@adcp/client 3.8.0 → 3.9.0

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MCPOAuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACZ,MAAM,SAAS,CAAC;AAIjB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAC1D,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;gBAE1C,MAAM,EAAE,mBAAmB;IAOvC;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,EAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACrD,gBAAgB;IAoBnB,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAE9B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAI9B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAOtE;;OAEG;IACG,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAOhD;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAUrC;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3F;;OAEG;YACW,YAAY;IAM1B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,cAAc,IAAI,OAAO;IAgBzB;;;OAGG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACH,QAAQ,IAAI,WAAW;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}

package/dist/lib/auth/oauth/MCPOAuthProvider.js

@@ -0,0 +1,236 @@
+"use strict";
+/**
+ * MCP OAuth Provider
+ *
+ * Implements the MCP SDK's OAuthClientProvider interface
+ * using AgentConfig for token storage.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCPOAuthProvider = void 0;
+const types_1 = require("./types");
+const crypto_1 = require("crypto");
+/**
+ * MCP OAuth Client Provider
+ *
+ * This provider stores OAuth tokens directly in the AgentConfig,
+ * using the same structure as static auth tokens.
+ *
+ * @example
+ * ```typescript
+ * const agent: AgentConfig = {
+ *   id: 'my-agent',
+ *   name: 'My Agent',
+ *   agent_uri: 'https://agent.example.com/mcp',
+ *   protocol: 'mcp',
+ *   // OAuth tokens stored here after auth flow
+ *   oauth_tokens: { access_token: '...', refresh_token: '...' }
+ * };
+ *
+ * const provider = new MCPOAuthProvider({
+ *   agent,
+ *   flowHandler: new CLIFlowHandler(),
+ *   storage: myConfigStorage  // Optional: persists tokens
+ * });
+ *
+ * const transport = new StreamableHTTPClientTransport(url, {
+ *   authProvider: provider
+ * });
+ * ```
+ */
+class MCPOAuthProvider {
+    agent;
+    storage;
+    flowHandler;
+    _clientMetadata;
+    constructor(config) {
+        this.agent = config.agent;
+        this.storage = config.storage;
+        this.flowHandler = config.flowHandler;
+        this._clientMetadata = config.clientMetadata;
+    }
+    /**
+     * Create a provider for CLI usage
+     */
+    static forCLI(agent, flowHandler, storage, clientMetadataOverrides) {
+        // Build complete client metadata with required fields
+        const clientMetadata = {
+            ...types_1.DEFAULT_CLIENT_METADATA,
+            redirect_uris: [flowHandler.getRedirectUrl().toString()],
+            ...clientMetadataOverrides,
+        };
+        return new MCPOAuthProvider({
+            agent,
+            flowHandler,
+            storage,
+            clientMetadata,
+        });
+    }
+    // ========================================
+    // OAuthClientProvider interface
+    // ========================================
+    get redirectUrl() {
+        return this.flowHandler.getRedirectUrl();
+    }
+    get clientMetadata() {
+        return this._clientMetadata;
+    }
+    /**
+     * Generate OAuth state parameter
+     */
+    async state() {
+        return (0, crypto_1.randomBytes)(32).toString('base64url');
+    }
+    /**
+     * Load client information from agent config
+     */
+    async clientInformation() {
+        if (this.agent.oauth_client) {
+            return (0, types_1.toMCPClientInfo)(this.agent.oauth_client);
+        }
+        return undefined;
+    }
+    /**
+     * Save client information after dynamic registration
+     */
+    async saveClientInformation(clientInfo) {
+        this.agent.oauth_client = (0, types_1.fromMCPClientInfo)(clientInfo);
+        await this.persistAgent();
+    }
+    /**
+     * Load existing tokens from agent config
+     */
+    async tokens() {
+        if (this.agent.oauth_tokens) {
+            return (0, types_1.toMCPTokens)(this.agent.oauth_tokens);
+        }
+        return undefined;
+    }
+    /**
+     * Save tokens after authorization
+     * Also cleans up the temporary code verifier
+     */
+    async saveTokens(tokens) {
+        this.agent.oauth_tokens = (0, types_1.fromMCPTokens)(tokens);
+        // Clean up temporary code verifier after successful token exchange
+        delete this.agent.oauth_code_verifier;
+        await this.persistAgent();
+    }
+    /**
+     * Redirect user to authorization URL
+     */
+    async redirectToAuthorization(authorizationUrl) {
+        await this.flowHandler.redirectToAuthorization(authorizationUrl);
+    }
+    /**
+     * Save PKCE code verifier
+     */
+    async saveCodeVerifier(codeVerifier) {
+        this.agent.oauth_code_verifier = codeVerifier;
+        await this.persistAgent();
+    }
+    /**
+     * Load PKCE code verifier
+     * The MCP SDK calls saveCodeVerifier() before authorization and
+     * retrieves it here during token exchange.
