@adcp/sdk 13.0.0-rc.6 → 13.0.0-rc.7

package/dist/lib/auth/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/index.ts"],"sourcesContent":["/**\n * OAuth module for MCP authentication\n *\n * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.\n *\n * @example\n * ```typescript\n * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/sdk';\n *\n * // Agent config - tokens will be stored here\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // After OAuth flow completes:\n *   // oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * // Create provider with CLI flow handler\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens to file/db\n * });\n *\n * // Use with MCP transport\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\n\n// Types\nexport type {\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n  AgentConfig,\n  AgentOAuthTokens,\n  AgentOAuthClient,\n} from './types';\n\nexport {\n  DEFAULT_CLIENT_METADATA,\n  OAuthError,\n  OAuthCancelledError,\n  OAuthTimeoutError,\n  toMCPTokens,\n  fromMCPTokens,\n  toMCPClientInfo,\n  fromMCPClientInfo,\n} from './types';\n\n// Flow handlers\nexport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nexport { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';\n\n// Web (server-side) OAuth flow — companion to CLIFlowHandler for environments\n// where /oauth/start and /oauth/callback may be served by different processes.\n// Note: standalone functions, NOT a class implementing OAuthFlowHandler — see\n// docs/guides/WEB-OAUTH.md for the rationale (the contract spans two requests).\nexport {\n  startWebOAuthFlow,\n  completeWebOAuthFlow,\n  safeReturnTo,\n  InMemoryPendingFlowStore,\n  InvalidOrExpiredFlowError,\n  StateMismatchError,\n  BrowserBindingRequiredError,\n  TokenExchangeError,\n  ProtectedResourceMetadataError,\n  AgentVanishedDuringFlowError,\n  ConfidentialClientNotAllowedError,\n  DEFAULT_WEB_FLOW_TTL_MS,\n  type PendingWebFlow,\n  type PendingWebFlowStore,\n  type PendingFlowStore,\n  type StartWebFlowOptions,\n  type StartWebFlowResult,\n  type CompleteWebFlowOptions,\n  type CompleteWebFlowResult,\n} from './web-flow';\n\n// Main provider\nexport { MCPOAuthProvider } from './MCPOAuthProvider';\n\n// ========================================\n// Convenience factory functions\n// ========================================\n\nimport { MCPOAuthProvider } from './MCPOAuthProvider';\nimport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nimport { NonInteractiveFlowHandler } from './NonInteractiveFlowHandler';\nimport type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';\nimport { DEFAULT_CLIENT_METADATA } from './types';\n\n/**\n * Create an OAuth provider for CLI usage\n *\n * @param agent Agent configuration (tokens stored here)\n * @param options Optional configuration\n * @returns Configured OAuth provider\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp'\n * };\n *\n * const provider = createCLIOAuthProvider(agent);\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n *\n * try {\n *   await client.connect(transport);\n * } catch (error) {\n *   if (error instanceof UnauthorizedError) {\n *     const code = await provider.waitForCallback();\n *     await transport.finishAuth(code);\n *     await client.connect(transport);\n *   }\n * }\n *\n * // After successful auth, agent.oauth_tokens is populated\n * console.log(agent.oauth_tokens);\n * ```\n */\nexport function createCLIOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Callback port (default: 8766) */\n    callbackPort?: number;\n    /** Auth timeout in ms (default: 300000 = 5 min) */\n    timeout?: number;\n    /** Custom client metadata overrides */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Suppress console output */\n    quiet?: boolean;\n    /** Storage for persisting agent config */\n    storage?: OAuthConfigStorage;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowConfig: CLIFlowHandlerConfig = {\n    callbackPort: options?.callbackPort,\n    timeout: options?.timeout,\n    quiet: options?.quiet,\n  };\n  const flowHandler = new CLIFlowHandler(flowConfig);\n\n  // Build complete client metadata\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Create an OAuth provider that uses and auto-refreshes saved tokens but\n * refuses to start a new interactive browser flow. Use this for storyboard\n * runs, scheduled jobs, and other non-interactive contexts where you've\n * already saved tokens via `createCLIOAuthProvider`.