError();
+                const redirect = response.get('redirect_uri');
+                if (redirect && redirect !== candidate.redirect)
+                    throw oauthAuthorityError();
+                const issuer = response.get('iss');
+                if (candidate.authority.requireIssuer && !issuer)
+                    throw oauthAuthorityError();
+                if (issuer !== null && issuer !== candidate.authority.issuer)
+                    throw oauthAuthorityError();
+                if (!response.get('code') && !response.get('error'))
+                    throw oauthAuthorityError();
+            });
+            if (response.has('error'))
+                throw new OAuthAuthorizationDeniedError(response.get('error') === 'access_denied' ? 'access_denied' : 'provider_error');
+            return this.callbacks.run({ verifier: attempt.verifier, generation: attempt.generation }, operation);
+        };
+        const pending = this.callbackTail.then(run, run);
+        this.callbackTail = pending.catch(() => undefined);
+        return pending;
+    }
+    async bindAdminReturn(state, origin) {
+        const record = this.requireCurrent();
+        await this.sessionRepository.updateBound(this.slot, record.generation, (current) => {
+            const attempt = current.attempts[oauthDigest(state)];
+            if (!attempt || attempt.consumed || attempt.expires <= Date.now())
+                throw oauthAuthorityError();
+            attempt.adminReturnOrigin = origin;
+        });
+    }
+    getAdminReturn(state) {
+        const attempt = this.current()?.attempts[oauthDigest(state)];
+        return attempt && attempt.consumed && attempt.expires > Date.now() ? attempt.adminReturnOrigin : undefined;
     }
-    /**
-     * Custom resource validation (optional)
-     */
     async validateResourceURL(serverUrl, resource) {
-        const url = typeof serverUrl === 'string' ? new URL(serverUrl) : serverUrl;
-        // Basic validation - can be extended for specific requirements
-        if (resource && !resource.startsWith(url.origin)) {
+        return this.selectResourceURL(serverUrl, resource);
+    }
+    selectResourceURL(serverUrl, resource) {
+        try {
+            const configured = new URL(this.context?.route.url ?? serverUrl);
+            configured.hash = '';
+            const requested = new URL(serverUrl);
+            requested.hash = '';
+            if (requested.href !== configured.href)
+                throw oauthAuthorityError();
+            if (resource === undefined)
+                return configured;
+            const advertised = new URL(resource);
+            if (advertised.username || advertised.password || resource.includes('#'))
+                throw oauthAuthorityError();
+            if (advertised.origin !== configured.origin || advertised.search !== configured.search)
+                throw oauthAuthorityError();
+            // Resource Indicators may describe a parent resource; the transport route remains exact.
+            const resourcePath = advertised.pathname.endsWith('/') ? advertised.pathname : advertised.pathname + '/';
+            const routePath = configured.pathname.endsWith('/') ? configured.pathname : configured.pathname + '/';
+            if (configured.pathname.length < advertised.pathname.length || !routePath.startsWith(resourcePath))
+                throw oauthAuthorityError();
+            return advertised;
+        }
+        catch {
+            throw oauthAuthorityError();
+        }
+    }
+    discoveryState() {
+        // A new SDK auth operation may retry transient transport failures. The failed
+        // operation itself remains blocked from inferred fallback or credential writes.
+        this.operations.enterWith({
+            failed: false,
+            responses: { token: new Map(), registration: new Map(), discovery: new Map() },
+        });
+        const current = this.current();
+        // Refresh/new authorization re-discovers current destinations. Only a validated
+        // callback resumes the exact discovery snapshot captured by its durable attempt.
