@adcp/sdk 12.0.0 → 12.0.1

package/dist/lib/agents/index.generated.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/agents/index.generated.ts"],"sourcesContent":["// Generated Agent Classes\n// Auto-generated from AdCP tool definitions\n\nimport type { AgentConfig } from '../types';\nimport { ProtocolClient } from '../protocols';\nimport { validateAgentUrl } from '../validation';\nimport { getCircuitBreaker, unwrapProtocolResponse } from '../utils';\nimport type { MutatingRequestInput } from '../utils/idempotency';\nimport type {\n  GetProductsRequest,\n  GetProductsResponse,\n  ListCreativeFormatsRequest,\n  ListCreativeFormatsResponse,\n  CreateMediaBuyRequest,\n  CreateMediaBuyResponse,\n  UpdateMediaBuyRequest,\n  UpdateMediaBuyResponse,\n  GetMediaBuysRequest,\n  GetMediaBuysResponse,\n  GetMediaBuyDeliveryRequest,\n  GetMediaBuyDeliveryResponse,\n  ProvidePerformanceFeedbackRequest,\n  ProvidePerformanceFeedbackResponse,\n  SyncEventSourcesRequest,\n  SyncEventSourcesResponse,\n  LogEventRequest,\n  LogEventResponse,\n  SyncAudiencesRequest,\n  SyncAudiencesResponse,\n  SyncCatalogsRequest,\n  SyncCatalogsResponse,\n  BuildCreativeRequest,\n  BuildCreativeResponse,\n  PreviewCreativeRequest,\n  PreviewCreativeResponse,\n  ListTransformersRequest,\n  ListTransformersResponse,\n  GetCreativeDeliveryRequest,\n  GetCreativeDeliveryResponse,\n  ListCreativesRequest,\n  ListCreativesResponse,\n  SyncCreativesRequest,\n  SyncCreativesResponse,\n  ValidateInputRequest,\n  ValidateInputResponse,\n  GetSignalsRequest,\n  GetSignalsResponse,\n  ActivateSignalRequest,\n  ActivateSignalResponse,\n  CreatePropertyListRequest,\n  CreatePropertyListResponse,\n  UpdatePropertyListRequest,\n  UpdatePropertyListResponse,\n  GetPropertyListRequest,\n  GetPropertyListResponse,\n  ListPropertyListsRequest,\n  ListPropertyListsResponse,\n  DeletePropertyListRequest,\n  DeletePropertyListResponse,\n  CreateCollectionListRequest,\n  CreateCollectionListResponse,\n  UpdateCollectionListRequest,\n  UpdateCollectionListResponse,\n  GetCollectionListRequest,\n  GetCollectionListResponse,\n  ListCollectionListsRequest,\n  ListCollectionListsResponse,\n  DeleteCollectionListRequest,\n  DeleteCollectionListResponse,\n  ListContentStandardsRequest,\n  ListContentStandardsResponse,\n  GetContentStandardsRequest,\n  GetContentStandardsResponse,\n  CreateContentStandardsRequest,\n  CreateContentStandardsResponse,\n  UpdateContentStandardsRequest,\n  UpdateContentStandardsResponse,\n  CalibrateContentRequest,\n  CalibrateContentResponse,\n  ValidateContentDeliveryRequest,\n  ValidateContentDeliveryResponse,\n  GetMediaBuyArtifactsRequest,\n  GetMediaBuyArtifactsResponse,\n  GetCreativeFeaturesRequest,\n  GetCreativeFeaturesResponse,\n  SyncPlansRequest,\n  SyncPlansResponse,\n  ReportPlanOutcomeRequest,\n  ReportPlanOutcomeResponse,\n  GetPlanAuditLogsRequest,\n  GetPlanAuditLogsResponse,\n  CheckGovernanceRequest,\n  CheckGovernanceResponse,\n  SIGetOfferingRequest,\n  SIGetOfferingResponse,\n  SIInitiateSessionRequest,\n  SIInitiateSessionResponse,\n  SISendMessageRequest,\n  SISendMessageResponse,\n  SITerminateSessionRequest,\n  SITerminateSessionResponse,\n  GetAdCPCapabilitiesRequest,\n  GetAdCPCapabilitiesResponse,\n  GetTaskStatusRequest,\n  GetTaskStatusResponse,\n  ListTasksRequest,\n  ListTasksResponse,\n  ListAccountsRequest,\n  ListAccountsResponse,\n  SyncAccountsRequest,\n  SyncAccountsResponse,\n  SyncGovernanceRequest,\n  SyncGovernanceResponse,\n  ReportUsageRequest,\n  ReportUsageResponse,\n  GetAccountFinancialsRequest,\n  GetAccountFinancialsResponse,\n  ComplyTestControllerRequest,\n  ComplyTestControllerResponse\n} from '../types/tools.generated';\n\n/**\n * Single agent operations with full type safety\n *\n * Returns raw AdCP responses matching schema exactly.\n * No SDK wrapping - responses follow AdCP discriminated union patterns.\n *\n * @deprecated Use `SingleAgentClient` / `AgentClient` / `ADCPMultiAgentClient`\n * from `@adcp/sdk` instead. The `Agent` class predates Stage 3's per-instance\n * `adcpVersion` plumbing — it always emits the SDK-pinned `ADCP_MAJOR_VERSION`\n * on the wire regardless of caller pin, which silently drifts from a buyer\n * who pins a non-default version. The conversation-aware clients honor the\n * per-instance pin end-to-end (validators, wire field, capability check).\n */\nlet _agentDeprecationWarned = false;\n\nexport class Agent {\n  constructor(\n    private config: AgentConfig,\n    private client: any // Will be AdCPClient\n  ) {\n    if (!_agentDeprecationWarned) {\n      // Flag is set only after a successful emitWarning so a runtime that\n      // throws on the first call (monkey-patched test harness, polyfilled\n      // worker) still surfaces the deprecation on a later construction.\n      try {\n        process.emitWarning(\n          'Agent class is deprecated. Use SingleAgentClient / AgentClient / ADCPMultiAgentClient from @adcp/sdk; ' +\n            'Agent does not honor per-instance adcpVersion pins (always emits the SDK default major).',\n          'DeprecationWarning'\n        );\n        _agentDeprecationWarned = true;\n      } catch {\n        // emitWarning is best-effort observability; never fatal.\n      }\n    }\n  }\n\n  private async callTool<T>(toolName: string, params: any): Promise<T> {\n    const debugLogs: any[] = [];\n\n    try {\n      validateAgentUrl(this.config.agent_uri);\n\n      const circuitBreaker = getCircuitBreaker(this.config.id);\n      const protocolResponse = await circuitBreaker.call(async () => {\n        return await ProtocolClient.callTool(this.config, toolName, params, { debugLogs });\n      });\n\n      // Unwrap and validate protocol response using tool-specific Zod schema\n      const adcpResponse = unwrapProtocolResponse(protocolResponse, toolName, this.config.protocol);\n\n      return adcpResponse as T;\n    } catch (error) {\n      // Convert exceptions to AdCP error format\n      const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n      return {\n        errors: [{\n          code: 'client_error',\n          message: errorMessage\n        }]\n      } as T;\n    }\n  }\n\n  /**\n   * Official AdCP get_products tool schema\n   */\n  async getProducts(params: GetProductsRequest): Promise<GetProductsResponse> {\n    return this.callTool<GetProductsResponse>('get_products', params);\n  }\n\n  /**\n   * Official AdCP list_creative_formats tool schema\n   */\n  async listCreativeFormats(params: ListCreativeFormatsRequest): Promise<ListCreativeFormatsResponse> {\n    return this.callTool<ListCreativeFormatsResponse>('list_creative_formats', params);\n  }\n\n  /**\n   * Official AdCP create_media_buy tool schema\n   */\n  async createMediaBuy(params: MutatingRequestInput<CreateMediaBuyRequest>): Promise<CreateMediaBuyResponse> {\n    return this.callTool<CreateMediaBuyResponse>('create_media_buy', params);\n  }\n\n  /**\n   * Official AdCP update_media_buy tool schema\n   */\n  async updateMediaBuy(params: MutatingRequestInput<UpdateMediaBuyRequest>): Promise<UpdateMediaBuyResponse> {\n    return this.callTool<UpdateMediaBuyResponse>('update_media_buy', params);\n  }\n\n  /**\n   * Official AdCP get_media_buys tool schema\n   */\n  async getMediaBuys(params: GetMediaBuysRequest): Promise<GetMediaBuysResponse> {\n    return this.callTool<GetMediaBuysResponse>('get_media_buys', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_delivery tool schema\n   */\n  async getMediaBuyDelivery(params: GetMediaBuyDeliveryRequest): Promise<GetMediaBuyDeliveryResponse> {\n    return this.callTool<GetMediaBuyDeliveryResponse>('get_media_buy_delivery', params);\n  }\n\n  /**\n   * Official AdCP provide_performance_feedback tool schema\n   */\n  async providePerformanceFeedback(params: MutatingRequestInput<ProvidePerformanceFeedbackRequest>): Promise<ProvidePerformanceFeedbackResponse> {\n    return this.callTool<ProvidePerformanceFeedbackResponse>('provide_performance_feedback', params);\n  }\n\n  /**\n   * Official AdCP sync_event_sources tool schema\n   */\n  async syncEventSources(params: MutatingRequestInput<SyncEventSourcesRequest>): Promise<SyncEventSourcesResponse> {\n    return this.callTool<SyncEventSourcesResponse>('sync_event_sources', params);\n  }\n\n  /**\n   * Official AdCP log_event tool schema\n   */\n  async logEvent(params: MutatingRequestInput<LogEventRequest>): Promise<LogEventResponse> {\n    return this.callTool<LogEventResponse>('log_event', params);\n  }\n\n  /**\n   * Official AdCP sync_audiences tool schema\n   */\n  async syncAudiences(params: MutatingRequestInput<SyncAudiencesRequest>): Promise<SyncAudiencesResponse> {\n    return this.callTool<SyncAudiencesResponse>('sync_audiences', params);\n  }\n\n  /**\n   * Official AdCP sync_catalogs tool schema\n   */\n  async syncCatalogs(params: MutatingRequestInput<SyncCatalogsRequest>): Promise<SyncCatalogsResponse> {\n    return this.callTool<SyncCatalogsResponse>('sync_catalogs', params);\n  }\n\n  /**\n   * Official AdCP build_creative tool schema\n   */\n  async buildCreative(params: MutatingRequestInput<BuildCreativeRequest>): Promise<BuildCreativeResponse> {\n    return this.callTool<BuildCreativeResponse>('build_creative', params);\n  }\n\n  /**\n   * Official AdCP preview_creative tool schema\n   */\n  async previewCreative(params: PreviewCreativeRequest): Promise<PreviewCreativeResponse> {\n    return this.callTool<PreviewCreativeResponse>('preview_creative', params);\n  }\n\n  /**\n   * Official AdCP list_transformers tool schema\n   */\n  async listTransformers(params: ListTransformersRequest): Promise<ListTransformersResponse> {\n    return this.callTool<ListTransformersResponse>('list_transformers', params);\n  }\n\n  /**\n   * Official AdCP get_creative_delivery tool schema\n   */\n  async getCreativeDelivery(params: GetCreativeDeliveryRequest): Promise<GetCreativeDeliveryResponse> {\n    return this.callTool<GetCreativeDeliveryResponse>('get_creative_delivery', params);\n  }\n\n  /**\n   * Official AdCP list_creatives tool schema\n   */\n  async listCreatives(params: ListCreativesRequest): Promise<ListCreativesResponse> {\n    return this.callTool<ListCreativesResponse>('list_creatives', params);\n  }\n\n  /**\n   * Official AdCP sync_creatives tool schema\n   */\n  async syncCreatives(params: MutatingRequestInput<SyncCreativesRequest>): Promise<SyncCreativesResponse> {\n    return this.callTool<SyncCreativesResponse>('sync_creatives', params);\n  }\n\n  /**\n   * Official AdCP validate_input tool schema\n   */\n  async validateInput(params: ValidateInputRequest): Promise<ValidateInputResponse> {\n    return this.callTool<ValidateInputResponse>('validate_input', params);\n  }\n\n  /**\n   * Official AdCP get_signals tool schema\n   */\n  async getSignals(params: GetSignalsRequest): Promise<GetSignalsResponse> {\n    return this.callTool<GetSignalsResponse>('get_signals', params);\n  }\n\n  /**\n   * Official AdCP activate_signal tool schema\n   */\n  async activateSignal(params: MutatingRequestInput<ActivateSignalRequest>): Promise<ActivateSignalResponse> {\n    return this.callTool<ActivateSignalResponse>('activate_signal', params);\n  }\n\n  /**\n   * Official AdCP create_property_list tool schema\n   */\n  async createPropertyList(params: MutatingRequestInput<CreatePropertyListRequest>): Promise<CreatePropertyListResponse> {\n    return this.callTool<CreatePropertyListResponse>('create_property_list', params);\n  }\n\n  /**\n   * Official AdCP update_property_list tool schema\n   */\n  async updatePropertyList(params: MutatingRequestInput<UpdatePropertyListRequest>): Promise<UpdatePropertyListResponse> {\n    return this.callTool<UpdatePropertyListResponse>('update_property_list', params);\n  }\n\n  /**\n   * Official AdCP get_property_list tool schema\n   */\n  async getPropertyList(params: GetPropertyListRequest): Promise<GetPropertyListResponse> {\n    return this.callTool<GetPropertyListResponse>('get_property_list', params);\n  }\n\n  /**\n   * Official AdCP list_property_lists tool schema\n   */\n  async listPropertyLists(params: ListPropertyListsRequest): Promise<ListPropertyListsResponse> {\n    return this.callTool<ListPropertyListsResponse>('list_property_lists', params);\n  }\n\n  /**\n   * Official AdCP delete_property_list tool schema\n   */\n  async deletePropertyList(params: MutatingRequestInput<DeletePropertyListRequest>): Promise<DeletePropertyListResponse> {\n    return this.callTool<DeletePropertyListResponse>('delete_property_list', params);\n  }\n\n  /**\n   * Official AdCP create_collection_list tool schema\n   */\n  async createCollectionList(params: MutatingRequestInput<CreateCollectionListRequest>): Promise<CreateCollectionListResponse> {\n    return this.callTool<CreateCollectionListResponse>('create_collection_list', params);\n  }\n\n  /**\n   * Official AdCP update_collection_list tool schema\n   */\n  async updateCollectionList(params: MutatingRequestInput<UpdateCollectionListRequest>): Promise<UpdateCollectionListResponse> {\n    return this.callTool<UpdateCollectionListResponse>('update_collection_list', params);\n  }\n\n  /**\n   * Official AdCP get_collection_list tool schema\n   */\n  async getCollectionList(params: GetCollectionListRequest): Promise<GetCollectionListResponse> {\n    return this.callTool<GetCollectionListResponse>('get_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_collection_lists tool schema\n   */\n  async listCollectionLists(params: ListCollectionListsRequest): Promise<ListCollectionListsResponse> {\n    return this.callTool<ListCollectionListsResponse>('list_collection_lists', params);\n  }\n\n  /**\n   * Official AdCP delete_collection_list tool schema\n   */\n  async deleteCollectionList(params: MutatingRequestInput<DeleteCollectionListRequest>): Promise<DeleteCollectionListResponse> {\n    return this.callTool<DeleteCollectionListResponse>('delete_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_content_standards tool schema\n   */\n  async listContentStandards(params: ListContentStandardsRequest): Promise<ListContentStandardsResponse> {\n    return this.callTool<ListContentStandardsResponse>('list_content_standards', params);\n  }\n\n  /**\n   * Official AdCP get_content_standards tool schema\n   */\n  async getContentStandards(params: GetContentStandardsRequest): Promise<GetContentStandardsResponse> {\n    return this.callTool<GetContentStandardsResponse>('get_content_standards', params);\n  }\n\n  /**\n   * Official AdCP create_content_standards tool schema\n   */\n  async createContentStandards(params: MutatingRequestInput<CreateContentStandardsRequest>): Promise<CreateContentStandardsResponse> {\n    return this.callTool<CreateContentStandardsResponse>('create_content_standards', params);\n  }\n\n  /**\n   * Official AdCP update_content_standards tool schema\n   */\n  async updateContentStandards(params: MutatingRequestInput<UpdateContentStandardsRequest>): Promise<UpdateContentStandardsResponse> {\n    return this.callTool<UpdateContentStandardsResponse>('update_content_standards', params);\n  }\n\n  /**\n   * Official AdCP calibrate_content tool schema\n   */\n  async calibrateContent(params: MutatingRequestInput<CalibrateContentRequest>): Promise<CalibrateContentResponse> {\n    return this.callTool<CalibrateContentResponse>('calibrate_content', params);\n  }\n\n  /**\n   * Official AdCP validate_content_delivery tool schema\n   */\n  async validateContentDelivery(params: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse> {\n    return this.callTool<ValidateContentDeliveryResponse>('validate_content_delivery', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_artifacts tool schema\n   */\n  async getMediaBuyArtifacts(params: GetMediaBuyArtifactsRequest): Promise<GetMediaBuyArtifactsResponse> {\n    return this.callTool<GetMediaBuyArtifactsResponse>('get_media_buy_artifacts', params);\n  }\n\n  /**\n   * Official AdCP get_creative_features tool schema\n   */\n  async getCreativeFeatures(params: GetCreativeFeaturesRequest): Promise<GetCreativeFeaturesResponse> {\n    return this.callTool<GetCreativeFeaturesResponse>('get_creative_features', params);\n  }\n\n  /**\n   * Official AdCP sync_plans tool schema\n   */\n  async syncPlans(params: MutatingRequestInput<SyncPlansRequest>): Promise<SyncPlansResponse> {\n    return this.callTool<SyncPlansResponse>('sync_plans', params);\n  }\n\n  /**\n   * Official AdCP report_plan_outcome tool schema\n   */\n  async reportPlanOutcome(params: MutatingRequestInput<ReportPlanOutcomeRequest>): Promise<ReportPlanOutcomeResponse> {\n    return this.callTool<ReportPlanOutcomeResponse>('report_plan_outcome', params);\n  }\n\n  /**\n   * Official AdCP get_plan_audit_logs tool schema\n   */\n  async getPlanAuditLogs(params: GetPlanAuditLogsRequest): Promise<GetPlanAuditLogsResponse> {\n    return this.callTool<GetPlanAuditLogsResponse>('get_plan_audit_logs', params);\n  }\n\n  /**\n   * Official AdCP check_governance tool schema\n   */\n  async checkGovernance(params: CheckGovernanceRequest): Promise<CheckGovernanceResponse> {\n    return this.callTool<CheckGovernanceResponse>('check_governance', params);\n  }\n\n  /**\n   * Official AdCP si_get_offering tool schema\n   */\n  async siGetOffering(params: SIGetOfferingRequest): Promise<SIGetOfferingResponse> {\n    return this.callTool<SIGetOfferingResponse>('si_get_offering', params);\n  }\n\n  /**\n   * Official AdCP si_initiate_session tool schema\n   */\n  async siInitiateSession(params: MutatingRequestInput<SIInitiateSessionRequest>): Promise<SIInitiateSessionResponse> {\n    return this.callTool<SIInitiateSessionResponse>('si_initiate_session', params);\n  }\n\n  /**\n   * Official AdCP si_send_message tool schema\n   */\n  async siSendMessage(params: MutatingRequestInput<SISendMessageRequest>): Promise<SISendMessageResponse> {\n    return this.callTool<SISendMessageResponse>('si_send_message', params);\n  }\n\n  /**\n   * Official AdCP si_terminate_session tool schema\n   */\n  async siTerminateSession(params: SITerminateSessionRequest): Promise<SITerminateSessionResponse> {\n    return this.callTool<SITerminateSessionResponse>('si_terminate_session', params);\n  }\n\n  /**\n   * Official AdCP get_adcp_capabilities tool schema\n   */\n  async getAdcpCapabilities(params: GetAdCPCapabilitiesRequest): Promise<GetAdCPCapabilitiesResponse> {\n    return this.callTool<GetAdCPCapabilitiesResponse>('get_adcp_capabilities', params);\n  }\n\n  /**\n   * Official AdCP get_task_status tool schema\n   */\n  async getTaskStatus(params: GetTaskStatusRequest): Promise<GetTaskStatusResponse> {\n    return this.callTool<GetTaskStatusResponse>('get_task_status', params);\n  }\n\n  /**\n   * Official AdCP list_tasks tool schema\n   */\n  async listTasks(params: ListTasksRequest): Promise<ListTasksResponse> {\n    return this.callTool<ListTasksResponse>('list_tasks', params);\n  }\n\n  /**\n   * Official AdCP list_accounts tool schema\n   */\n  async listAccounts(params: ListAccountsRequest): Promise<ListAccountsResponse> {\n    return this.callTool<ListAccountsResponse>('list_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_accounts tool schema\n   */\n  async syncAccounts(params: MutatingRequestInput<SyncAccountsRequest>): Promise<SyncAccountsResponse> {\n    return this.callTool<SyncAccountsResponse>('sync_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_governance tool schema\n   */\n  async syncGovernance(params: MutatingRequestInput<SyncGovernanceRequest>): Promise<SyncGovernanceResponse> {\n    return this.callTool<SyncGovernanceResponse>('sync_governance', params);\n  }\n\n  /**\n   * Official AdCP report_usage tool schema\n   */\n  async reportUsage(params: MutatingRequestInput<ReportUsageRequest>): Promise<ReportUsageResponse> {\n    return this.callTool<ReportUsageResponse>('report_usage', params);\n  }\n\n  /**\n   * Official AdCP get_account_financials tool schema\n   */\n  async getAccountFinancials(params: GetAccountFinancialsRequest): Promise<GetAccountFinancialsResponse> {\n    return this.callTool<GetAccountFinancialsResponse>('get_account_financials', params);\n  }\n\n  /**\n   * Official AdCP comply_test_controller tool schema\n   */\n  async complyTestController(params: ComplyTestControllerRequest): Promise<ComplyTestControllerResponse> {\n    return this.callTool<ComplyTestControllerResponse>('comply_test_controller', params);\n  }\n\n}\n\n/**\n * Multi-agent operations with full type safety\n */\nexport class AgentCollection {\n  constructor(\n    private configs: AgentConfig[],\n    private client: any // Will be AdCPClient\n  ) {}\n\n  private async callToolOnAll<T>(toolName: string, params: any): Promise<T[]> {\n    const agents = this.configs.map(config => new Agent(config, this.client));\n    const promises = agents.map(agent => (agent as any).callTool(toolName, params));\n    return Promise.all(promises);\n  }\n\n  /**\n   * Official AdCP get_products tool schema (across multiple agents)\n   */\n  async getProducts(params: GetProductsRequest): Promise<GetProductsResponse[]> {\n    return this.callToolOnAll<GetProductsResponse>('get_products', params);\n  }\n\n  /**\n   * Official AdCP list_creative_formats tool schema (across multiple agents)\n   */\n  async listCreativeFormats(params: ListCreativeFormatsRequest): Promise<ListCreativeFormatsResponse[]> {\n    return this.callToolOnAll<ListCreativeFormatsResponse>('list_creative_formats', params);\n  }\n\n  /**\n   * Official AdCP get_media_buys tool schema (across multiple agents)\n   */\n  async getMediaBuys(params: GetMediaBuysRequest): Promise<GetMediaBuysResponse[]> {\n    return this.callToolOnAll<GetMediaBuysResponse>('get_media_buys', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_delivery tool schema (across multiple agents)\n   */\n  async getMediaBuyDelivery(params: GetMediaBuyDeliveryRequest): Promise<GetMediaBuyDeliveryResponse[]> {\n    return this.callToolOnAll<GetMediaBuyDeliveryResponse>('get_media_buy_delivery', params);\n  }\n\n  /**\n   * Official AdCP provide_performance_feedback tool schema (across multiple agents)\n   */\n  async providePerformanceFeedback(params: MutatingRequestInput<ProvidePerformanceFeedbackRequest>): Promise<ProvidePerformanceFeedbackResponse[]> {\n    return this.callToolOnAll<ProvidePerformanceFeedbackResponse>('provide_performance_feedback', params);\n  }\n\n  /**\n   * Official AdCP sync_event_sources tool schema (across multiple agents)\n   */\n  async syncEventSources(params: MutatingRequestInput<SyncEventSourcesRequest>): Promise<SyncEventSourcesResponse[]> {\n    return this.callToolOnAll<SyncEventSourcesResponse>('sync_event_sources', params);\n  }\n\n  /**\n   * Official AdCP log_event tool schema (across multiple agents)\n   */\n  async logEvent(params: MutatingRequestInput<LogEventRequest>): Promise<LogEventResponse[]> {\n    return this.callToolOnAll<LogEventResponse>('log_event', params);\n  }\n\n  /**\n   * Official AdCP sync_audiences tool