\n *\n * If refresh fails (e.g., the refresh_token is revoked or expired), the\n * MCP SDK will throw `UnauthorizedError` at call time — the caller should\n * treat that as a signal to run `adcp --save-auth <alias> --oauth` and retry.\n */\nexport function createNonInteractiveOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Hint shown in error messages if an interactive flow is attempted. */\n    agentHint?: string;\n    /** Custom client metadata overrides (inherited from saved registration in practice). */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Storage for persisting refreshed tokens back to disk. */\n    storage?: OAuthConfigStorage;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowHandler = new NonInteractiveFlowHandler({ agentHint: options?.agentHint });\n\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Check if an error indicates OAuth is required\n */\nexport function isOAuthRequired(error: unknown): boolean {\n  if (error instanceof Error) {\n    if (error.name === 'UnauthorizedError') return true;\n    const msg = error.message.toLowerCase();\n    if (msg.includes('unauthorized') || msg.includes('authentication required') || msg.includes('oauth')) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Check if an agent has valid OAuth tokens\n */\nexport function hasValidOAuthTokens(agent: AgentConfig): boolean {\n  const tokens = agent.oauth_tokens;\n  if (!tokens?.access_token) return false;\n\n  if (tokens.expires_at) {\n    const expiresAt = new Date(tokens.expires_at);\n    // Expired if within 5 minutes of expiration\n    if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\n/**\n * Clear OAuth tokens from an agent config\n */\nexport function clearOAuthTokens(agent: AgentConfig): void {\n  delete agent.oauth_tokens;\n  delete agent.oauth_client;\n  delete agent.oauth_code_verifier;\n}\n\n/**\n * Get the effective auth token for an agent\n * Returns OAuth access_token if available, otherwise static auth_token\n */\nexport function getEffectiveAuthToken(agent: AgentConfig): string | undefined {\n  // Prefer OAuth if available and valid\n  if (hasValidOAuthTokens(agent)) {\n    return agent.oauth_tokens!.access_token;\n  }\n  // Fall back to static token\n  return agent.auth_token;\n}\n\n// OAuth discovery\nexport {\n  discoverOAuthMetadata,\n  supportsOAuth,\n  supportsDynamicRegistration,\n  type OAuthMetadata,\n  type DiscoveryOptions,\n} from './discovery';\n\n// Diagnostics utilities — for `adcp diagnose-auth` and consumer introspection\nexport {\n  parseWWWAuthenticate,\n  decodeAccessTokenClaims,\n  validateTokenAudience,\n  type WWWAuthenticateChallenge,\n  type DecodedJWTHeader,\n  type DecodedJWTClaims,\n  type DecodedAccessToken,\n  type TokenAudienceResult,\n} from './diagnostics';\n\n// End-to-end OAuth handshake diagnosis (powers `adcp diagnose-auth`)\nexport {\n  runAuthDiagnosis,\n  AUTH_DIAGNOSIS_SCHEMA_VERSION,\n  type DiagnoseOptions,\n  type HttpCapture,\n  type DiagnosisStep,\n  type Hypothesis,\n  type HypothesisVerdict,\n  type AuthDiagnosisReport,\n} from './diagnose';\n\n// Zero-config authorization discovery + actionable error type.\n// Raised automatically by `ProtocolClient.callTool` when an MCP agent returns\n// a 401 Bearer challenge and the caller has no saved tokens.