+        if (!this.callbacks.getStore() || !current?.discovery)
+            return undefined;
+        try {
+            return JSON.parse(current.discovery);
+        }
+        catch {
+            throw oauthAuthorityError();
+        }
+    }
+    async saveDiscoveryState(state) {
+        await this.migration;
+        this.assertOperation();
+        if (!this.context || !this.slot)
+            throw oauthAuthorityError();
+        const metadata = state.authorizationServerMetadata;
+        let requestVersion = this.operations.getStore()?.requestVersion;
+        if (metadata) {
+            const key = this.discoveryKey(metadata);
+            const ticket = this.responseMap('discovery').get(key);
+            this.responseMap('discovery').delete(key);
+            if (ticket && (ticket.ambiguous || ticket.generation !== this.claim))
+                throw oauthAuthorityError();
+            if (ticket)
+                requestVersion = ticket.requestVersion;
+        }
+        const issuer = state.authorizationServerUrl;
+        if (this.config.issuer && this.config.issuer !== issuer)
+            throw oauthAuthorityError();
+        if (metadata?.issuer && metadata.issuer !== issuer)
+            throw oauthAuthorityError();
+        const approved = this.record?.authority.issuer;
+        const advertised = state.resourceMetadata?.authorization_servers;
+        if (advertised?.length) {
+            const selected = this.config.issuer ?? (approved && advertised.includes(approved) ? approved : undefined);
+            if (selected ? selected !== issuer : advertised.length !== 1 || advertised[0] !== issuer)
+                throw oauthAuthorityError();
+        }
+        else if (!this.config.legacy && !this.config.issuer) {
+            throw oauthAuthorityError();
+        }
+        const issuerUrl = validateOAuthEndpoint(issuer, this.context.route.url, undefined, this.config.issuer);
+        if (issuerUrl.search || issuerUrl.hash)
+            throw oauthAuthorityError();
+        const fallback = this.config.legacy && issuerUrl.origin === new URL(this.context.route.url).origin;
+        if (!metadata && !fallback)
+            throw oauthAuthorityError();
+        const resource = await this.validateResourceURL(this.context.route.url, state.resourceMetadata?.resource);
+        const endpoint = (value, pathname) => {
+            if (!value && !fallback)
+                throw oauthAuthorityError();
+            return validateOAuthEndpoint(value ?? new URL(pathname, issuerUrl).href, this.context.route.url, value ? undefined : issuerUrl.origin, this.config.issuer).href;
+        };
+        let registrationEndpoint;
+        if (metadata?.registration_endpoint)
+            registrationEndpoint = endpoint(metadata.registration_endpoint, '/register');
+        else if (!metadata && fallback)
+            registrationEndpoint = endpoint(undefined, '/register');
+        const authority = {
+            ...this.context,
+            version: 1,
+            issuer,
+            resource: resource.href,
+            authorizationEndpoint: endpoint(metadata?.authorization_endpoint, '/authorize'),
+            tokenEndpoint: endpoint(metadata?.token_endpoint, '/token'),
+            registrationEndpoint,
+            requireIssuer: metadata
+                ?.authorization_response_iss_parameter_supported === true,
+        };
+        this.record = await this.sessionRepository.activate(this.slot, authority, JSON.stringify(state), this.claim, requestVersion);
+        this.claim = this.record.generation;
+        this.advanceOperation();
+    }
+    current() {
+        if (!this.record || !this.slot || !this.context)
             return undefined;
+        const current = this.sessionRepository.getBound(this.slot);
+        if (this.sessionRepository.getClaim(this.slot)?.generation !== this.record.generation)
+            throw oauthAuthorityError();
+        if (!current ||
+            current.generation !== this.record.generation ||
+            !sameAuthority(current.authority, this.record.authority) ||
+            !matchesAuthorityContext(current.authority, this.context))
+            throw oauthAuthorityError();
+        return current;
+    }
+    requireCurrent() {
+        const current = this.current();
+        if (!current)
+            throw oauthAuthorityError();
+        return current;
+    }
+    checkIssuer(ctx) {
+        if (!ctx)
+            return;
+        const issuer = this.record?.authority.issuer ?? this.config.issuer;
+        if (!issuer || ctx.issuer !== issuer)
+            throw oauthAuthorityError();
+    }
+    assertScopes(scope) {
+        if (this.config.scopes && scope?.split(' ').some((item) => !this.config.scopes.includes(item)))
+            throw oauthAuthorityError();
+    }
+    validateMetadata(value, url) {
+        if (!this.context)
+            throw oauthAuthorityError();
+        if (Array.isArray(value.authorization_servers)) {
+            const issuers = value.authorization_servers;
+            if (!issuers.length || issuers.length > 16 || issuers.some((issuer) => typeof issuer !== 'string'))
+                throw oauthAuthorityError();