+     */
+    async codeVerifier() {
+        if (!this.agent.oauth_code_verifier) {
+            throw new Error('No PKCE code verifier found. The OAuth flow may have been interrupted or ' +
+                'the agent config was modified. Please try authenticating again.');
+        }
+        return this.agent.oauth_code_verifier;
+    }
+    /**
+     * Invalidate credentials when server indicates they're invalid
+     */
+    async invalidateCredentials(scope) {
+        switch (scope) {
+            case 'all':
+                delete this.agent.oauth_tokens;
+                delete this.agent.oauth_client;
+                delete this.agent.oauth_code_verifier;
+                break;
+            case 'tokens':
+                delete this.agent.oauth_tokens;
+                break;
+            case 'client':
+                delete this.agent.oauth_client;
+                break;
+            case 'verifier':
+                delete this.agent.oauth_code_verifier;
+                break;
+        }
+        await this.persistAgent();
+    }
+    // ========================================
+    // Additional methods
+    // ========================================
+    /**
+     * Persist agent config to storage if configured
+     */
+    async persistAgent() {
+        if (this.storage) {
+            await this.storage.saveAgent(this.agent);
+        }
+    }
+    /**
+     * Wait for the OAuth callback
+     * Call this after UnauthorizedError is thrown
+     */
+    async waitForCallback() {
+        return this.flowHandler.waitForCallback();
+    }
+    /**
+     * Clean up resources
+     */
+    async cleanup() {
+        await this.flowHandler.cleanup();
+    }
+    /**
+     * Check if we have valid, non-expired OAuth tokens
+     * @returns true if access_token exists and hasn't expired (with 5 minute buffer)
+     */
+    hasValidTokens() {
+        const tokens = this.agent.oauth_tokens;
+        if (!tokens?.access_token)
+            return false;
+        // Check expiration if available
+        if (tokens.expires_at) {
+            const expiresAt = new Date(tokens.expires_at);
+            // Consider expired if within 5 minutes of expiration
+            if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Check if we have a refresh token available for token refresh
+     * @returns true if refresh_token is present
+     */
+    hasRefreshToken() {
+        return !!this.agent.oauth_tokens?.refresh_token;
+    }
+    /**
+     * Clear all OAuth data for this agent
+     */
+    async clearAuth() {
+        await this.invalidateCredentials('all');
+    }
+    /**
+     * Get the agent config this provider manages
+     * @returns The AgentConfig with OAuth tokens populated after successful auth
+     */
+    getAgent() {
+        return this.agent;
+    }
+    /**
+     * Get the agent identifier
+     * @returns The agent's unique ID
+     */
+    getAgentId() {
+        return this.agent.id;
+    }
+}
+exports.MCPOAuthProvider = MCPOAuthProvider;
+//# sourceMappingURL=MCPOAuthProvider.js.map

package/dist/lib/auth/oauth/MCPOAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MCPOAuthProvider.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAaH,mCAAkH;AAClH,mCAAqC;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAa,gBAAgB;IACnB,KAAK,CAAc;IACV,OAAO,CAAsB;IAC7B,WAAW,CAAmB;IAC9B,eAAe,CAAsB;IAEtD,YAAY,MAA2B;QACrC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAkB,EAClB,WAA6B,EAC7B,OAA4B,EAC5B,uBAAsD;QAEtD,sDAAsD;QACtD,MAAM,cAAc,GAAwB;YAC1C,GAAG,+BAAuB;YAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;YACxD,GAAG,uBAAuB;SAC3B,CAAC;QAEF,OAAO,IAAI,gBAAgB,CAAC;YAC1B,KAAK;YACL,WAAW;YACX,OAAO;YACP,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,gCAAgC;IAChC,2CAA2C;IAE3C,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,IAAA,uBAAe,EAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,UAAsC;QAChE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,IAAA,mBAAW,EAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB;QAClC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAC;QAChD,mEAAmE;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACtC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAAC,gBAAqB;QACjD,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,YAAY,CAAC;QAC9C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2EAA2E;gBACzE,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAA+C;QACzE,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;gBACtC,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,MAAM;YACR,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;gBACtC,MAAM;QACV,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,2CAA2C;IAC3C,qBAAqB;IACrB,2CAA2C;IAE3C;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,YAAY;YAAE,OAAO,KAAK,CAAC;QAExC,gCAAgC;QAChC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9C,qDAAqD;YACrD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACrD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvB,CAAC;CACF;AAlOD,4CAkOC"}

package/dist/lib/auth/oauth/index.d.ts

@@ -0,0 +1,104 @@
+/**
+ * OAuth module for MCP authentication
+ *
+ * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.