\nexport {\n  NeedsAuthorizationError,\n  discoverAuthorizationRequirements,\n  probeAuthChallenge,\n  type AuthorizationRequirements,\n  type DiscoverAuthorizationOptions,\n} from './authorization-required';\n\n// File-backed `OAuthConfigStorage` implementation (agents.json format).\nexport { createFileOAuthStorage, type FileOAuthStorageOptions } from './file-storage';\n\n// OAuth 2.0 client credentials grant (RFC 6749 §4.4) for machine-to-machine\n// token exchange. Used by the CLI for automated compliance runs where there\n// is no user to walk through an authorization-code flow.\nexport {\n  exchangeClientCredentials,\n  ensureClientCredentialsTokens,\n  ClientCredentialsExchangeError,\n  type ExchangeClientCredentialsOptions,\n  type EnsureClientCredentialsOptions,\n} from './ClientCredentialsFlow';\n\n// `$ENV:VAR` indirection for client credentials so secrets can live in env\n// vars (CI) rather than on disk in the agent config.\nexport {\n  resolveSecret,\n  isEnvSecretReference,\n  toEnvSecretReference,\n  extractEnvSecretName,\n  MissingEnvSecretError,\n} from './secret-resolver';\n\n// Type re-export — the credentials struct itself lives in the ADCP core types\n// module alongside `AgentOAuthTokens` / `AgentOAuthClient`.\nexport type { AgentOAuthClientCredentials } from '../../types/adcp';\n\n// Per-agent storage binding — the bridge that lets `callTool` pick up the\n// caller's chosen `OAuthConfigStorage` without a signature change.\nexport { bindAgentStorage, getAgentStorage, unbindAgentStorage } from './storage-registry';\n\n// Re-exported MCP SDK OAuth error types so consumers can discriminate 401 causes\n// without string-matching on error messages. These originate from the MCP server\n// auth module but are the canonical OAuth error classes for client-side handling too.\nexport { InvalidTokenError, InsufficientScopeError } from '@modelcontextprotocol/sdk/server/auth/errors.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+CA,mBASO;AAGP,4BAA0D;AAC1D,uCAAgF;AAMhF,sBAoBO;AAGP,8BAAiC;AAMjC,IAAAA,2BAAiC;AACjC,IAAAC,yBAA0D;AAC1D,IAAAC,oCAA0C;AAE1C,IAAAC,gBAAwC;AAmLxC,uBAMO;AAGP,yBASO;AAGP,sBASO;AAKP,oCAMO;AAGP,0BAAqE;AAKrE,mCAMO;AAIP,6BAMO;AAQP,8BAAsE;AAKtE,oBAA0D;AA3NnD,SAAS,uBACd,OACA,SAiBkB;AAClB,QAAM,aAAmC;AAAA,IACvC,cAAc,SAAS;AAAA,IACvB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS;AAAA,EAClB;AACA,QAAM,cAAc,IAAI,sCAAe,UAAU;AAGjD,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAYO,SAAS,kCACd,OACA,SAakB;AAClB,QAAM,cAAc,IAAI,4DAA0B,EAAE,WAAW,SAAS,UAAU,CAAC;AAEnF,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,gBAAgB,OAAyB;AACvD,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,oBAAqB,QAAO;AAC/C,UAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,yBAAyB,KAAK,IAAI,SAAS,OAAO,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,OAA6B;AAC/D,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,aAAc,QAAO;AAElC,MAAI,OAAO,YAAY;AACrB,UAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,QAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,iBAAiB,OAA0B;AACzD,SAAO,MAAM;AACb,SAAO,MAAM;AACb,SAAO,MAAM;AACf;AAMO,SAAS,sBAAsB,OAAwC;AAE5E,MAAI,oBAAoB,KAAK,GAAG;AAC9B,WAAO,MAAM,aAAc;AAAA,EAC7B;AAEA,SAAO,MAAM;AACf;","names":["import_MCPOAuthProvider","import_CLIFlowHandler","import_NonInteractiveFlowHandler","import_types"]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/index.ts"],"sourcesContent":["/**\n * OAuth module for MCP authentication\n *\n * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.