schema (across multiple agents)\n   */\n  async syncAudiences(params: MutatingRequestInput<SyncAudiencesRequest>): Promise<SyncAudiencesResponse[]> {\n    return this.callToolOnAll<SyncAudiencesResponse>('sync_audiences', params);\n  }\n\n  /**\n   * Official AdCP sync_catalogs tool schema (across multiple agents)\n   */\n  async syncCatalogs(params: MutatingRequestInput<SyncCatalogsRequest>): Promise<SyncCatalogsResponse[]> {\n    return this.callToolOnAll<SyncCatalogsResponse>('sync_catalogs', params);\n  }\n\n  /**\n   * Official AdCP build_creative tool schema (across multiple agents)\n   */\n  async buildCreative(params: MutatingRequestInput<BuildCreativeRequest>): Promise<BuildCreativeResponse[]> {\n    return this.callToolOnAll<BuildCreativeResponse>('build_creative', params);\n  }\n\n  /**\n   * Official AdCP preview_creative tool schema (across multiple agents)\n   */\n  async previewCreative(params: PreviewCreativeRequest): Promise<PreviewCreativeResponse[]> {\n    return this.callToolOnAll<PreviewCreativeResponse>('preview_creative', params);\n  }\n\n  /**\n   * Official AdCP list_transformers tool schema (across multiple agents)\n   */\n  async listTransformers(params: ListTransformersRequest): Promise<ListTransformersResponse[]> {\n    return this.callToolOnAll<ListTransformersResponse>('list_transformers', params);\n  }\n\n  /**\n   * Official AdCP get_creative_delivery tool schema (across multiple agents)\n   */\n  async getCreativeDelivery(params: GetCreativeDeliveryRequest): Promise<GetCreativeDeliveryResponse[]> {\n    return this.callToolOnAll<GetCreativeDeliveryResponse>('get_creative_delivery', params);\n  }\n\n  /**\n   * Official AdCP list_creatives tool schema (across multiple agents)\n   */\n  async listCreatives(params: ListCreativesRequest): Promise<ListCreativesResponse[]> {\n    return this.callToolOnAll<ListCreativesResponse>('list_creatives', params);\n  }\n\n  /**\n   * Official AdCP sync_creatives tool schema (across multiple agents)\n   */\n  async syncCreatives(params: MutatingRequestInput<SyncCreativesRequest>): Promise<SyncCreativesResponse[]> {\n    return this.callToolOnAll<SyncCreativesResponse>('sync_creatives', params);\n  }\n\n  /**\n   * Official AdCP validate_input tool schema (across multiple agents)\n   */\n  async validateInput(params: ValidateInputRequest): Promise<ValidateInputResponse[]> {\n    return this.callToolOnAll<ValidateInputResponse>('validate_input', params);\n  }\n\n  /**\n   * Official AdCP get_signals tool schema (across multiple agents)\n   */\n  async getSignals(params: GetSignalsRequest): Promise<GetSignalsResponse[]> {\n    return this.callToolOnAll<GetSignalsResponse>('get_signals', params);\n  }\n\n  /**\n   * Official AdCP activate_signal tool schema (across multiple agents)\n   */\n  async activateSignal(params: MutatingRequestInput<ActivateSignalRequest>): Promise<ActivateSignalResponse[]> {\n    return this.callToolOnAll<ActivateSignalResponse>('activate_signal', params);\n  }\n\n  /**\n   * Official AdCP get_property_list tool schema (across multiple agents)\n   */\n  async getPropertyList(params: GetPropertyListRequest): Promise<GetPropertyListResponse[]> {\n    return this.callToolOnAll<GetPropertyListResponse>('get_property_list', params);\n  }\n\n  /**\n   * Official AdCP list_property_lists tool schema (across multiple agents)\n   */\n  async listPropertyLists(params: ListPropertyListsRequest): Promise<ListPropertyListsResponse[]> {\n    return this.callToolOnAll<ListPropertyListsResponse>('list_property_lists', params);\n  }\n\n  /**\n   * Official AdCP create_collection_list tool schema (across multiple agents)\n   */\n  async createCollectionList(params: MutatingRequestInput<CreateCollectionListRequest>): Promise<CreateCollectionListResponse[]> {\n    return this.callToolOnAll<CreateCollectionListResponse>('create_collection_list', params);\n  }\n\n  /**\n   * Official AdCP update_collection_list tool schema (across multiple agents)\n   */\n  async updateCollectionList(params: MutatingRequestInput<UpdateCollectionListRequest>): Promise<UpdateCollectionListResponse[]> {\n    return this.callToolOnAll<UpdateCollectionListResponse>('update_collection_list', params);\n  }\n\n  /**\n   * Official AdCP get_collection_list tool schema (across multiple agents)\n   */\n  async getCollectionList(params: GetCollectionListRequest): Promise<GetCollectionListResponse[]> {\n    return this.callToolOnAll<GetCollectionListResponse>('get_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_collection_lists tool schema (across multiple agents)\n   */\n  async listCollectionLists(params: ListCollectionListsRequest): Promise<ListCollectionListsResponse[]> {\n    return this.callToolOnAll<ListCollectionListsResponse>('list_collection_lists', params);\n  }\n\n  /**\n   * Official AdCP delete_collection_list tool schema (across multiple agents)\n   */\n  async deleteCollectionList(params: MutatingRequestInput<DeleteCollectionListRequest>): Promise<DeleteCollectionListResponse[]> {\n    return this.callToolOnAll<DeleteCollectionListResponse>('delete_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_content_standards tool schema (across multiple agents)\n   */\n  async listContentStandards(params: ListContentStandardsRequest): Promise<ListContentStandardsResponse[]> {\n    return this.callToolOnAll<ListContentStandardsResponse>('list_content_standards', params);\n  }\n\n  /**\n   * Official AdCP get_content_standards tool schema (across multiple agents)\n   */\n  async getContentStandards(params: GetContentStandardsRequest): Promise<GetContentStandardsResponse[]> {\n    return this.callToolOnAll<GetContentStandardsResponse>('get_content_standards', params);\n  }\n\n  /**\n   * Official AdCP calibrate_content tool schema (across multiple agents)\n   */\n  async calibrateContent(params: MutatingRequestInput<CalibrateContentRequest>): Promise<CalibrateContentResponse[]> {\n    return this.callToolOnAll<CalibrateContentResponse>('calibrate_content', params);\n  }\n\n  /**\n   * Official AdCP validate_content_delivery tool schema (across multiple agents)\n   */\n  async validateContentDelivery(params: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse[]> {\n    return this.callToolOnAll<ValidateContentDeliveryResponse>('validate_content_delivery', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_artifacts tool schema (across multiple agents)\n   */\n  async getMediaBuyArtifacts(params: GetMediaBuyArtifactsRequest): Promise<GetMediaBuyArtifactsResponse[]> {\n    return this.callToolOnAll<GetMediaBuyArtifactsResponse>('get_media_buy_artifacts', params);\n  }\n\n  /**\n   * Official AdCP get_creative_features tool schema (across multiple agents)\n   */\n  async getCreativeFeatures(params: GetCreativeFeaturesRequest): Promise<GetCreativeFeaturesResponse[]> {\n    return this.callToolOnAll<GetCreativeFeaturesResponse>('get_creative_features', params);\n  }\n\n  /**\n   * Official AdCP sync_plans tool schema (across multiple agents)\n   */\n  async syncPlans(params: MutatingRequestInput<SyncPlansRequest>): Promise<SyncPlansResponse[]> {\n    return this.callToolOnAll<SyncPlansResponse>('sync_plans', params);\n  }\n\n  /**\n   * Official AdCP report_plan_outcome tool schema (across multiple agents)\n   */\n  async reportPlanOutcome(params: MutatingRequestInput<ReportPlanOutcomeRequest>): Promise<ReportPlanOutcomeResponse[]> {\n    return this.callToolOnAll<ReportPlanOutcomeResponse>('report_plan_outcome', params);\n  }\n\n  /**\n   * Official AdCP get_plan_audit_logs tool schema (across multiple agents)\n   */\n  async getPlanAuditLogs(params: GetPlanAuditLogsRequest): Promise<GetPlanAuditLogsResponse[]> {\n    return this.callToolOnAll<GetPlanAuditLogsResponse>('get_plan_audit_logs', params);\n  }\n\n  /**\n   * Official AdCP check_governance tool schema (across multiple agents)\n   */\n  async checkGovernance(params: CheckGovernanceRequest): Promise<CheckGovernanceResponse[]> {\n    return this.callToolOnAll<CheckGovernanceResponse>('check_governance', params);\n  }\n\n  /**\n   * Official AdCP si_get_offering tool schema (across multiple agents)\n   */\n  async siGetOffering(params: SIGetOfferingRequest): Promise<SIGetOfferingResponse[]> {\n    return this.callToolOnAll<SIGetOfferingResponse>('si_get_offering', params);\n  }\n\n  /**\n   * Official AdCP si_send_message tool schema (across multiple agents)\n   */\n  async siSendMessage(params: MutatingRequestInput<SISendMessageRequest>): Promise<SISendMessageResponse[]> {\n    return this.callToolOnAll<SISendMessageResponse>('si_send_message', params);\n  }\n\n  /**\n   * Official AdCP get_adcp_capabilities tool schema (across multiple agents)\n   */\n  async getAdcpCapabilities(params: GetAdCPCapabilitiesRequest): Promise<GetAdCPCapabilitiesResponse[]> {\n    return this.callToolOnAll<GetAdCPCapabilitiesResponse>('get_adcp_capabilities', params);\n  }\n\n  /**\n   * Official AdCP get_task_status tool schema (across multiple agents)\n   */\n  async getTaskStatus(params: GetTaskStatusRequest): Promise<GetTaskStatusResponse[]> {\n    return this.callToolOnAll<GetTaskStatusResponse>('get_task_status', params);\n  }\n\n  /**\n   * Official AdCP list_tasks tool schema (across multiple agents)\n   */\n  async listTasks(params: ListTasksRequest): Promise<ListTasksResponse[]> {\n    return this.callToolOnAll<ListTasksResponse>('list_tasks', params);\n  }\n\n  /**\n   * Official AdCP list_accounts tool schema (across multiple agents)\n   */\n  async listAccounts(params: ListAccountsRequest): Promise<ListAccountsResponse[]> {\n    return this.callToolOnAll<ListAccountsResponse>('list_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_accounts tool schema (across multiple agents)\n   */\n  async syncAccounts(params: MutatingRequestInput<SyncAccountsRequest>): Promise<SyncAccountsResponse[]> {\n    return this.callToolOnAll<SyncAccountsResponse>('sync_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_governance tool schema (across multiple agents)\n   */\n  async syncGovernance(params: MutatingRequestInput<SyncGovernanceRequest>): Promise<SyncGovernanceResponse[]> {\n    return this.callToolOnAll<SyncGovernanceResponse>('sync_governance', params);\n  }\n\n  /**\n   * Official AdCP report_usage tool schema (across multiple agents)\n   */\n  async reportUsage(params: MutatingRequestInput<ReportUsageRequest>): Promise<ReportUsageResponse[]> {\n    return this.callToolOnAll<ReportUsageResponse>('report_usage', params);\n  }\n\n  /**\n   * Official AdCP get_account_financials tool schema (across multiple agents)\n   */\n  async getAccountFinancials(params: GetAccountFinancialsRequest): Promise<GetAccountFinancialsResponse[]> {\n    return this.callToolOnAll<GetAccountFinancialsResponse>('get_account_financials', params);\n  }\n\n  /**\n   * Official AdCP comply_test_controller tool schema (across multiple agents)\n   */\n  async complyTestController(params: ComplyTestControllerRequest): Promise<ComplyTestControllerResponse[]> {\n    return this.callToolOnAll<ComplyTestControllerResponse>('comply_test_controller', params);\n  }\n\n}\n"],"mappings":";;;;;;AAIA,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,mBAAmB,8BAA8B;AAgI1D,IAAI,0BAA0B;AAEvB,MAAM,MAAM;AAAA,EACjB,YACU,QACA,QACR;AAFQ;AACA;AAER,QAAI,CAAC,yBAAyB;AAI5B,UAAI;AACF,gBAAQ;AAAA,UACN;AAAA,UAEA;AAAA,QACF;AACA,kCAA0B;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAlBU;AAAA,EACA;AAAA,EAmBV,MAAc,SAAY,UAAkB,QAAyB;AACnE,UAAM,YAAmB,CAAC;AAE1B,QAAI;AACF,uBAAiB,KAAK,OAAO,SAAS;AAEtC,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,EAAE;AACvD,YAAM,mBAAmB,MAAM,eAAe,KAAK,YAAY;AAC7D,eAAO,MAAM,eAAe,SAAS,KAAK,QAAQ,UAAU,QAAQ,EAAE,UAAU,CAAC;AAAA,MACnF,CAAC;AAGD,YAAM,eAAe,uBAAuB,kBAAkB,UAAU,KAAK,OAAO,QAAQ;AAE5F,aAAO;AAAA,IACT,SAAS,OAAO;AAEd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU;AAC9D,aAAO;AAAA,QACL,QAAQ,CAAC;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAA0D;AAC1E,WAAO,KAAK,SAA8B,gBAAgB,MAAM;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,oBAAoB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,oBAAoB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA4D;AAC7E,WAAO,KAAK,SAA+B,kBAAkB,MAAM;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,0BAA0B,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,2BAA2B,QAA8G;AAC7I,WAAO,KAAK,SAA6C,gCAAgC,MAAM;AAAA,EACjG;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA0F;AAC/G,WAAO,KAAK,SAAmC,sBAAsB,MAAM;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,QAA0E;AACvF,WAAO,KAAK,SAA2B,aAAa,MAAM;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAkF;AACnG,WAAO,KAAK,SAA+B,iBAAiB,MAAM;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAkE;AACtF,WAAO,KAAK,SAAkC,oBAAoB,MAAM;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAoE;AACzF,WAAO,KAAK,SAAmC,qBAAqB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAAwD;AACvE,WAAO,KAAK,SAA6B,eAAe,MAAM;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,mBAAmB,MAAM;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAA8F;AACrH,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAA8F;AACrH,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAkE;AACtF,WAAO,KAAK,SAAkC,qBAAqB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAsE;AAC5F,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAA8F;AACrH,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAkG;AAC3H,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAkG;AAC3H,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAsE;AAC5F,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAkG;AAC3H,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,QAAsG;AACjI,WAAO,KAAK,SAAyC,4BAA4B,MAAM;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,QAAsG;AACjI,WAAO,KAAK,SAAyC,4BAA4B,MAAM;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA0F;AAC/G,WAAO,KAAK,SAAmC,qBAAqB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,QAAkF;AAC9G,WAAO,KAAK,SAA0C,6BAA6B,MAAM;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,2BAA2B,MAAM;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA4E;AAC1F,WAAO,KAAK,SAA4B,cAAc,MAAM;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAA4F;AAClH,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAoE;AACzF,WAAO,KAAK,SAAmC,uBAAuB,MAAM;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAkE;AACtF,WAAO,KAAK,SAAkC,oBAAoB,MAAM;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,mBAAmB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAA4F;AAClH,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,mBAAmB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAAwE;AAC/F,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,mBAAmB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAAsD;AACpE,WAAO,KAAK,SAA4B,cAAc,MAAM;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA4D;AAC7E,WAAO,KAAK,SAA+B,iBAAiB,MAAM;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAkF;AACnG,WAAO,KAAK,SAA+B,iBAAiB,MAAM;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,mBAAmB,MAAM;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAAgF;AAChG,WAAO,KAAK,SAA8B,gBAAgB,MAAM;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAEF;AAKO,MAAM,gBAAgB;AAAA,EAC3B,YACU,SACA,QACR;AAFQ;AACA;AAAA,EACP;AAAA,EAFO;AAAA,EACA;AAAA,EAGV,MAAc,cAAiB,UAAkB,QAA2B;AAC1E,UAAM,SAAS,KAAK,QAAQ,IAAI,YAAU,IAAI,MAAM,QAAQ,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,WAAU,MAAc,SAAS,UAAU,MAAM,CAAC;AAC9E,WAAO,QAAQ,IAAI,QAAQ;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAA4D;AAC5E,WAAO,KAAK,cAAmC,gBAAgB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA8D;AAC/E,WAAO,KAAK,cAAoC,kBAAkB,MAAM;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,0BAA0B,MAAM;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,2BAA2B,QAAgH;AAC/I,WAAO,KAAK,cAAkD,gCAAgC,MAAM;AAAA,EACtG;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA4F;AACjH,WAAO,KAAK,cAAwC,sBAAsB,MAAM;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,QAA4E;AACzF,WAAO,KAAK,cAAgC,aAAa,MAAM;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAoF;AACrG,WAAO,KAAK,cAAoC,iBAAiB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAoE;AACxF,WAAO,KAAK,cAAuC,oBAAoB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAsE;AAC3F,WAAO,KAAK,cAAwC,qBAAqB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAA0D;AACzE,WAAO,KAAK,cAAkC,eAAe,MAAM;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAwF;AAC3G,WAAO,KAAK,cAAsC,mBAAmB,MAAM;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAoE;AACxF,WAAO,KAAK,cAAuC,qBAAqB,MAAM;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAwE;AAC9F,WAAO,KAAK,cAAyC,uBAAuB,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAoG;AAC7H,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAoG;AAC7H,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAwE;AAC9F,WAAO,KAAK,cAAyC,uBAAuB,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAoG;AAC7H,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA4F;AACjH,WAAO,KAAK,cAAwC,qBAAqB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,QAAoF;AAChH,WAAO,KAAK,cAA+C,6BAA6B,MAAM;AAAA,EAChG;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,2BAA2B,MAAM;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA8E;AAC5F,WAAO,KAAK,cAAiC,cAAc,MAAM;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAA8F;AACpH,WAAO,KAAK,cAAyC,uBAAuB,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAsE;AAC3F,WAAO,KAAK,cAAwC,uBAAuB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAoE;AACxF,WAAO,KAAK,cAAuC,oBAAoB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,mBAAmB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,mBAAmB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,mBAAmB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAAwD;AACtE,WAAO,KAAK,cAAiC,cAAc,MAAM;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA8D;AAC/E,WAAO,KAAK,cAAoC,iBAAiB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAoF;AACrG,WAAO,KAAK,cAAoC,iBAAiB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAwF;AAC3G,WAAO,KAAK,cAAsC,mBAAmB,MAAM;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAAkF;AAClG,WAAO,KAAK,cAAmC,gBAAgB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAEF;","names":[]}
+{"version":3,"sources":["../../../src/lib/agents/index.generated.ts"],"sourcesContent":["// Generated Agent Classes\n// Auto-generated from AdCP tool definitions\n\nimport type { AgentConfig } from '../types';\nimport { ProtocolClient } from '../protocols';\nimport { validateAgentUrl } from '../validation';\nimport { getCircuitBreaker, unwrapProtocolResponse } from '../utils';\nimport type { MutatingRequestInput } from '../utils/idempotency';\nimport type {\n  GetProductsRequest,\n  GetProductsResponse,\n  ListCreativeFormatsRequest,\n  ListCreativeFormatsResponse,\n  CreateMediaBuyRequest,\n  CreateMediaBuyResponse,\n  UpdateMediaBuyRequest,\n  UpdateMediaBuyResponse,\n  GetMediaBuysRequest,\n  GetMediaBuysResponse,\n  GetMediaBuyDeliveryRequest,\n  GetMediaBuyDeliveryResponse,\n  ProvidePerformanceFeedbackRequest,\n  ProvidePerformanceFeedbackResponse,\n  SyncEventSourcesRequest,\n  SyncEventSourcesResponse,\n  LogEventRequest,\n  LogEventResponse,\n  SyncAudiencesRequest,\n  SyncAudiencesResponse,\n  SyncCatalogsRequest,\n  SyncCatalogsResponse,\n  BuildCreativeRequest,\n  BuildCreativeResponse,\n  PreviewCreativeRequest,\n  PreviewCreativeResponse,\n  ListTransformersRequest,\n  ListTransformersResponse,\n  GetCreativeDeliveryRequest,\n  GetCreativeDeliveryResponse,\n  ListCreativesRequest,\n  ListCreativesResponse,\n  SyncCreativesRequest,\n  SyncCreativesResponse,\n  ValidateInputRequest,\n  ValidateInputResponse,\n  GetSignalsRequest,\n  GetSignalsResponse,\n  ActivateSignalRequest,\n  ActivateSignalResponse,\n  CreatePropertyListRequest,\n  CreatePropertyListResponse,\n  UpdatePropertyListRequest,\n  UpdatePropertyListResponse,\n  GetPropertyListRequest,\n  GetPropertyListResponse,\n  ListPropertyListsRequest,\n  ListPropertyListsResponse,\n  DeletePropertyListRequest,\n  DeletePropertyListResponse,\n  CreateCollectionListRequest,\n  CreateCollectionListResponse,\n  UpdateCollectionListRequest,\n  UpdateCollectionListResponse,\n  GetCollectionListRequest,\n  GetCollectionListResponse,\n  ListCollectionListsRequest,\n  ListCollectionListsResponse,\n  DeleteCollectionListRequest,\n  DeleteCollectionListResponse,\n  ListContentStandardsRequest,\n  ListContentStandardsResponse,\n  GetContentStandardsRequest,\n  GetContentStandardsResponse,\n  CreateContentStandardsRequest,\n  CreateContentStandardsResponse,\n  UpdateContentStandardsRequest,\n  UpdateContentStandardsResponse,\n  CalibrateContentRequest,\n  CalibrateContentResponse,\n  ValidateContentDeliveryRequest,\n  ValidateContentDeliveryResponse,\n  GetMediaBuyArtifactsRequest,\n  GetMediaBuyArtifactsResponse,\n  GetCreativeFeaturesRequest,\n  GetCreativeFeaturesResponse,\n  SyncPlansRequest,\n  SyncPlansResponse,\n  ReportPlanOutcomeRequest,\n  ReportPlanOutcomeResponse,\n  GetPlanAuditLogsRequest,\n  GetPlanAuditLogsResponse,\n  CheckGovernanceRequest,\n  CheckGovernanceResponse,\n  SIGetOfferingRequest,\n  SIGetOfferingResponse,\n  SIInitiateSessionRequest,\n  SIInitiateSessionResponse,\n  SISendMessageRequest,\n  SISendMessageResponse,\n  SITerminateSessionRequest,\n  SITerminateSessionResponse,\n  GetAdCPCapabilitiesRequest,\n  GetAdCPCapabilitiesResponse,\n  GetTaskStatusRequest,\n  GetTaskStatusResponse,\n  ListTasksRequest,\n  ListTasksResponse,\n  ListAccountsRequest,\n  ListAccountsResponse,\n  SyncAccountsRequest,\n  SyncAccountsResponse,\n  SyncGovernanceRequest,\n  SyncGovernanceResponse,\n  ReportUsageRequest,\n  ReportUsageResponse,\n  GetAccountFinancialsRequest,\n  GetAccountFinancialsResponse,\n  ComplyTestControllerRequest,\n  ComplyTestControllerResponse\n} from '../types/tools.generated';\n\n/**\n * Single agent operations with full type safety\n *\n * Returns raw AdCP responses matching schema exactly.\n * No SDK wrapping - responses follow AdCP discriminated union patterns.\n *\n * @deprecated Use `SingleAgentClient` / `AgentClient` / `ADCPMultiAgentClient`\n * from `@adcp/sdk` instead. The `Agent` class predates Stage 3's per-instance\n * `adcpVersion` plumbing — it always emits the SDK-pinned `ADCP_MAJOR_VERSION`\n * on the wire regardless of caller pin, which silently drifts from a buyer\n * who pins a non-default version. The conversation-aware clients honor the\n * per-instance pin end-to-end (validators, wire field, capability check).\n */\nlet _agentDeprecationWarned = false;\n\nexport class Agent {\n  constructor(\n    private config: AgentConfig,\n    private client: any // Will be AdCPClient\n  ) {\n    if (!_agentDeprecationWarned) {\n      // Flag is set only after a successful emitWarning so a runtime that\n      // throws on the first call (monkey-patched test harness, polyfilled\n      // worker) still surfaces the deprecation on a later construction.