npm - @adcp/sdk - Versions diffs - 13.0.0-rc.6 → 13.0.0-rc.7 - Mend

@adcp/sdk 13.0.0-rc.6 → 13.0.0-rc.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1441) hide show

package/dist/lib/adapters/legacy/v2-5/sync_creatives.d.ts CHANGED Viewed

@@ -3,9 +3,10 @@ import type { AdapterPair } from './types';
 /**
  * `sync_creatives` adapter pair. Currently has no v2.5 → v3 response
  * normalizer — sync responses are pass-through. The request adapter strips
- * v3-only fields and converts `status` enum → `approved` boolean; `assets`
- * passes through verbatim because v2.5 uses the same role-keyed manifest
- * shape as v3.
+ * v3-only fields, converts `status` enum → `approved` boolean, and groups
+ * v3 assignment edges into v2.5's creative-keyed package mapping. `assets`
+ * passes through with the v3 `asset_type` discriminator stripped because
+ * v2.5 does not declare that embedded field and structurally matches assets.
  */
 export declare const syncCreativesAdapter: AdapterPair<unknown, SyncCreativesRequest, SyncCreativesResponse, unknown>;
 //# sourceMappingURL=sync_creatives.d.ts.map

package/dist/lib/adapters/legacy/v2-5/sync_creatives.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sync_creatives.d.ts","sourceRoot":"","sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C~~;;;;;;GAMG~~;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,OAAO,CAG3G,CAAC"}
1	+ {"version":3,"file":"sync_creatives.d.ts","sourceRoot":"","sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,OAAO,CAG3G,CAAC"}

package/dist/lib/adapters/legacy/v2-5/sync_creatives.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"sourcesContent":["import { adaptSyncCreativesRequestForV2 } from '../../../utils/sync-creatives-adapter';\nimport type { SyncCreativesRequest, SyncCreativesResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/*\n `sync_creatives` adapter pair. Currently has no v2.5 → v3 response\n * normalizer — sync responses are pass-through. The request adapter strips\n * v3-only fields ~~and~~ converts `status` enum → `approved` boolean; `assets`\n * passes through ~~verbatim~~ because v2.5 ~~uses~~ ~~the~~ ~~same~~ ~~role-keyed~~ ~~manifest\n~~ * ~~shape~~ as v3.\n */\nexport const syncCreativesAdapter: AdapterPair<unknown, SyncCreativesRequest, SyncCreativesResponse, unknown> = {\n toolName: 'sync_creatives',\n adaptRequest: adaptSyncCreativesRequestForV2,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCAA+C;~~AAWxC~~,MAAM,uBAAmG;AAAA,EAC9G,UAAU;AAAA,EACV,cAAc;AAChB;","names":[]}
1	+ {"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"sourcesContent":["import { adaptSyncCreativesRequestForV2 } from '../../../utils/sync-creatives-adapter';\nimport type { SyncCreativesRequest, SyncCreativesResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/*\n `sync_creatives` adapter pair. Currently has no v2.5 → v3 response\n * normalizer — sync responses are pass-through. The request adapter strips\n * v3-only fields, converts `status` enum → `approved` boolean, and groups\n * v3 assignment edges into v2.5's creative-keyed package mapping. `assets`\n * passes through with the v3 `asset_type` discriminator stripped because\n * v2.5 does not declare that embedded field and structurally matches assets.\n */\nexport const syncCreativesAdapter: AdapterPair<unknown, SyncCreativesRequest, SyncCreativesResponse, unknown> = {\n toolName: 'sync_creatives',\n adaptRequest: adaptSyncCreativesRequestForV2,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCAA+C;AAYxC,MAAM,uBAAmG;AAAA,EAC9G,UAAU;AAAA,EACV,cAAc;AAChB;","names":[]}

package/dist/lib/adapters/legacy/v2-5/sync_creatives.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"sourcesContent":["import { adaptSyncCreativesRequestForV2 } from '../../../utils/sync-creatives-adapter';\nimport type { SyncCreativesRequest, SyncCreativesResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/*\n `sync_creatives` adapter pair. Currently has no v2.5 → v3 response\n * normalizer — sync responses are pass-through. The request adapter strips\n * v3-only fields ~~and~~ converts `status` enum → `approved` boolean; `assets`\n * passes through ~~verbatim~~ because v2.5 ~~uses~~ ~~the~~ ~~same~~ ~~role-keyed~~ ~~manifest\n~~ * ~~shape~~ as v3.\n */\nexport const syncCreativesAdapter: AdapterPair<unknown, SyncCreativesRequest, SyncCreativesResponse, unknown> = {\n toolName: 'sync_creatives',\n adaptRequest: adaptSyncCreativesRequestForV2,\n};\n"],"mappings":"AAAA,SAAS,sCAAsC;~~AAWxC~~,MAAM,uBAAmG;AAAA,EAC9G,UAAU;AAAA,EACV,cAAc;AAChB;","names":[]}
1	+ {"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"sourcesContent":["import { adaptSyncCreativesRequestForV2 } from '../../../utils/sync-creatives-adapter';\nimport type { SyncCreativesRequest, SyncCreativesResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/*\n `sync_creatives` adapter pair. Currently has no v2.5 → v3 response\n * normalizer — sync responses are pass-through. The request adapter strips\n * v3-only fields, converts `status` enum → `approved` boolean, and groups\n * v3 assignment edges into v2.5's creative-keyed package mapping. `assets`\n * passes through with the v3 `asset_type` discriminator stripped because\n * v2.5 does not declare that embedded field and structurally matches assets.\n */\nexport const syncCreativesAdapter: AdapterPair<unknown, SyncCreativesRequest, SyncCreativesResponse, unknown> = {\n toolName: 'sync_creatives',\n adaptRequest: adaptSyncCreativesRequestForV2,\n};\n"],"mappings":"AAAA,SAAS,sCAAsC;AAYxC,MAAM,uBAAmG;AAAA,EAC9G,UAAU;AAAA,EACV,cAAc;AAChB;","names":[]}

package/dist/lib/auth/oauth/MCPOAuthProvider.d.mts CHANGED Viewed

@@ -40,12 +40,14 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     private readonly flowHandler;
     private readonly _clientMetadata;
     private readonly allowHttp;
+    private readonly configuredResourceOverride?;
     constructor(config: OAuthProviderConfig);
     /**
      * Create a provider for CLI usage
      */
     static forCLI(agent: AgentConfig, flowHandler: OAuthFlowHandler, storage?: OAuthConfigStorage, clientMetadataOverrides?: Partial<OAuthClientMetadata>, options?: {
         allowHttp?: boolean;
+        resourceOverride?: string | null;
     }): MCPOAuthProvider;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts CHANGED Viewed

@@ -40,12 +40,14 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     private readonly flowHandler;
     private readonly _clientMetadata;
     private readonly allowHttp;
+    private readonly configuredResourceOverride?;
     constructor(config: OAuthProviderConfig);
     /**
      * Create a provider for CLI usage
      */
     static forCLI(agent: AgentConfig, flowHandler: OAuthFlowHandler, storage?: OAuthConfigStorage, clientMetadataOverrides?: Partial<OAuthClientMetadata>, options?: {
         allowHttp?: boolean;
+        resourceOverride?: string | null;
     }): MCPOAuthProvider;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MCPOAuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACZ,MAAM,SAAS,CAAC;~~AAIjB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAC1D,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;~~gBAExB~~,MAAM,EAAE,mBAAmB;~~IAQvC~~;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,EAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EACtD,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,~~GAChC~~,gBAAgB;~~IAqBnB~~,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAE9B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;~~IAc~~/F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAI9B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAOtE;;OAEG;IACG,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAOhD;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAUrC;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3F;;OAEG;YACW,YAAY;IAM1B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,cAAc,IAAI,OAAO;IAgBzB;;;OAGG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACH,QAAQ,IAAI,WAAW;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}
1	+ {"version":3,"file":"MCPOAuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACZ,MAAM,SAAS,CAAC;AAKjB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAC1D,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAgB;gBAEhD,MAAM,EAAE,mBAAmB;IASvC;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,EAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EACtD,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAClE,gBAAgB;IAsBnB,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAE9B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAY/F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAI9B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAOtE;;OAEG;IACG,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAOhD;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAUrC;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3F;;OAEG;YACW,YAAY;IAM1B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,cAAc,IAAI,OAAO;IAgBzB;;;OAGG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACH,QAAQ,IAAI,WAAW;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}