\n *\n * @example\n * ```typescript\n * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/sdk';\n *\n * // Agent config - tokens will be stored here\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // After OAuth flow completes:\n *   // oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * // Create provider with CLI flow handler\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens to file/db\n * });\n *\n * // Use with MCP transport\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\n\n// Types\nexport type {\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n  AgentConfig,\n  AgentOAuthTokens,\n  AgentOAuthClient,\n} from './types';\n\nexport {\n  DEFAULT_CLIENT_METADATA,\n  OAuthError,\n  OAuthCancelledError,\n  OAuthTimeoutError,\n  toMCPTokens,\n  fromMCPTokens,\n  toMCPClientInfo,\n  fromMCPClientInfo,\n} from './types';\n\n// Flow handlers\nexport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nexport { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';\n\n// Web (server-side) OAuth flow — companion to CLIFlowHandler for environments\n// where /oauth/start and /oauth/callback may be served by different processes.\n// Note: standalone functions, NOT a class implementing OAuthFlowHandler — see\n// docs/guides/WEB-OAUTH.md for the rationale (the contract spans two requests).\nexport {\n  startWebOAuthFlow,\n  completeWebOAuthFlow,\n  safeReturnTo,\n  InMemoryPendingFlowStore,\n  InvalidOrExpiredFlowError,\n  StateMismatchError,\n  BrowserBindingRequiredError,\n  TokenExchangeError,\n  ProtectedResourceMetadataError,\n  AgentVanishedDuringFlowError,\n  AgentChangedDuringFlowError,\n  ConfidentialClientNotAllowedError,\n  DEFAULT_WEB_FLOW_TTL_MS,\n  type PendingWebFlow,\n  type PendingWebFlowStore,\n  type PendingFlowStore,\n  type StartWebFlowOptions,\n  type StartWebFlowResult,\n  type CompleteWebFlowOptions,\n  type CompleteWebFlowResult,\n} from './web-flow';\n\n// Main provider\nexport { MCPOAuthProvider } from './MCPOAuthProvider';\n\n// ========================================\n// Convenience factory functions\n// ========================================\n\nimport { MCPOAuthProvider } from './MCPOAuthProvider';\nimport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nimport { NonInteractiveFlowHandler } from './NonInteractiveFlowHandler';\nimport type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';\nimport { DEFAULT_CLIENT_METADATA } from './types';\n\n/**\n * Create an OAuth provider for CLI usage\n *\n * @param agent Agent configuration (tokens stored here)\n * @param options Optional configuration\n * @returns Configured OAuth provider\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp'\n * };\n *\n * const provider = createCLIOAuthProvider(agent);\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n *\n * try {\n *   await client.connect(transport);\n * } catch (error) {\n *   if (error instanceof UnauthorizedError) {\n *     const code = await provider.waitForCallback();\n *     await transport.finishAuth(code);\n *     await client.connect(transport);\n *   }\n * }\n *\n * // After successful auth, agent.oauth_tokens is populated\n * console.log(agent.oauth_tokens);\n * ```\n */\nexport function createCLIOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Callback port (default: 8766) */\n    callbackPort?: number;\n    /** Auth timeout in ms (default: 300000 = 5 min) */\n    timeout?: number;\n    /** Custom client metadata overrides */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Suppress console output */\n    quiet?: boolean;\n    /** Storage for persisting agent config */\n    storage?: OAuthConfigStorage;\n    /** Operator RFC 8707 override; `null` returns to metadata discovery. */\n    resourceOverride?: string | null;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowConfig: CLIFlowHandlerConfig = {\n    callbackPort: options?.callbackPort,\n    timeout: options?.timeout,\n    quiet: options?.quiet,\n  };\n  const flowHandler = new CLIFlowHandler(flowConfig);\n\n  // Build complete client metadata\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    resourceOverride: options?.resourceOverride,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Create an OAuth provider that uses and auto-refreshes saved tokens but\n * refuses to start a new interactive browser flow. Use this for storyboard\n * runs, scheduled jobs, and other non-interactive contexts where you've\n * already saved tokens via `createCLIOAuthProvider`.