+ *
+ * @example
+ * ```typescript
+ * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/client';
+ *
+ * // Agent config - tokens will be stored here
+ * const agent: AgentConfig = {
+ *   id: 'my-agent',
+ *   name: 'My Agent',
+ *   agent_uri: 'https://agent.example.com/mcp',
+ *   protocol: 'mcp',
+ *   // After OAuth flow completes:
+ *   // oauth_tokens: { access_token: '...', refresh_token: '...' }
+ * };
+ *
+ * // Create provider with CLI flow handler
+ * const provider = new MCPOAuthProvider({
+ *   agent,
+ *   flowHandler: new CLIFlowHandler(),
+ *   storage: myConfigStorage  // Optional: persists tokens to file/db
+ * });
+ *
+ * // Use with MCP transport
+ * const transport = new StreamableHTTPClientTransport(url, {
+ *   authProvider: provider
+ * });
+ * ```
+ */
+export type { OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens, AgentConfig, AgentOAuthTokens, AgentOAuthClient, } from './types';
+export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutError, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo, } from './types';
+export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';
+export { MCPOAuthProvider } from './MCPOAuthProvider';
+import { MCPOAuthProvider } from './MCPOAuthProvider';
+import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';
+/**
+ * Create an OAuth provider for CLI usage
+ *
+ * @param agent Agent configuration (tokens stored here)
+ * @param options Optional configuration
+ * @returns Configured OAuth provider
+ *
+ * @example
+ * ```typescript
+ * const agent: AgentConfig = {
+ *   id: 'my-agent',
+ *   name: 'My Agent',
+ *   agent_uri: 'https://agent.example.com/mcp',
+ *   protocol: 'mcp'
+ * };
+ *
+ * const provider = createCLIOAuthProvider(agent);
+ *
+ * const transport = new StreamableHTTPClientTransport(url, {
+ *   authProvider: provider
+ * });
+ *
+ * try {
+ *   await client.connect(transport);
+ * } catch (error) {
+ *   if (error instanceof UnauthorizedError) {
+ *     const code = await provider.waitForCallback();
+ *     await transport.finishAuth(code);
+ *     await client.connect(transport);
+ *   }
+ * }
+ *
+ * // After successful auth, agent.oauth_tokens is populated
+ * console.log(agent.oauth_tokens);
+ * ```
+ */
+export declare function createCLIOAuthProvider(agent: AgentConfig, options?: {
+    /** Callback port (default: 8766) */
+    callbackPort?: number;
+    /** Auth timeout in ms (default: 300000 = 5 min) */
+    timeout?: number;
+    /** Custom client metadata overrides */
+    clientMetadata?: Partial<OAuthClientMetadata>;
+    /** Suppress console output */
+    quiet?: boolean;
+    /** Storage for persisting agent config */
+    storage?: OAuthConfigStorage;
+}): MCPOAuthProvider;
+/**
+ * Check if an error indicates OAuth is required
+ */
+export declare function isOAuthRequired(error: unknown): boolean;
+/**
+ * Check if an agent has valid OAuth tokens
+ */
+export declare function hasValidOAuthTokens(agent: AgentConfig): boolean;
+/**
+ * Clear OAuth tokens from an agent config
+ */
+export declare function clearOAuthTokens(agent: AgentConfig): void;
+/**
+ * Get the effective auth token for an agent
+ * Returns OAuth access_token if available, otherwise static auth_token
+ */
+export declare function getEffectiveAuthToken(agent: AgentConfig): string | undefined;
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/auth/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,8BAA8B;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,GACA,gBAAgB,CAqBlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAa/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAIzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAO5E"}

package/dist/lib/auth/oauth/index.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * OAuth module for MCP authentication
+ *
+ * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.