+            for (const issuer of issuers)
+                validateOAuthEndpoint(String(issuer), this.context.route.url, undefined, this.config.issuer);
+            const approved = this.config.issuer ?? this.record?.authority.issuer;
+            let selected;
+            if (approved && issuers.includes(approved))
+                selected = approved;
+            else if (issuers.length === 1)
+                selected = String(issuers[0]);
+            if (!selected || (this.config.issuer && selected !== this.config.issuer))
+                throw oauthAuthorityError();
+            if (typeof value.resource !== 'string')
+                throw oauthAuthorityError();
+            this.selectResourceURL(this.context.route.url, value.resource);
+            return {
+                ...value,
+                authorization_servers: [selected],
+                ...(this.config.scopes ? { scopes_supported: this.config.scopes } : {}),
+            };
         }
-        return url;
-    }
-    /**
-     * Load persisted OAuth data from unified client session storage
-     */
-    loadPersistedData() {
-        const clientSession = this.sessionRepository.get(this.serverName);
-        if (clientSession) {
-            // Load client info
-            if (clientSession.clientInfo) {
-                this._clientInfo = JSON.parse(clientSession.clientInfo);
+        if (typeof value.issuer === 'string') {
+            const issuer = validateOAuthEndpoint(value.issuer, this.context.route.url, undefined, this.config.issuer);
+            if (issuer.origin !== url.origin || (this.config.issuer && value.issuer !== this.config.issuer))
+                throw oauthAuthorityError();
+            for (const key of ['authorization_endpoint', 'token_endpoint', 'registration_endpoint', 'jwks_uri']) {
+                if (value[key] !== undefined)
+                    validateOAuthEndpoint(String(value[key]), this.context.route.url, undefined, this.config.issuer);
             }
-            // Load tokens
-            if (clientSession.tokens) {
-                this._tokens = JSON.parse(clientSession.tokens);
-                // Check if tokens are expired
-                if (this._tokens && this.isTokenExpired(this._tokens)) {
-                    logger.warn(`OAuth tokens expired for ${this.serverName}, clearing`);
-                    this._tokens = undefined;
-                    this.persistAllData();
+        }
+        return value;
+    }
+    async prepareFetch(url, init) {
+        await this.migration;
+        if (!this.context)
+            throw oauthAuthorityError();
+        const resource = new URL(this.context.route.url);
+        const headers = new Headers(init.headers);
+        const isDiscovery = (init.method ?? 'GET') === 'GET' && url.href !== resource.href && url.href !== this.sseEndpoint;
+        if (isDiscovery) {
+            this.assertOperation();
+            const requestVersion = await this.reserveRequest();
+            if (url.search)
+                throw oauthAuthorityError();
+            const request = { ...init, headers: { accept: 'application/json' }, redirect: 'error' };
+            this.tokenRequests.set(request, {
+                generation: this.claim,
+                revision: this.record?.revision ?? 0,
+                kind: 'discovery',
+                requestVersion,
+            });
+            return request;
+        }
+        // Resource requests need the generation check in pinDestination, not credential loading.
+        if (url.href === resource.href || url.href === this.sseEndpoint)
+            return { ...init, redirect: 'error' };
+        const record = this.current();
+        const isToken = record?.authority.tokenEndpoint === url.href;
+        const isRegistration = record?.authority.registrationEndpoint === url.href;
+        if (isToken || isRegistration) {
+            this.assertOperation();
+            const requestVersion = await this.reserveRequest();
+            if ((init.method ?? 'GET') !== 'POST')
+                throw oauthAuthorityError();
+            const safeHeaders = new Headers();
+            safeHeaders.set('content-type', isToken ? 'application/x-www-form-urlencoded' : 'application/json');
+            if (isToken) {
+                const params = new URLSearchParams(String(init.body ?? ''));
+                if (params.get('resource') !== record.authority.resource)
+                    throw oauthAuthorityError();
+                this.assertScopes(params.get('scope'));
+                if (params.get('grant_type') === 'authorization_code') {
+                    if (this.callbacks.getStore()?.generation !== record.generation)
+                        throw oauthAuthorityError();
                 }
+                const client = this.clientInformation();
+                const authorization = headers.get('authorization');
+                if (authorization?.startsWith('Basic ') && client?.client_secret) {
+                    const expected = `Basic ${Buffer.from(`${client.client_id}:${client.client_secret}`).toString('base64')}`;
+                    if (authorization !== expected)
+                        throw oauthAuthorityError();