\n      try {\n        process.emitWarning(\n          'Agent class is deprecated. Use SingleAgentClient / AgentClient / ADCPMultiAgentClient from @adcp/sdk; ' +\n            'Agent does not honor per-instance adcpVersion pins (always emits the SDK default major).',\n          'DeprecationWarning'\n        );\n        _agentDeprecationWarned = true;\n      } catch {\n        // emitWarning is best-effort observability; never fatal.\n      }\n    }\n  }\n\n  private async callTool<T>(toolName: string, params: any): Promise<T> {\n    const debugLogs: any[] = [];\n\n    try {\n      validateAgentUrl(this.config.agent_uri);\n\n      const circuitBreaker = getCircuitBreaker(this.config.id);\n      const protocolResponse = await circuitBreaker.call(async () => {\n        return await ProtocolClient.callTool(this.config, toolName, params, { debugLogs });\n      });\n\n      // Unwrap and validate protocol response using tool-specific Zod schema\n      const adcpResponse = unwrapProtocolResponse(protocolResponse, toolName, this.config.protocol);\n\n      return adcpResponse as T;\n    } catch (error) {\n      // Convert exceptions to AdCP error format\n      const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n      return {\n        errors: [{\n          code: 'client_error',\n          message: errorMessage\n        }]\n      } as T;\n    }\n  }\n\n  /**\n   * Official AdCP get_products tool schema\n   */\n  async getProducts(params: GetProductsRequest): Promise<GetProductsResponse> {\n    return this.callTool<GetProductsResponse>('get_products', params);\n  }\n\n  /**\n   * Official AdCP list_creative_formats tool schema\n   */\n  async listCreativeFormats(params: ListCreativeFormatsRequest): Promise<ListCreativeFormatsResponse> {\n    return this.callTool<ListCreativeFormatsResponse>('list_creative_formats', params);\n  }\n\n  /**\n   * Official AdCP create_media_buy tool schema\n   */\n  async createMediaBuy(params: MutatingRequestInput<CreateMediaBuyRequest>): Promise<CreateMediaBuyResponse> {\n    return this.callTool<CreateMediaBuyResponse>('create_media_buy', params);\n  }\n\n  /**\n   * Official AdCP update_media_buy tool schema\n   */\n  async updateMediaBuy(params: MutatingRequestInput<UpdateMediaBuyRequest>): Promise<UpdateMediaBuyResponse> {\n    return this.callTool<UpdateMediaBuyResponse>('update_media_buy', params);\n  }\n\n  /**\n   * Official AdCP get_media_buys tool schema\n   */\n  async getMediaBuys(params: GetMediaBuysRequest): Promise<GetMediaBuysResponse> {\n    return this.callTool<GetMediaBuysResponse>('get_media_buys', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_delivery tool schema\n   */\n  async getMediaBuyDelivery(params: GetMediaBuyDeliveryRequest): Promise<GetMediaBuyDeliveryResponse> {\n    return this.callTool<GetMediaBuyDeliveryResponse>('get_media_buy_delivery', params);\n  }\n\n  /**\n   * Official AdCP provide_performance_feedback tool schema\n   */\n  async providePerformanceFeedback(params: MutatingRequestInput<ProvidePerformanceFeedbackRequest>): Promise<ProvidePerformanceFeedbackResponse> {\n    return this.callTool<ProvidePerformanceFeedbackResponse>('provide_performance_feedback', params);\n  }\n\n  /**\n   * Official AdCP sync_event_sources tool schema\n   */\n  async syncEventSources(params: MutatingRequestInput<SyncEventSourcesRequest>): Promise<SyncEventSourcesResponse> {\n    return this.callTool<SyncEventSourcesResponse>('sync_event_sources', params);\n  }\n\n  /**\n   * Official AdCP log_event tool schema\n   */\n  async logEvent(params: MutatingRequestInput<LogEventRequest>): Promise<LogEventResponse> {\n    return this.callTool<LogEventResponse>('log_event', params);\n  }\n\n  /**\n   * Official AdCP sync_audiences tool schema\n   */\n  async syncAudiences(params: MutatingRequestInput<SyncAudiencesRequest>): Promise<SyncAudiencesResponse> {\n    return this.callTool<SyncAudiencesResponse>('sync_audiences', params);\n  }\n\n  /**\n   * Official AdCP sync_catalogs tool schema\n   */\n  async syncCatalogs(params: MutatingRequestInput<SyncCatalogsRequest>): Promise<SyncCatalogsResponse> {\n    return this.callTool<SyncCatalogsResponse>('sync_catalogs', params);\n  }\n\n  /**\n   * Official AdCP build_creative tool schema\n   */\n  async buildCreative(params: MutatingRequestInput<BuildCreativeRequest>): Promise<BuildCreativeResponse> {\n    return this.callTool<BuildCreativeResponse>('build_creative', params);\n  }\n\n  /**\n   * Official AdCP preview_creative tool schema\n   */\n  async previewCreative(params: PreviewCreativeRequest): Promise<PreviewCreativeResponse> {\n    return this.callTool<PreviewCreativeResponse>('preview_creative', params);\n  }\n\n  /**\n   * Official AdCP list_transformers tool schema\n   */\n  async listTransformers(params: ListTransformersRequest): Promise<ListTransformersResponse> {\n    return this.callTool<ListTransformersResponse>('list_transformers', params);\n  }\n\n  /**\n   * Official AdCP get_creative_delivery tool schema\n   */\n  async getCreativeDelivery(params: GetCreativeDeliveryRequest): Promise<GetCreativeDeliveryResponse> {\n    return this.callTool<GetCreativeDeliveryResponse>('get_creative_delivery', params);\n  }\n\n  /**\n   * Official AdCP list_creatives tool schema\n   */\n  async listCreatives(params: ListCreativesRequest): Promise<ListCreativesResponse> {\n    return this.callTool<ListCreativesResponse>('list_creatives', params);\n  }\n\n  /**\n   * Official AdCP sync_creatives tool schema\n   */\n  async syncCreatives(params: MutatingRequestInput<SyncCreativesRequest>): Promise<SyncCreativesResponse> {\n    return this.callTool<SyncCreativesResponse>('sync_creatives', params);\n  }\n\n  /**\n   * Official AdCP validate_input tool schema\n   */\n  async validateInput(params: ValidateInputRequest): Promise<ValidateInputResponse> {\n    return this.callTool<ValidateInputResponse>('validate_input', params);\n  }\n\n  /**\n   * Official AdCP get_signals tool schema\n   */\n  async getSignals(params: GetSignalsRequest): Promise<GetSignalsResponse> {\n    return this.callTool<GetSignalsResponse>('get_signals', params);\n  }\n\n  /**\n   * Official AdCP activate_signal tool schema\n   */\n  async activateSignal(params: MutatingRequestInput<ActivateSignalRequest>): Promise<ActivateSignalResponse> {\n    return this.callTool<ActivateSignalResponse>('activate_signal', params);\n  }\n\n  /**\n   * Official AdCP create_property_list tool schema\n   */\n  async createPropertyList(params: MutatingRequestInput<CreatePropertyListRequest>): Promise<CreatePropertyListResponse> {\n    return this.callTool<CreatePropertyListResponse>('create_property_list', params);\n  }\n\n  /**\n   * Official AdCP update_property_list tool schema\n   */\n  async updatePropertyList(params: MutatingRequestInput<UpdatePropertyListRequest>): Promise<UpdatePropertyListResponse> {\n    return this.callTool<UpdatePropertyListResponse>('update_property_list', params);\n  }\n\n  /**\n   * Official AdCP get_property_list tool schema\n   */\n  async getPropertyList(params: GetPropertyListRequest): Promise<GetPropertyListResponse> {\n    return this.callTool<GetPropertyListResponse>('get_property_list', params);\n  }\n\n  /**\n   * Official AdCP list_property_lists tool schema\n   */\n  async listPropertyLists(params: ListPropertyListsRequest): Promise<ListPropertyListsResponse> {\n    return this.callTool<ListPropertyListsResponse>('list_property_lists', params);\n  }\n\n  /**\n   * Official AdCP delete_property_list tool schema\n   */\n  async deletePropertyList(params: MutatingRequestInput<DeletePropertyListRequest>): Promise<DeletePropertyListResponse> {\n    return this.callTool<DeletePropertyListResponse>('delete_property_list', params);\n  }\n\n  /**\n   * Official AdCP create_collection_list tool schema\n   */\n  async createCollectionList(params: MutatingRequestInput<CreateCollectionListRequest>): Promise<CreateCollectionListResponse> {\n    return this.callTool<CreateCollectionListResponse>('create_collection_list', params);\n  }\n\n  /**\n   * Official AdCP update_collection_list tool schema\n   */\n  async updateCollectionList(params: MutatingRequestInput<UpdateCollectionListRequest>): Promise<UpdateCollectionListResponse> {\n    return this.callTool<UpdateCollectionListResponse>('update_collection_list', params);\n  }\n\n  /**\n   * Official AdCP get_collection_list tool schema\n   */\n  async getCollectionList(params: GetCollectionListRequest): Promise<GetCollectionListResponse> {\n    return this.callTool<GetCollectionListResponse>('get_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_collection_lists tool schema\n   */\n  async listCollectionLists(params: ListCollectionListsRequest): Promise<ListCollectionListsResponse> {\n    return this.callTool<ListCollectionListsResponse>('list_collection_lists', params);\n  }\n\n  /**\n   * Official AdCP delete_collection_list tool schema\n   */\n  async deleteCollectionList(params: MutatingRequestInput<DeleteCollectionListRequest>): Promise<DeleteCollectionListResponse> {\n    return this.callTool<DeleteCollectionListResponse>('delete_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_content_standards tool schema\n   */\n  async listContentStandards(params: ListContentStandardsRequest): Promise<ListContentStandardsResponse> {\n    return this.callTool<ListContentStandardsResponse>('list_content_standards', params);\n  }\n\n  /**\n   * Official AdCP get_content_standards tool schema\n   */\n  async getContentStandards(params: GetContentStandardsRequest): Promise<GetContentStandardsResponse> {\n    return this.callTool<GetContentStandardsResponse>('get_content_standards', params);\n  }\n\n  /**\n   * Official AdCP create_content_standards tool schema\n   */\n  async createContentStandards(params: MutatingRequestInput<CreateContentStandardsRequest>): Promise<CreateContentStandardsResponse> {\n    return this.callTool<CreateContentStandardsResponse>('create_content_standards', params);\n  }\n\n  /**\n   * Official AdCP update_content_standards tool schema\n   */\n  async updateContentStandards(params: MutatingRequestInput<UpdateContentStandardsRequest>): Promise<UpdateContentStandardsResponse> {\n    return this.callTool<UpdateContentStandardsResponse>('update_content_standards', params);\n  }\n\n  /**\n   * Official AdCP calibrate_content tool schema\n   */\n  async calibrateContent(params: MutatingRequestInput<CalibrateContentRequest>): Promise<CalibrateContentResponse> {\n    return this.callTool<CalibrateContentResponse>('calibrate_content', params);\n  }\n\n  /**\n   * Official AdCP validate_content_delivery tool schema\n   */\n  async validateContentDelivery(params: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse> {\n    return this.callTool<ValidateContentDeliveryResponse>('validate_content_delivery', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_artifacts tool schema\n   */\n  async getMediaBuyArtifacts(params: GetMediaBuyArtifactsRequest): Promise<GetMediaBuyArtifactsResponse> {\n    return this.callTool<GetMediaBuyArtifactsResponse>('get_media_buy_artifacts', params);\n  }\n\n  /**\n   * Official AdCP get_creative_features tool schema\n   */\n  async getCreativeFeatures(params: GetCreativeFeaturesRequest): Promise<GetCreativeFeaturesResponse> {\n    return this.callTool<GetCreativeFeaturesResponse>('get_creative_features', params);\n  }\n\n  /**\n   * Official AdCP sync_plans tool schema\n   */\n  async syncPlans(params: MutatingRequestInput<SyncPlansRequest>): Promise<SyncPlansResponse> {\n    return this.callTool<SyncPlansResponse>('sync_plans', params);\n  }\n\n  /**\n   * Official AdCP report_plan_outcome tool schema\n   */\n  async reportPlanOutcome(params: MutatingRequestInput<ReportPlanOutcomeRequest>): Promise<ReportPlanOutcomeResponse> {\n    return this.callTool<ReportPlanOutcomeResponse>('report_plan_outcome', params);\n  }\n\n  /**\n   * Official AdCP get_plan_audit_logs tool schema\n   */\n  async getPlanAuditLogs(params: GetPlanAuditLogsRequest): Promise<GetPlanAuditLogsResponse> {\n    return this.callTool<GetPlanAuditLogsResponse>('get_plan_audit_logs', params);\n  }\n\n  /**\n   * Official AdCP check_governance tool schema\n   */\n  async checkGovernance(params: CheckGovernanceRequest): Promise<CheckGovernanceResponse> {\n    return this.callTool<CheckGovernanceResponse>('check_governance', params);\n  }\n\n  /**\n   * Official AdCP si_get_offering tool schema\n   */\n  async siGetOffering(params: SIGetOfferingRequest): Promise<SIGetOfferingResponse> {\n    return this.callTool<SIGetOfferingResponse>('si_get_offering', params);\n  }\n\n  /**\n   * Official AdCP si_initiate_session tool schema\n   */\n  async siInitiateSession(params: MutatingRequestInput<SIInitiateSessionRequest>): Promise<SIInitiateSessionResponse> {\n    return this.callTool<SIInitiateSessionResponse>('si_initiate_session', params);\n  }\n\n  /**\n   * Official AdCP si_send_message tool schema\n   */\n  async siSendMessage(params: MutatingRequestInput<SISendMessageRequest>): Promise<SISendMessageResponse> {\n    return this.callTool<SISendMessageResponse>('si_send_message', params);\n  }\n\n  /**\n   * Official AdCP si_terminate_session tool schema\n   */\n  async siTerminateSession(params: SITerminateSessionRequest): Promise<SITerminateSessionResponse> {\n    return this.callTool<SITerminateSessionResponse>('si_terminate_session', params);\n  }\n\n  /**\n   * Official AdCP get_adcp_capabilities tool schema\n   */\n  async getAdcpCapabilities(params: GetAdCPCapabilitiesRequest): Promise<GetAdCPCapabilitiesResponse> {\n    return this.callTool<GetAdCPCapabilitiesResponse>('get_adcp_capabilities', params);\n  }\n\n  /**\n   * Official AdCP get_task_status tool schema\n   */\n  async getTaskStatus(params: GetTaskStatusRequest): Promise<GetTaskStatusResponse> {\n    return this.callTool<GetTaskStatusResponse>('get_task_status', params);\n  }\n\n  /**\n   * Official AdCP list_tasks tool schema\n   */\n  async listTasks(params: ListTasksRequest): Promise<ListTasksResponse> {\n    return this.callTool<ListTasksResponse>('list_tasks', params);\n  }\n\n  /**\n   * Official AdCP list_accounts tool schema\n   */\n  async listAccounts(params: ListAccountsRequest): Promise<ListAccountsResponse> {\n    return this.callTool<ListAccountsResponse>('list_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_accounts tool schema\n   */\n  async syncAccounts(params: MutatingRequestInput<SyncAccountsRequest>): Promise<SyncAccountsResponse> {\n    return this.callTool<SyncAccountsResponse>('sync_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_governance tool schema\n   */\n  async syncGovernance(params: MutatingRequestInput<SyncGovernanceRequest>): Promise<SyncGovernanceResponse> {\n    return this.callTool<SyncGovernanceResponse>('sync_governance', params);\n  }\n\n  /**\n   * Official AdCP report_usage tool schema\n   */\n  async reportUsage(params: MutatingRequestInput<ReportUsageRequest>): Promise<ReportUsageResponse> {\n    return this.callTool<ReportUsageResponse>('report_usage', params);\n  }\n\n  /**\n   * Official AdCP get_account_financials tool schema\n   */\n  async getAccountFinancials(params: GetAccountFinancialsRequest): Promise<GetAccountFinancialsResponse> {\n    return this.callTool<GetAccountFinancialsResponse>('get_account_financials', params);\n  }\n\n  /**\n   * Official AdCP comply_test_controller tool schema\n   */\n  async complyTestController(params: ComplyTestControllerRequest): Promise<ComplyTestControllerResponse> {\n    return this.callTool<ComplyTestControllerResponse>('comply_test_controller', params);\n  }\n\n}\n\n/**\n * Multi-agent operations with full type safety\n */\nexport class AgentCollection {\n  constructor(\n    private configs: AgentConfig[],\n    private client: any // Will be AdCPClient\n  ) {}\n\n  private async callToolOnAll<T>(toolName: string, params: any): Promise<T[]> {\n    const agents = this.configs.map(config => new Agent(config, this.client));\n    const promises = agents.map(agent => (agent as any).callTool(toolName, params));\n    return Promise.all(promises);\n  }\n\n  /**\n   * Official AdCP get_products tool schema (across multiple agents)\n   */\n  async getProducts(params: GetProductsRequest): Promise<GetProductsResponse[]> {\n    return this.callToolOnAll<GetProductsResponse>('get_products', params);\n  }\n\n  /**\n   * Official AdCP list_creative_formats tool schema (across multiple agents)\n   */\n  async listCreativeFormats(params: ListCreativeFormatsRequest): Promise<ListCreativeFormatsResponse[]> {\n    return this.callToolOnAll<ListCreativeFormatsResponse>('list_creative_formats', params);\n  }\n\n  /**\n   * Official AdCP get_media_buys tool schema (across multiple agents)\n   */\n  async getMediaBuys(params: GetMediaBuysRequest): Promise<GetMediaBuysResponse[]> {\n    return this.callToolOnAll<GetMediaBuysResponse>('get_media_buys', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_delivery tool schema (across multiple agents)\n   */\n  async getMediaBuyDelivery(params: GetMediaBuyDeliveryRequest): Promise<GetMediaBuyDeliveryResponse[]> {\n    return this.callToolOnAll<GetMediaBuyDeliveryResponse>('get_media_buy_delivery', params);\n  }\n\n  /**\n   * Official AdCP provide_performance_feedback tool schema (across multiple agents)\n   */\n  async providePerformanceFeedback(params: MutatingRequestInput<ProvidePerformanceFeedbackRequest>): Promise<ProvidePerformanceFeedbackResponse[]> {\n    return this.callToolOnAll<ProvidePerformanceFeedbackResponse>('provide_performance_feedback', params);\n  }\n\n  /**\n   * Official AdCP sync_event_sources tool schema (across multiple agents)\n   */\n  async syncEventSources(params: MutatingRequestInput<SyncEventSourcesRequest>): Promise<SyncEventSourcesResponse[]> {\n    return this.callToolOnAll<SyncEventSourcesResponse>('sync_event_sources', params);\n  }\n\n  /**\n   * Official AdCP log_event tool schema (across multiple agents)\n   */\n  async logEvent(params: MutatingRequestInput<LogEventRequest>): Promise<LogEventResponse[]> {\n    return this.callToolOnAll<LogEventResponse>('log_event', params);\n  }\n\n  /**\n   * Official AdCP sync_audiences tool schema (across multiple agents)\n   */\n  async syncAudiences(params: MutatingRequestInput<SyncAudiencesRequest>): Promise<SyncAudiencesResponse[]> {\n    return this.callToolOnAll<SyncAudiencesResponse>('sync_audiences', params);\n  }\n\n  /**\n   * Official AdCP sync_catalogs tool schema (across multiple agents)\n   */\n  async syncCatalogs(params: MutatingRequestInput<SyncCatalogsRequest>): Promise<SyncCatalogsResponse[]> {\n    return this.callToolOnAll<SyncCatalogsResponse>('sync_catalogs', params);\n  }\n\n  /**\n   * Official AdCP build_creative tool schema (across multiple agents)\n   */\n  async buildCreative(params: MutatingRequestInput<BuildCreativeRequest>): Promise<BuildCreativeResponse[]> {\n    return this.callToolOnAll<BuildCreativeResponse>('build_creative', params);\n  }\n\n  /**\n   * Official AdCP preview_creative tool schema (across multiple agents)\n   */\n  async previewCreative(params: PreviewCreativeRequest): Promise<PreviewCreativeResponse[]> {\n    return this.callToolOnAll<PreviewCreativeResponse>('preview_creative', params);\n  }\n\n  /**\n   * Official AdCP list_transformers tool schema (across multiple agents)\n   */\n  async listTransformers(params: ListTransformersRequest): Promise<ListTransformersResponse[]> {\n    return this.callToolOnAll<ListTransformersResponse>('list_transformers', params);\n  }\n\n  /**\n   * Official AdCP get_creative_delivery tool schema (across multiple agents)\n   */\n  async getCreativeDelivery(params: GetCreativeDeliveryRequest): Promise<GetCreativeDeliveryResponse[]> {\n    return this.callToolOnAll<GetCreativeDeliveryResponse>('get_creative_delivery', params);\n  }\n\n  /**\n   * Official AdCP list_creatives tool schema (across multiple agents)\n   */\n  async listCreatives(params: ListCreativesRequest): Promise<ListCreativesResponse[]> {\n    return this.callToolOnAll<ListCreativesResponse>('list_creatives', params);\n  }\n\n  /**\n   * Official AdCP sync_creatives tool schema (across multiple agents)\n   */\n  async syncCreatives(params: MutatingRequestInput<SyncCreativesRequest>): Promise<SyncCreativesResponse[]> {\n    return this.callToolOnAll<SyncCreativesResponse>('sync_creatives', params);\n  }\n\n  /**\n   * Official AdCP validate_input tool schema (across multiple agents)\n   */\n  async validateInput(params: ValidateInputRequest): Promise<ValidateInputResponse[]> {\n    return this.callToolOnAll<ValidateInputResponse>('validate_input', params);\n  }\n\n  /**\n   * Official AdCP get_signals tool schema (across multiple agents)\n   */\n  async getSignals(params: GetSignalsRequest): Promise<GetSignalsResponse[]> {\n    return this.callToolOnAll<GetSignalsResponse>('get_signals', params);\n  }\n\n  /**\n   * Official AdCP activate_signal tool schema (across multiple agents)\n   */\n  async activateSignal(params: MutatingRequestInput<ActivateSignalRequest>): Promise<ActivateSignalResponse[]> {\n    return this.callToolOnAll<ActivateSignalResponse>('activate_signal', params);\n  }\n\n  /**\n   * Official AdCP get_property_list tool schema (across multiple agents)\n   */\n  async getPropertyList(params: GetPropertyListRequest): Promise<GetPropertyListResponse[]> {\n    return this.callToolOnAll<GetPropertyListResponse>('get_property_list', params);\n  }\n\n  /**\n   * Official AdCP list_property_lists tool schema (across multiple agents)\n   */\n  async listPropertyLists(params: ListPropertyListsRequest): Promise<ListPropertyListsResponse[]> {\n    return this.callToolOnAll<ListPropertyListsResponse>('list_property_lists', params);\n  }\n\n  /**\n   * Official AdCP create_collection_list tool schema (across multiple agents)\n   */\n  async createCollectionList(params: MutatingRequestInput<CreateCollectionListRequest>): Promise<CreateCollectionListResponse[]> {\n    return this.callToolOnAll<CreateCollectionListResponse>('create_collection_list', params);\n  }\n\n  /**\n   * Official AdCP update_collection_list tool schema (across multiple agents)\n   */\n  async updateCollectionList(params: MutatingRequestInput<UpdateCollectionListRequest>): Promise<UpdateCollectionListResponse[]> {\n    return this.callToolOnAll<UpdateCollectionListResponse>('update_collection_list', params);\n  }\n\n  /**\n   * Official AdCP get_collection_list tool schema (across multiple agents)\n   */\n  async getCollectionList(params: GetCollectionListRequest): Promise<GetCollectionListResponse[]> {\n    return this.callToolOnAll<GetCollectionListResponse>('get_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_collection_lists tool schema (across multiple agents)\n   */\n  async listCollectionLists(params: ListCollectionListsRequest): Promise<ListCollectionListsResponse[]> {\n    return this.callToolOnAll<ListCollectionListsResponse>('list_collection_lists', params);\n  }\n\n  /**\n   * Official AdCP delete_collection_list tool schema (across multiple agents)\n   */\n  async deleteCollectionList(params: MutatingRequestInput<DeleteCollectionListRequest>): Promise<DeleteCollectionListResponse[]> {\n    