package/dist/lib/auth/oauth/MCPOAuthProvider.js CHANGED Viewed

@@ -23,18 +23,21 @@ __export(MCPOAuthProvider_exports, {
 module.exports = __toCommonJS(MCPOAuthProvider_exports);
 var import_types = require('./types.js');
 var import_crypto = require("crypto");
+var import_resource_url = require('./resource-url.js');
 class MCPOAuthProvider {
   agent;
   storage;
   flowHandler;
   _clientMetadata;
   allowHttp;
+  configuredResourceOverride;
   constructor(config) {
     this.agent = config.agent;
     this.storage = config.storage;
     this.flowHandler = config.flowHandler;
     this._clientMetadata = config.clientMetadata;
     this.allowHttp = config.allowHttp === true;
+    this.configuredResourceOverride = config.resourceOverride;
   }
   /**
    * Create a provider for CLI usage
@@ -50,7 +53,8 @@ class MCPOAuthProvider {
       flowHandler,
       storage,
       clientMetadata,
-      allowHttp: options?.allowHttp
+      allowHttp: options?.allowHttp,
+      resourceOverride: options?.resourceOverride
     });
   }
   // ========================================
@@ -76,14 +80,11 @@ class MCPOAuthProvider {
    * mirrors the CLI's `--allow-http` flag.
    */
   async validateResourceURL(serverUrl, resource) {
-    if (!resource) {
+    const selectedResource = this.configuredResourceOverride === null ? resource : this.configuredResourceOverride ?? this.agent.oauth_resource ?? resource;
+    if (!selectedResource) {
       return void 0;
     }
-    const resourceURL = new URL(resource);
-    if (resourceURL.protocol !== "https:" && !this.allowHttp) {
-      throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);
-    }
-    return resourceURL;
+    return (0, import_resource_url.validateOAuthResourceUrl)(selectedResource, { allowHttp: this.allowHttp });
   }
   /**
    * Generate OAuth state parameter