+                    safeHeaders.set('authorization', authorization);
+                }
+                if (params.has('client_id') && params.get('client_id') !== client?.client_id)
+                    throw oauthAuthorityError();
+                if (params.has('client_secret') && params.get('client_secret') !== client?.client_secret)
+                    throw oauthAuthorityError();
             }
-            // Load code verifier
-            if (clientSession.codeVerifier) {
-                this._codeVerifier = clientSession.codeVerifier;
-            }
-            // Load state
-            if (clientSession.state) {
-                this._state = clientSession.state;
+            else {
+                const registration = JSON.parse(String(init.body ?? '{}'));
+                this.assertScopes(registration.scope ?? null);
+                if (this.config.clientId || this.config.autoRegister === false)
+                    throw oauthAuthorityError();
             }
+            const request = { ...init, headers: safeHeaders, redirect: 'error' };
+            this.tokenRequests.set(request, {
+                generation: record.generation,
+                revision: record.revision,
+                kind: isToken ? 'token' : 'registration',
+                requestVersion,
+            });
+            return request;
         }
+        throw oauthAuthorityError();
     }
-    /**
-     * Persist all OAuth data to unified client session storage
-     */
-    persistAllData() {
-        // Calculate the longest TTL based on the data we have
-        let maxTtl = AUTH_CONFIG.CLIENT.OAUTH.TTL_MS; // Default to 30 days
-        // If we have tokens, use their expiry time
-        if (this._tokens && this._tokens.expires_in) {
-            const tokenTtl = this._tokens.expires_in * 1000;
-            maxTtl = Math.max(maxTtl, tokenTtl);
-        }
-        // Code verifier and state have shorter TTL, but we keep them for completeness
-        const clientSessionData = {
-            serverName: this.serverName,
-            clientInfo: this._clientInfo ? JSON.stringify(this._clientInfo) : undefined,
-            tokens: this._tokens ? JSON.stringify(this._tokens) : undefined,
-            codeVerifier: this._codeVerifier,
-            state: this._state,
-            expires: Date.now() + maxTtl,
-            createdAt: Date.now(),
-        };
-        this.sessionRepository.save(this.serverName, clientSessionData, maxTtl);
-    }
-    /**
-     * Check if OAuth tokens are expired
-     */
-    isTokenExpired(tokens) {
-        if (!tokens.expires_in) {
-            return false; // No expiration info, assume valid
-        }
-        // This is a simple check - in practice, you might want to store the issued_at time
-        // For now, we'll rely on the session storage TTL for expiration
-        return false;
-    }
-    /**
-     * Clean up resources
-     */
-    shutdown() {
-        // Clean up temporary session data by clearing verifier and state
-        this._codeVerifier = undefined;
-        this._state = undefined;
-        this.persistAllData();
+    responseMap(kind) {
+        const operation = this.operations.getStore();
+        if (operation)
+            return operation.responses[kind];
+        if (kind === 'token')
+            return this.tokenResponses;
+        if (kind === 'registration')
+            return this.registrationResponses;
+        return this.discoveryResponses;
+    }
+    advanceOperation() {
+        const operation = this.operations.getStore();
+        if (operation && this.slot)
+            operation.requestVersion = this.sessionRepository.getClaim(this.slot)?.requestVersion;
+    }
+    rejectOperation() {
+        const operation = this.operations.getStore();
+        if (operation)
+            operation.failed = true;
+        throw oauthAuthorityError();
+    }
+    assertOperation() {
+        if (this.operations.getStore()?.failed)
+            throw oauthAuthorityError();
+    }
+    async reserveRequest() {
+        const requestVersion = await this.sessionRepository.reserveRequest(this.slot, this.claim);
+        const operation = this.operations.getStore();
+        if (operation)
+            operation.requestVersion = requestVersion;
+        return requestVersion;
+    }
+    responseDigest(value) {
+        return createHmac('sha256', this.responseKey).update(JSON.stringify(value)).digest('hex');
+    }
+    discoveryKey(metadata) {
+        return this.responseDigest([
+            metadata.issuer,
+            metadata.authorization_endpoint,
+            metadata.token_endpoint,
+            metadata.registration_endpoint,
+        ]);
+    }
+    recordResponse(target, key, ticket) {
+        if (target.size >= 32 && !target.has(key))
+            throw oauthAuthorityError();
+        const previous = target.get(key);
+        if (previous) {
+            previous.ambiguous = true;
+            return;
+        }
+        target.set(key, ticket);
+    }
+    async shutdown() {
+        this.shutdownSignal.abort();
         this.fileStorage.shutdown();
+        await this.migration.catch(() => undefined);
     }
 }
 //# sourceMappingURL=sdkOAuthClientProvider.js.map