+ *
+ * @example
+ * ```typescript
+ * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/client';
+ *
+ * // Agent config - tokens will be stored here
+ * const agent: AgentConfig = {
+ *   id: 'my-agent',
+ *   name: 'My Agent',
+ *   agent_uri: 'https://agent.example.com/mcp',
+ *   protocol: 'mcp',
+ *   // After OAuth flow completes:
+ *   // oauth_tokens: { access_token: '...', refresh_token: '...' }
+ * };
+ *
+ * // Create provider with CLI flow handler
+ * const provider = new MCPOAuthProvider({
+ *   agent,
+ *   flowHandler: new CLIFlowHandler(),
+ *   storage: myConfigStorage  // Optional: persists tokens to file/db
+ * });
+ *
+ * // Use with MCP transport
+ * const transport = new StreamableHTTPClientTransport(url, {
+ *   authProvider: provider
+ * });
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCPOAuthProvider = exports.CLIFlowHandler = exports.fromMCPClientInfo = exports.toMCPClientInfo = exports.fromMCPTokens = exports.toMCPTokens = exports.OAuthTimeoutError = exports.OAuthCancelledError = exports.OAuthError = exports.DEFAULT_CLIENT_METADATA = void 0;
+exports.createCLIOAuthProvider = createCLIOAuthProvider;
+exports.isOAuthRequired = isOAuthRequired;
+exports.hasValidOAuthTokens = hasValidOAuthTokens;
+exports.clearOAuthTokens = clearOAuthTokens;
+exports.getEffectiveAuthToken = getEffectiveAuthToken;
+var types_1 = require("./types");
+Object.defineProperty(exports, "DEFAULT_CLIENT_METADATA", { enumerable: true, get: function () { return types_1.DEFAULT_CLIENT_METADATA; } });
+Object.defineProperty(exports, "OAuthError", { enumerable: true, get: function () { return types_1.OAuthError; } });
+Object.defineProperty(exports, "OAuthCancelledError", { enumerable: true, get: function () { return types_1.OAuthCancelledError; } });
+Object.defineProperty(exports, "OAuthTimeoutError", { enumerable: true, get: function () { return types_1.OAuthTimeoutError; } });
+Object.defineProperty(exports, "toMCPTokens", { enumerable: true, get: function () { return types_1.toMCPTokens; } });
+Object.defineProperty(exports, "fromMCPTokens", { enumerable: true, get: function () { return types_1.fromMCPTokens; } });
+Object.defineProperty(exports, "toMCPClientInfo", { enumerable: true, get: function () { return types_1.toMCPClientInfo; } });
+Object.defineProperty(exports, "fromMCPClientInfo", { enumerable: true, get: function () { return types_1.fromMCPClientInfo; } });
+// Flow handlers
+var CLIFlowHandler_1 = require("./CLIFlowHandler");
+Object.defineProperty(exports, "CLIFlowHandler", { enumerable: true, get: function () { return CLIFlowHandler_1.CLIFlowHandler; } });
+// Main provider
+var MCPOAuthProvider_1 = require("./MCPOAuthProvider");
+Object.defineProperty(exports, "MCPOAuthProvider", { enumerable: true, get: function () { return MCPOAuthProvider_1.MCPOAuthProvider; } });
+// ========================================
+// Convenience factory functions
+// ========================================
+const MCPOAuthProvider_2 = require("./MCPOAuthProvider");
+const CLIFlowHandler_2 = require("./CLIFlowHandler");
+const types_2 = require("./types");
+/**
+ * Create an OAuth provider for CLI usage
+ *
+ * @param agent Agent configuration (tokens stored here)
+ * @param options Optional configuration
+ * @returns Configured OAuth provider
+ *
+ * @example
+ * ```typescript
+ * const agent: AgentConfig = {
+ *   id: 'my-agent',
+ *   name: 'My Agent',
+ *   agent_uri: 'https://agent.example.com/mcp',
+ *   protocol: 'mcp'
+ * };
+ *
+ * const provider = createCLIOAuthProvider(agent);
+ *
+ * const transport = new StreamableHTTPClientTransport(url, {
+ *   authProvider: provider
+ * });
+ *
+ * try {
+ *   await client.connect(transport);
+ * } catch (error) {
+ *   if (error instanceof UnauthorizedError) {
+ *     const code = await provider.waitForCallback();
+ *     await transport.finishAuth(code);
+ *     await client.connect(transport);
+ *   }
+ * }
+ *
+ * // After successful auth, agent.oauth_tokens is populated
+ * console.log(agent.oauth_tokens);
+ * ```
+ */
+function createCLIOAuthProvider(agent, options) {
+    const flowConfig = {