package/dist/lib/auth/oauth/MCPOAuthProvider.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/*\n MCP OAuth Provider\n \n Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n /\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n OAuthClientMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthTokens,\n OAuthFlowHandler,\n OAuthProviderConfig,\n OAuthConfigStorage,\n AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\n\n/\n MCP OAuth Client Provider\n \n This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n \n @example\n * ```typescript\n * const agent: AgentConfig = {\n * id: 'my-agent',\n * name: 'My Agent',\n * agent_uri: 'https://agent.example.com/mcp',\n * protocol: 'mcp',\n * // OAuth tokens stored here after auth flow\n * oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n \n const provider = new MCPOAuthProvider({\n * agent,\n * flowHandler: new CLIFlowHandler(),\n * storage: myConfigStorage // Optional: persists tokens\n * });\n \n const transport = new StreamableHTTPClientTransport(url, {\n * authProvider: provider\n * });\n * ```\n /\nexport class MCPOAuthProvider implements OAuthClientProvider {\n private agent: AgentConfig;\n private readonly storage?: OAuthConfigStorage;\n private readonly flowHandler: OAuthFlowHandler;\n private readonly _clientMetadata: OAuthClientMetadata;\n private readonly allowHttp: boolean;\n\n constructor(config: OAuthProviderConfig) {\n this.agent = config.agent;\n this.storage = config.storage;\n this.flowHandler = config.flowHandler;\n this._clientMetadata = config.clientMetadata;\n this.allowHttp = config.allowHttp === true;\n }\n\n /\n Create a provider for CLI usage\n /\n static forCLI(\n agent: AgentConfig,\n flowHandler: OAuthFlowHandler,\n storage?: OAuthConfigStorage,\n clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n options?: { allowHttp?: boolean }\n ): MCPOAuthProvider {\n // Build complete client metadata with required fields\n const clientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n redirect_uris: [flowHandler.getRedirectUrl().toString()],\n ...clientMetadataOverrides,\n };\n\n return new MCPOAuthProvider({\n agent,\n flowHandler,\n storage,\n clientMetadata,\n allowHttp: options?.allowHttp,\n });\n }\n\n // ========================================\n // OAuthClientProvider interface\n // ========================================\n\n get redirectUrl(): string \| URL {\n return this.flowHandler.getRedirectUrl();\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return this._clientMetadata;\n }\n\n /\n Validate the protected resource URL from server metadata (RFC 9728).\n \n Servers behind reverse proxies or DNS aliases may advertise a canonical\n * resource URL (RFC 8707) that differs from the URL the client connected to.\n * We allow cross-origin resource URLs because agent configs are pre-configured\n * by the user, not discovered from untrusted sources. The authorization server\n * remains the final gatekeeper for token audience validation.\n \n Non-HTTPS resource URLs are rejected by default. Construct the provider\n * with `allowHttp: true` to lift that restriction for local development —\n * mirrors the CLI's `--allow-http` flag.\n /\n async validateResourceURL(serverUrl: string \| URL, resource?: string): Promise<URL \| undefined> {\n if (!resource) {\n return undefined;\n }\n\n const resourceURL = new URL(resource);\n\n if (resourceURL.protocol !== 'https:' && !this.allowHttp) {\n throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);\n }\n\n return resourceURL;\n }\n\n /\n Generate OAuth state parameter\n /\n async state(): Promise<string> {\n return randomBytes(32).toString('base64url');\n }\n\n /\n Load client information from agent config\n /\n async clientInformation(): Promise<OAuthClientInformation \| undefined> {\n if (this.agent.oauth_client) {\n return toMCPClientInfo(this.agent.oauth_client);\n }\n return undefined;\n }\n\n /\n Save client information after dynamic registration\n /\n async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n await this.persistAgent();\n }\n\n /\n Load existing tokens from agent config\n /\n async tokens(): Promise<OAuthTokens \| undefined> {\n if (this.agent.oauth_tokens) {\n return toMCPTokens(this.agent.oauth_tokens);\n }\n return undefined;\n }\n\n /\n Save tokens after authorization\n * Also cleans up the temporary code verifier\n /\n async saveTokens(tokens: OAuthTokens): Promise<void> {\n this.agent.oauth_tokens = fromMCPTokens(tokens);\n // Clean up temporary code verifier after successful token exchange\n delete this.agent.oauth_code_verifier;\n await this.persistAgent();\n }\n\n /\n Redirect user to authorization URL\n /\n async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n await this.flowHandler.redirectToAuthorization(authorizationUrl);\n }\n\n /\n Save PKCE code verifier\n /\n async saveCodeVerifier(codeVerifier: string): Promise<void> {\n this.agent.oauth_code_verifier = codeVerifier;\n await this.persistAgent();\n }\n\n /\n Load PKCE code verifier\n * The MCP SDK calls saveCodeVerifier() before authorization and\n * retrieves it here during token exchange.\n /\n async codeVerifier(): Promise<string> {\n if (!this.agent.oauth_code_verifier) {\n throw new Error(\n 'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n 'the agent config was modified. Please try authenticating again.'\n );\n }\n return this.agent.oauth_code_verifier;\n }\n\n /\n Invalidate credentials when server indicates they're invalid\n /\n async invalidateCredentials(scope: 'all' \| 'client' \| 'tokens' \| 'verifier'): Promise<void> {\n switch (scope) {\n case 'all':\n delete this.agent.oauth_tokens;\n delete this.agent.oauth_client;\n delete this.agent.oauth_code_verifier;\n break;\n case 'tokens':\n delete this.agent.oauth_tokens;\n break;\n case 'client':\n delete this.agent.oauth_client;\n break;\n case 'verifier':\n delete this.agent.oauth_code_verifier;\n break;\n }\n await this.persistAgent();\n }\n\n // ========================================\n // Additional methods\n // ========================================\n\n /\n Persist agent config to storage if configured\n /\n private async persistAgent(): Promise<void> {\n if (this.storage) {\n await this.storage.saveAgent(this.agent);\n }\n }\n\n /\n Wait for the OAuth callback\n * Call this after UnauthorizedError is thrown\n /\n async waitForCallback(): Promise<string> {\n return this.flowHandler.waitForCallback();\n }\n\n /\n Clean up resources\n /\n async cleanup(): Promise<void> {\n await this.flowHandler.cleanup();\n }\n\n /\n Check if we have valid, non-expired OAuth tokens\n * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n /\n hasValidTokens(): boolean {\n const tokens = this.agent.oauth_tokens;\n if (!tokens?.access_token) return false;\n\n // Check expiration if available\n if (tokens.expires_at) {\n const expiresAt = new Date(tokens.expires_at);\n // Consider expired if within 5 minutes of expiration\n if (expiresAt.getTime() - Date.now() < 5 60 * 1000) {\n return false;\n }\n }\n\n return true;\n }\n\n /*\n Check if we have a refresh token available for token refresh\n * @returns true if refresh_token is present\n /\n hasRefreshToken(): boolean {\n return !!this.agent.oauth_tokens?.refresh_token;\n }\n\n /\n Clear all OAuth data for this agent\n /\n async clearAuth(): Promise<void> {\n await this.invalidateCredentials('all');\n }\n\n /\n Get the agent config this provider manages\n * @returns The AgentConfig with OAuth tokens populated after successful auth\n /\n getAgent(): AgentConfig {\n return this.agent;\n }\n\n /\n Get the agent identifier\n * @returns The agent's unique ID\n */\n getAgentId(): string {\n return this.agent.id;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,mBAAwG;AACxG,oBAA4B;AA8BrB,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,QAAI,YAAY,aAAa,YAAY,CAAC,KAAK,WAAW;AACxD,YAAM,IAAI,MAAM,aAAa,SAAS,uCAAuC,QAAQ,EAAE;AAAA,IACzF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,eAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,8BAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,mBAAe,gCAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,0BAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,mBAAe,4BAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}
1	+ {"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/*\n MCP OAuth Provider\n \n Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n /\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n OAuthClientMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthTokens,\n OAuthFlowHandler,\n OAuthProviderConfig,\n OAuthConfigStorage,\n AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\nimport { validateOAuthResourceUrl } from './resource-url';\n\n/\n MCP OAuth Client Provider\n \n This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n \n @example\n * ```typescript\n * const agent: AgentConfig = {\n * id: 'my-agent',\n * name: 'My Agent',\n * agent_uri: 'https://agent.example.com/mcp',\n * protocol: 'mcp',\n * // OAuth tokens stored here after auth flow\n * oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n \n const provider = new MCPOAuthProvider({\n * agent,\n * flowHandler: new CLIFlowHandler(),\n * storage: myConfigStorage // Optional: persists tokens\n * });\n \n const transport = new StreamableHTTPClientTransport(url, {\n * authProvider: provider\n * });\n * ```\n /\nexport class MCPOAuthProvider implements OAuthClientProvider {\n private agent: AgentConfig;\n private readonly storage?: OAuthConfigStorage;\n private readonly flowHandler: OAuthFlowHandler;\n private readonly _clientMetadata: OAuthClientMetadata;\n private readonly allowHttp: boolean;\n private readonly configuredResourceOverride?: string \| null;\n\n constructor(config: OAuthProviderConfig) {\n this.agent = config.agent;\n this.storage = config.storage;\n this.flowHandler = config.flowHandler;\n this._clientMetadata = config.clientMetadata;\n this.allowHttp = config.allowHttp === true;\n this.configuredResourceOverride = config.resourceOverride;\n }\n\n /\n Create a provider for CLI usage\n /\n static forCLI(\n agent: AgentConfig,\n flowHandler: OAuthFlowHandler,\n storage?: OAuthConfigStorage,\n clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n options?: { allowHttp?: boolean; resourceOverride?: string \| null }\n ): MCPOAuthProvider {\n // Build complete client metadata with required fields\n const clientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n redirect_uris: [flowHandler.getRedirectUrl().toString()],\n ...clientMetadataOverrides,\n };\n\n return new MCPOAuthProvider({\n agent,\n flowHandler,\n storage,\n clientMetadata,\n allowHttp: options?.allowHttp,\n resourceOverride: options?.resourceOverride,\n });\n }\n\n // ========================================\n // OAuthClientProvider interface\n // ========================================\n\n get redirectUrl(): string \| URL {\n return this.flowHandler.getRedirectUrl();\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return this._clientMetadata;\n }\n\n /\n Validate the protected resource URL from server metadata (RFC 9728).\n \n Servers behind reverse proxies or DNS aliases may advertise a canonical\n * resource URL (RFC 8707) that differs from the URL the client connected to.\n * We allow cross-origin resource URLs because agent configs are pre-configured\n * by the user, not discovered from untrusted sources. The authorization server\n * remains the final gatekeeper for token audience validation.\n \n Non-HTTPS resource URLs are rejected by default. Construct the provider\n * with `allowHttp: true` to lift that restriction for local development —\n * mirrors the CLI's `--allow-http` flag.\n /\n async validateResourceURL(serverUrl: string \| URL, resource?: string): Promise<URL \| undefined> {\n const selectedResource =\n this.configuredResourceOverride === null\n ? resource\n : (this.configuredResourceOverride ?? this.agent.oauth_resource ?? resource);\n if (!selectedResource) {\n return undefined;\n }\n\n return validateOAuthResourceUrl(selectedResource, { allowHttp: this.allowHttp });\n }\n\n /\n Generate OAuth state parameter\n /\n async state(): Promise<string> {\n return randomBytes(32).toString('base64url');\n }\n\n /\n Load client information from agent config\n /\n async clientInformation(): Promise<OAuthClientInformation \| undefined> {\n if (this.agent.oauth_client) {\n return toMCPClientInfo(this.agent.oauth_client);\n }\n return undefined;\n }\n\n /\n Save client information after dynamic registration\n /\n async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n await this.persistAgent();\n }\n\n /\n Load existing tokens from agent config\n /\n async tokens(): Promise<OAuthTokens \| undefined> {\n if (this.agent.oauth_tokens) {\n return toMCPTokens(this.agent.oauth_tokens);\n }\n return undefined;\n }\n\n /\n Save tokens after authorization\n * Also cleans up the temporary code verifier\n /\n async saveTokens(tokens: OAuthTokens): Promise<void> {\n this.agent.oauth_tokens = fromMCPTokens(tokens);\n // Clean up temporary code verifier after successful token exchange\n delete this.agent.oauth_code_verifier;\n await this.persistAgent();\n }\n\n /\n Redirect user to authorization URL\n /\n async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n await this.flowHandler.redirectToAuthorization(authorizationUrl);\n }\n\n /\n Save PKCE code verifier\n /\n async saveCodeVerifier(codeVerifier: string): Promise<void> {\n this.agent.oauth_code_verifier = codeVerifier;\n await this.persistAgent();\n }\n\n /\n Load PKCE code verifier\n * The MCP SDK calls saveCodeVerifier() before authorization and\n * retrieves it here during token exchange.\n /\n async codeVerifier(): Promise<string> {\n if (!this.agent.oauth_code_verifier) {\n throw new Error(\n 'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n 'the agent config was modified. Please try authenticating again.'\n );\n }\n return this.agent.oauth_code_verifier;\n }\n\n /\n Invalidate credentials when server indicates they're invalid\n /\n async invalidateCredentials(scope: 'all' \| 'client' \| 'tokens' \| 'verifier'): Promise<void> {\n switch (scope) {\n case 'all':\n delete this.agent.oauth_tokens;\n delete this.agent.oauth_client;\n delete this.agent.oauth_code_verifier;\n break;\n case 'tokens':\n delete this.agent.oauth_tokens;\n break;\n case 'client':\n delete this.agent.oauth_client;\n break;\n case 'verifier':\n delete this.agent.oauth_code_verifier;\n break;\n }\n await this.persistAgent();\n }\n\n // ========================================\n // Additional methods\n // ========================================\n\n /\n Persist agent config to storage if configured\n /\n private async persistAgent(): Promise<void> {\n if (this.storage) {\n await this.storage.saveAgent(this.agent);\n }\n }\n\n /\n Wait for the OAuth callback\n * Call this after UnauthorizedError is thrown\n /\n async waitForCallback(): Promise<string> {\n return this.flowHandler.waitForCallback();\n }\n\n /\n Clean up resources\n /\n async cleanup(): Promise<void> {\n await this.flowHandler.cleanup();\n }\n\n /\n Check if we have valid, non-expired OAuth tokens\n * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n /\n hasValidTokens(): boolean {\n const tokens = this.agent.oauth_tokens;\n if (!tokens?.access_token) return false;\n\n // Check expiration if available\n if (tokens.expires_at) {\n const expiresAt = new Date(tokens.expires_at);\n // Consider expired if within 5 minutes of expiration\n if (expiresAt.getTime() - Date.now() < 5 60 * 1000) {\n return false;\n }\n }\n\n return true;\n }\n\n /*\n Check if we have a refresh token available for token refresh\n * @returns true if refresh_token is present\n /\n hasRefreshToken(): boolean {\n return !!this.agent.oauth_tokens?.refresh_token;\n }\n\n /\n Clear all OAuth data for this agent\n /\n async clearAuth(): Promise<void> {\n await this.invalidateCredentials('all');\n }\n\n /\n Get the agent config this provider manages\n * @returns The AgentConfig with OAuth tokens populated after successful auth\n /\n getAgent(): AgentConfig {\n return this.agent;\n }\n\n /\n Get the agent identifier\n * @returns The agent's unique ID\n */\n getAgentId(): string {\n return this.agent.id;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,mBAAwG;AACxG,oBAA4B;AAC5B,0BAAyC;AA8BlC,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AACtC,SAAK,6BAA6B,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,MACpB,kBAAkB,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,UAAM,mBACJ,KAAK,+BAA+B,OAChC,WACC,KAAK,8BAA8B,KAAK,MAAM,kBAAkB;AACvE,QAAI,CAAC,kBAAkB;AACrB,aAAO;AAAA,IACT;AAEA,eAAO,8CAAyB,kBAAkB,EAAE,WAAW,KAAK,UAAU,CAAC;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,eAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,8BAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,mBAAe,gCAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,0BAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,mBAAe,4BAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}