return this.callToolOnAll<DeleteCollectionListResponse>('delete_collection_list', params);\n  }\n\n  /**\n   * Official AdCP list_content_standards tool schema (across multiple agents)\n   */\n  async listContentStandards(params: ListContentStandardsRequest): Promise<ListContentStandardsResponse[]> {\n    return this.callToolOnAll<ListContentStandardsResponse>('list_content_standards', params);\n  }\n\n  /**\n   * Official AdCP get_content_standards tool schema (across multiple agents)\n   */\n  async getContentStandards(params: GetContentStandardsRequest): Promise<GetContentStandardsResponse[]> {\n    return this.callToolOnAll<GetContentStandardsResponse>('get_content_standards', params);\n  }\n\n  /**\n   * Official AdCP calibrate_content tool schema (across multiple agents)\n   */\n  async calibrateContent(params: MutatingRequestInput<CalibrateContentRequest>): Promise<CalibrateContentResponse[]> {\n    return this.callToolOnAll<CalibrateContentResponse>('calibrate_content', params);\n  }\n\n  /**\n   * Official AdCP validate_content_delivery tool schema (across multiple agents)\n   */\n  async validateContentDelivery(params: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse[]> {\n    return this.callToolOnAll<ValidateContentDeliveryResponse>('validate_content_delivery', params);\n  }\n\n  /**\n   * Official AdCP get_media_buy_artifacts tool schema (across multiple agents)\n   */\n  async getMediaBuyArtifacts(params: GetMediaBuyArtifactsRequest): Promise<GetMediaBuyArtifactsResponse[]> {\n    return this.callToolOnAll<GetMediaBuyArtifactsResponse>('get_media_buy_artifacts', params);\n  }\n\n  /**\n   * Official AdCP get_creative_features tool schema (across multiple agents)\n   */\n  async getCreativeFeatures(params: GetCreativeFeaturesRequest): Promise<GetCreativeFeaturesResponse[]> {\n    return this.callToolOnAll<GetCreativeFeaturesResponse>('get_creative_features', params);\n  }\n\n  /**\n   * Official AdCP sync_plans tool schema (across multiple agents)\n   */\n  async syncPlans(params: MutatingRequestInput<SyncPlansRequest>): Promise<SyncPlansResponse[]> {\n    return this.callToolOnAll<SyncPlansResponse>('sync_plans', params);\n  }\n\n  /**\n   * Official AdCP report_plan_outcome tool schema (across multiple agents)\n   */\n  async reportPlanOutcome(params: MutatingRequestInput<ReportPlanOutcomeRequest>): Promise<ReportPlanOutcomeResponse[]> {\n    return this.callToolOnAll<ReportPlanOutcomeResponse>('report_plan_outcome', params);\n  }\n\n  /**\n   * Official AdCP get_plan_audit_logs tool schema (across multiple agents)\n   */\n  async getPlanAuditLogs(params: GetPlanAuditLogsRequest): Promise<GetPlanAuditLogsResponse[]> {\n    return this.callToolOnAll<GetPlanAuditLogsResponse>('get_plan_audit_logs', params);\n  }\n\n  /**\n   * Official AdCP check_governance tool schema (across multiple agents)\n   */\n  async checkGovernance(params: CheckGovernanceRequest): Promise<CheckGovernanceResponse[]> {\n    return this.callToolOnAll<CheckGovernanceResponse>('check_governance', params);\n  }\n\n  /**\n   * Official AdCP si_get_offering tool schema (across multiple agents)\n   */\n  async siGetOffering(params: SIGetOfferingRequest): Promise<SIGetOfferingResponse[]> {\n    return this.callToolOnAll<SIGetOfferingResponse>('si_get_offering', params);\n  }\n\n  /**\n   * Official AdCP si_send_message tool schema (across multiple agents)\n   */\n  async siSendMessage(params: MutatingRequestInput<SISendMessageRequest>): Promise<SISendMessageResponse[]> {\n    return this.callToolOnAll<SISendMessageResponse>('si_send_message', params);\n  }\n\n  /**\n   * Official AdCP get_adcp_capabilities tool schema (across multiple agents)\n   */\n  async getAdcpCapabilities(params: GetAdCPCapabilitiesRequest): Promise<GetAdCPCapabilitiesResponse[]> {\n    return this.callToolOnAll<GetAdCPCapabilitiesResponse>('get_adcp_capabilities', params);\n  }\n\n  /**\n   * Official AdCP get_task_status tool schema (across multiple agents)\n   */\n  async getTaskStatus(params: GetTaskStatusRequest): Promise<GetTaskStatusResponse[]> {\n    return this.callToolOnAll<GetTaskStatusResponse>('get_task_status', params);\n  }\n\n  /**\n   * Official AdCP list_tasks tool schema (across multiple agents)\n   */\n  async listTasks(params: ListTasksRequest): Promise<ListTasksResponse[]> {\n    return this.callToolOnAll<ListTasksResponse>('list_tasks', params);\n  }\n\n  /**\n   * Official AdCP list_accounts tool schema (across multiple agents)\n   */\n  async listAccounts(params: ListAccountsRequest): Promise<ListAccountsResponse[]> {\n    return this.callToolOnAll<ListAccountsResponse>('list_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_accounts tool schema (across multiple agents)\n   */\n  async syncAccounts(params: MutatingRequestInput<SyncAccountsRequest>): Promise<SyncAccountsResponse[]> {\n    return this.callToolOnAll<SyncAccountsResponse>('sync_accounts', params);\n  }\n\n  /**\n   * Official AdCP sync_governance tool schema (across multiple agents)\n   */\n  async syncGovernance(params: MutatingRequestInput<SyncGovernanceRequest>): Promise<SyncGovernanceResponse[]> {\n    return this.callToolOnAll<SyncGovernanceResponse>('sync_governance', params);\n  }\n\n  /**\n   * Official AdCP report_usage tool schema (across multiple agents)\n   */\n  async reportUsage(params: MutatingRequestInput<ReportUsageRequest>): Promise<ReportUsageResponse[]> {\n    return this.callToolOnAll<ReportUsageResponse>('report_usage', params);\n  }\n\n  /**\n   * Official AdCP get_account_financials tool schema (across multiple agents)\n   */\n  async getAccountFinancials(params: GetAccountFinancialsRequest): Promise<GetAccountFinancialsResponse[]> {\n    return this.callToolOnAll<GetAccountFinancialsResponse>('get_account_financials', params);\n  }\n\n  /**\n   * Official AdCP comply_test_controller tool schema (across multiple agents)\n   */\n  async complyTestController(params: ComplyTestControllerRequest): Promise<ComplyTestControllerResponse[]> {\n    return this.callToolOnAll<ComplyTestControllerResponse>('comply_test_controller', params);\n  }\n\n}\n"],"mappings":"AAIA,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,mBAAmB,8BAA8B;AAgI1D,IAAI,0BAA0B;AAEvB,MAAM,MAAM;AAAA,EACjB,YACU,QACA,QACR;AAFQ;AACA;AAER,QAAI,CAAC,yBAAyB;AAI5B,UAAI;AACF,gBAAQ;AAAA,UACN;AAAA,UAEA;AAAA,QACF;AACA,kCAA0B;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAlBU;AAAA,EACA;AAAA,EAmBV,MAAc,SAAY,UAAkB,QAAyB;AACnE,UAAM,YAAmB,CAAC;AAE1B,QAAI;AACF,uBAAiB,KAAK,OAAO,SAAS;AAEtC,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,EAAE;AACvD,YAAM,mBAAmB,MAAM,eAAe,KAAK,YAAY;AAC7D,eAAO,MAAM,eAAe,SAAS,KAAK,QAAQ,UAAU,QAAQ,EAAE,UAAU,CAAC;AAAA,MACnF,CAAC;AAGD,YAAM,eAAe,uBAAuB,kBAAkB,UAAU,KAAK,OAAO,QAAQ;AAE5F,aAAO;AAAA,IACT,SAAS,OAAO;AAEd,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU;AAC9D,aAAO;AAAA,QACL,QAAQ,CAAC;AAAA,UACP,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAA0D;AAC1E,WAAO,KAAK,SAA8B,gBAAgB,MAAM;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,oBAAoB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,oBAAoB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA4D;AAC7E,WAAO,KAAK,SAA+B,kBAAkB,MAAM;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,0BAA0B,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,2BAA2B,QAA8G;AAC7I,WAAO,KAAK,SAA6C,gCAAgC,MAAM;AAAA,EACjG;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA0F;AAC/G,WAAO,KAAK,SAAmC,sBAAsB,MAAM;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,QAA0E;AACvF,WAAO,KAAK,SAA2B,aAAa,MAAM;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAkF;AACnG,WAAO,KAAK,SAA+B,iBAAiB,MAAM;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAkE;AACtF,WAAO,KAAK,SAAkC,oBAAoB,MAAM;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAoE;AACzF,WAAO,KAAK,SAAmC,qBAAqB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,kBAAkB,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAAwD;AACvE,WAAO,KAAK,SAA6B,eAAe,MAAM;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,mBAAmB,MAAM;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAA8F;AACrH,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAA8F;AACrH,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAkE;AACtF,WAAO,KAAK,SAAkC,qBAAqB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAsE;AAC5F,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAA8F;AACrH,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAkG;AAC3H,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAkG;AAC3H,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAsE;AAC5F,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAkG;AAC3H,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,QAAsG;AACjI,WAAO,KAAK,SAAyC,4BAA4B,MAAM;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,uBAAuB,QAAsG;AACjI,WAAO,KAAK,SAAyC,4BAA4B,MAAM;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA0F;AAC/G,WAAO,KAAK,SAAmC,qBAAqB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,QAAkF;AAC9G,WAAO,KAAK,SAA0C,6BAA6B,MAAM;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,2BAA2B,MAAM;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA4E;AAC1F,WAAO,KAAK,SAA4B,cAAc,MAAM;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAA4F;AAClH,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAoE;AACzF,WAAO,KAAK,SAAmC,uBAAuB,MAAM;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAkE;AACtF,WAAO,KAAK,SAAkC,oBAAoB,MAAM;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,mBAAmB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAA4F;AAClH,WAAO,KAAK,SAAoC,uBAAuB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAoF;AACtG,WAAO,KAAK,SAAgC,mBAAmB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAAwE;AAC/F,WAAO,KAAK,SAAqC,wBAAwB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA0E;AAClG,WAAO,KAAK,SAAsC,yBAAyB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA8D;AAChF,WAAO,KAAK,SAAgC,mBAAmB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAAsD;AACpE,WAAO,KAAK,SAA4B,cAAc,MAAM;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA4D;AAC7E,WAAO,KAAK,SAA+B,iBAAiB,MAAM;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAkF;AACnG,WAAO,KAAK,SAA+B,iBAAiB,MAAM;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAsF;AACzG,WAAO,KAAK,SAAiC,mBAAmB,MAAM;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAAgF;AAChG,WAAO,KAAK,SAA8B,gBAAgB,MAAM;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA4E;AACrG,WAAO,KAAK,SAAuC,0BAA0B,MAAM;AAAA,EACrF;AAEF;AAKO,MAAM,gBAAgB;AAAA,EAC3B,YACU,SACA,QACR;AAFQ;AACA;AAAA,EACP;AAAA,EAFO;AAAA,EACA;AAAA,EAGV,MAAc,cAAiB,UAAkB,QAA2B;AAC1E,UAAM,SAAS,KAAK,QAAQ,IAAI,YAAU,IAAI,MAAM,QAAQ,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,WAAU,MAAc,SAAS,UAAU,MAAM,CAAC;AAC9E,WAAO,QAAQ,IAAI,QAAQ;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAA4D;AAC5E,WAAO,KAAK,cAAmC,gBAAgB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA8D;AAC/E,WAAO,KAAK,cAAoC,kBAAkB,MAAM;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,0BAA0B,MAAM;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,2BAA2B,QAAgH;AAC/I,WAAO,KAAK,cAAkD,gCAAgC,MAAM;AAAA,EACtG;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA4F;AACjH,WAAO,KAAK,cAAwC,sBAAsB,MAAM;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,QAA4E;AACzF,WAAO,KAAK,cAAgC,aAAa,MAAM;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAoF;AACrG,WAAO,KAAK,cAAoC,iBAAiB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAoE;AACxF,WAAO,KAAK,cAAuC,oBAAoB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAsE;AAC3F,WAAO,KAAK,cAAwC,qBAAqB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,kBAAkB,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAA0D;AACzE,WAAO,KAAK,cAAkC,eAAe,MAAM;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAwF;AAC3G,WAAO,KAAK,cAAsC,mBAAmB,MAAM;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAoE;AACxF,WAAO,KAAK,cAAuC,qBAAqB,MAAM;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAwE;AAC9F,WAAO,KAAK,cAAyC,uBAAuB,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAoG;AAC7H,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAoG;AAC7H,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAAwE;AAC9F,WAAO,KAAK,cAAyC,uBAAuB,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAAoG;AAC7H,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAA4F;AACjH,WAAO,KAAK,cAAwC,qBAAqB,MAAM;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,QAAoF;AAChH,WAAO,KAAK,cAA+C,6BAA6B,MAAM;AAAA,EAChG;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,2BAA2B,MAAM;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA8E;AAC5F,WAAO,KAAK,cAAiC,cAAc,MAAM;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,QAA8F;AACpH,WAAO,KAAK,cAAyC,uBAAuB,MAAM;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,QAAsE;AAC3F,WAAO,KAAK,cAAwC,uBAAuB,MAAM;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,QAAoE;AACxF,WAAO,KAAK,cAAuC,oBAAoB,MAAM;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,mBAAmB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAsF;AACxG,WAAO,KAAK,cAAqC,mBAAmB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAoB,QAA4E;AACpG,WAAO,KAAK,cAA2C,yBAAyB,MAAM;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgE;AAClF,WAAO,KAAK,cAAqC,mBAAmB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAAwD;AACtE,WAAO,KAAK,cAAiC,cAAc,MAAM;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAA8D;AAC/E,WAAO,KAAK,cAAoC,iBAAiB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAoF;AACrG,WAAO,KAAK,cAAoC,iBAAiB,MAAM;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,QAAwF;AAC3G,WAAO,KAAK,cAAsC,mBAAmB,MAAM;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,QAAkF;AAClG,WAAO,KAAK,cAAmC,gBAAgB,MAAM;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,qBAAqB,QAA8E;AACvG,WAAO,KAAK,cAA4C,0BAA0B,MAAM;AAAA,EAC1F;AAEF;","names":[]}

package/dist/lib/auth/index.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 export * from "./oauth/index.mjs";
 function generateUUID() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, function(c) {

package/dist/lib/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/auth/index.ts"],"sourcesContent":["import type { AgentConfig } from '../types';\n\n// ====== OAuth Support ======\nexport * from './oauth';\n\n/**\n * Generate UUID for request tracking\n */\nexport function generateUUID(): string {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {\n    const r = (Math.random() * 16) | 0;\n    const v = c == 'x' ? r : (r & 0x3) | 0x8;\n    return v.toString(16);\n  });\n}\n\n/**\n * Get authentication token for an agent.\n *\n * Returns, in order:\n * 1. The cached client-credentials access token (when the agent declares\n *    `oauth_client_credentials`). These tokens are refreshed via secret\n *    re-exchange, not the MCP SDK's `refresh_token` grant, so the bearer\n *    path is the correct transport — there is no \"refresh on 401\" hook\n *    the SDK can use, and the call path pre-refreshes them anyway.\n * 2. The static `auth_token`.\n *\n * Tokens from the authorization-code flow (`oauth_tokens` without\n * `oauth_client_credentials`) are handled separately by the OAuth provider\n * path in `ProtocolClient.callTool` and intentionally do NOT surface here.\n */\nexport function getAuthToken(agent: AgentConfig): string | undefined {\n  if (agent.oauth_client_credentials && agent.oauth_tokens?.access_token) {\n    return agent.oauth_tokens.access_token;\n  }\n  return agent.auth_token;\n}\n\n/**\n * Create AdCP-compliant headers\n */\nexport function createAdCPHeaders(authToken?: string, isMCP: boolean = false): Record<string, string> {\n  return {\n    'Content-Type': isMCP ? 'application/json' : 'application/vnd.adcp+json',\n    'AdCP-Version': '1.0',\n    'AdCP-Request-ID': generateUUID(),\n    'User-Agent': 'AdCP-Testing-Framework/1.0.0',\n    Accept: isMCP ? 'application/json, text/event-stream' : 'application/vnd.adcp+json, application/json',\n    ...(authToken && { Authorization: `Bearer ${authToken}` }),\n  };\n}\n\n/**\n * Create an authenticated fetch function for A2A client\n */\nexport function createAuthenticatedFetch(authToken: string) {\n  return async (url: string | URL | Request, options?: RequestInit) => {\n    const headers = createAdCPHeaders(authToken);\n\n    return fetch(url, {\n      ...options,\n      headers: {\n        ...headers,\n        ...(options?.headers || {}),\n      },\n    });\n  };\n}\n\n/**\n * Create MCP authentication headers\n *\n * Sends both:\n * - Authorization: Bearer (standard OAuth, required by OAuth-protected MCP servers)\n * - x-adcp-auth (AdCP-specific header for backwards compatibility)\n */\nexport function createMCPAuthHeaders(authToken?: string): Record<string, string> {\n  const headers: Record<string, string> = {\n    Accept: 'application/json, text/event-stream',\n  };\n\n  if (authToken) {\n    headers['Authorization'] = `Bearer ${authToken}`;\n    headers['x-adcp-auth'] = authToken;\n  }\n\n  return headers;\n}\n"],"mappings":";;;;;;AAGA,cAAc;AAKP,SAAS,eAAuB;AACrC,SAAO,uCAAuC,QAAQ,SAAS,SAAU,GAAG;AAC1E,UAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,UAAM,IAAI,KAAK,MAAM,IAAK,IAAI,IAAO;AACrC,WAAO,EAAE,SAAS,EAAE;AAAA,EACtB,CAAC;AACH;AAiBO,SAAS,aAAa,OAAwC;AACnE,MAAI,MAAM,4BAA4B,MAAM,cAAc,cAAc;AACtE,WAAO,MAAM,aAAa;AAAA,EAC5B;AACA,SAAO,MAAM;AACf;AAKO,SAAS,kBAAkB,WAAoB,QAAiB,OAA+B;AACpG,SAAO;AAAA,IACL,gBAAgB,QAAQ,qBAAqB;AAAA,IAC7C,gBAAgB;AAAA,IAChB,mBAAmB,aAAa;AAAA,IAChC,cAAc;AAAA,IACd,QAAQ,QAAQ,wCAAwC;AAAA,IACxD,GAAI,aAAa,EAAE,eAAe,UAAU,SAAS,GAAG;AAAA,EAC1D;AACF;AAKO,SAAS,yBAAyB,WAAmB;AAC1D,SAAO,OAAO,KAA6B,YAA0B;AACnE,UAAM,UAAU,kBAAkB,SAAS;AAE3C,WAAO,MAAM,KAAK;AAAA,MAChB,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAG;AAAA,QACH,GAAI,SAAS,WAAW,CAAC;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AACF;AASO,SAAS,qBAAqB,WAA4C;AAC/E,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,EACV;AAEA,MAAI,WAAW;AACb,YAAQ,eAAe,IAAI,UAAU,SAAS;AAC9C,YAAQ,aAAa,IAAI;AAAA,EAC3B;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/lib/auth/index.ts"],"sourcesContent":["import type { AgentConfig } from '../types';\n\n// ====== OAuth Support ======\nexport * from './oauth';\n\n/**\n * Generate UUID for request tracking\n */\nexport function generateUUID(): string {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {\n    const r = (Math.random() * 16) | 0;\n    const v = c == 'x' ? r : (r & 0x3) | 0x8;\n    return v.toString(16);\n  });\n}\n\n/**\n * Get authentication token for an agent.\n *\n * Returns, in order:\n * 1. The cached client-credentials access token (when the agent declares\n *    `oauth_client_credentials`). These tokens are refreshed via secret\n *    re-exchange, not the MCP SDK's `refresh_token` grant, so the bearer\n *    path is the correct transport — there is no \"refresh on 401\" hook\n *    the SDK can use, and the call path pre-refreshes them anyway.\n * 2. The static `auth_token`.\n *\n * Tokens from the authorization-code flow (`oauth_tokens` without\n * `oauth_client_credentials`) are handled separately by the OAuth provider\n * path in `ProtocolClient.callTool` and intentionally do NOT surface here.\n */\nexport function getAuthToken(agent: AgentConfig): string | undefined {\n  if (agent.oauth_client_credentials && agent.oauth_tokens?.access_token) {\n    return agent.oauth_tokens.access_token;\n  }\n  return agent.auth_token;\n}\n\n/**\n * Create AdCP-compliant headers\n */\nexport function createAdCPHeaders(authToken?: string, isMCP: boolean = false): Record<string, string> {\n  return {\n    'Content-Type': isMCP ? 'application/json' : 'application/vnd.adcp+json',\n    'AdCP-Version': '1.0',\n    'AdCP-Request-ID': generateUUID(),\n    'User-Agent': 'AdCP-Testing-Framework/1.0.0',\n    Accept: isMCP ? 'application/json, text/event-stream' : 'application/vnd.adcp+json, application/json',\n    ...(authToken && { Authorization: `Bearer ${authToken}` }),\n  };\n}\n\n/**\n * Create an authenticated fetch function for A2A client\n */\nexport function createAuthenticatedFetch(authToken: string) {\n  return async (url: string | URL | Request, options?: RequestInit) => {\n    const headers = createAdCPHeaders(authToken);\n\n    return fetch(url, {\n      ...options,\n      headers: {\n        ...headers,\n        ...(options?.headers || {}),\n      },\n    });\n  };\n}\n\n/**\n * Create MCP authentication headers\n *\n * Sends both:\n * - Authorization: Bearer (standard OAuth, required by OAuth-protected MCP servers)\n * - x-adcp-auth (AdCP-specific header for backwards compatibility)\n */\nexport function createMCPAuthHeaders(authToken?: string): Record<string, string> {\n  const headers: Record<string, string> = {\n    Accept: 'application/json, text/event-stream',\n  };\n\n  if (authToken) {\n    headers['Authorization'] = `Bearer ${authToken}`;\n    headers['x-adcp-auth'] = authToken;\n  }\n\n  return headers;\n}\n"],"mappings":"AAGA,cAAc;AAKP,SAAS,eAAuB;AACrC,SAAO,uCAAuC,QAAQ,SAAS,SAAU,GAAG;AAC1E,UAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,UAAM,IAAI,KAAK,MAAM,IAAK,IAAI,IAAO;AACrC,WAAO,EAAE,SAAS,EAAE;AAAA,EACtB,CAAC;AACH;AAiBO,SAAS,aAAa,OAAwC;AACnE,MAAI,MAAM,4BAA4B,MAAM,cAAc,cAAc;AACtE,WAAO,MAAM,aAAa;AAAA,EAC5B;AACA,SAAO,MAAM;AACf;AAKO,SAAS,kBAAkB,WAAoB,QAAiB,OAA+B;AACpG,SAAO;AAAA,IACL,gBAAgB,QAAQ,qBAAqB;AAAA,IAC7C,gBAAgB;AAAA,IAChB,mBAAmB,aAAa;AAAA,IAChC,cAAc;AAAA,IACd,QAAQ,QAAQ,wCAAwC;AAAA,IACxD,GAAI,aAAa,EAAE,eAAe,UAAU,SAAS,GAAG;AAAA,EAC1D;AACF;AAKO,SAAS,yBAAyB,WAAmB;AAC1D,SAAO,OAAO,KAA6B,YAA0B;AACnE,UAAM,UAAU,kBAAkB,SAAS;AAE3C,WAAO,MAAM,KAAK;AAAA,MAChB,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAG;AAAA,QACH,GAAI,SAAS,WAAW,CAAC;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH;AACF;AASO,SAAS,qBAAqB,WAA4C;AAC/E,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,EACV;AAEA,MAAI,WAAW;AACb,YAAQ,eAAe,IAAI,UAAU,SAAS;AAC9C,YAAQ,aAAa,IAAI;AAAA,EAC3B;AAEA,SAAO;AACT;","names":[]}

package/dist/lib/auth/oauth/CLIFlowHandler.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { createServer } from "http";
 import { spawn } from "child_process";
 import { URL } from "url";