+        callbackPort: options?.callbackPort,
+        timeout: options?.timeout,
+        quiet: options?.quiet,
+    };
+    const flowHandler = new CLIFlowHandler_2.CLIFlowHandler(flowConfig);
+    // Build complete client metadata
+    const clientMetadata = {
+        ...types_2.DEFAULT_CLIENT_METADATA,
+        redirect_uris: [flowHandler.getRedirectUrl().toString()],
+        ...options?.clientMetadata,
+    };
+    return new MCPOAuthProvider_2.MCPOAuthProvider({
+        agent,
+        flowHandler,
+        storage: options?.storage,
+        clientMetadata,
+    });
+}
+/**
+ * Check if an error indicates OAuth is required
+ */
+function isOAuthRequired(error) {
+    if (error instanceof Error) {
+        if (error.name === 'UnauthorizedError')
+            return true;
+        const msg = error.message.toLowerCase();
+        if (msg.includes('unauthorized') || msg.includes('authentication required') || msg.includes('oauth')) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if an agent has valid OAuth tokens
+ */
+function hasValidOAuthTokens(agent) {
+    const tokens = agent.oauth_tokens;
+    if (!tokens?.access_token)
+        return false;
+    if (tokens.expires_at) {
+        const expiresAt = new Date(tokens.expires_at);
+        // Expired if within 5 minutes of expiration
+        if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Clear OAuth tokens from an agent config
+ */
+function clearOAuthTokens(agent) {
+    delete agent.oauth_tokens;
+    delete agent.oauth_client;
+    delete agent.oauth_code_verifier;
+}
+/**
+ * Get the effective auth token for an agent
+ * Returns OAuth access_token if available, otherwise static auth_token
+ */
+function getEffectiveAuthToken(agent) {
+    // Prefer OAuth if available and valid
+    if (hasValidOAuthTokens(agent)) {
+        return agent.oauth_tokens.access_token;
+    }
+    // Fall back to static token
+    return agent.auth_token;
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/auth/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AA8EH,wDAmCC;AAKD,0CASC;AAKD,kDAaC;AAKD,4CAIC;AAMD,sDAOC;AAvJD,iCASiB;AARf,gHAAA,uBAAuB,OAAA;AACvB,mGAAA,UAAU,OAAA;AACV,4GAAA,mBAAmB,OAAA;AACnB,0GAAA,iBAAiB,OAAA;AACjB,oGAAA,WAAW,OAAA;AACX,sGAAA,aAAa,OAAA;AACb,wGAAA,eAAe,OAAA;AACf,0GAAA,iBAAiB,OAAA;AAGnB,gBAAgB;AAChB,mDAA6E;AAApE,gHAAA,cAAc,OAAA;AAEvB,gBAAgB;AAChB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AAEzB,2CAA2C;AAC3C,gCAAgC;AAChC,2CAA2C;AAE3C,yDAAsD;AACtD,qDAA6E;AAE7E,mCAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAgB,sBAAsB,CACpC,KAAkB,EAClB,OAWC;IAED,MAAM,UAAU,GAAyB;QACvC,YAAY,EAAE,OAAO,EAAE,YAAY;QACnC,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,+BAAc,CAAC,UAAU,CAAC,CAAC;IAEnD,iCAAiC;IACjC,MAAM,cAAc,GAAwB;QAC1C,GAAG,+BAAuB;QAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,GAAG,OAAO,EAAE,cAAc;KAC3B,CAAC;IAEF,OAAO,IAAI,mCAAgB,CAAC;QAC1B,KAAK;QACL,WAAW;QACX,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAkB;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,4CAA4C;QAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAkB;IACjD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC,mBAAmB,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,KAAkB;IACtD,sCAAsC;IACtC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,YAAa,CAAC,YAAY,CAAC;IAC1C,CAAC;IACD,4BAA4B;IAC5B,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC"}

package/dist/lib/auth/oauth/types.d.ts

@@ -0,0 +1,114 @@
+/**
+ * OAuth types for MCP authentication
+ *
+ * These types support the pluggable OAuth architecture:
+ * - OAuthConfigStorage: Interface for reading/writing agent config with OAuth data
+ * - OAuthFlowHandler: Abstract interface for authorization flow (CLI vs web)
+ */
+import type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { AgentConfig, AgentOAuthTokens, AgentOAuthClient } from '../../types/adcp';
+export type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens };
+export type { AgentConfig, AgentOAuthTokens, AgentOAuthClient };
+/**
+ * Agent config storage interface
+ *
+ * Implement this to persist OAuth tokens back to agent configuration.