package/dist/lib/auth/oauth/MCPOAuthProvider.mjs CHANGED Viewed

@@ -1,17 +1,20 @@
 import { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from "./types.mjs";
 import { randomBytes } from "crypto";
+import { validateOAuthResourceUrl } from "./resource-url.mjs";
 class MCPOAuthProvider {
   agent;
   storage;
   flowHandler;
   _clientMetadata;
   allowHttp;
+  configuredResourceOverride;
   constructor(config) {
     this.agent = config.agent;
     this.storage = config.storage;
     this.flowHandler = config.flowHandler;
     this._clientMetadata = config.clientMetadata;
     this.allowHttp = config.allowHttp === true;
+    this.configuredResourceOverride = config.resourceOverride;
   }
   /**
    * Create a provider for CLI usage
@@ -27,7 +30,8 @@ class MCPOAuthProvider {
       flowHandler,
       storage,
       clientMetadata,
-      allowHttp: options?.allowHttp
+      allowHttp: options?.allowHttp,
+      resourceOverride: options?.resourceOverride
     });
   }
   // ========================================
@@ -53,14 +57,11 @@ class MCPOAuthProvider {
    * mirrors the CLI's `--allow-http` flag.
    */
   async validateResourceURL(serverUrl, resource) {
-    if (!resource) {
+    const selectedResource = this.configuredResourceOverride === null ? resource : this.configuredResourceOverride ?? this.agent.oauth_resource ?? resource;
+    if (!selectedResource) {
       return void 0;
     }
-    const resourceURL = new URL(resource);
-    if (resourceURL.protocol !== "https:" && !this.allowHttp) {
-      throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);
-    }
-    return resourceURL;
+    return validateOAuthResourceUrl(selectedResource, { allowHttp: this.allowHttp });
   }
   /**
    * Generate OAuth state parameter