package/dist/lib/auth/oauth/CLIFlowHandler.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/CLIFlowHandler.ts"],"sourcesContent":["/**\n * CLI OAuth flow handler\n *\n * Opens the user's browser for authorization and\n * starts a local HTTP server to receive the callback.\n */\n\nimport { createServer, Server, IncomingMessage, ServerResponse } from 'http';\nimport { spawn } from 'child_process';\nimport { URL } from 'url';\nimport { platform } from 'os';\nimport type { OAuthFlowHandler } from './types';\nimport { OAuthCancelledError, OAuthTimeoutError } from './types';\n\n/**\n * Configuration for CLI OAuth flow\n */\nexport interface CLIFlowHandlerConfig {\n  /** Port for the callback server (default: 8766) */\n  callbackPort?: number;\n  /** Timeout in ms for waiting for callback (default: 300000 = 5 min) */\n  timeout?: number;\n  /** Custom callback path (default: /callback) */\n  callbackPath?: string;\n  /** Suppress console output */\n  quiet?: boolean;\n}\n\n/**\n * CLI OAuth flow handler implementation\n *\n * Handles the OAuth flow for command-line tools by:\n * 1. Opening the authorization URL in the user's default browser\n * 2. Starting a local HTTP server to receive the callback\n * 3. Extracting and returning the authorization code\n *\n * @example\n * ```typescript\n * const flow = new CLIFlowHandler({ callbackPort: 8766 });\n * await flow.redirectToAuthorization(new URL('https://auth.example.com/authorize?...'));\n * const code = await flow.waitForCallback();\n * await flow.cleanup();\n * ```\n */\nexport class CLIFlowHandler implements OAuthFlowHandler {\n  private readonly port: number;\n  private readonly timeout: number;\n  private readonly callbackPath: string;\n  private readonly quiet: boolean;\n  private server: Server | null = null;\n  private pendingCallback: {\n    resolve: (code: string) => void;\n    reject: (error: Error) => void;\n  } | null = null;\n\n  constructor(config: CLIFlowHandlerConfig = {}) {\n    this.port = config.callbackPort ?? 8766;\n    this.timeout = config.timeout ?? 300000; // 5 minutes\n    this.callbackPath = config.callbackPath ?? '/callback';\n    this.quiet = config.quiet ?? false;\n  }\n\n  getRedirectUrl(): string {\n    return `http://localhost:${this.port}${this.callbackPath}`;\n  }\n\n  /**\n   * Open URL in the user's default browser\n   *\n   * Uses spawn with separate arguments to avoid command injection risks.\n   * The URL is passed as an argument, not interpolated into a shell command.\n   */\n  private async openBrowser(url: string): Promise<void> {\n    return new Promise(resolve => {\n      let command: string;\n      let args: string[];\n\n      switch (platform()) {\n        case 'darwin':\n          command = 'open';\n          args = [url];\n          break;\n        case 'win32':\n          command = 'cmd';\n          args = ['/c', 'start', '', url];\n          break;\n        default:\n          // Linux and others - try xdg-open\n          command = 'xdg-open';\n          args = [url];\n      }\n\n      const child = spawn(command, args, {\n        detached: true,\n        stdio: 'ignore',\n      });\n\n      child.on('error', error => {\n        if (!this.quiet) {\n          console.error(`Failed to open browser: ${error.message}`);\n          console.log(`Please manually open: ${url}`);\n        }\n        // Don't reject - user can manually open the URL\n        resolve();\n      });\n\n      // Unref so the parent process can exit\n      child.unref();\n      resolve();\n    });\n  }\n\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    const url = authorizationUrl.toString();\n\n    if (!this.quiet) {\n      console.log('');\n      console.log('Opening browser for authorization...');\n      console.log(`URL: ${url}`);\n      console.log('');\n    }\n\n    await this.openBrowser(url);\n  }\n\n  async waitForCallback(): Promise<string> {\n    return new Promise((resolve, reject) => {\n      // Set up timeout\n      const timeoutId = setTimeout(() => {\n        this.cleanup();\n        reject(new OAuthTimeoutError(undefined, this.timeout));\n      }, this.timeout);\n\n      this.pendingCallback = {\n        resolve: (code: string) => {\n          clearTimeout(timeoutId);\n          resolve(code);\n        },\n        reject: (error: Error) => {\n          clearTimeout(timeoutId);\n          reject(error);\n        },\n      };\n\n      // Start the callback server\n      this.server = createServer((req: IncomingMessage, res: ServerResponse) => {\n        this.handleRequest(req, res);\n      });\n\n      this.server.on('error', error => {\n        if (this.pendingCallback) {\n          this.pendingCallback.reject(new Error(`Callback server error: ${error.message}`));\n        }\n      });\n\n      this.server.listen(this.port, '127.0.0.1', () => {\n        if (!this.quiet) {\n          console.log(`Waiting for authorization callback on port ${this.port}...`);\n          console.log('(Press Ctrl+C to cancel)');\n          console.log('');\n        }\n      });\n    });\n  }\n\n  private handleRequest(req: IncomingMessage, res: ServerResponse): void {\n    const url = new URL(req.url || '/', `http://localhost:${this.port}`);\n\n    // Ignore favicon requests\n    if (url.pathname === '/favicon.ico') {\n      res.writeHead(404);\n      res.end();\n      return;\n    }\n\n    // Only handle the callback path\n    if (url.pathname !== this.callbackPath) {\n      res.writeHead(404);\n      res.end('Not found');\n      return;\n    }\n\n    const code = url.searchParams.get('code');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n\n    if (error) {\n      const errorMsg = errorDescription || error;\n      this.sendErrorResponse(res, errorMsg);\n\n      if (this.pendingCallback) {\n        if (error === 'access_denied') {\n          this.pendingCallback.reject(new OAuthCancelledError());\n        } else {\n          this.pendingCallback.reject(new Error(`OAuth error: ${errorMsg}`));\n        }\n      }\n      return;\n    }\n\n    if (!code) {\n      this.sendErrorResponse(res, 'No authorization code received');\n      if (this.pendingCallback) {\n        this.pendingCallback.reject(new Error('No authorization code received'));\n      }\n      return;\n    }\n\n    // Success!\n    this.sendSuccessResponse(res);\n\n    if (this.pendingCallback) {\n      this.pendingCallback.resolve(code);\n    }\n\n    // Clean up after a short delay to ensure response is sent\n    setTimeout(() => this.cleanup(), 1000);\n  }\n\n  private sendSuccessResponse(res: ServerResponse): void {\n    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n<!DOCTYPE html>\n<html>\n<head>\n  <meta charset=\"utf-8\">\n  <title>Authorization Successful</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      display: flex;\n      justify-content: center;\n      align-items: center;\n      height: 100vh;\n      margin: 0;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n    }\n    .card {\n      background: white;\n      padding: 40px;\n      border-radius: 12px;\n      box-shadow: 0 10px 40px rgba(0,0,0,0.2);\n      text-align: center;\n      max-width: 400px;\n    }\n    h1 { color: #22c55e; margin-top: 0; }\n    p { color: #666; line-height: 1.6; }\n    .icon { font-size: 48px; margin-bottom: 20px; color: #22c55e; }\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"icon\">&#10003;</div>\n    <h1>Authorization Successful</h1>\n    <p>You can close this window and return to your terminal.</p>\n    <p><small>This window will close automatically in 3 seconds...</small></p>\n  </div>\n  <script>setTimeout(() => window.close(), 3000);</script>\n</body>\n</html>\n    `);\n  }\n\n  private sendErrorResponse(res: ServerResponse, error: string): void {\n    res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n<!DOCTYPE html>\n<html>\n<head>\n  <meta charset=\"utf-8\">\n  <title>Authorization Failed</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      display: flex;\n      justify-content: center;\n      align-items: center;\n      height: 100vh;\n      margin: 0;\n      background: linear-gradient(135deg, #f87171 0%, #dc2626 100%);\n    }\n    .card {\n      background: white;\n      padding: 40px;\n      border-radius: 12px;\n      box-shadow: 0 10px 40px rgba(0,0,0,0.2);\n      text-align: center;\n      max-width: 400px;\n    }\n    h1 { color: #dc2626; margin-top: 0; }\n    p { color: #666; line-height: 1.6; }\n    .error { color: #dc2626; background: #fef2f2; padding: 10px; border-radius: 6px; }\n    .icon { font-size: 48px; margin-bottom: 20px; color: #dc2626; }\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"icon\">&#10007;</div>\n    <h1>Authorization Failed</h1>\n    <p class=\"error\">${escapeHtml(error)}</p>\n    <p>Please close this window and try again.</p>\n  </div>\n</body>\n</html>\n    `);\n  }\n\n  async cleanup(): Promise<void> {\n    if (this.server) {\n      return new Promise(resolve => {\n        this.server!.close(() => {\n          this.server = null;\n          resolve();\n        });\n      });\n    }\n  }\n}\n\n/**\n * Escape HTML entities to prevent XSS\n */\nfunction escapeHtml(text: string): string {\n  return text\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#039;');\n}\n"],"mappings":";;;;;;AAOA,SAAS,oBAA6D;AACtE,SAAS,aAAa;AACtB,SAAS,WAAW;AACpB,SAAS,gBAAgB;AAEzB,SAAS,qBAAqB,yBAAyB;AAgChD,MAAM,eAA2C;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,SAAwB;AAAA,EACxB,kBAGG;AAAA,EAEX,YAAY,SAA+B,CAAC,GAAG;AAC7C,SAAK,OAAO,OAAO,gBAAgB;AACnC,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,eAAe,OAAO,gBAAgB;AAC3C,SAAK,QAAQ,OAAO,SAAS;AAAA,EAC/B;AAAA,EAEA,iBAAyB;AACvB,WAAO,oBAAoB,KAAK,IAAI,GAAG,KAAK,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,YAAY,KAA4B;AACpD,WAAO,IAAI,QAAQ,aAAW;AAC5B,UAAI;AACJ,UAAI;AAEJ,cAAQ,SAAS,GAAG;AAAA,QAClB,KAAK;AACH,oBAAU;AACV,iBAAO,CAAC,GAAG;AACX;AAAA,QACF,KAAK;AACH,oBAAU;AACV,iBAAO,CAAC,MAAM,SAAS,IAAI,GAAG;AAC9B;AAAA,QACF;AAEE,oBAAU;AACV,iBAAO,CAAC,GAAG;AAAA,MACf;AAEA,YAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,QACjC,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AAED,YAAM,GAAG,SAAS,WAAS;AACzB,YAAI,CAAC,KAAK,OAAO;AACf,kBAAQ,MAAM,2BAA2B,MAAM,OAAO,EAAE;AACxD,kBAAQ,IAAI,yBAAyB,GAAG,EAAE;AAAA,QAC5C;AAEA,gBAAQ;AAAA,MACV,CAAC;AAGD,YAAM,MAAM;AACZ,cAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,MAAM,iBAAiB,SAAS;AAEtC,QAAI,CAAC,KAAK,OAAO;AACf,cAAQ,IAAI,EAAE;AACd,cAAQ,IAAI,sCAAsC;AAClD,cAAQ,IAAI,QAAQ,GAAG,EAAE;AACzB,cAAQ,IAAI,EAAE;AAAA,IAChB;AAEA,UAAM,KAAK,YAAY,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,kBAAmC;AACvC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAEtC,YAAM,YAAY,WAAW,MAAM;AACjC,aAAK,QAAQ;AACb,eAAO,IAAI,kBAAkB,QAAW,KAAK,OAAO,CAAC;AAAA,MACvD,GAAG,KAAK,OAAO;AAEf,WAAK,kBAAkB;AAAA,QACrB,SAAS,CAAC,SAAiB;AACzB,uBAAa,SAAS;AACtB,kBAAQ,IAAI;AAAA,QACd;AAAA,QACA,QAAQ,CAAC,UAAiB;AACxB,uBAAa,SAAS;AACtB,iBAAO,KAAK;AAAA,QACd;AAAA,MACF;AAGA,WAAK,SAAS,aAAa,CAAC,KAAsB,QAAwB;AACxE,aAAK,cAAc,KAAK,GAAG;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,SAAS,WAAS;AAC/B,YAAI,KAAK,iBAAiB;AACxB,eAAK,gBAAgB,OAAO,IAAI,MAAM,0BAA0B,MAAM,OAAO,EAAE,CAAC;AAAA,QAClF;AAAA,MACF,CAAC;AAED,WAAK,OAAO,OAAO,KAAK,MAAM,aAAa,MAAM;AAC/C,YAAI,CAAC,KAAK,OAAO;AACf,kBAAQ,IAAI,8CAA8C,KAAK,IAAI,KAAK;AACxE,kBAAQ,IAAI,0BAA0B;AACtC,kBAAQ,IAAI,EAAE;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEQ,cAAc,KAAsB,KAA2B;AACrE,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,KAAK,IAAI,EAAE;AAGnE,QAAI,IAAI,aAAa,gBAAgB;AACnC,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI;AACR;AAAA,IACF;AAGA,QAAI,IAAI,aAAa,KAAK,cAAc;AACtC,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,UAAM,mBAAmB,IAAI,aAAa,IAAI,mBAAmB;AAEjE,QAAI,OAAO;AACT,YAAM,WAAW,oBAAoB;AACrC,WAAK,kBAAkB,KAAK,QAAQ;AAEpC,UAAI,KAAK,iBAAiB;AACxB,YAAI,UAAU,iBAAiB;AAC7B,eAAK,gBAAgB,OAAO,IAAI,oBAAoB,CAAC;AAAA,QACvD,OAAO;AACL,eAAK,gBAAgB,OAAO,IAAI,MAAM,gBAAgB,QAAQ,EAAE,CAAC;AAAA,QACnE;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI,CAAC,MAAM;AACT,WAAK,kBAAkB,KAAK,gCAAgC;AAC5D,UAAI,KAAK,iBAAiB;AACxB,aAAK,gBAAgB,OAAO,IAAI,MAAM,gCAAgC,CAAC;AAAA,MACzE;AACA;AAAA,IACF;AAGA,SAAK,oBAAoB,GAAG;AAE5B,QAAI,KAAK,iBAAiB;AACxB,WAAK,gBAAgB,QAAQ,IAAI;AAAA,IACnC;AAGA,eAAW,MAAM,KAAK,QAAQ,GAAG,GAAI;AAAA,EACvC;AAAA,EAEQ,oBAAoB,KAA2B;AACrD,QAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;AACjE,QAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAuCP;AAAA,EACH;AAAA,EAEQ,kBAAkB,KAAqB,OAAqB;AAClE,QAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;AACjE,QAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAkCW,WAAW,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,KAKnC;AAAA,EACH;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,QAAQ;AACf,aAAO,IAAI,QAAQ,aAAW;AAC5B,aAAK,OAAQ,MAAM,MAAM;AACvB,eAAK,SAAS;AACd,kBAAQ;AAAA,QACV,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAKA,SAAS,WAAW,MAAsB;AACxC,SAAO,KACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,QAAQ;AAC3B;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/CLIFlowHandler.ts"],"sourcesContent":["/**\n * CLI OAuth flow handler\n *\n * Opens the user's browser for authorization and\n * starts a local HTTP server to receive the callback.\n */\n\nimport { createServer, Server, IncomingMessage, ServerResponse } from 'http';\nimport { spawn } from 'child_process';\nimport { URL } from 'url';\nimport { platform } from 'os';\nimport type { OAuthFlowHandler } from './types';\nimport { OAuthCancelledError, OAuthTimeoutError } from './types';\n\n/**\n * Configuration for CLI OAuth flow\n */\nexport interface CLIFlowHandlerConfig {\n  /** Port for the callback server (default: 8766) */\n  callbackPort?: number;\n  /** Timeout in ms for waiting for callback (default: 300000 = 5 min) */\n  timeout?: number;\n  /** Custom callback path (default: /callback) */\n  callbackPath?: string;\n  /** Suppress console output */\n  quiet?: boolean;\n}\n\n/**\n * CLI OAuth flow handler implementation\n *\n * Handles the OAuth flow for command-line tools by:\n * 1. Opening the authorization URL in the user's default browser\n * 2. Starting a local HTTP server to receive the callback\n * 3. Extracting and returning the authorization code\n *\n * @example\n * ```typescript\n * const flow = new CLIFlowHandler({ callbackPort: 8766 });\n * await flow.redirectToAuthorization(new URL('https://auth.example.com/authorize?...'));\n * const code = await flow.waitForCallback();\n * await flow.cleanup();\n * ```\n */\nexport class CLIFlowHandler implements OAuthFlowHandler {\n  private readonly port: number;\n  private readonly timeout: number;\n  private readonly callbackPath: string;\n  private readonly quiet: boolean;\n  private server: Server | null = null;\n  private pendingCallback: {\n    resolve: (code: string) => void;\n    reject: (error: Error) => void;\n  } | null = null;\n\n  constructor(config: CLIFlowHandlerConfig = {}) {\n    this.port = config.callbackPort ?? 8766;\n    this.timeout = config.timeout ?? 300000; // 5 minutes\n    this.callbackPath = config.callbackPath ?? '/callback';\n    this.quiet = config.quiet ?? false;\n  }\n\n  getRedirectUrl(): string {\n    return `http://localhost:${this.port}${this.callbackPath}`;\n  }\n\n  /**\n   * Open URL in the user's default browser\n   *\n   * Uses spawn with separate arguments to avoid command injection risks.\n   * The URL is passed as an argument, not interpolated into a shell command.\n   */\n  private async openBrowser(url: string): Promise<void> {\n    return new Promise(resolve => {\n      let command: string;\n      let args: string[];\n\n      switch (platform()) {\n        case 'darwin':\n          command = 'open';\n          args = [url];\n          break;\n        case 'win32':\n          command = 'cmd';\n          args = ['/c', 'start', '', url];\n          break;\n        default:\n          // Linux and others - try xdg-open\n          command = 'xdg-open';\n          args = [url];\n      }\n\n      const child = spawn(command, args, {\n        detached: true,\n        stdio: 'ignore',\n      });\n\n      child.on('error', error => {\n        if (!this.quiet) {\n          console.error(`Failed to open browser: ${error.message}`);\n          console.log(`Please manually open: ${url}`);\n        }\n        // Don't reject - user can manually open the URL\n        resolve();\n      });\n\n      // Unref so the parent process can exit\n      child.unref();\n      resolve();\n    });\n  }\n\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    const url = authorizationUrl.toString();\n\n    if (!this.quiet) {\n      console.log('');\n      console.log('Opening browser for authorization...');\n      console.log(`URL: ${url}`);\n      console.log('');\n    }\n\n    await this.openBrowser(url);\n  }\n\n  async waitForCallback(): Promise<string> {\n    return new Promise((resolve, reject) => {\n      // Set up timeout\n      const timeoutId = setTimeout(() => {\n        this.cleanup();\n        reject(new OAuthTimeoutError(undefined, this.timeout));\n      }, this.timeout);\n\n      this.pendingCallback = {\n        resolve: (code: string) => {\n          clearTimeout(timeoutId);\n          resolve(code);\n        },\n        reject: (error: Error) => {\n          clearTimeout(timeoutId);\n          reject(error);\n        },\n      };\n\n      // Start the callback server\n      this.server = createServer((req: IncomingMessage, res: ServerResponse) => {\n        this.handleRequest(req, res);\n      });\n\n      this.server.on('error', error => {\n        if (this.pendingCallback) {\n          this.pendingCallback.reject(new Error(`Callback server error: ${error.message}`));\n        }\n      });\n\n      this.server.listen(this.port, '127.0.0.1', () => {\n        if (!this.quiet) {\n          console.log(`Waiting for authorization callback on port ${this.port}...`);\n          console.log('(Press Ctrl+C to cancel)');\n          console.log('');\n        }\n      });\n    });\n  }\n\n  private handleRequest(req: IncomingMessage, res: ServerResponse): void {\n    const url = new URL(req.url || '/', `http://localhost:${this.port}`);\n\n    // Ignore favicon requests\n    if (url.pathname === '/favicon.ico') {\n      res.writeHead(404);\n      res.end();\n      return;\n    }\n\n    // Only handle the callback path\n    if (url.pathname !== this.callbackPath) {\n      res.writeHead(404);\n      res.end('Not found');\n      return;\n    }\n\n    const code = url.searchParams.get('code');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n\n    if (error) {\n      const errorMsg = errorDescription || error;\n      this.sendErrorResponse(res, errorMsg);\n\n      if (this.pendingCallback) {\n        if (error === 'access_denied') {\n          this.pendingCallback.reject(new OAuthCancelledError());\n        } else {\n          this.pendingCallback.reject(new Error(`OAuth error: ${errorMsg}`));\n        }\n      }\n      return;\n    }\n\n    if (!code) {\n      this.sendErrorResponse(res, 'No authorization code received');\n      if (this.pendingCallback) {\n        this.pendingCallback.reject(new Error('No authorization code received'));\n      }\n      return;\n    }\n\n    // Success!\n    this.sendSuccessResponse(res);\n\n    if (this.pendingCallback) {\n      this.pendingCallback.resolve(code);\n    }\n\n    // Clean up after a short delay to ensure response is sent\n    setTimeout(() => this.cleanup(), 1000);\n  }\n\n  private sendSuccessResponse(res: ServerResponse): void {\n    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n<!DOCTYPE html>\n<html>\n<head>\n  <meta charset=\"utf-8\">\n  <title>Authorization Successful</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      display: flex;\n      justify-content: center;\n      align-items: center;\n      height: 100vh;\n      margin: 0;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n    }\n    .card {\n      background: white;\n      padding: 40px;\n      border-radius: 12px;\n      box-shadow: 0 10px 40px rgba(0,0,0,0.2);\n      text-align: center;\n      max-width: 400px;\n    }\n    h1 { color: #22c55e; margin-top: 0; }\n    p { color: #666; line-height: 1.6; }\n    .icon { font-size: 48px; margin-bottom: 20px; color: #22c55e; }\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"icon\">&#10003;</div>\n    <h1>Authorization Successful</h1>\n    <p>You can close this window and return to your terminal.</p>\n    <p><small>This window will close automatically in 3 seconds...</small></p>\n  </div>\n  <script>setTimeout(() => window.close(), 3000);</script>\n</body>\n</html>\n    `);\n  }\n\n  private sendErrorResponse(res: ServerResponse, error: string): void {\n    res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n<!DOCTYPE html>\n<html>\n<head>\n  <meta charset=\"utf-8\">\n  <title>Authorization Failed</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;\n      display: flex;\n      justify-content: center;\n      align-items: center;\n      height: 100vh;\n      margin: 0;\n      background: linear-gradient(135deg, #f87171 0%, #dc2626 100%);\n    }\n    .card {\n      background: white;\n      padding: 40px;\n      border-radius: 12px;\n      box-shadow: 0 10px 40px rgba(0,0,0,0.2);\n      text-align: center;\n      max-width: 400px;\n    }\n    h1 { color: #dc2626; margin-top: 0; }\n    p { color: #666; line-height: 1.6; }\n    .error { color: #dc2626; background: #fef2f2; padding: 10px; border-radius: 6px; }\n    .icon { font-size: 48px; margin-bottom: 20px; color: #dc2626; }\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"icon\">&#10007;</div>\n    <h1>Authorization Failed</h1>\n    <p class=\"error\">${escapeHtml(error)}</p>\n    <p>Please close this window and try again.</p>\n  </div>\n</body>\n</html>\n    `);\n  }\n\n  async cleanup(): Promise<void> {\n    if (this.server) {\n      return new Promise(resolve => {\n        this.server!.close(() => {\n          this.server = null;\n          resolve();\n        });\n      });\n    }\n  }\n}\n\n/**\n * Escape HTML entities to prevent XSS\n */\nfunction escapeHtml(text: string): string {\n  return text\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#039;');\n}\n"],"mappings":"AAOA,SAAS,oBAA6D;AACtE,SAAS,aAAa;AACtB,SAAS,WAAW;AACpB,SAAS,gBAAgB;AAEzB,SAAS,qBAAqB,yBAAyB;AAgChD,MAAM,eAA2C;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,SAAwB;AAAA,EACxB,kBAGG;AAAA,EAEX,YAAY,SAA+B,CAAC,GAAG;AAC7C,SAAK,OAAO,OAAO,gBAAgB;AACnC,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,eAAe,OAAO,gBAAgB;AAC3C,SAAK,QAAQ,OAAO,SAAS;AAAA,EAC/B;AAAA,EAEA,iBAAyB;AACvB,WAAO,oBAAoB,KAAK,IAAI,GAAG,KAAK,YAAY;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,YAAY,KAA4B;AACpD,WAAO,IAAI,QAAQ,aAAW;AAC5B,UAAI;AACJ,UAAI;AAEJ,cAAQ,SAAS,GAAG;AAAA,QAClB,KAAK;AACH,oBAAU;AACV,iBAAO,CAAC,GAAG;AACX;AAAA,QACF,KAAK;AACH,oBAAU;AACV,iBAAO,CAAC,MAAM,SAAS,IAAI,GAAG;AAC9B;AAAA,QACF;AAEE,oBAAU;AACV,iBAAO,CAAC,GAAG;AAAA,MACf;AAEA,YAAM,QAAQ,MAAM,SAAS,MAAM;AAAA,QACjC,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AAED,YAAM,GAAG,SAAS,WAAS;AACzB,YAAI,CAAC,KAAK,OAAO;AACf,kBAAQ,MAAM,2BAA2B,MAAM,OAAO,EAAE;AACxD,kBAAQ,IAAI,yBAAyB,GAAG,EAAE;AAAA,QAC5C;AAEA,gBAAQ;AAAA,MACV,CAAC;AAGD,YAAM,MAAM;AACZ,cAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,MAAM,iBAAiB,SAAS;AAEtC,QAAI,CAAC,KAAK,OAAO;AACf,cAAQ,IAAI,EAAE;AACd,cAAQ,IAAI,sCAAsC;AAClD,cAAQ,IAAI,QAAQ,GAAG,EAAE;AACzB,cAAQ,IAAI,EAAE;AAAA,IAChB;AAEA,UAAM,KAAK,YAAY,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,kBAAmC;AACvC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAEtC,YAAM,YAAY,WAAW,MAAM;AACjC,aAAK,QAAQ;AACb,eAAO,IAAI,kBAAkB,QAAW,KAAK,OAAO,CAAC;AAAA,MACvD,GAAG,KAAK,OAAO;AAEf,WAAK,kBAAkB;AAAA,QACrB,SAAS,CAAC,SAAiB;AACzB,uBAAa,SAAS;AACtB,kBAAQ,IAAI;AAAA,QACd;AAAA,QACA,QAAQ,CAAC,UAAiB;AACxB,uBAAa,SAAS;AACtB,iBAAO,KAAK;AAAA,QACd;AAAA,MACF;AAGA,WAAK,SAAS,aAAa,CAAC,KAAsB,QAAwB;AACxE,aAAK,cAAc,KAAK,GAAG;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,SAAS,WAAS;AAC/B,YAAI,KAAK,iBAAiB;AACxB,eAAK,gBAAgB,OAAO,IAAI,MAAM,0BAA0B,MAAM,OAAO,EAAE,CAAC;AAAA,QAClF;AAAA,MACF,CAAC;AAED,WAAK,OAAO,OAAO,KAAK,MAAM,aAAa,MAAM;AAC/C,YAAI,CAAC,KAAK,OAAO;AACf,kBAAQ,IAAI,8CAA8C,KAAK,IAAI,KAAK;AACxE,kBAAQ,IAAI,0BAA0B;AACtC,kBAAQ,IAAI,EAAE;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEQ,cAAc,KAAsB,KAA2B;AACrE,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,KAAK,IAAI,EAAE;AAGnE,QAAI,IAAI,aAAa,gBAAgB;AACnC,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI;AACR;AAAA,IACF;AAGA,QAAI,IAAI,aAAa,KAAK,cAAc;AACtC,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,UAAM,mBAAmB,IAAI,aAAa,IAAI,mBAAmB;AAEjE,QAAI,OAAO;AACT,YAAM,WAAW,oBAAoB;AACrC,WAAK,kBAAkB,KAAK,QAAQ;AAEpC,UAAI,KAAK,iBAAiB;AACxB,YAAI,UAAU,iBAAiB;AAC7B,eAAK,gBAAgB,OAAO,IAAI,oBAAoB,CAAC;AAAA,QACvD,OAAO;AACL,eAAK,gBAAgB,OAAO,IAAI,MAAM,gBAAgB,QAAQ,EAAE,CAAC;AAAA,QACnE;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI,CAAC,MAAM;AACT,WAAK,kBAAkB,KAAK,gCAAgC;AAC5D,UAAI,KAAK,iBAAiB;AACxB,aAAK,gBAAgB,OAAO,IAAI,MAAM,gCAAgC,CAAC;AAAA,MACzE;AACA;AAAA,IACF;AAGA,SAAK,oBAAoB,GAAG;AAE5B,QAAI,KAAK,iBAAiB;AACxB,WAAK,gBAAgB,QAAQ,IAAI;AAAA,IACnC;AAGA,eAAW,MAAM,KAAK,QAAQ,GAAG,GAAI;AAAA,EACvC;AAAA,EAEQ,oBAAoB,KAA2B;AACrD,QAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;AACjE,QAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAuCP;AAAA,EACH;AAAA,EAEQ,kBAAkB,KAAqB,OAAqB;AAClE,QAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;AACjE,QAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAkCW,WAAW,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,KAKnC;AAAA,EACH;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,QAAQ;AACf,aAAO,IAAI,QAAQ,aAAW;AAC5B,aAAK,OAAQ,MAAM,MAAM;AACvB,eAAK,SAAS;AACd,kBAAQ;AAAA,QACV,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAKA,SAAS,WAAW,MAAsB;AACxC,SAAO,KACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,QAAQ;AAC3B;","names":[]}