+ * This allows different storage backends (file, database, memory)
+ * while keeping tokens in the agent config structure.
+ */
+export interface OAuthConfigStorage {
+    /**
+     * Load agent configuration
+     * @param agentId The agent ID
+     * @returns Agent config or undefined if not found
+     */
+    loadAgent(agentId: string): Promise<AgentConfig | undefined>;
+    /**
+     * Save agent configuration (with updated OAuth data)
+     * @param agent The agent config to save
+     */
+    saveAgent(agent: AgentConfig): Promise<void>;
+}
+/**
+ * Authorization flow handler - implement this for different environments
+ *
+ * Examples:
+ * - CLIFlowHandler: Opens browser, starts callback server
+ * - WebFlowHandler: HTTP redirects
+ * - HeadlessFlowHandler: Device code flow (future)
+ */
+export interface OAuthFlowHandler {
+    /**
+     * Get the callback URL for OAuth redirects
+     */
+    getRedirectUrl(): string | URL;
+    /**
+     * Redirect the user to the authorization URL
+     * For CLI: Opens browser
+     * For web: HTTP redirect or return URL for client-side redirect
+     *
+     * @param authorizationUrl The OAuth authorization URL
+     * @returns Promise that resolves when user is redirected
+     */
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    /**
+     * Wait for the authorization callback and extract the auth code
+     * For CLI: Starts a local HTTP server and waits
+     * For web: Called by the callback route handler
+     *
+     * @returns Promise resolving to the authorization code
+     */
+    waitForCallback(): Promise<string>;
+    /**
+     * Clean up any resources (e.g., callback server)
+     */
+    cleanup(): Promise<void>;
+}
+/**
+ * Configuration for creating an OAuth provider
+ */
+export interface OAuthProviderConfig {
+    /** Agent configuration (tokens will be stored here) */
+    agent: AgentConfig;
+    /** Storage for persisting agent config changes */
+    storage?: OAuthConfigStorage;
+    /** Authorization flow handler */
+    flowHandler: OAuthFlowHandler;
+    /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */
+    clientMetadata: OAuthClientMetadata;
+}
+/**
+ * Default OAuth client metadata for ADCP clients
+ */
+export declare const DEFAULT_CLIENT_METADATA: OAuthClientMetadata;
+/**
+ * OAuth error types
+ */
+export declare class OAuthError extends Error {
+    readonly code: string;
+    readonly agentId?: string | undefined;
+    constructor(message: string, code: string, agentId?: string | undefined);
+}
+export declare class OAuthCancelledError extends OAuthError {
+    constructor(agentId?: string);
+}
+export declare class OAuthTimeoutError extends OAuthError {
+    constructor(agentId?: string, timeoutMs?: number);
+}
+/**
+ * Convert AgentOAuthTokens to MCP SDK OAuthTokens format
+ */
+export declare function toMCPTokens(tokens: AgentOAuthTokens): OAuthTokens;
+/**
+ * Convert MCP SDK OAuthTokens to AgentOAuthTokens format
+ */
+export declare function fromMCPTokens(tokens: OAuthTokens): AgentOAuthTokens;
+/**
+ * Convert AgentOAuthClient to MCP SDK OAuthClientInformation format
+ */
+export declare function toMCPClientInfo(client: AgentOAuthClient): OAuthClientInformation;
+/**
+ * Convert MCP SDK OAuthClientInformationFull to AgentOAuthClient format
+ */
+export declare function fromMCPClientInfo(info: OAuthClientInformationFull): AgentOAuthClient;
+//# sourceMappingURL=types.d.ts.map

package/dist/lib/auth/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGxF,YAAY,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;AAGrG,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAE7D;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,GAAG,CAAC;IAE/B;;;;;;;OAOG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;;;OAMG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,WAAW,CAAC;IAEnB,kDAAkD;IAClD,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B,iCAAiC;IACjC,WAAW,EAAE,gBAAgB,CAAC;IAE9B,6EAA6E;IAC7E,cAAc,EAAE,mBAAmB,CAAC;CACrC;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAMrC,CAAC;AAEF;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAGjB,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,MAAM;gBAFhC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,YAAA;CAKnC;AAED,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,CAAC,EAAE,MAAM;CAI7B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAQjE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAkBnE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CAMhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,0BAA0B,GAAG,gBAAgB,CAMpF"}