\n *\n * If refresh fails (e.g., the refresh_token is revoked or expired), the\n * MCP SDK will throw `UnauthorizedError` at call time — the caller should\n * treat that as a signal to run `adcp --save-auth <alias> --oauth` and retry.\n */\nexport function createNonInteractiveOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Hint shown in error messages if an interactive flow is attempted. */\n    agentHint?: string;\n    /** Custom client metadata overrides (inherited from saved registration in practice). */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Storage for persisting refreshed tokens back to disk. */\n    storage?: OAuthConfigStorage;\n    /** Operator RFC 8707 override reused during refresh; `null` disables it. */\n    resourceOverride?: string | null;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowHandler = new NonInteractiveFlowHandler({ agentHint: options?.agentHint });\n\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    resourceOverride: options?.resourceOverride,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Check if an error indicates OAuth is required\n */\nexport function isOAuthRequired(error: unknown): boolean {\n  if (error instanceof Error) {\n    if (error.name === 'UnauthorizedError') return true;\n    const msg = error.message.toLowerCase();\n    if (msg.includes('unauthorized') || msg.includes('authentication required') || msg.includes('oauth')) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Check if an agent has valid OAuth tokens\n */\nexport function hasValidOAuthTokens(agent: AgentConfig): boolean {\n  const tokens = agent.oauth_tokens;\n  if (!tokens?.access_token) return false;\n\n  if (tokens.expires_at) {\n    const expiresAt = new Date(tokens.expires_at);\n    // Expired if within 5 minutes of expiration\n    if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\n/**\n * Clear OAuth tokens from an agent config\n */\nexport function clearOAuthTokens(agent: AgentConfig): void {\n  delete agent.oauth_tokens;\n  delete agent.oauth_client;\n  delete agent.oauth_code_verifier;\n}\n\n/**\n * Get the effective auth token for an agent\n * Returns OAuth access_token if available, otherwise static auth_token\n */\nexport function getEffectiveAuthToken(agent: AgentConfig): string | undefined {\n  // Prefer OAuth if available and valid\n  if (hasValidOAuthTokens(agent)) {\n    return agent.oauth_tokens!.access_token;\n  }\n  // Fall back to static token\n  return agent.auth_token;\n}\n\n// OAuth discovery\nexport {\n  discoverOAuthMetadata,\n  supportsOAuth,\n  supportsDynamicRegistration,\n  type OAuthMetadata,\n  type DiscoveryOptions,\n} from './discovery';\n\n// Diagnostics utilities — for `adcp diagnose-auth` and consumer introspection\nexport {\n  parseWWWAuthenticate,\n  decodeAccessTokenClaims,\n  validateTokenAudience,\n  type WWWAuthenticateChallenge,\n  type DecodedJWTHeader,\n  type DecodedJWTClaims,\n  type DecodedAccessToken,\n  type TokenAudienceResult,\n} from './diagnostics';\n\n// End-to-end OAuth handshake diagnosis (powers `adcp diagnose-auth`)\nexport {\n  runAuthDiagnosis,\n  AUTH_DIAGNOSIS_SCHEMA_VERSION,\n  type DiagnoseOptions,\n  type HttpCapture,\n  type DiagnosisStep,\n  type Hypothesis,\n  type HypothesisVerdict,\n  type AuthDiagnosisReport,\n} from './diagnose';\n\n// Zero-config authorization discovery + actionable error type.\n// Raised automatically by `ProtocolClient.callTool` when an MCP agent returns\n// a 401 Bearer challenge and the caller has no saved tokens.\nexport {\n  NeedsAuthorizationError,\n  discoverAuthorizationRequirements,\n  probeAuthChallenge,\n  type AuthorizationRequirements,\n  type DiscoverAuthorizationOptions,\n} from './authorization-required';\n\n// File-backed `OAuthConfigStorage` implementation (agents.json format).