package/dist/lib/auth/oauth/MCPOAuthProvider.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/*\n MCP OAuth Provider\n \n Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n /\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n OAuthClientMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthTokens,\n OAuthFlowHandler,\n OAuthProviderConfig,\n OAuthConfigStorage,\n AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\n\n/\n MCP OAuth Client Provider\n \n This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n \n @example\n * ```typescript\n * const agent: AgentConfig = {\n * id: 'my-agent',\n * name: 'My Agent',\n * agent_uri: 'https://agent.example.com/mcp',\n * protocol: 'mcp',\n * // OAuth tokens stored here after auth flow\n * oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n \n const provider = new MCPOAuthProvider({\n * agent,\n * flowHandler: new CLIFlowHandler(),\n * storage: myConfigStorage // Optional: persists tokens\n * });\n \n const transport = new StreamableHTTPClientTransport(url, {\n * authProvider: provider\n * });\n * ```\n /\nexport class MCPOAuthProvider implements OAuthClientProvider {\n private agent: AgentConfig;\n private readonly storage?: OAuthConfigStorage;\n private readonly flowHandler: OAuthFlowHandler;\n private readonly _clientMetadata: OAuthClientMetadata;\n private readonly allowHttp: boolean;\n\n constructor(config: OAuthProviderConfig) {\n this.agent = config.agent;\n this.storage = config.storage;\n this.flowHandler = config.flowHandler;\n this._clientMetadata = config.clientMetadata;\n this.allowHttp = config.allowHttp === true;\n }\n\n /\n Create a provider for CLI usage\n /\n static forCLI(\n agent: AgentConfig,\n flowHandler: OAuthFlowHandler,\n storage?: OAuthConfigStorage,\n clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n options?: { allowHttp?: boolean }\n ): MCPOAuthProvider {\n // Build complete client metadata with required fields\n const clientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n redirect_uris: [flowHandler.getRedirectUrl().toString()],\n ...clientMetadataOverrides,\n };\n\n return new MCPOAuthProvider({\n agent,\n flowHandler,\n storage,\n clientMetadata,\n allowHttp: options?.allowHttp,\n });\n }\n\n // ========================================\n // OAuthClientProvider interface\n // ========================================\n\n get redirectUrl(): string \| URL {\n return this.flowHandler.getRedirectUrl();\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return this._clientMetadata;\n }\n\n /\n Validate the protected resource URL from server metadata (RFC 9728).\n \n Servers behind reverse proxies or DNS aliases may advertise a canonical\n * resource URL (RFC 8707) that differs from the URL the client connected to.\n * We allow cross-origin resource URLs because agent configs are pre-configured\n * by the user, not discovered from untrusted sources. The authorization server\n * remains the final gatekeeper for token audience validation.\n \n Non-HTTPS resource URLs are rejected by default. Construct the provider\n * with `allowHttp: true` to lift that restriction for local development —\n * mirrors the CLI's `--allow-http` flag.\n /\n async validateResourceURL(serverUrl: string \| URL, resource?: string): Promise<URL \| undefined> {\n if (!resource) {\n return undefined;\n }\n\n const resourceURL = new URL(resource);\n\n if (resourceURL.protocol !== 'https:' && !this.allowHttp) {\n throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);\n }\n\n return resourceURL;\n }\n\n /\n Generate OAuth state parameter\n /\n async state(): Promise<string> {\n return randomBytes(32).toString('base64url');\n }\n\n /\n Load client information from agent config\n /\n async clientInformation(): Promise<OAuthClientInformation \| undefined> {\n if (this.agent.oauth_client) {\n return toMCPClientInfo(this.agent.oauth_client);\n }\n return undefined;\n }\n\n /\n Save client information after dynamic registration\n /\n async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n await this.persistAgent();\n }\n\n /\n Load existing tokens from agent config\n /\n async tokens(): Promise<OAuthTokens \| undefined> {\n if (this.agent.oauth_tokens) {\n return toMCPTokens(this.agent.oauth_tokens);\n }\n return undefined;\n }\n\n /\n Save tokens after authorization\n * Also cleans up the temporary code verifier\n /\n async saveTokens(tokens: OAuthTokens): Promise<void> {\n this.agent.oauth_tokens = fromMCPTokens(tokens);\n // Clean up temporary code verifier after successful token exchange\n delete this.agent.oauth_code_verifier;\n await this.persistAgent();\n }\n\n /\n Redirect user to authorization URL\n /\n async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n await this.flowHandler.redirectToAuthorization(authorizationUrl);\n }\n\n /\n Save PKCE code verifier\n /\n async saveCodeVerifier(codeVerifier: string): Promise<void> {\n this.agent.oauth_code_verifier = codeVerifier;\n await this.persistAgent();\n }\n\n /\n Load PKCE code verifier\n * The MCP SDK calls saveCodeVerifier() before authorization and\n * retrieves it here during token exchange.\n /\n async codeVerifier(): Promise<string> {\n if (!this.agent.oauth_code_verifier) {\n throw new Error(\n 'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n 'the agent config was modified. Please try authenticating again.'\n );\n }\n return this.agent.oauth_code_verifier;\n }\n\n /\n Invalidate credentials when server indicates they're invalid\n /\n async invalidateCredentials(scope: 'all' \| 'client' \| 'tokens' \| 'verifier'): Promise<void> {\n switch (scope) {\n case 'all':\n delete this.agent.oauth_tokens;\n delete this.agent.oauth_client;\n delete this.agent.oauth_code_verifier;\n break;\n case 'tokens':\n delete this.agent.oauth_tokens;\n break;\n case 'client':\n delete this.agent.oauth_client;\n break;\n case 'verifier':\n delete this.agent.oauth_code_verifier;\n break;\n }\n await this.persistAgent();\n }\n\n // ========================================\n // Additional methods\n // ========================================\n\n /\n Persist agent config to storage if configured\n /\n private async persistAgent(): Promise<void> {\n if (this.storage) {\n await this.storage.saveAgent(this.agent);\n }\n }\n\n /\n Wait for the OAuth callback\n * Call this after UnauthorizedError is thrown\n /\n async waitForCallback(): Promise<string> {\n return this.flowHandler.waitForCallback();\n }\n\n /\n Clean up resources\n /\n async cleanup(): Promise<void> {\n await this.flowHandler.cleanup();\n }\n\n /\n Check if we have valid, non-expired OAuth tokens\n * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n /\n hasValidTokens(): boolean {\n const tokens = this.agent.oauth_tokens;\n if (!tokens?.access_token) return false;\n\n // Check expiration if available\n if (tokens.expires_at) {\n const expiresAt = new Date(tokens.expires_at);\n // Consider expired if within 5 minutes of expiration\n if (expiresAt.getTime() - Date.now() < 5 60 * 1000) {\n return false;\n }\n }\n\n return true;\n }\n\n /*\n Check if we have a refresh token available for token refresh\n * @returns true if refresh_token is present\n /\n hasRefreshToken(): boolean {\n return !!this.agent.oauth_tokens?.refresh_token;\n }\n\n /\n Clear all OAuth data for this agent\n /\n async clearAuth(): Promise<void> {\n await this.invalidateCredentials('all');\n }\n\n /\n Get the agent config this provider manages\n * @returns The AgentConfig with OAuth tokens populated after successful auth\n /\n getAgent(): AgentConfig {\n return this.agent;\n }\n\n /\n Get the agent identifier\n * @returns The agent's unique ID\n */\n getAgentId(): string {\n return this.agent.id;\n }\n}\n"],"mappings":"AAkBA,SAAS,yBAAyB,aAAa,eAAe,iBAAiB,yBAAyB;AACxG,SAAS,mBAAmB;AA8BrB,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,QAAI,YAAY,aAAa,YAAY,CAAC,KAAK,WAAW;AACxD,YAAM,IAAI,MAAM,aAAa,SAAS,uCAAuC,QAAQ,EAAE;AAAA,IACzF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,WAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,gBAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,eAAe,kBAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,YAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,eAAe,cAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}
1	+ {"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/*\n MCP OAuth Provider\n \n Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n /\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n OAuthClientMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthTokens,\n OAuthFlowHandler,\n OAuthProviderConfig,\n OAuthConfigStorage,\n AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\nimport { validateOAuthResourceUrl } from './resource-url';\n\n/\n MCP OAuth Client Provider\n \n This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n \n @example\n * ```typescript\n * const agent: AgentConfig = {\n * id: 'my-agent',\n * name: 'My Agent',\n * agent_uri: 'https://agent.example.com/mcp',\n * protocol: 'mcp',\n * // OAuth tokens stored here after auth flow\n * oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n \n const provider = new MCPOAuthProvider({\n * agent,\n * flowHandler: new CLIFlowHandler(),\n * storage: myConfigStorage // Optional: persists tokens\n * });\n \n const transport = new StreamableHTTPClientTransport(url, {\n * authProvider: provider\n * });\n * ```\n /\nexport class MCPOAuthProvider implements OAuthClientProvider {\n private agent: AgentConfig;\n private readonly storage?: OAuthConfigStorage;\n private readonly flowHandler: OAuthFlowHandler;\n private readonly _clientMetadata: OAuthClientMetadata;\n private readonly allowHttp: boolean;\n private readonly configuredResourceOverride?: string \| null;\n\n constructor(config: OAuthProviderConfig) {\n this.agent = config.agent;\n this.storage = config.storage;\n this.flowHandler = config.flowHandler;\n this._clientMetadata = config.clientMetadata;\n this.allowHttp = config.allowHttp === true;\n this.configuredResourceOverride = config.resourceOverride;\n }\n\n /\n Create a provider for CLI usage\n /\n static forCLI(\n agent: AgentConfig,\n flowHandler: OAuthFlowHandler,\n storage?: OAuthConfigStorage,\n clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n options?: { allowHttp?: boolean; resourceOverride?: string \| null }\n ): MCPOAuthProvider {\n // Build complete client metadata with required fields\n const clientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n redirect_uris: [flowHandler.getRedirectUrl().toString()],\n ...clientMetadataOverrides,\n };\n\n return new MCPOAuthProvider({\n agent,\n flowHandler,\n storage,\n clientMetadata,\n allowHttp: options?.allowHttp,\n resourceOverride: options?.resourceOverride,\n });\n }\n\n // ========================================\n // OAuthClientProvider interface\n // ========================================\n\n get redirectUrl(): string \| URL {\n return this.flowHandler.getRedirectUrl();\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return this._clientMetadata;\n }\n\n /\n Validate the protected resource URL from server metadata (RFC 9728).\n \n Servers behind reverse proxies or DNS aliases may advertise a canonical\n * resource URL (RFC 8707) that differs from the URL the client connected to.\n * We allow cross-origin resource URLs because agent configs are pre-configured\n * by the user, not discovered from untrusted sources. The authorization server\n * remains the final gatekeeper for token audience validation.\n \n Non-HTTPS resource URLs are rejected by default. Construct the provider\n * with `allowHttp: true` to lift that restriction for local development —\n * mirrors the CLI's `--allow-http` flag.\n /\n async validateResourceURL(serverUrl: string \| URL, resource?: string): Promise<URL \| undefined> {\n const selectedResource =\n this.configuredResourceOverride === null\n ? resource\n : (this.configuredResourceOverride ?? this.agent.oauth_resource ?? resource);\n if (!selectedResource) {\n return undefined;\n }\n\n return validateOAuthResourceUrl(selectedResource, { allowHttp: this.allowHttp });\n }\n\n /\n Generate OAuth state parameter\n /\n async state(): Promise<string> {\n return randomBytes(32).toString('base64url');\n }\n\n /\n Load client information from agent config\n /\n async clientInformation(): Promise<OAuthClientInformation \| undefined> {\n if (this.agent.oauth_client) {\n return toMCPClientInfo(this.agent.oauth_client);\n }\n return undefined;\n }\n\n /\n Save client information after dynamic registration\n /\n async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n await this.persistAgent();\n }\n\n /\n Load existing tokens from agent config\n /\n async tokens(): Promise<OAuthTokens \| undefined> {\n if (this.agent.oauth_tokens) {\n return toMCPTokens(this.agent.oauth_tokens);\n }\n return undefined;\n }\n\n /\n Save tokens after authorization\n * Also cleans up the temporary code verifier\n /\n async saveTokens(tokens: OAuthTokens): Promise<void> {\n this.agent.oauth_tokens = fromMCPTokens(tokens);\n // Clean up temporary code verifier after successful token exchange\n delete this.agent.oauth_code_verifier;\n await this.persistAgent();\n }\n\n /\n Redirect user to authorization URL\n /\n async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n await this.flowHandler.redirectToAuthorization(authorizationUrl);\n }\n\n /\n Save PKCE code verifier\n /\n async saveCodeVerifier(codeVerifier: string): Promise<void> {\n this.agent.oauth_code_verifier = codeVerifier;\n await this.persistAgent();\n }\n\n /\n Load PKCE code verifier\n * The MCP SDK calls saveCodeVerifier() before authorization and\n * retrieves it here during token exchange.\n /\n async codeVerifier(): Promise<string> {\n if (!this.agent.oauth_code_verifier) {\n throw new Error(\n 'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n 'the agent config was modified. Please try authenticating again.'\n );\n }\n return this.agent.oauth_code_verifier;\n }\n\n /\n Invalidate credentials when server indicates they're invalid\n /\n async invalidateCredentials(scope: 'all' \| 'client' \| 'tokens' \| 'verifier'): Promise<void> {\n switch (scope) {\n case 'all':\n delete this.agent.oauth_tokens;\n delete this.agent.oauth_client;\n delete this.agent.oauth_code_verifier;\n break;\n case 'tokens':\n delete this.agent.oauth_tokens;\n break;\n case 'client':\n delete this.agent.oauth_client;\n break;\n case 'verifier':\n delete this.agent.oauth_code_verifier;\n break;\n }\n await this.persistAgent();\n }\n\n // ========================================\n // Additional methods\n // ========================================\n\n /\n Persist agent config to storage if configured\n /\n private async persistAgent(): Promise<void> {\n if (this.storage) {\n await this.storage.saveAgent(this.agent);\n }\n }\n\n /\n Wait for the OAuth callback\n * Call this after UnauthorizedError is thrown\n /\n async waitForCallback(): Promise<string> {\n return this.flowHandler.waitForCallback();\n }\n\n /\n Clean up resources\n /\n async cleanup(): Promise<void> {\n await this.flowHandler.cleanup();\n }\n\n /\n Check if we have valid, non-expired OAuth tokens\n * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n /\n hasValidTokens(): boolean {\n const tokens = this.agent.oauth_tokens;\n if (!tokens?.access_token) return false;\n\n // Check expiration if available\n if (tokens.expires_at) {\n const expiresAt = new Date(tokens.expires_at);\n // Consider expired if within 5 minutes of expiration\n if (expiresAt.getTime() - Date.now() < 5 60 * 1000) {\n return false;\n }\n }\n\n return true;\n }\n\n /*\n Check if we have a refresh token available for token refresh\n * @returns true if refresh_token is present\n /\n hasRefreshToken(): boolean {\n return !!this.agent.oauth_tokens?.refresh_token;\n }\n\n /\n Clear all OAuth data for this agent\n /\n async clearAuth(): Promise<void> {\n await this.invalidateCredentials('all');\n }\n\n /\n Get the agent config this provider manages\n * @returns The AgentConfig with OAuth tokens populated after successful auth\n /\n getAgent(): AgentConfig {\n return this.agent;\n }\n\n /\n Get the agent identifier\n * @returns The agent's unique ID\n */\n getAgentId(): string {\n return this.agent.id;\n }\n}\n"],"mappings":"AAkBA,SAAS,yBAAyB,aAAa,eAAe,iBAAiB,yBAAyB;AACxG,SAAS,mBAAmB;AAC5B,SAAS,gCAAgC;AA8BlC,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AACtC,SAAK,6BAA6B,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,MACpB,kBAAkB,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,UAAM,mBACJ,KAAK,+BAA+B,OAChC,WACC,KAAK,8BAA8B,KAAK,MAAM,kBAAkB;AACvE,QAAI,CAAC,kBAAkB;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,yBAAyB,kBAAkB,EAAE,WAAW,KAAK,UAAU,CAAC;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,WAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,gBAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,eAAe,kBAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,aAAO,YAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,eAAe,cAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}