package/dist/lib/auth/oauth/ClientCredentialsFlow.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { fromMCPTokens } from "./types.mjs";
 import { resolveSecret } from "./secret-resolver.mjs";
 import { isLikelyPrivateUrl } from "../../net/index.mjs";

package/dist/lib/auth/oauth/ClientCredentialsFlow.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/ClientCredentialsFlow.ts"],"sourcesContent":["/**\n * OAuth 2.0 client credentials grant — RFC 6749 §4.4.\n *\n * For machine-to-machine use cases (CI compliance runs, automated checks)\n * where there is no user to walk through an authorization-code flow. The\n * client POSTs its ID + secret to the authorization server's token endpoint\n * and gets back an access token directly.\n *\n * This file provides:\n * - {@link exchangeClientCredentials}: one-shot token exchange. Use for the\n *   initial fetch during `--save-auth` and for forced refresh.\n * - {@link ensureClientCredentialsTokens}: reads the cached tokens on an\n *   `AgentConfig`, checks expiry, re-exchanges if needed, and persists the\n *   refreshed tokens via an optional {@link OAuthConfigStorage}.\n *\n * Why a dedicated module instead of the MCP SDK's `OAuthClientProvider`:\n * client credentials doesn't need discovery, dynamic client registration,\n * PKCE, or authorization code exchange — all the plumbing that provider\n * exists to coordinate. A direct token POST and a cached-token check is the\n * entire protocol. The call path keeps using the plain `Authorization:\n * Bearer` header path — the same path it already uses for `auth_token`.\n *\n * **Security note (library consumers):** `token_endpoint` is passed to\n * `fetch` directly. Callers that accept untrusted `AgentConfig` values\n * from network requests (e.g. a hosted compliance service accepting\n * user-supplied configs) MUST validate the URL against an allowlist or\n * SSRF-block private IPs before invoking these helpers. The CLI and\n * operator-driven flows are already trusted.\n */\n\nimport { fromMCPTokens, type OAuthTokens, type AgentConfig, type AgentOAuthTokens } from './types';\nimport type { AgentOAuthClientCredentials } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\nimport { resolveSecret } from './secret-resolver';\nimport { isLikelyPrivateUrl } from '../../net';\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\n\n/** Max length we'll echo from an AS-supplied error description into errors. */\nconst MAX_AS_ERROR_LENGTH = 200;\n\n/**\n * Raised when the authorization server rejects a client credentials\n * exchange or the token endpoint is unreachable/malformed.\n *\n * The {@link kind} discriminator lets callers branch without\n * string-matching on the message:\n * - `oauth`: the AS returned a structured OAuth error (RFC 6749 §5.2 —\n *   `invalid_client`, `invalid_grant`, `invalid_scope`, …). Read\n *   {@link oauthError} / {@link oauthErrorDescription}.\n * - `malformed`: the AS returned HTTP 200 but no `access_token`, or a\n *   non-JSON body.\n * - `network`: the exchange never reached the AS (DNS failure, connection\n *   refused, timeout, TLS error).\n */\nexport class ClientCredentialsExchangeError extends Error {\n  readonly code = 'client_credentials_exchange_failed';\n  constructor(\n    message: string,\n    public readonly kind: 'oauth' | 'malformed' | 'network',\n    public readonly oauthError?: string,\n    public readonly oauthErrorDescription?: string,\n    public readonly httpStatus?: number\n  ) {\n    super(message);\n    this.name = 'ClientCredentialsExchangeError';\n  }\n}\n\n/**\n * Options for {@link exchangeClientCredentials}.\n */\nexport interface ExchangeClientCredentialsOptions {\n  /**\n   * Custom fetch implementation (default: global `fetch`).\n   * Primarily a testing hook — lets unit tests stub the authorization server\n   * without intercepting the global.\n   */\n  fetch?: typeof fetch;\n  /**\n   * Request timeout in milliseconds (default: 30_000). Guards against a\n   * silently hung authorization server blocking the caller indefinitely.\n   */\n  timeoutMs?: number;\n  /**\n   * Allow `token_endpoint` to resolve to a private / loopback IP address.\n   * Default: false (SSRF guard). The CLI opts in because the operator is\n   * explicitly configuring the endpoint; hosted consumers accepting\n   * user-supplied configs should leave this off.\n   */\n  allowPrivateIp?: boolean;\n}\n\n/**\n * RFC 6749 §2.3.1 application/x-www-form-urlencoded encoding.\n *\n * Differs from `encodeURIComponent` in two important ways:\n * 1. Spaces are encoded as `+`, not `%20`.\n * 2. The characters `!'()*` are percent-encoded (URI component leaves them\n *    alone).\n *\n * A secret containing any of those chars would hash to a different Basic\n * string than the AS computes, producing a spurious `invalid_client`.\n */\nfunction formUrlEncode(value: string): string {\n  return encodeURIComponent(value)\n    .replace(/%20/g, '+')\n    .replace(/!/g, '%21')\n    .replace(/'/g, '%27')\n    .replace(/\\(/g, '%28')\n    .replace(/\\)/g, '%29')\n    .replace(/\\*/g, '%2A');\n}\n\n/**\n * Strip control chars (C0, C1, DEL) and truncate.\n *\n * Defensive cleanup on AS-controlled strings we print to a TTY. A\n * malicious or compromised AS could emit ANSI escape sequences or CRLF\n * payloads in `error_description`; we don't want those rewriting terminal\n * titles or forging log lines.\n */\nfunction sanitizeAsMessage(raw: string): string {\n  // eslint-disable-next-line no-control-regex\n  const stripped = raw.replace(/[\\x00-\\x1F\\x7F-\\x9F]/g, ' ');\n  if (stripped.length <= MAX_AS_ERROR_LENGTH) return stripped;\n  return stripped.slice(0, MAX_AS_ERROR_LENGTH) + '…';\n}\n\n/**\n * Validate the token endpoint before we hit it. Three checks, in order:\n *\n * 1. Parse as a URL. Unparseable → `malformed`.\n * 2. Reject URLs that carry `user:pass@` userinfo — they'd leak via error\n *    messages and log aggregators, and the OAuth client credentials live\n *    in `client_id` / `client_secret`, never the URL.\n * 3. Reject plaintext `http://` outside `localhost` / loopback IPs.\n *    RFC 6749 §3.1 requires TLS; the loopback carve-out covers local dev\n *    authorization servers where plaintext is not a leak risk.\n * 4. Reject private / loopback / link-local IPs unless `allowPrivateIp`.\n *    The library default is a SSRF guard; the CLI (operator-driven) opts\n *    in because a user pointing at `localhost:8080` is legitimate. Network\n *    code behind this call will still do DNS resolution, so this is a\n *    best-effort literal-IP / known-loopback check — host allowlisting\n *    upstream is the right control for adversarial environments.\n */\nfunction validateTokenEndpoint(tokenEndpoint: string, options: { allowPrivateIp?: boolean } = {}): URL {\n  let url: URL;\n  try {\n    url = new URL(tokenEndpoint);\n  } catch {\n    throw new ClientCredentialsExchangeError(`Invalid token_endpoint URL: ${tokenEndpoint}`, 'malformed');\n  }\n\n  if (url.username || url.password) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must not contain userinfo (user:pass@). Put credentials in client_id / client_secret instead.`,\n      'malformed'\n    );\n  }\n\n  const host = url.hostname;\n  const isLoopback = host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';\n\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must be HTTPS (got ${url.protocol}//${host}). The client secret would be sent in plaintext over HTTP. Use https:// (or http://localhost for local dev).`,\n      'malformed'\n    );\n  }\n\n  if (!options.allowPrivateIp && isLikelyPrivateUrl(tokenEndpoint)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint resolves to a private or loopback address (${host}). Pass { allowPrivateIp: true } to exchangeClientCredentials / ensureClientCredentialsTokens if this is intentional (operator-driven CLI or local test setups).`,\n      'malformed'\n    );\n  }\n\n  return url;\n}\n\n/**\n * Exchange client credentials for an access token.\n *\n * Secret values in `credentials.client_id` / `client_secret` may be `$ENV:VAR`\n * references — they are resolved here at exchange time. Missing env vars\n * surface as `MissingEnvSecretError` (from `secret-resolver`), which\n * callers typically print with the variable name for the user to fix.\n *\n * @throws {ClientCredentialsExchangeError} on any non-2xx response, malformed 200, or network failure\n * @throws {MissingEnvSecretError} if a `$ENV:VAR` ref points at an unset var\n */\nexport async function exchangeClientCredentials(\n  credentials: AgentOAuthClientCredentials,\n  options: ExchangeClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  // Wrap with the response-size-limit guard so a hostile token endpoint\n  // can't buffer-bomb on every refresh. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const fetchImpl = wrapFetchWithSizeLimit(options.fetch ?? fetch);\n  const timeoutMs = options.timeoutMs ?? 30_000;\n\n  validateTokenEndpoint(credentials.token_endpoint, { allowPrivateIp: options.allowPrivateIp });\n\n  const clientId = resolveSecret(credentials.client_id);\n  const clientSecret = resolveSecret(credentials.client_secret);\n  const authMethod = credentials.auth_method ?? 'basic';\n\n  const body = new URLSearchParams();\n  body.set('grant_type', 'client_credentials');\n  if (credentials.scope) {\n    body.set('scope', credentials.scope);\n  }\n  // RFC 8707 resource indicators — emitted as one `resource` field per URI\n  // so the AS receives the full list. URLSearchParams#append is the only\n  // way to produce repeated keys in form encoding.\n  if (credentials.resource) {\n    const resources = Array.isArray(credentials.resource) ? credentials.resource : [credentials.resource];\n    for (const r of resources) body.append('resource', r);\n  }\n  if (credentials.audience) {\n    body.set('audience', credentials.audience);\n  }\n\n  const headers: Record<string, string> = {\n    'content-type': 'application/x-www-form-urlencoded',\n    accept: 'application/json',\n  };\n\n  if (authMethod === 'basic') {\n    // RFC 6749 §2.3.1: form-urlencode ID/secret before base64 (NOT URI\n    // component encoding — space is `+`, and `!'()*` must be percent-\n    // encoded). Most deployed servers accept raw values too, but spec\n    // compliance avoids a footgun with secrets containing those chars.\n    const encoded = Buffer.from(`${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`, 'utf-8').toString(\n      'base64'\n    );\n    headers.authorization = `Basic ${encoded}`;\n  } else {\n    body.set('client_id', clientId);\n    body.set('client_secret', clientSecret);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), timeoutMs);\n\n  let response: Response;\n  try {\n    response = await fetchImpl(credentials.token_endpoint, {\n      method: 'POST',\n      headers,\n      body: body.toString(),\n      signal: controller.signal,\n    });\n  } catch (err) {\n    if ((err as { name?: string }).name === 'AbortError') {\n      throw new ClientCredentialsExchangeError(\n        `Token endpoint ${credentials.token_endpoint} did not respond within ${timeoutMs}ms.`,\n        'network'\n      );\n    }\n    throw new ClientCredentialsExchangeError(\n      `Failed to reach token endpoint ${credentials.token_endpoint}: ${(err as Error).message}`,\n      'network'\n    );\n  } finally {\n    clearTimeout(timeout);\n  }\n\n  const bodyText = await response.text();\n  let parsed: Record<string, unknown> | undefined;\n  try {\n    parsed = bodyText ? (JSON.parse(bodyText) as Record<string, unknown>) : undefined;\n  } catch {\n    // Non-JSON response; parsed stays undefined, handled below.\n  }\n\n  if (!response.ok) {\n    const rawOauthError = typeof parsed?.error === 'string' ? parsed.error : undefined;\n    const rawOauthDesc = typeof parsed?.error_description === 'string' ? parsed.error_description : undefined;\n    const oauthError = rawOauthError ? sanitizeAsMessage(rawOauthError) : undefined;\n    const oauthDesc = rawOauthDesc ? sanitizeAsMessage(rawOauthDesc) : undefined;\n    const message =\n      oauthError || oauthDesc\n        ? `Client credentials exchange failed: ${oauthError ?? 'error'}${oauthDesc ? ` — ${oauthDesc}` : ''}`\n        : `Client credentials exchange failed with HTTP ${response.status}: ${sanitizeAsMessage(bodyText) || '(empty body)'}`;\n    const kind = rawOauthError ? 'oauth' : 'malformed';\n    throw new ClientCredentialsExchangeError(message, kind, oauthError, oauthDesc, response.status);\n  }\n\n  if (!parsed || typeof parsed.access_token !== 'string') {\n    throw new ClientCredentialsExchangeError(\n      `Token endpoint returned HTTP ${response.status} but no access_token. Body: ${sanitizeAsMessage(bodyText)}`,\n      'malformed',\n      undefined,\n      undefined,\n      response.status\n    );\n  }\n\n  return fromMCPTokens(parsed as unknown as OAuthTokens);\n}\n\n/**\n * Options for {@link ensureClientCredentialsTokens}.\n */\nexport interface EnsureClientCredentialsOptions extends ExchangeClientCredentialsOptions {\n  /**\n   * Storage backend used to persist refreshed tokens. Optional — if omitted,\n   * tokens are only mutated on the in-memory `agent` object and the caller\n   * is responsible for persisting.\n   */\n  storage?: OAuthConfigStorage;\n  /**\n   * Force a re-exchange even if the cached token looks valid. Useful after a\n   * 401 in case the authorization server rotated something out-of-band.\n   */\n  force?: boolean;\n  /**\n   * Expiration skew (ms). Treat the token as expired this many milliseconds\n   * before its nominal `expires_at` — protects against clock skew and\n   * in-flight requests. Default: 60_000 (1 minute). The interactive auth\n   * code flow uses 5 minutes; client credentials refresh is cheap (single\n   * POST) so the shorter window is fine here.\n   */\n  expirationSkewMs?: number;\n}\n\n/**\n * In-flight refresh coalescing map. Keyed by the tuple\n * `(agent.id, token_endpoint, client_id)` — concurrent\n * `ensureClientCredentialsTokens` calls for the same credentials share a\n * single token POST instead of each racing to exchange the same secret.\n *\n * Two different `AgentConfig` objects that accidentally reuse the same\n * `id` (e.g. two tenants both creating `cli-agent`) but hold different\n * credentials won't cross-contaminate — the endpoint + client_id in the\n * key keeps them distinct.\n *\n * Cleared on completion regardless of success/failure.\n *\n * Note: this is an in-process map. Multi-process deployments (worker\n * pools, multiple CLI invocations, horizontally scaled Node servers)\n * don't coalesce across workers — each process will do its own refresh.\n * For the CLI this is fine; for high-throughput server deployments,\n * coalesce upstream at the storage layer.\n */\nconst inFlightRefresh = new Map<string, Promise<AgentOAuthTokens>>();\n\n/**\n * Compute the coalesce key for `ensureClientCredentialsTokens`. `force: true`\n * uses a distinct bucket so a 401-triggered forced refresh never piggybacks\n * on a still-pending non-forced exchange — the whole point of forcing is\n * that the in-flight token is *known* stale, so awaiting it would defeat\n * the retry.\n */\nfunction coalesceKeyFor(agent: AgentConfig, credentials: AgentOAuthClientCredentials, force: boolean): string {\n  return `${force ? 'force' : 'normal'}\\u0000${agent.id}\\u0000${credentials.token_endpoint}\\u0000${credentials.client_id}`;\n}\n\n/**\n * Ensure an agent has a valid access token, refreshing via client credentials\n * if the cached one is missing or expired. Idempotent and safe to call\n * before every request.\n *\n * Concurrent calls for the same `agent.id` are coalesced into a single\n * token POST via an in-process promise map — the common case of a\n * storyboard fan-out firing 10 tool calls in parallel does one refresh,\n * not ten.\n *\n * **Mutation:** this function writes `agent.oauth_tokens` in place. That is\n * the contract the MCP SDK's `OAuthClientProvider` pattern also uses, and\n * it lets the CLI's file-backed storage see the same object. Callers that\n * share an `AgentConfig` across different logical agents must copy first.\n *\n * Precondition: `agent.oauth_client_credentials` must be set. Throws a plain\n * Error if not — callers are expected to branch on its presence before\n * calling this.\n */\nexport async function ensureClientCredentialsTokens(\n  agent: AgentConfig,\n  options: EnsureClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  if (!agent.oauth_client_credentials) {\n    throw new Error(\n      `ensureClientCredentialsTokens called for agent '${agent.id}' with no oauth_client_credentials configured.`\n    );\n  }\n\n  const skew = options.expirationSkewMs ?? 60_000;\n  const cached = agent.oauth_tokens;\n  const cachedIsValid =\n    !options.force &&\n    cached?.access_token &&\n    (!cached.expires_at || new Date(cached.expires_at).getTime() - Date.now() > skew);\n\n  if (cachedIsValid) {\n    return cached!;\n  }\n\n  const coalesceKey = coalesceKeyFor(agent, agent.oauth_client_credentials, options.force === true);\n  const existing = inFlightRefresh.get(coalesceKey);\n  if (existing) {\n    const tokens = await existing;\n    agent.oauth_tokens = tokens;\n    return tokens;\n  }\n\n  const exchange = (async () => {\n    try {\n      const tokens = await exchangeClientCredentials(agent.oauth_client_credentials!, {\n        fetch: options.fetch,\n        timeoutMs: options.timeoutMs,\n        allowPrivateIp: options.allowPrivateIp,\n      });\n      agent.oauth_tokens = tokens;\n      if (options.storage) {\n        await options.storage.saveAgent(agent);\n      }\n      return tokens;\n    } finally {\n      inFlightRefresh.delete(coalesceKey);\n    }\n  })();\n\n  inFlightRefresh.set(coalesceKey, exchange);\n  return exchange;\n}\n"],"mappings":";;;;;;AA8BA,SAAS,qBAAgF;AAGzF,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,MAAM,sBAAsB;AAgBrB,MAAM,uCAAuC,MAAM;AAAA,EAExD,YACE,SACgB,MACA,YACA,uBACA,YAChB;AACA,UAAM,OAAO;AALG;AACA;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAPkB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANT,OAAO;AAWlB;AAqCA,SAAS,cAAc,OAAuB;AAC5C,SAAO,mBAAmB,KAAK,EAC5B,QAAQ,QAAQ,GAAG,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAUA,SAAS,kBAAkB,KAAqB;AAE9C,QAAM,WAAW,IAAI,QAAQ,yBAAyB,GAAG;AACzD,MAAI,SAAS,UAAU,oBAAqB,QAAO;AACnD,SAAO,SAAS,MAAM,GAAG,mBAAmB,IAAI;AAClD;AAmBA,SAAS,sBAAsB,eAAuB,UAAwC,CAAC,GAAQ;AACrG,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,aAAa;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,+BAA+B,+BAA+B,aAAa,IAAI,WAAW;AAAA,EACtG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,IAAI;AACjB,QAAM,aAAa,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AAEhG,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAAa;AAC1E,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI,QAAQ,KAAK,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,kBAAkB,mBAAmB,aAAa,GAAG;AAChE,UAAM,IAAI;AAAA,MACR,6DAA6D,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,0BACpB,aACA,UAA4C,CAAC,GAClB;AAI3B,QAAM,YAAY,uBAAuB,QAAQ,SAAS,KAAK;AAC/D,QAAM,YAAY,QAAQ,aAAa;AAEvC,wBAAsB,YAAY,gBAAgB,EAAE,gBAAgB,QAAQ,eAAe,CAAC;AAE5F,QAAM,WAAW,cAAc,YAAY,SAAS;AACpD,QAAM,eAAe,cAAc,YAAY,aAAa;AAC5D,QAAM,aAAa,YAAY,eAAe;AAE9C,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,cAAc,oBAAoB;AAC3C,MAAI,YAAY,OAAO;AACrB,SAAK,IAAI,SAAS,YAAY,KAAK;AAAA,EACrC;AAIA,MAAI,YAAY,UAAU;AACxB,UAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,IAAI,YAAY,WAAW,CAAC,YAAY,QAAQ;AACpG,eAAW,KAAK,UAAW,MAAK,OAAO,YAAY,CAAC;AAAA,EACtD;AACA,MAAI,YAAY,UAAU;AACxB,SAAK,IAAI,YAAY,YAAY,QAAQ;AAAA,EAC3C;AAEA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAEA,MAAI,eAAe,SAAS;AAK1B,UAAM,UAAU,OAAO,KAAK,GAAG,cAAc,QAAQ,CAAC,IAAI,cAAc,YAAY,CAAC,IAAI,OAAO,EAAE;AAAA,MAChG;AAAA,IACF;AACA,YAAQ,gBAAgB,SAAS,OAAO;AAAA,EAC1C,OAAO;AACL,SAAK,IAAI,aAAa,QAAQ;AAC9B,SAAK,IAAI,iBAAiB,YAAY;AAAA,EACxC;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAE9D,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,YAAY,gBAAgB;AAAA,MACrD,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,SAAS;AAAA,MACpB,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAK,IAA0B,SAAS,cAAc;AACpD,YAAM,IAAI;AAAA,QACR,kBAAkB,YAAY,cAAc,2BAA2B,SAAS;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,kCAAkC,YAAY,cAAc,KAAM,IAAc,OAAO;AAAA,MACvF;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AAEA,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,MAAI;AACJ,MAAI;AACF,aAAS,WAAY,KAAK,MAAM,QAAQ,IAAgC;AAAA,EAC1E,QAAQ;AAAA,EAER;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACzE,UAAM,eAAe,OAAO,QAAQ,sBAAsB,WAAW,OAAO,oBAAoB;AAChG,UAAM,aAAa,gBAAgB,kBAAkB,aAAa,IAAI;AACtE,UAAM,YAAY,eAAe,kBAAkB,YAAY,IAAI;AACnE,UAAM,UACJ,cAAc,YACV,uCAAuC,cAAc,OAAO,GAAG,YAAY,WAAM,SAAS,KAAK,EAAE,KACjG,gDAAgD,SAAS,MAAM,KAAK,kBAAkB,QAAQ,KAAK,cAAc;AACvH,UAAM,OAAO,gBAAgB,UAAU;AACvC,UAAM,IAAI,+BAA+B,SAAS,MAAM,YAAY,WAAW,SAAS,MAAM;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,OAAO,OAAO,iBAAiB,UAAU;AACtD,UAAM,IAAI;AAAA,MACR,gCAAgC,SAAS,MAAM,+BAA+B,kBAAkB,QAAQ,CAAC;AAAA,MACzG;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AAEA,SAAO,cAAc,MAAgC;AACvD;AA8CA,MAAM,kBAAkB,oBAAI,IAAuC;AASnE,SAAS,eAAe,OAAoB,aAA0C,OAAwB;AAC5G,SAAO,GAAG,QAAQ,UAAU,QAAQ,KAAS,MAAM,EAAE,KAAS,YAAY,cAAc,KAAS,YAAY,SAAS;AACxH;AAqBA,eAAsB,8BACpB,OACA,UAA0C,CAAC,GAChB;AAC3B,MAAI,CAAC,MAAM,0BAA0B;AACnC,UAAM,IAAI;AAAA,MACR,mDAAmD,MAAM,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,oBAAoB;AACzC,QAAM,SAAS,MAAM;AACrB,QAAM,gBACJ,CAAC,QAAQ,SACT,QAAQ,iBACP,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI,IAAI;AAE9E,MAAI,eAAe;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,eAAe,OAAO,MAAM,0BAA0B,QAAQ,UAAU,IAAI;AAChG,QAAM,WAAW,gBAAgB,IAAI,WAAW;AAChD,MAAI,UAAU;AACZ,UAAM,SAAS,MAAM;AACrB,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,YAAY;AAC5B,QAAI;AACF,YAAM,SAAS,MAAM,0BAA0B,MAAM,0BAA2B;AAAA,QAC9E,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AACD,YAAM,eAAe;AACrB,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,QAAQ,UAAU,KAAK;AAAA,MACvC;AACA,aAAO;AAAA,IACT,UAAE;AACA,sBAAgB,OAAO,WAAW;AAAA,IACpC;AAAA,EACF,GAAG;AAEH,kBAAgB,IAAI,aAAa,QAAQ;AACzC,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/ClientCredentialsFlow.ts"],"sourcesContent":["/**\n * OAuth 2.0 client credentials grant — RFC 6749 §4.4.