\nexport { createFileOAuthStorage, type FileOAuthStorageOptions } from './file-storage';\n\n// OAuth 2.0 client credentials grant (RFC 6749 §4.4) for machine-to-machine\n// token exchange. Used by the CLI for automated compliance runs where there\n// is no user to walk through an authorization-code flow.\nexport {\n  exchangeClientCredentials,\n  ensureClientCredentialsTokens,\n  ClientCredentialsExchangeError,\n  type ExchangeClientCredentialsOptions,\n  type EnsureClientCredentialsOptions,\n} from './ClientCredentialsFlow';\n\n// `$ENV:VAR` indirection for client credentials so secrets can live in env\n// vars (CI) rather than on disk in the agent config.\nexport {\n  resolveSecret,\n  isEnvSecretReference,\n  toEnvSecretReference,\n  extractEnvSecretName,\n  MissingEnvSecretError,\n} from './secret-resolver';\n\n// Type re-export — the credentials struct itself lives in the ADCP core types\n// module alongside `AgentOAuthTokens` / `AgentOAuthClient`.\nexport type { AgentOAuthClientCredentials } from '../../types/adcp';\n\n// Per-agent storage binding — the bridge that lets `callTool` pick up the\n// caller's chosen `OAuthConfigStorage` without a signature change.\nexport { bindAgentStorage, getAgentStorage, unbindAgentStorage } from './storage-registry';\n\n// Re-exported MCP SDK OAuth error types so consumers can discriminate 401 causes\n// without string-matching on error messages. These originate from the MCP server\n// auth module but are the canonical OAuth error classes for client-side handling too.\nexport { InvalidTokenError, InsufficientScopeError } from '@modelcontextprotocol/sdk/server/auth/errors.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+CA,mBASO;AAGP,4BAA0D;AAC1D,uCAAgF;AAMhF,sBAqBO;AAGP,8BAAiC;AAMjC,IAAAA,2BAAiC;AACjC,IAAAC,yBAA0D;AAC1D,IAAAC,oCAA0C;AAE1C,IAAAC,gBAAwC;AAyLxC,uBAMO;AAGP,yBASO;AAGP,sBASO;AAKP,oCAMO;AAGP,0BAAqE;AAKrE,mCAMO;AAIP,6BAMO;AAQP,8BAAsE;AAKtE,oBAA0D;AAjOnD,SAAS,uBACd,OACA,SAmBkB;AAClB,QAAM,aAAmC;AAAA,IACvC,cAAc,SAAS;AAAA,IACvB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS;AAAA,EAClB;AACA,QAAM,cAAc,IAAI,sCAAe,UAAU;AAGjD,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAYO,SAAS,kCACd,OACA,SAekB;AAClB,QAAM,cAAc,IAAI,4DAA0B,EAAE,WAAW,SAAS,UAAU,CAAC;AAEnF,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,gBAAgB,OAAyB;AACvD,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,oBAAqB,QAAO;AAC/C,UAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,yBAAyB,KAAK,IAAI,SAAS,OAAO,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,OAA6B;AAC/D,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,aAAc,QAAO;AAElC,MAAI,OAAO,YAAY;AACrB,UAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,QAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,iBAAiB,OAA0B;AACzD,SAAO,MAAM;AACb,SAAO,MAAM;AACb,SAAO,MAAM;AACf;AAMO,SAAS,sBAAsB,OAAwC;AAE5E,MAAI,oBAAoB,KAAK,GAAG;AAC9B,WAAO,MAAM,aAAc;AAAA,EAC7B;AAEA,SAAO,MAAM;AACf;","names":["import_MCPOAuthProvider","import_CLIFlowHandler","import_NonInteractiveFlowHandler","import_types"]}

package/dist/lib/auth/oauth/index.mjs

@@ -21,6 +21,7 @@ import {
   TokenExchangeError,
   ProtectedResourceMetadataError,
   AgentVanishedDuringFlowError,
+  AgentChangedDuringFlowError,
   ConfidentialClientNotAllowedError,
   DEFAULT_WEB_FLOW_TTL_MS
 } from "./web-flow.mjs";
@@ -45,6 +46,7 @@ function createCLIOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -60,6 +62,7 @@ function createNonInteractiveOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -132,6 +135,7 @@ import { bindAgentStorage, getAgentStorage, unbindAgentStorage } from "./storage
 import { InvalidTokenError, InsufficientScopeError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 export {
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
+  AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   CLIFlowHandler,