package/dist/lib/auth/oauth/file-storage.d.mts CHANGED Viewed

@@ -28,7 +28,8 @@ export interface FileOAuthStorageOptions {
  *
  * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom
  * fields) when saving — the MCP provider only mutates `oauth_tokens`,
- * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.
+ * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve
+ * everything else.
  *
  * @example
  * ```ts

package/dist/lib/auth/oauth/file-storage.d.ts CHANGED Viewed

@@ -28,7 +28,8 @@ export interface FileOAuthStorageOptions {
  *
  * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom
  * fields) when saving — the MCP provider only mutates `oauth_tokens`,
- * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.
+ * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve
+ * everything else.
  *
  * @example
  * ```ts

package/dist/lib/auth/oauth/file-storage.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"file-storage.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"names":[],"mappings":"~~AAgBA~~,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;~~AAuBlD~~;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED~~;;;;;;;;;;;;;;;GAeG~~;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,kBAAkB,~~CAsE3F~~"}
1	+ {"version":3,"file":"file-storage.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAwBlD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,kBAAkB,CA0E3F"}

package/dist/lib/auth/oauth/file-storage.js CHANGED Viewed

@@ -73,6 +73,7 @@ function createFileOAuthStorage(options) {
         auth_token: stored.auth_token,
         oauth_tokens: stored.oauth_tokens,
         oauth_client: stored.oauth_client,
+        oauth_resource: stored.oauth_resource,
         oauth_client_credentials: stored.oauth_client_credentials,
         oauth_code_verifier: stored.oauth_code_verifier
       };
@@ -81,16 +82,19 @@ function createFileOAuthStorage(options) {
       const key = agentKeyOverride ?? agent.id;
       const config = await readConfig();
       const existing = config.agents[key] ?? { url: agent.agent_uri };
-      config.agents[key] = {
+      const next = {
         ...existing,
         url: agent.agent_uri,
         protocol: agent.protocol,
         ...agent.auth_token !== void 0 ? { auth_token: agent.auth_token } : {},
         ...agent.oauth_tokens !== void 0 ? { oauth_tokens: agent.oauth_tokens } : {},
         ...agent.oauth_client !== void 0 ? { oauth_client: agent.oauth_client } : {},
+        ...agent.oauth_resource !== void 0 ? { oauth_resource: agent.oauth_resource } : {},
         ...agent.oauth_client_credentials !== void 0 ? { oauth_client_credentials: agent.oauth_client_credentials } : {},
         ...agent.oauth_code_verifier !== void 0 ? { oauth_code_verifier: agent.oauth_code_verifier } : {}
       };
+      if (agent.oauth_resource === void 0) delete next.oauth_resource;
+      config.agents[key] = next;
       await writeConfig(config);
     }
   };

package/dist/lib/auth/oauth/file-storage.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/*\n File-backed {@link OAuthConfigStorage} implementation.\n \n Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n \n On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with `{ url, protocol, auth_token?, oauth_tokens?, oauth_client? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n /\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/\n Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n /\ninterface StoredAgent {\n url: string;\n protocol?: 'mcp' \| 'a2a';\n auth_token?: string;\n oauth_tokens?: AgentConfig['oauth_tokens'];\n oauth_client?: AgentConfig['oauth_client'];\n oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n oauth_code_verifier?: string;\n}\n\n/\n Shape of the whole config file.\n /\ninterface StoredConfig {\n agents: Record<string, StoredAgent>;\n defaults?: Record<string, unknown>;\n}\n\n/\n Options for {@link createFileOAuthStorage}.\n /\nexport interface FileOAuthStorageOptions {\n /* Absolute path to the config JSON file. Must be a file, not a directory. /\n configPath: string;\n /\n Key persistence under a stable alias regardless of `agent.id`. Use this\n * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n * should be organized by a long-lived alias chosen by the operator.\n /\n agentKey?: string;\n /\n Create the parent directory (with mode 0o700) if it doesn't exist.\n * Default true — CLI users expect first-run to create `~/.adcp/`.\n /\n autoCreateDir?: boolean;\n /* File mode for the config file when we create it. Default 0o600. /\n fileMode?: number;\n}\n\n/\n Create a file-backed `OAuthConfigStorage`.\n \n Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n \n Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.\n \n @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n const configPath = options.configPath;\n const agentKeyOverride = options.agentKey;\n const autoCreateDir = options.autoCreateDir ?? true;\n const fileMode = options.fileMode ?? 0o600;\n\n async function readConfig(): Promise<StoredConfig> {\n try {\n const raw = await fs.readFile(configPath, 'utf-8');\n const parsed = JSON.parse(raw) as StoredConfig;\n if (!parsed.agents \|\| typeof parsed.agents !== 'object') parsed.agents = {};\n return parsed;\n } catch (err) {\n if (isNotFound(err)) return { agents: {} };\n throw err;\n }\n }\n\n async function writeConfig(config: StoredConfig): Promise<void> {\n if (autoCreateDir) {\n await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n }\n // Atomic write: stage next to the target, then rename. Same filesystem →\n // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n // Random suffix guards against two concurrent saves in the same process\n // racing on the same temp path.\n const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n const serialized = JSON.stringify(config, null, 2);\n await fs.writeFile(tempPath, serialized, { mode: fileMode });\n await fs.rename(tempPath, configPath);\n }\n\n return {\n async loadAgent(agentId: string): Promise<AgentConfig \| undefined> {\n const key = agentKeyOverride ?? agentId;\n const config = await readConfig();\n const stored = config.agents[key];\n if (!stored) return undefined;\n return {\n id: agentId,\n name: agentId,\n agent_uri: stored.url,\n protocol: stored.protocol ?? 'mcp',\n auth_token: stored.auth_token,\n oauth_tokens: stored.oauth_tokens,\n oauth_client: stored.oauth_client,\n oauth_client_credentials: stored.oauth_client_credentials,\n oauth_code_verifier: stored.oauth_code_verifier,\n };\n },\n\n async saveAgent(agent: AgentConfig): Promise<void> {\n const key = agentKeyOverride ?? agent.id;\n const config = await readConfig();\n const existing = config.agents[key] ?? { url: agent.agent_uri };\n ~~config.agents[key]~~ = {\n ...existing,\n url: agent.agent_uri,\n protocol: agent.protocol,\n ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n ...(agent.oauth_client_credentials !== undefined\n ? { oauth_client_credentials: agent.oauth_client_credentials }\n : {}),\n ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n };\n await writeConfig(config);\n },\n };\n}\n\nfunction isNotFound(err: unknown): boolean {\n return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;~~AAYA~~,gBAA+B;AAC/B,kBAAiB;AACjB,oBAA4B;~~AA+DrB~~,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,UAAAA,SAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,UAAAA,SAAG,MAAM,YAAAC,QAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,QAAI,2BAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,UAAAD,SAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,UAAAA,SAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,~~aAAO~~,~~OAAO,GAAG,IAAI~~;AAAA,~~QACnB~~,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":["fs","path"]}
1	+ {"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/*\n File-backed {@link OAuthConfigStorage} implementation.\n \n Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n \n On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with\n * `{ url, protocol, auth_token?, oauth_tokens?, oauth_client?, oauth_resource? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n /\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/\n Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n /\ninterface StoredAgent {\n url: string;\n protocol?: 'mcp' \| 'a2a';\n auth_token?: string;\n oauth_tokens?: AgentConfig['oauth_tokens'];\n oauth_client?: AgentConfig['oauth_client'];\n oauth_resource?: string;\n oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n oauth_code_verifier?: string;\n}\n\n/\n Shape of the whole config file.\n /\ninterface StoredConfig {\n agents: Record<string, StoredAgent>;\n defaults?: Record<string, unknown>;\n}\n\n/\n Options for {@link createFileOAuthStorage}.\n /\nexport interface FileOAuthStorageOptions {\n /* Absolute path to the config JSON file. Must be a file, not a directory. /\n configPath: string;\n /\n Key persistence under a stable alias regardless of `agent.id`. Use this\n * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n * should be organized by a long-lived alias chosen by the operator.\n /\n agentKey?: string;\n /\n Create the parent directory (with mode 0o700) if it doesn't exist.\n * Default true — CLI users expect first-run to create `~/.adcp/`.\n /\n autoCreateDir?: boolean;\n /* File mode for the config file when we create it. Default 0o600. /\n fileMode?: number;\n}\n\n/\n Create a file-backed `OAuthConfigStorage`.\n \n Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n \n Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve\n * everything else.\n \n @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n const configPath = options.configPath;\n const agentKeyOverride = options.agentKey;\n const autoCreateDir = options.autoCreateDir ?? true;\n const fileMode = options.fileMode ?? 0o600;\n\n async function readConfig(): Promise<StoredConfig> {\n try {\n const raw = await fs.readFile(configPath, 'utf-8');\n const parsed = JSON.parse(raw) as StoredConfig;\n if (!parsed.agents \|\| typeof parsed.agents !== 'object') parsed.agents = {};\n return parsed;\n } catch (err) {\n if (isNotFound(err)) return { agents: {} };\n throw err;\n }\n }\n\n async function writeConfig(config: StoredConfig): Promise<void> {\n if (autoCreateDir) {\n await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n }\n // Atomic write: stage next to the target, then rename. Same filesystem →\n // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n // Random suffix guards against two concurrent saves in the same process\n // racing on the same temp path.\n const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n const serialized = JSON.stringify(config, null, 2);\n await fs.writeFile(tempPath, serialized, { mode: fileMode });\n await fs.rename(tempPath, configPath);\n }\n\n return {\n async loadAgent(agentId: string): Promise<AgentConfig \| undefined> {\n const key = agentKeyOverride ?? agentId;\n const config = await readConfig();\n const stored = config.agents[key];\n if (!stored) return undefined;\n return {\n id: agentId,\n name: agentId,\n agent_uri: stored.url,\n protocol: stored.protocol ?? 'mcp',\n auth_token: stored.auth_token,\n oauth_tokens: stored.oauth_tokens,\n oauth_client: stored.oauth_client,\n oauth_resource: stored.oauth_resource,\n oauth_client_credentials: stored.oauth_client_credentials,\n oauth_code_verifier: stored.oauth_code_verifier,\n };\n },\n\n async saveAgent(agent: AgentConfig): Promise<void> {\n const key = agentKeyOverride ?? agent.id;\n const config = await readConfig();\n const existing = config.agents[key] ?? { url: agent.agent_uri };\n const next: StoredAgent = {\n ...existing,\n url: agent.agent_uri,\n protocol: agent.protocol,\n ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n ...(agent.oauth_resource !== undefined ? { oauth_resource: agent.oauth_resource } : {}),\n ...(agent.oauth_client_credentials !== undefined\n ? { oauth_client_credentials: agent.oauth_client_credentials }\n : {}),\n ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n };\n if (agent.oauth_resource === undefined) delete next.oauth_resource;\n config.agents[key] = next;\n await writeConfig(config);\n },\n };\n}\n\nfunction isNotFound(err: unknown): boolean {\n return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,gBAA+B;AAC/B,kBAAiB;AACjB,oBAA4B;AAiErB,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,UAAAA,SAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,UAAAA,SAAG,MAAM,YAAAC,QAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,QAAI,2BAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,UAAAD,SAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,UAAAA,SAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,YAAM,OAAoB;AAAA,QACxB,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,mBAAmB,SAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,QACrF,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,UAAI,MAAM,mBAAmB,OAAW,QAAO,KAAK;AACpD,aAAO,OAAO,GAAG,IAAI;AACrB,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":["fs","path"]}