\n *\n * For machine-to-machine use cases (CI compliance runs, automated checks)\n * where there is no user to walk through an authorization-code flow. The\n * client POSTs its ID + secret to the authorization server's token endpoint\n * and gets back an access token directly.\n *\n * This file provides:\n * - {@link exchangeClientCredentials}: one-shot token exchange. Use for the\n *   initial fetch during `--save-auth` and for forced refresh.\n * - {@link ensureClientCredentialsTokens}: reads the cached tokens on an\n *   `AgentConfig`, checks expiry, re-exchanges if needed, and persists the\n *   refreshed tokens via an optional {@link OAuthConfigStorage}.\n *\n * Why a dedicated module instead of the MCP SDK's `OAuthClientProvider`:\n * client credentials doesn't need discovery, dynamic client registration,\n * PKCE, or authorization code exchange — all the plumbing that provider\n * exists to coordinate. A direct token POST and a cached-token check is the\n * entire protocol. The call path keeps using the plain `Authorization:\n * Bearer` header path — the same path it already uses for `auth_token`.\n *\n * **Security note (library consumers):** `token_endpoint` is passed to\n * `fetch` directly. Callers that accept untrusted `AgentConfig` values\n * from network requests (e.g. a hosted compliance service accepting\n * user-supplied configs) MUST validate the URL against an allowlist or\n * SSRF-block private IPs before invoking these helpers. The CLI and\n * operator-driven flows are already trusted.\n */\n\nimport { fromMCPTokens, type OAuthTokens, type AgentConfig, type AgentOAuthTokens } from './types';\nimport type { AgentOAuthClientCredentials } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\nimport { resolveSecret } from './secret-resolver';\nimport { isLikelyPrivateUrl } from '../../net';\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\n\n/** Max length we'll echo from an AS-supplied error description into errors. */\nconst MAX_AS_ERROR_LENGTH = 200;\n\n/**\n * Raised when the authorization server rejects a client credentials\n * exchange or the token endpoint is unreachable/malformed.\n *\n * The {@link kind} discriminator lets callers branch without\n * string-matching on the message:\n * - `oauth`: the AS returned a structured OAuth error (RFC 6749 §5.2 —\n *   `invalid_client`, `invalid_grant`, `invalid_scope`, …). Read\n *   {@link oauthError} / {@link oauthErrorDescription}.\n * - `malformed`: the AS returned HTTP 200 but no `access_token`, or a\n *   non-JSON body.\n * - `network`: the exchange never reached the AS (DNS failure, connection\n *   refused, timeout, TLS error).\n */\nexport class ClientCredentialsExchangeError extends Error {\n  readonly code = 'client_credentials_exchange_failed';\n  constructor(\n    message: string,\n    public readonly kind: 'oauth' | 'malformed' | 'network',\n    public readonly oauthError?: string,\n    public readonly oauthErrorDescription?: string,\n    public readonly httpStatus?: number\n  ) {\n    super(message);\n    this.name = 'ClientCredentialsExchangeError';\n  }\n}\n\n/**\n * Options for {@link exchangeClientCredentials}.\n */\nexport interface ExchangeClientCredentialsOptions {\n  /**\n   * Custom fetch implementation (default: global `fetch`).\n   * Primarily a testing hook — lets unit tests stub the authorization server\n   * without intercepting the global.\n   */\n  fetch?: typeof fetch;\n  /**\n   * Request timeout in milliseconds (default: 30_000). Guards against a\n   * silently hung authorization server blocking the caller indefinitely.\n   */\n  timeoutMs?: number;\n  /**\n   * Allow `token_endpoint` to resolve to a private / loopback IP address.\n   * Default: false (SSRF guard). The CLI opts in because the operator is\n   * explicitly configuring the endpoint; hosted consumers accepting\n   * user-supplied configs should leave this off.\n   */\n  allowPrivateIp?: boolean;\n}\n\n/**\n * RFC 6749 §2.3.1 application/x-www-form-urlencoded encoding.\n *\n * Differs from `encodeURIComponent` in two important ways:\n * 1. Spaces are encoded as `+`, not `%20`.\n * 2. The characters `!'()*` are percent-encoded (URI component leaves them\n *    alone).\n *\n * A secret containing any of those chars would hash to a different Basic\n * string than the AS computes, producing a spurious `invalid_client`.\n */\nfunction formUrlEncode(value: string): string {\n  return encodeURIComponent(value)\n    .replace(/%20/g, '+')\n    .replace(/!/g, '%21')\n    .replace(/'/g, '%27')\n    .replace(/\\(/g, '%28')\n    .replace(/\\)/g, '%29')\n    .replace(/\\*/g, '%2A');\n}\n\n/**\n * Strip control chars (C0, C1, DEL) and truncate.\n *\n * Defensive cleanup on AS-controlled strings we print to a TTY. A\n * malicious or compromised AS could emit ANSI escape sequences or CRLF\n * payloads in `error_description`; we don't want those rewriting terminal\n * titles or forging log lines.\n */\nfunction sanitizeAsMessage(raw: string): string {\n  // eslint-disable-next-line no-control-regex\n  const stripped = raw.replace(/[\\x00-\\x1F\\x7F-\\x9F]/g, ' ');\n  if (stripped.length <= MAX_AS_ERROR_LENGTH) return stripped;\n  return stripped.slice(0, MAX_AS_ERROR_LENGTH) + '…';\n}\n\n/**\n * Validate the token endpoint before we hit it. Three checks, in order:\n *\n * 1. Parse as a URL. Unparseable → `malformed`.\n * 2. Reject URLs that carry `user:pass@` userinfo — they'd leak via error\n *    messages and log aggregators, and the OAuth client credentials live\n *    in `client_id` / `client_secret`, never the URL.\n * 3. Reject plaintext `http://` outside `localhost` / loopback IPs.\n *    RFC 6749 §3.1 requires TLS; the loopback carve-out covers local dev\n *    authorization servers where plaintext is not a leak risk.\n * 4. Reject private / loopback / link-local IPs unless `allowPrivateIp`.\n *    The library default is a SSRF guard; the CLI (operator-driven) opts\n *    in because a user pointing at `localhost:8080` is legitimate. Network\n *    code behind this call will still do DNS resolution, so this is a\n *    best-effort literal-IP / known-loopback check — host allowlisting\n *    upstream is the right control for adversarial environments.\n */\nfunction validateTokenEndpoint(tokenEndpoint: string, options: { allowPrivateIp?: boolean } = {}): URL {\n  let url: URL;\n  try {\n    url = new URL(tokenEndpoint);\n  } catch {\n    throw new ClientCredentialsExchangeError(`Invalid token_endpoint URL: ${tokenEndpoint}`, 'malformed');\n  }\n\n  if (url.username || url.password) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must not contain userinfo (user:pass@). Put credentials in client_id / client_secret instead.`,\n      'malformed'\n    );\n  }\n\n  const host = url.hostname;\n  const isLoopback = host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';\n\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must be HTTPS (got ${url.protocol}//${host}). The client secret would be sent in plaintext over HTTP. Use https:// (or http://localhost for local dev).`,\n      'malformed'\n    );\n  }\n\n  if (!options.allowPrivateIp && isLikelyPrivateUrl(tokenEndpoint)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint resolves to a private or loopback address (${host}). Pass { allowPrivateIp: true } to exchangeClientCredentials / ensureClientCredentialsTokens if this is intentional (operator-driven CLI or local test setups).`,\n      'malformed'\n    );\n  }\n\n  return url;\n}\n\n/**\n * Exchange client credentials for an access token.\n *\n * Secret values in `credentials.client_id` / `client_secret` may be `$ENV:VAR`\n * references — they are resolved here at exchange time. Missing env vars\n * surface as `MissingEnvSecretError` (from `secret-resolver`), which\n * callers typically print with the variable name for the user to fix.\n *\n * @throws {ClientCredentialsExchangeError} on any non-2xx response, malformed 200, or network failure\n * @throws {MissingEnvSecretError} if a `$ENV:VAR` ref points at an unset var\n */\nexport async function exchangeClientCredentials(\n  credentials: AgentOAuthClientCredentials,\n  options: ExchangeClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  // Wrap with the response-size-limit guard so a hostile token endpoint\n  // can't buffer-bomb on every refresh. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const fetchImpl = wrapFetchWithSizeLimit(options.fetch ?? fetch);\n  const timeoutMs = options.timeoutMs ?? 30_000;\n\n  validateTokenEndpoint(credentials.token_endpoint, { allowPrivateIp: options.allowPrivateIp });\n\n  const clientId = resolveSecret(credentials.client_id);\n  const clientSecret = resolveSecret(credentials.client_secret);\n  const authMethod = credentials.auth_method ?? 'basic';\n\n  const body = new URLSearchParams();\n  body.set('grant_type', 'client_credentials');\n  if (credentials.scope) {\n    body.set('scope', credentials.scope);\n  }\n  // RFC 8707 resource indicators — emitted as one `resource` field per URI\n  // so the AS receives the full list. URLSearchParams#append is the only\n  // way to produce repeated keys in form encoding.\n  if (credentials.resource) {\n    const resources = Array.isArray(credentials.resource) ? credentials.resource : [credentials.resource];\n    for (const r of resources) body.append('resource', r);\n  }\n  if (credentials.audience) {\n    body.set('audience', credentials.audience);\n  }\n\n  const headers: Record<string, string> = {\n    'content-type': 'application/x-www-form-urlencoded',\n    accept: 'application/json',\n  };\n\n  if (authMethod === 'basic') {\n    // RFC 6749 §2.3.1: form-urlencode ID/secret before base64 (NOT URI\n    // component encoding — space is `+`, and `!'()*` must be percent-\n    // encoded). Most deployed servers accept raw values too, but spec\n    // compliance avoids a footgun with secrets containing those chars.\n    const encoded = Buffer.from(`${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`, 'utf-8').toString(\n      'base64'\n    );\n    headers.authorization = `Basic ${encoded}`;\n  } else {\n    body.set('client_id', clientId);\n    body.set('client_secret', clientSecret);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), timeoutMs);\n\n  let response: Response;\n  try {\n    response = await fetchImpl(credentials.token_endpoint, {\n      method: 'POST',\n      headers,\n      body: body.toString(),\n      signal: controller.signal,\n    });\n  } catch (err) {\n    if ((err as { name?: string }).name === 'AbortError') {\n      throw new ClientCredentialsExchangeError(\n        `Token endpoint ${credentials.token_endpoint} did not respond within ${timeoutMs}ms.`,\n        'network'\n      );\n    }\n    throw new ClientCredentialsExchangeError(\n      `Failed to reach token endpoint ${credentials.token_endpoint}: ${(err as Error).message}`,\n      'network'\n    );\n  } finally {\n    clearTimeout(timeout);\n  }\n\n  const bodyText = await response.text();\n  let parsed: Record<string, unknown> | undefined;\n  try {\n    parsed = bodyText ? (JSON.parse(bodyText) as Record<string, unknown>) : undefined;\n  } catch {\n    // Non-JSON response; parsed stays undefined, handled below.\n  }\n\n  if (!response.ok) {\n    const rawOauthError = typeof parsed?.error === 'string' ? parsed.error : undefined;\n    const rawOauthDesc = typeof parsed?.error_description === 'string' ? parsed.error_description : undefined;\n    const oauthError = rawOauthError ? sanitizeAsMessage(rawOauthError) : undefined;\n    const oauthDesc = rawOauthDesc ? sanitizeAsMessage(rawOauthDesc) : undefined;\n    const message =\n      oauthError || oauthDesc\n        ? `Client credentials exchange failed: ${oauthError ?? 'error'}${oauthDesc ? ` — ${oauthDesc}` : ''}`\n        : `Client credentials exchange failed with HTTP ${response.status}: ${sanitizeAsMessage(bodyText) || '(empty body)'}`;\n    const kind = rawOauthError ? 'oauth' : 'malformed';\n    throw new ClientCredentialsExchangeError(message, kind, oauthError, oauthDesc, response.status);\n  }\n\n  if (!parsed || typeof parsed.access_token !== 'string') {\n    throw new ClientCredentialsExchangeError(\n      `Token endpoint returned HTTP ${response.status} but no access_token. Body: ${sanitizeAsMessage(bodyText)}`,\n      'malformed',\n      undefined,\n      undefined,\n      response.status\n    );\n  }\n\n  return fromMCPTokens(parsed as unknown as OAuthTokens);\n}\n\n/**\n * Options for {@link ensureClientCredentialsTokens}.\n */\nexport interface EnsureClientCredentialsOptions extends ExchangeClientCredentialsOptions {\n  /**\n   * Storage backend used to persist refreshed tokens. Optional — if omitted,\n   * tokens are only mutated on the in-memory `agent` object and the caller\n   * is responsible for persisting.\n   */\n  storage?: OAuthConfigStorage;\n  /**\n   * Force a re-exchange even if the cached token looks valid. Useful after a\n   * 401 in case the authorization server rotated something out-of-band.\n   */\n  force?: boolean;\n  /**\n   * Expiration skew (ms). Treat the token as expired this many milliseconds\n   * before its nominal `expires_at` — protects against clock skew and\n   * in-flight requests. Default: 60_000 (1 minute). The interactive auth\n   * code flow uses 5 minutes; client credentials refresh is cheap (single\n   * POST) so the shorter window is fine here.\n   */\n  expirationSkewMs?: number;\n}\n\n/**\n * In-flight refresh coalescing map. Keyed by the tuple\n * `(agent.id, token_endpoint, client_id)` — concurrent\n * `ensureClientCredentialsTokens` calls for the same credentials share a\n * single token POST instead of each racing to exchange the same secret.\n *\n * Two different `AgentConfig` objects that accidentally reuse the same\n * `id` (e.g. two tenants both creating `cli-agent`) but hold different\n * credentials won't cross-contaminate — the endpoint + client_id in the\n * key keeps them distinct.\n *\n * Cleared on completion regardless of success/failure.\n *\n * Note: this is an in-process map. Multi-process deployments (worker\n * pools, multiple CLI invocations, horizontally scaled Node servers)\n * don't coalesce across workers — each process will do its own refresh.\n * For the CLI this is fine; for high-throughput server deployments,\n * coalesce upstream at the storage layer.\n */\nconst inFlightRefresh = new Map<string, Promise<AgentOAuthTokens>>();\n\n/**\n * Compute the coalesce key for `ensureClientCredentialsTokens`. `force: true`\n * uses a distinct bucket so a 401-triggered forced refresh never piggybacks\n * on a still-pending non-forced exchange — the whole point of forcing is\n * that the in-flight token is *known* stale, so awaiting it would defeat\n * the retry.\n */\nfunction coalesceKeyFor(agent: AgentConfig, credentials: AgentOAuthClientCredentials, force: boolean): string {\n  return `${force ? 'force' : 'normal'}\\u0000${agent.id}\\u0000${credentials.token_endpoint}\\u0000${credentials.client_id}`;\n}\n\n/**\n * Ensure an agent has a valid access token, refreshing via client credentials\n * if the cached one is missing or expired. Idempotent and safe to call\n * before every request.\n *\n * Concurrent calls for the same `agent.id` are coalesced into a single\n * token POST via an in-process promise map — the common case of a\n * storyboard fan-out firing 10 tool calls in parallel does one refresh,\n * not ten.\n *\n * **Mutation:** this function writes `agent.oauth_tokens` in place. That is\n * the contract the MCP SDK's `OAuthClientProvider` pattern also uses, and\n * it lets the CLI's file-backed storage see the same object. Callers that\n * share an `AgentConfig` across different logical agents must copy first.\n *\n * Precondition: `agent.oauth_client_credentials` must be set. Throws a plain\n * Error if not — callers are expected to branch on its presence before\n * calling this.\n */\nexport async function ensureClientCredentialsTokens(\n  agent: AgentConfig,\n  options: EnsureClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  if (!agent.oauth_client_credentials) {\n    throw new Error(\n      `ensureClientCredentialsTokens called for agent '${agent.id}' with no oauth_client_credentials configured.`\n    );\n  }\n\n  const skew = options.expirationSkewMs ?? 60_000;\n  const cached = agent.oauth_tokens;\n  const cachedIsValid =\n    !options.force &&\n    cached?.access_token &&\n    (!cached.expires_at || new Date(cached.expires_at).getTime() - Date.now() > skew);\n\n  if (cachedIsValid) {\n    return cached!;\n  }\n\n  const coalesceKey = coalesceKeyFor(agent, agent.oauth_client_credentials, options.force === true);\n  const existing = inFlightRefresh.get(coalesceKey);\n  if (existing) {\n    const tokens = await existing;\n    agent.oauth_tokens = tokens;\n    return tokens;\n  }\n\n  const exchange = (async () => {\n    try {\n      const tokens = await exchangeClientCredentials(agent.oauth_client_credentials!, {\n        fetch: options.fetch,\n        timeoutMs: options.timeoutMs,\n        allowPrivateIp: options.allowPrivateIp,\n      });\n      agent.oauth_tokens = tokens;\n      if (options.storage) {\n        await options.storage.saveAgent(agent);\n      }\n      return tokens;\n    } finally {\n      inFlightRefresh.delete(coalesceKey);\n    }\n  })();\n\n  inFlightRefresh.set(coalesceKey, exchange);\n  return exchange;\n}\n"],"mappings":"AA8BA,SAAS,qBAAgF;AAGzF,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,MAAM,sBAAsB;AAgBrB,MAAM,uCAAuC,MAAM;AAAA,EAExD,YACE,SACgB,MACA,YACA,uBACA,YAChB;AACA,UAAM,OAAO;AALG;AACA;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAPkB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANT,OAAO;AAWlB;AAqCA,SAAS,cAAc,OAAuB;AAC5C,SAAO,mBAAmB,KAAK,EAC5B,QAAQ,QAAQ,GAAG,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAUA,SAAS,kBAAkB,KAAqB;AAE9C,QAAM,WAAW,IAAI,QAAQ,yBAAyB,GAAG;AACzD,MAAI,SAAS,UAAU,oBAAqB,QAAO;AACnD,SAAO,SAAS,MAAM,GAAG,mBAAmB,IAAI;AAClD;AAmBA,SAAS,sBAAsB,eAAuB,UAAwC,CAAC,GAAQ;AACrG,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,aAAa;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,+BAA+B,+BAA+B,aAAa,IAAI,WAAW;AAAA,EACtG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,IAAI;AACjB,QAAM,aAAa,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AAEhG,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAAa;AAC1E,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI,QAAQ,KAAK,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,kBAAkB,mBAAmB,aAAa,GAAG;AAChE,UAAM,IAAI;AAAA,MACR,6DAA6D,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,0BACpB,aACA,UAA4C,CAAC,GAClB;AAI3B,QAAM,YAAY,uBAAuB,QAAQ,SAAS,KAAK;AAC/D,QAAM,YAAY,QAAQ,aAAa;AAEvC,wBAAsB,YAAY,gBAAgB,EAAE,gBAAgB,QAAQ,eAAe,CAAC;AAE5F,QAAM,WAAW,cAAc,YAAY,SAAS;AACpD,QAAM,eAAe,cAAc,YAAY,aAAa;AAC5D,QAAM,aAAa,YAAY,eAAe;AAE9C,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,cAAc,oBAAoB;AAC3C,MAAI,YAAY,OAAO;AACrB,SAAK,IAAI,SAAS,YAAY,KAAK;AAAA,EACrC;AAIA,MAAI,YAAY,UAAU;AACxB,UAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,IAAI,YAAY,WAAW,CAAC,YAAY,QAAQ;AACpG,eAAW,KAAK,UAAW,MAAK,OAAO,YAAY,CAAC;AAAA,EACtD;AACA,MAAI,YAAY,UAAU;AACxB,SAAK,IAAI,YAAY,YAAY,QAAQ;AAAA,EAC3C;AAEA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAEA,MAAI,eAAe,SAAS;AAK1B,UAAM,UAAU,OAAO,KAAK,GAAG,cAAc,QAAQ,CAAC,IAAI,cAAc,YAAY,CAAC,IAAI,OAAO,EAAE;AAAA,MAChG;AAAA,IACF;AACA,YAAQ,gBAAgB,SAAS,OAAO;AAAA,EAC1C,OAAO;AACL,SAAK,IAAI,aAAa,QAAQ;AAC9B,SAAK,IAAI,iBAAiB,YAAY;AAAA,EACxC;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAE9D,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,YAAY,gBAAgB;AAAA,MACrD,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,SAAS;AAAA,MACpB,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAK,IAA0B,SAAS,cAAc;AACpD,YAAM,IAAI;AAAA,QACR,kBAAkB,YAAY,cAAc,2BAA2B,SAAS;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,kCAAkC,YAAY,cAAc,KAAM,IAAc,OAAO;AAAA,MACvF;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AAEA,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,MAAI;AACJ,MAAI;AACF,aAAS,WAAY,KAAK,MAAM,QAAQ,IAAgC;AAAA,EAC1E,QAAQ;AAAA,EAER;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACzE,UAAM,eAAe,OAAO,QAAQ,sBAAsB,WAAW,OAAO,oBAAoB;AAChG,UAAM,aAAa,gBAAgB,kBAAkB,aAAa,IAAI;AACtE,UAAM,YAAY,eAAe,kBAAkB,YAAY,IAAI;AACnE,UAAM,UACJ,cAAc,YACV,uCAAuC,cAAc,OAAO,GAAG,YAAY,WAAM,SAAS,KAAK,EAAE,KACjG,gDAAgD,SAAS,MAAM,KAAK,kBAAkB,QAAQ,KAAK,cAAc;AACvH,UAAM,OAAO,gBAAgB,UAAU;AACvC,UAAM,IAAI,+BAA+B,SAAS,MAAM,YAAY,WAAW,SAAS,MAAM;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,OAAO,OAAO,iBAAiB,UAAU;AACtD,UAAM,IAAI;AAAA,MACR,gCAAgC,SAAS,MAAM,+BAA+B,kBAAkB,QAAQ,CAAC;AAAA,MACzG;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AAEA,SAAO,cAAc,MAAgC;AACvD;AA8CA,MAAM,kBAAkB,oBAAI,IAAuC;AASnE,SAAS,eAAe,OAAoB,aAA0C,OAAwB;AAC5G,SAAO,GAAG,QAAQ,UAAU,QAAQ,KAAS,MAAM,EAAE,KAAS,YAAY,cAAc,KAAS,YAAY,SAAS;AACxH;AAqBA,eAAsB,8BACpB,OACA,UAA0C,CAAC,GAChB;AAC3B,MAAI,CAAC,MAAM,0BAA0B;AACnC,UAAM,IAAI;AAAA,MACR,mDAAmD,MAAM,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,oBAAoB;AACzC,QAAM,SAAS,MAAM;AACrB,QAAM,gBACJ,CAAC,QAAQ,SACT,QAAQ,iBACP,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI,IAAI;AAE9E,MAAI,eAAe;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,eAAe,OAAO,MAAM,0BAA0B,QAAQ,UAAU,IAAI;AAChG,QAAM,WAAW,gBAAgB,IAAI,WAAW;AAChD,MAAI,UAAU;AACZ,UAAM,SAAS,MAAM;AACrB,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,YAAY;AAC5B,QAAI;AACF,YAAM,SAAS,MAAM,0BAA0B,MAAM,0BAA2B;AAAA,QAC9E,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AACD,YAAM,eAAe;AACrB,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,QAAQ,UAAU,KAAK;AAAA,MACvC;AACA,aAAO;AAAA,IACT,UAAE;AACA,sBAAgB,OAAO,WAAW;AAAA,IACpC;AAAA,EACF,GAAG;AAEH,kBAAgB,IAAI,aAAa,QAAQ;AACzC,SAAO;AACT;","names":[]}

package/dist/lib/auth/oauth/MCPOAuthProvider.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from "./types.mjs";
 import { randomBytes } from "crypto";
 class MCPOAuthProvider {