package/dist/lib/auth/oauth/file-storage.mjs CHANGED Viewed

@@ -40,6 +40,7 @@ function createFileOAuthStorage(options) {
         auth_token: stored.auth_token,
         oauth_tokens: stored.oauth_tokens,
         oauth_client: stored.oauth_client,
+        oauth_resource: stored.oauth_resource,
         oauth_client_credentials: stored.oauth_client_credentials,
         oauth_code_verifier: stored.oauth_code_verifier
       };
@@ -48,16 +49,19 @@ function createFileOAuthStorage(options) {
       const key = agentKeyOverride ?? agent.id;
       const config = await readConfig();
       const existing = config.agents[key] ?? { url: agent.agent_uri };
-      config.agents[key] = {
+      const next = {
         ...existing,
         url: agent.agent_uri,
         protocol: agent.protocol,
         ...agent.auth_token !== void 0 ? { auth_token: agent.auth_token } : {},
         ...agent.oauth_tokens !== void 0 ? { oauth_tokens: agent.oauth_tokens } : {},
         ...agent.oauth_client !== void 0 ? { oauth_client: agent.oauth_client } : {},
+        ...agent.oauth_resource !== void 0 ? { oauth_resource: agent.oauth_resource } : {},
         ...agent.oauth_client_credentials !== void 0 ? { oauth_client_credentials: agent.oauth_client_credentials } : {},
         ...agent.oauth_code_verifier !== void 0 ? { oauth_code_verifier: agent.oauth_code_verifier } : {}
       };
+      if (agent.oauth_resource === void 0) delete next.oauth_resource;
+      config.agents[key] = next;
       await writeConfig(config);
     }
   };