package/dist/lib/auth/oauth/MCPOAuthProvider.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/**\n * MCP OAuth Provider\n *\n * Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n */\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n  OAuthClientMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthTokens,\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\n\n/**\n * MCP OAuth Client Provider\n *\n * This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // OAuth tokens stored here after auth flow\n *   oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens\n * });\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\nexport class MCPOAuthProvider implements OAuthClientProvider {\n  private agent: AgentConfig;\n  private readonly storage?: OAuthConfigStorage;\n  private readonly flowHandler: OAuthFlowHandler;\n  private readonly _clientMetadata: OAuthClientMetadata;\n  private readonly allowHttp: boolean;\n\n  constructor(config: OAuthProviderConfig) {\n    this.agent = config.agent;\n    this.storage = config.storage;\n    this.flowHandler = config.flowHandler;\n    this._clientMetadata = config.clientMetadata;\n    this.allowHttp = config.allowHttp === true;\n  }\n\n  /**\n   * Create a provider for CLI usage\n   */\n  static forCLI(\n    agent: AgentConfig,\n    flowHandler: OAuthFlowHandler,\n    storage?: OAuthConfigStorage,\n    clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n    options?: { allowHttp?: boolean }\n  ): MCPOAuthProvider {\n    // Build complete client metadata with required fields\n    const clientMetadata: OAuthClientMetadata = {\n      ...DEFAULT_CLIENT_METADATA,\n      redirect_uris: [flowHandler.getRedirectUrl().toString()],\n      ...clientMetadataOverrides,\n    };\n\n    return new MCPOAuthProvider({\n      agent,\n      flowHandler,\n      storage,\n      clientMetadata,\n      allowHttp: options?.allowHttp,\n    });\n  }\n\n  // ========================================\n  // OAuthClientProvider interface\n  // ========================================\n\n  get redirectUrl(): string | URL {\n    return this.flowHandler.getRedirectUrl();\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return this._clientMetadata;\n  }\n\n  /**\n   * Validate the protected resource URL from server metadata (RFC 9728).\n   *\n   * Servers behind reverse proxies or DNS aliases may advertise a canonical\n   * resource URL (RFC 8707) that differs from the URL the client connected to.\n   * We allow cross-origin resource URLs because agent configs are pre-configured\n   * by the user, not discovered from untrusted sources. The authorization server\n   * remains the final gatekeeper for token audience validation.\n   *\n   * Non-HTTPS resource URLs are rejected by default. Construct the provider\n   * with `allowHttp: true` to lift that restriction for local development —\n   * mirrors the CLI's `--allow-http` flag.\n   */\n  async validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined> {\n    if (!resource) {\n      return undefined;\n    }\n\n    const resourceURL = new URL(resource);\n\n    if (resourceURL.protocol !== 'https:' && !this.allowHttp) {\n      throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);\n    }\n\n    return resourceURL;\n  }\n\n  /**\n   * Generate OAuth state parameter\n   */\n  async state(): Promise<string> {\n    return randomBytes(32).toString('base64url');\n  }\n\n  /**\n   * Load client information from agent config\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    if (this.agent.oauth_client) {\n      return toMCPClientInfo(this.agent.oauth_client);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save client information after dynamic registration\n   */\n  async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n    this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n    await this.persistAgent();\n  }\n\n  /**\n   * Load existing tokens from agent config\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    if (this.agent.oauth_tokens) {\n      return toMCPTokens(this.agent.oauth_tokens);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save tokens after authorization\n   * Also cleans up the temporary code verifier\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    this.agent.oauth_tokens = fromMCPTokens(tokens);\n    // Clean up temporary code verifier after successful token exchange\n    delete this.agent.oauth_code_verifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Redirect user to authorization URL\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    await this.flowHandler.redirectToAuthorization(authorizationUrl);\n  }\n\n  /**\n   * Save PKCE code verifier\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    this.agent.oauth_code_verifier = codeVerifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Load PKCE code verifier\n   * The MCP SDK calls saveCodeVerifier() before authorization and\n   * retrieves it here during token exchange.\n   */\n  async codeVerifier(): Promise<string> {\n    if (!this.agent.oauth_code_verifier) {\n      throw new Error(\n        'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n          'the agent config was modified. Please try authenticating again.'\n      );\n    }\n    return this.agent.oauth_code_verifier;\n  }\n\n  /**\n   * Invalidate credentials when server indicates they're invalid\n   */\n  async invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): Promise<void> {\n    switch (scope) {\n      case 'all':\n        delete this.agent.oauth_tokens;\n        delete this.agent.oauth_client;\n        delete this.agent.oauth_code_verifier;\n        break;\n      case 'tokens':\n        delete this.agent.oauth_tokens;\n        break;\n      case 'client':\n        delete this.agent.oauth_client;\n        break;\n      case 'verifier':\n        delete this.agent.oauth_code_verifier;\n        break;\n    }\n    await this.persistAgent();\n  }\n\n  // ========================================\n  // Additional methods\n  // ========================================\n\n  /**\n   * Persist agent config to storage if configured\n   */\n  private async persistAgent(): Promise<void> {\n    if (this.storage) {\n      await this.storage.saveAgent(this.agent);\n    }\n  }\n\n  /**\n   * Wait for the OAuth callback\n   * Call this after UnauthorizedError is thrown\n   */\n  async waitForCallback(): Promise<string> {\n    return this.flowHandler.waitForCallback();\n  }\n\n  /**\n   * Clean up resources\n   */\n  async cleanup(): Promise<void> {\n    await this.flowHandler.cleanup();\n  }\n\n  /**\n   * Check if we have valid, non-expired OAuth tokens\n   * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n   */\n  hasValidTokens(): boolean {\n    const tokens = this.agent.oauth_tokens;\n    if (!tokens?.access_token) return false;\n\n    // Check expiration if available\n    if (tokens.expires_at) {\n      const expiresAt = new Date(tokens.expires_at);\n      // Consider expired if within 5 minutes of expiration\n      if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Check if we have a refresh token available for token refresh\n   * @returns true if refresh_token is present\n   */\n  hasRefreshToken(): boolean {\n    return !!this.agent.oauth_tokens?.refresh_token;\n  }\n\n  /**\n   * Clear all OAuth data for this agent\n   */\n  async clearAuth(): Promise<void> {\n    await this.invalidateCredentials('all');\n  }\n\n  /**\n   * Get the agent config this provider manages\n   * @returns The AgentConfig with OAuth tokens populated after successful auth\n   */\n  getAgent(): AgentConfig {\n    return this.agent;\n  }\n\n  /**\n   * Get the agent identifier\n   * @returns The agent's unique ID\n   */\n  getAgentId(): string {\n    return this.agent.id;\n  }\n}\n"],"mappings":";;;;;;AAkBA,SAAS,yBAAyB,aAAa,eAAe,iBAAiB,yBAAyB;AACxG,SAAS,mBAAmB;AA8BrB,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,QAAI,YAAY,aAAa,YAAY,CAAC,KAAK,WAAW;AACxD,YAAM,IAAI,MAAM,aAAa,SAAS,uCAAuC,QAAQ,EAAE;AAAA,IACzF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,WAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,gBAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,eAAe,kBAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,YAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,eAAe,cAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/**\n * MCP OAuth Provider\n *\n * Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n */\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n  OAuthClientMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthTokens,\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\n\n/**\n * MCP OAuth Client Provider\n *\n * This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // OAuth tokens stored here after auth flow\n *   oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens\n * });\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\nexport class MCPOAuthProvider implements OAuthClientProvider {\n  private agent: AgentConfig;\n  private readonly storage?: OAuthConfigStorage;\n  private readonly flowHandler: OAuthFlowHandler;\n  private readonly _clientMetadata: OAuthClientMetadata;\n  private readonly allowHttp: boolean;\n\n  constructor(config: OAuthProviderConfig) {\n    this.agent = config.agent;\n    this.storage = config.storage;\n    this.flowHandler = config.flowHandler;\n    this._clientMetadata = config.clientMetadata;\n    this.allowHttp = config.allowHttp === true;\n  }\n\n  /**\n   * Create a provider for CLI usage\n   */\n  static forCLI(\n    agent: AgentConfig,\n    flowHandler: OAuthFlowHandler,\n    storage?: OAuthConfigStorage,\n    clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n    options?: { allowHttp?: boolean }\n  ): MCPOAuthProvider {\n    // Build complete client metadata with required fields\n    const clientMetadata: OAuthClientMetadata = {\n      ...DEFAULT_CLIENT_METADATA,\n      redirect_uris: [flowHandler.getRedirectUrl().toString()],\n      ...clientMetadataOverrides,\n    };\n\n    return new MCPOAuthProvider({\n      agent,\n      flowHandler,\n      storage,\n      clientMetadata,\n      allowHttp: options?.allowHttp,\n    });\n  }\n\n  // ========================================\n  // OAuthClientProvider interface\n  // ========================================\n\n  get redirectUrl(): string | URL {\n    return this.flowHandler.getRedirectUrl();\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return this._clientMetadata;\n  }\n\n  /**\n   * Validate the protected resource URL from server metadata (RFC 9728).\n   *\n   * Servers behind reverse proxies or DNS aliases may advertise a canonical\n   * resource URL (RFC 8707) that differs from the URL the client connected to.\n   * We allow cross-origin resource URLs because agent configs are pre-configured\n   * by the user, not discovered from untrusted sources. The authorization server\n   * remains the final gatekeeper for token audience validation.\n   *\n   * Non-HTTPS resource URLs are rejected by default. Construct the provider\n   * with `allowHttp: true` to lift that restriction for local development —\n   * mirrors the CLI's `--allow-http` flag.\n   */\n  async validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined> {\n    if (!resource) {\n      return undefined;\n    }\n\n    const resourceURL = new URL(resource);\n\n    if (resourceURL.protocol !== 'https:' && !this.allowHttp) {\n      throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);\n    }\n\n    return resourceURL;\n  }\n\n  /**\n   * Generate OAuth state parameter\n   */\n  async state(): Promise<string> {\n    return randomBytes(32).toString('base64url');\n  }\n\n  /**\n   * Load client information from agent config\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    if (this.agent.oauth_client) {\n      return toMCPClientInfo(this.agent.oauth_client);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save client information after dynamic registration\n   */\n  async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n    this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n    await this.persistAgent();\n  }\n\n  /**\n   * Load existing tokens from agent config\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    if (this.agent.oauth_tokens) {\n      return toMCPTokens(this.agent.oauth_tokens);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save tokens after authorization\n   * Also cleans up the temporary code verifier\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    this.agent.oauth_tokens = fromMCPTokens(tokens);\n    // Clean up temporary code verifier after successful token exchange\n    delete this.agent.oauth_code_verifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Redirect user to authorization URL\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    await this.flowHandler.redirectToAuthorization(authorizationUrl);\n  }\n\n  /**\n   * Save PKCE code verifier\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    this.agent.oauth_code_verifier = codeVerifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Load PKCE code verifier\n   * The MCP SDK calls saveCodeVerifier() before authorization and\n   * retrieves it here during token exchange.\n   */\n  async codeVerifier(): Promise<string> {\n    if (!this.agent.oauth_code_verifier) {\n      throw new Error(\n        'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n          'the agent config was modified. Please try authenticating again.'\n      );\n    }\n    return this.agent.oauth_code_verifier;\n  }\n\n  /**\n   * Invalidate credentials when server indicates they're invalid\n   */\n  async invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): Promise<void> {\n    switch (scope) {\n      case 'all':\n        delete this.agent.oauth_tokens;\n        delete this.agent.oauth_client;\n        delete this.agent.oauth_code_verifier;\n        break;\n      case 'tokens':\n        delete this.agent.oauth_tokens;\n        break;\n      case 'client':\n        delete this.agent.oauth_client;\n        break;\n      case 'verifier':\n        delete this.agent.oauth_code_verifier;\n        break;\n    }\n    await this.persistAgent();\n  }\n\n  // ========================================\n  // Additional methods\n  // ========================================\n\n  /**\n   * Persist agent config to storage if configured\n   */\n  private async persistAgent(): Promise<void> {\n    if (this.storage) {\n      await this.storage.saveAgent(this.agent);\n    }\n  }\n\n  /**\n   * Wait for the OAuth callback\n   * Call this after UnauthorizedError is thrown\n   */\n  async waitForCallback(): Promise<string> {\n    return this.flowHandler.waitForCallback();\n  }\n\n  /**\n   * Clean up resources\n   */\n  async cleanup(): Promise<void> {\n    await this.flowHandler.cleanup();\n  }\n\n  /**\n   * Check if we have valid, non-expired OAuth tokens\n   * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n   */\n  hasValidTokens(): boolean {\n    const tokens = this.agent.oauth_tokens;\n    if (!tokens?.access_token) return false;\n\n    // Check expiration if available\n    if (tokens.expires_at) {\n      const expiresAt = new Date(tokens.expires_at);\n      // Consider expired if within 5 minutes of expiration\n      if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Check if we have a refresh token available for token refresh\n   * @returns true if refresh_token is present\n   */\n  hasRefreshToken(): boolean {\n    return !!this.agent.oauth_tokens?.refresh_token;\n  }\n\n  /**\n   * Clear all OAuth data for this agent\n   */\n  async clearAuth(): Promise<void> {\n    await this.invalidateCredentials('all');\n  }\n\n  /**\n   * Get the agent config this provider manages\n   * @returns The AgentConfig with OAuth tokens populated after successful auth\n   */\n  getAgent(): AgentConfig {\n    return this.agent;\n  }\n\n  /**\n   * Get the agent identifier\n   * @returns The agent's unique ID\n   */\n  getAgentId(): string {\n    return this.agent.id;\n  }\n}\n"],"mappings":"AAkBA,SAAS,yBAAyB,aAAa,eAAe,iBAAiB,yBAAyB;AACxG,SAAS,mBAAmB;AA8BrB,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,QAAI,YAAY,aAAa,YAAY,CAAC,KAAK,WAAW;AACxD,YAAM,IAAI,MAAM,aAAa,SAAS,uCAAuC,QAAQ,EAAE;AAAA,IACzF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,WAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,gBAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,eAAe,kBAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,YAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,eAAe,cAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}

package/dist/lib/auth/oauth/NonInteractiveFlowHandler.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { OAuthError } from "./types.mjs";
 class NonInteractiveFlowHandler {
   _redirectUrl;

package/dist/lib/auth/oauth/NonInteractiveFlowHandler.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/NonInteractiveFlowHandler.ts"],"sourcesContent":["/**\n * Non-interactive OAuth flow handler for background / headless contexts\n * (storyboard runs, scheduled compliance jobs, CI).\n *\n * Use with {@link MCPOAuthProvider} when you want to **use and refresh**\n * previously-saved OAuth tokens, but do not want to initiate a new\n * authorization flow (which would require a browser). Any attempt to\n * redirect to authorization throws with an actionable error message.\n *\n * The MCP SDK will still call this handler's lifecycle — `getRedirectUrl`,\n * `redirectToAuthorization`, `waitForCallback`, `cleanup` — but only the\n * first is expected to succeed in practice. The others throw if reached.\n */\nimport type { OAuthFlowHandler } from './types';\nimport { OAuthError } from './types';\n\nexport interface NonInteractiveFlowHandlerConfig {\n  /**\n   * Redirect URL reported back to the MCP SDK. Should match the\n   * `redirect_uris` of the saved client registration (usually\n   * `http://localhost:8766/callback`). Defaults to that value.\n   */\n  redirectUrl?: string | URL;\n\n  /**\n   * Optional hint shown in the error message when a browser flow is\n   * attempted — e.g., the alias name to pass to `adcp --save-auth`.\n   */\n  agentHint?: string;\n}\n\nexport class NonInteractiveFlowHandler implements OAuthFlowHandler {\n  private readonly _redirectUrl: URL;\n  private readonly agentHint?: string;\n\n  constructor(config: NonInteractiveFlowHandlerConfig = {}) {\n    this._redirectUrl = new URL((config.redirectUrl ?? 'http://localhost:8766/callback').toString());\n    this.agentHint = config.agentHint;\n  }\n\n  getRedirectUrl(): URL {\n    return this._redirectUrl;\n  }\n\n  async redirectToAuthorization(): Promise<void> {\n    const target = this.agentHint\n      ? `adcp --save-auth ${this.agentHint} --oauth`\n      : 'adcp --save-auth <alias> <url> --oauth';\n    throw new OAuthError(\n      `OAuth authorization required but this context is non-interactive. ` +\n        `Run \\`${target}\\` from a terminal with a browser, then retry.`,\n      'interactive_required'\n    );\n  }\n\n  async waitForCallback(): Promise<string> {\n    throw new OAuthError('waitForCallback() is not supported in non-interactive mode.', 'interactive_required');\n  }\n\n  async cleanup(): Promise<void> {\n    // Nothing to clean up — no server was started, no resources allocated.\n  }\n}\n"],"mappings":";;;;;;AAcA,SAAS,kBAAkB;AAiBpB,MAAM,0BAAsD;AAAA,EAChD;AAAA,EACA;AAAA,EAEjB,YAAY,SAA0C,CAAC,GAAG;AACxD,SAAK,eAAe,IAAI,KAAK,OAAO,eAAe,kCAAkC,SAAS,CAAC;AAC/F,SAAK,YAAY,OAAO;AAAA,EAC1B;AAAA,EAEA,iBAAsB;AACpB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,0BAAyC;AAC7C,UAAM,SAAS,KAAK,YAChB,oBAAoB,KAAK,SAAS,aAClC;AACJ,UAAM,IAAI;AAAA,MACR,2EACW,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAmC;AACvC,UAAM,IAAI,WAAW,+DAA+D,sBAAsB;AAAA,EAC5G;AAAA,EAEA,MAAM,UAAyB;AAAA,EAE/B;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/NonInteractiveFlowHandler.ts"],"sourcesContent":["/**\n * Non-interactive OAuth flow handler for background / headless contexts\n * (storyboard runs, scheduled compliance jobs, CI).\n *\n * Use with {@link MCPOAuthProvider} when you want to **use and refresh**\n * previously-saved OAuth tokens, but do not want to initiate a new\n * authorization flow (which would require a browser). Any attempt to\n * redirect to authorization throws with an actionable error message.\n *\n * The MCP SDK will still call this handler's lifecycle — `getRedirectUrl`,\n * `redirectToAuthorization`, `waitForCallback`, `cleanup` — but only the\n * first is expected to succeed in practice. The others throw if reached.\n */\nimport type { OAuthFlowHandler } from './types';\nimport { OAuthError } from './types';\n\nexport interface NonInteractiveFlowHandlerConfig {\n  /**\n   * Redirect URL reported back to the MCP SDK. Should match the\n   * `redirect_uris` of the saved client registration (usually\n   * `http://localhost:8766/callback`). Defaults to that value.\n   */\n  redirectUrl?: string | URL;\n\n  /**\n   * Optional hint shown in the error message when a browser flow is\n   * attempted — e.g., the alias name to pass to `adcp --save-auth`.\n   */\n  agentHint?: string;\n}\n\nexport class NonInteractiveFlowHandler implements OAuthFlowHandler {\n  private readonly _redirectUrl: URL;\n  private readonly agentHint?: string;\n\n  constructor(config: NonInteractiveFlowHandlerConfig = {}) {\n    this._redirectUrl = new URL((config.redirectUrl ?? 'http://localhost:8766/callback').toString());\n    this.agentHint = config.agentHint;\n  }\n\n  getRedirectUrl(): URL {\n    return this._redirectUrl;\n  }\n\n  async redirectToAuthorization(): Promise<void> {\n    const target = this.agentHint\n      ? `adcp --save-auth ${this.agentHint} --oauth`\n      : 'adcp --save-auth <alias> <url> --oauth';\n    throw new OAuthError(\n      `OAuth authorization required but this context is non-interactive. ` +\n        `Run \\`${target}\\` from a terminal with a browser, then retry.`,\n      'interactive_required'\n    );\n  }\n\n  async waitForCallback(): Promise<string> {\n    throw new OAuthError('waitForCallback() is not supported in non-interactive mode.', 'interactive_required');\n  }\n\n  async cleanup(): Promise<void> {\n    // Nothing to clean up — no server was started, no resources allocated.\n  }\n}\n"],"mappings":"AAcA,SAAS,kBAAkB;AAiBpB,MAAM,0BAAsD;AAAA,EAChD;AAAA,EACA;AAAA,EAEjB,YAAY,SAA0C,CAAC,GAAG;AACxD,SAAK,eAAe,IAAI,KAAK,OAAO,eAAe,kCAAkC,SAAS,CAAC;AAC/F,SAAK,YAAY,OAAO;AAAA,EAC1B;AAAA,EAEA,iBAAsB;AACpB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,0BAAyC;AAC7C,UAAM,SAAS,KAAK,YAChB,oBAAoB,KAAK,SAAS,aAClC;AACJ,UAAM,IAAI;AAAA,MACR,2EACW,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAmC;AACvC,UAAM,IAAI,WAAW,+DAA+D,sBAAsB;AAAA,EAC5G;AAAA,EAEA,MAAM,UAAyB;AAAA,EAE/B;AACF;","names":[]}

package/dist/lib/auth/oauth/authorization-required.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { ssrfSafeFetch, decodeBodyAsJsonOrText } from "../../net/index.mjs";
 import { AuthenticationRequiredError } from "../../errors/index.mjs";
 import { parseWWWAuthenticate } from "./diagnostics.mjs";