package/dist/lib/auth/oauth/file-storage.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/*\n File-backed {@link OAuthConfigStorage} implementation.\n \n Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n \n On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with `{ url, protocol, auth_token?, oauth_tokens?, oauth_client? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n /\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/\n Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n /\ninterface StoredAgent {\n url: string;\n protocol?: 'mcp' \| 'a2a';\n auth_token?: string;\n oauth_tokens?: AgentConfig['oauth_tokens'];\n oauth_client?: AgentConfig['oauth_client'];\n oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n oauth_code_verifier?: string;\n}\n\n/\n Shape of the whole config file.\n /\ninterface StoredConfig {\n agents: Record<string, StoredAgent>;\n defaults?: Record<string, unknown>;\n}\n\n/\n Options for {@link createFileOAuthStorage}.\n /\nexport interface FileOAuthStorageOptions {\n /* Absolute path to the config JSON file. Must be a file, not a directory. /\n configPath: string;\n /\n Key persistence under a stable alias regardless of `agent.id`. Use this\n * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n * should be organized by a long-lived alias chosen by the operator.\n /\n agentKey?: string;\n /\n Create the parent directory (with mode 0o700) if it doesn't exist.\n * Default true — CLI users expect first-run to create `~/.adcp/`.\n /\n autoCreateDir?: boolean;\n /* File mode for the config file when we create it. Default 0o600. /\n fileMode?: number;\n}\n\n/\n Create a file-backed `OAuthConfigStorage`.\n \n Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n \n Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.\n \n @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n const configPath = options.configPath;\n const agentKeyOverride = options.agentKey;\n const autoCreateDir = options.autoCreateDir ?? true;\n const fileMode = options.fileMode ?? 0o600;\n\n async function readConfig(): Promise<StoredConfig> {\n try {\n const raw = await fs.readFile(configPath, 'utf-8');\n const parsed = JSON.parse(raw) as StoredConfig;\n if (!parsed.agents \|\| typeof parsed.agents !== 'object') parsed.agents = {};\n return parsed;\n } catch (err) {\n if (isNotFound(err)) return { agents: {} };\n throw err;\n }\n }\n\n async function writeConfig(config: StoredConfig): Promise<void> {\n if (autoCreateDir) {\n await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n }\n // Atomic write: stage next to the target, then rename. Same filesystem →\n // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n // Random suffix guards against two concurrent saves in the same process\n // racing on the same temp path.\n const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n const serialized = JSON.stringify(config, null, 2);\n await fs.writeFile(tempPath, serialized, { mode: fileMode });\n await fs.rename(tempPath, configPath);\n }\n\n return {\n async loadAgent(agentId: string): Promise<AgentConfig \| undefined> {\n const key = agentKeyOverride ?? agentId;\n const config = await readConfig();\n const stored = config.agents[key];\n if (!stored) return undefined;\n return {\n id: agentId,\n name: agentId,\n agent_uri: stored.url,\n protocol: stored.protocol ?? 'mcp',\n auth_token: stored.auth_token,\n oauth_tokens: stored.oauth_tokens,\n oauth_client: stored.oauth_client,\n oauth_client_credentials: stored.oauth_client_credentials,\n oauth_code_verifier: stored.oauth_code_verifier,\n };\n },\n\n async saveAgent(agent: AgentConfig): Promise<void> {\n const key = agentKeyOverride ?? agent.id;\n const config = await readConfig();\n const existing = config.agents[key] ?? { url: agent.agent_uri };\n ~~config.agents[key]~~ = {\n ...existing,\n url: agent.agent_uri,\n protocol: agent.protocol,\n ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n ...(agent.oauth_client_credentials !== undefined\n ? { oauth_client_credentials: agent.oauth_client_credentials }\n : {}),\n ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n };\n await writeConfig(config);\n },\n };\n}\n\nfunction isNotFound(err: unknown): boolean {\n return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":"~~AAYA~~,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,mBAAmB;~~AA+DrB~~,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,GAAG,MAAM,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,GAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,GAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,~~aAAO~~,~~OAAO,GAAG,IAAI~~;AAAA,~~QACnB~~,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":[]}
1	+ {"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/*\n File-backed {@link OAuthConfigStorage} implementation.\n \n Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n \n On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with\n * `{ url, protocol, auth_token?, oauth_tokens?, oauth_client?, oauth_resource? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n /\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/\n Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n /\ninterface StoredAgent {\n url: string;\n protocol?: 'mcp' \| 'a2a';\n auth_token?: string;\n oauth_tokens?: AgentConfig['oauth_tokens'];\n oauth_client?: AgentConfig['oauth_client'];\n oauth_resource?: string;\n oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n oauth_code_verifier?: string;\n}\n\n/\n Shape of the whole config file.\n /\ninterface StoredConfig {\n agents: Record<string, StoredAgent>;\n defaults?: Record<string, unknown>;\n}\n\n/\n Options for {@link createFileOAuthStorage}.\n /\nexport interface FileOAuthStorageOptions {\n /* Absolute path to the config JSON file. Must be a file, not a directory. /\n configPath: string;\n /\n Key persistence under a stable alias regardless of `agent.id`. Use this\n * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n * should be organized by a long-lived alias chosen by the operator.\n /\n agentKey?: string;\n /\n Create the parent directory (with mode 0o700) if it doesn't exist.\n * Default true — CLI users expect first-run to create `~/.adcp/`.\n /\n autoCreateDir?: boolean;\n /* File mode for the config file when we create it. Default 0o600. /\n fileMode?: number;\n}\n\n/\n Create a file-backed `OAuthConfigStorage`.\n \n Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n \n Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve\n * everything else.\n \n @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n const configPath = options.configPath;\n const agentKeyOverride = options.agentKey;\n const autoCreateDir = options.autoCreateDir ?? true;\n const fileMode = options.fileMode ?? 0o600;\n\n async function readConfig(): Promise<StoredConfig> {\n try {\n const raw = await fs.readFile(configPath, 'utf-8');\n const parsed = JSON.parse(raw) as StoredConfig;\n if (!parsed.agents \|\| typeof parsed.agents !== 'object') parsed.agents = {};\n return parsed;\n } catch (err) {\n if (isNotFound(err)) return { agents: {} };\n throw err;\n }\n }\n\n async function writeConfig(config: StoredConfig): Promise<void> {\n if (autoCreateDir) {\n await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n }\n // Atomic write: stage next to the target, then rename. Same filesystem →\n // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n // Random suffix guards against two concurrent saves in the same process\n // racing on the same temp path.\n const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n const serialized = JSON.stringify(config, null, 2);\n await fs.writeFile(tempPath, serialized, { mode: fileMode });\n await fs.rename(tempPath, configPath);\n }\n\n return {\n async loadAgent(agentId: string): Promise<AgentConfig \| undefined> {\n const key = agentKeyOverride ?? agentId;\n const config = await readConfig();\n const stored = config.agents[key];\n if (!stored) return undefined;\n return {\n id: agentId,\n name: agentId,\n agent_uri: stored.url,\n protocol: stored.protocol ?? 'mcp',\n auth_token: stored.auth_token,\n oauth_tokens: stored.oauth_tokens,\n oauth_client: stored.oauth_client,\n oauth_resource: stored.oauth_resource,\n oauth_client_credentials: stored.oauth_client_credentials,\n oauth_code_verifier: stored.oauth_code_verifier,\n };\n },\n\n async saveAgent(agent: AgentConfig): Promise<void> {\n const key = agentKeyOverride ?? agent.id;\n const config = await readConfig();\n const existing = config.agents[key] ?? { url: agent.agent_uri };\n const next: StoredAgent = {\n ...existing,\n url: agent.agent_uri,\n protocol: agent.protocol,\n ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n ...(agent.oauth_resource !== undefined ? { oauth_resource: agent.oauth_resource } : {}),\n ...(agent.oauth_client_credentials !== undefined\n ? { oauth_client_credentials: agent.oauth_client_credentials }\n : {}),\n ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n };\n if (agent.oauth_resource === undefined) delete next.oauth_resource;\n config.agents[key] = next;\n await writeConfig(config);\n },\n };\n}\n\nfunction isNotFound(err: unknown): boolean {\n return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":"AAaA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,mBAAmB;AAiErB,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,GAAG,MAAM,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,GAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,GAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,YAAM,OAAoB;AAAA,QACxB,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,mBAAmB,SAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,QACrF,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,UAAI,MAAM,mBAAmB,OAAW,QAAO,KAAK;AACpD,aAAO,OAAO,GAAG,IAAI;AACrB,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":[]}

package/dist/lib/auth/oauth/index.d.mts CHANGED Viewed

@@ -34,7 +34,7 @@ export type { OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, OAuthCl
 export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutError, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo, } from './types.mjs';
 export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler.mjs';
 export { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler.mjs';
-export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow.mjs';
+export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, AgentChangedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow.mjs';
 export { MCPOAuthProvider } from './MCPOAuthProvider.mjs';
 import { MCPOAuthProvider } from './MCPOAuthProvider.mjs';
 import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types.mjs';
@@ -85,6 +85,8 @@ export declare function createCLIOAuthProvider(agent: AgentConfig, options?: {
     quiet?: boolean;
     /** Storage for persisting agent config */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override; `null` returns to metadata discovery. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.
@@ -108,6 +110,8 @@ export declare function createNonInteractiveOAuthProvider(agent: AgentConfig, op
     clientMetadata?: Partial<OAuthClientMetadata>;
     /** Storage for persisting refreshed tokens back to disk. */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override reused during refresh; `null` disables it. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.

package/dist/lib/auth/oauth/index.d.ts CHANGED Viewed

@@ -34,7 +34,7 @@ export type { OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, OAuthCl
 export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutError, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo, } from './types';
 export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';
 export { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';
-export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow';
+export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, AgentChangedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow';
 export { MCPOAuthProvider } from './MCPOAuthProvider';
 import { MCPOAuthProvider } from './MCPOAuthProvider';
 import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';
@@ -85,6 +85,8 @@ export declare function createCLIOAuthProvider(agent: AgentConfig, options?: {
     quiet?: boolean;
     /** Storage for persisting agent config */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override; `null` returns to metadata discovery. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.
@@ -108,6 +110,8 @@ export declare function createNonInteractiveOAuthProvider(agent: AgentConfig, op
     clientMetadata?: Partial<OAuthClientMetadata>;
     /** Storage for persisting refreshed tokens back to disk. */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override reused during refresh; `null` disables it. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.

package/dist/lib/auth/oauth/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAM9G,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,kBAAkB,EAClB,8BAA8B,EAC9B,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,8BAA8B;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,~~CAsBlB~~;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,~~CAgBlB~~;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAa/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAIzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAO5E;AAGD,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAKpB,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAKtF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACpC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,YAAY,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK3F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAM9G,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,kBAAkB,EAClB,8BAA8B,EAC9B,4BAA4B,EAC5B,2BAA2B,EAC3B,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,8BAA8B;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,CAuBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,CAiBlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAa/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAIzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAO5E;AAGD,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAKpB,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAKtF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACpC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,YAAY,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK3F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC"}

package/dist/lib/auth/oauth/index.js CHANGED Viewed

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var oauth_exports = {};
 __export(oauth_exports, {
   AUTH_DIAGNOSIS_SCHEMA_VERSION: () => import_diagnose.AUTH_DIAGNOSIS_SCHEMA_VERSION,
+  AgentChangedDuringFlowError: () => import_web_flow.AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError: () => import_web_flow.AgentVanishedDuringFlowError,
   BrowserBindingRequiredError: () => import_web_flow.BrowserBindingRequiredError,
   CLIFlowHandler: () => import_CLIFlowHandler.CLIFlowHandler,
@@ -108,6 +109,7 @@ function createCLIOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -123,6 +125,7 @@ function createNonInteractiveOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -162,6 +165,7 @@ function getEffectiveAuthToken(agent) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
+  AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   CLIFlowHandler,