package/dist/lib/auth/oauth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/index.ts"],"sourcesContent":["/**\n * OAuth module for MCP authentication\n *\n * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.\n *\n * @example\n * ```typescript\n * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/sdk';\n *\n * // Agent config - tokens will be stored here\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // After OAuth flow completes:\n *   // oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * // Create provider with CLI flow handler\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens to file/db\n * });\n *\n * // Use with MCP transport\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\n\n// Types\nexport type {\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n  AgentConfig,\n  AgentOAuthTokens,\n  AgentOAuthClient,\n} from './types';\n\nexport {\n  DEFAULT_CLIENT_METADATA,\n  OAuthError,\n  OAuthCancelledError,\n  OAuthTimeoutError,\n  toMCPTokens,\n  fromMCPTokens,\n  toMCPClientInfo,\n  fromMCPClientInfo,\n} from './types';\n\n// Flow handlers\nexport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nexport { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';\n\n// Web (server-side) OAuth flow — companion to CLIFlowHandler for environments\n// where /oauth/start and /oauth/callback may be served by different processes.\n// Note: standalone functions, NOT a class implementing OAuthFlowHandler — see\n// docs/guides/WEB-OAUTH.md for the rationale (the contract spans two requests).\nexport {\n  startWebOAuthFlow,\n  completeWebOAuthFlow,\n  safeReturnTo,\n  InMemoryPendingFlowStore,\n  InvalidOrExpiredFlowError,\n  StateMismatchError,\n  BrowserBindingRequiredError,\n  TokenExchangeError,\n  ProtectedResourceMetadataError,\n  AgentVanishedDuringFlowError,\n  ConfidentialClientNotAllowedError,\n  DEFAULT_WEB_FLOW_TTL_MS,\n  type PendingWebFlow,\n  type PendingWebFlowStore,\n  type PendingFlowStore,\n  type StartWebFlowOptions,\n  type StartWebFlowResult,\n  type CompleteWebFlowOptions,\n  type CompleteWebFlowResult,\n} from './web-flow';\n\n// Main provider\nexport { MCPOAuthProvider } from './MCPOAuthProvider';\n\n// ========================================\n// Convenience factory functions\n// ========================================\n\nimport { MCPOAuthProvider } from './MCPOAuthProvider';\nimport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nimport { NonInteractiveFlowHandler } from './NonInteractiveFlowHandler';\nimport type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';\nimport { DEFAULT_CLIENT_METADATA } from './types';\n\n/**\n * Create an OAuth provider for CLI usage\n *\n * @param agent Agent configuration (tokens stored here)\n * @param options Optional configuration\n * @returns Configured OAuth provider\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp'\n * };\n *\n * const provider = createCLIOAuthProvider(agent);\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n *\n * try {\n *   await client.connect(transport);\n * } catch (error) {\n *   if (error instanceof UnauthorizedError) {\n *     const code = await provider.waitForCallback();\n *     await transport.finishAuth(code);\n *     await client.connect(transport);\n *   }\n * }\n *\n * // After successful auth, agent.oauth_tokens is populated\n * console.log(agent.oauth_tokens);\n * ```\n */\nexport function createCLIOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Callback port (default: 8766) */\n    callbackPort?: number;\n    /** Auth timeout in ms (default: 300000 = 5 min) */\n    timeout?: number;\n    /** Custom client metadata overrides */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Suppress console output */\n    quiet?: boolean;\n    /** Storage for persisting agent config */\n    storage?: OAuthConfigStorage;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowConfig: CLIFlowHandlerConfig = {\n    callbackPort: options?.callbackPort,\n    timeout: options?.timeout,\n    quiet: options?.quiet,\n  };\n  const flowHandler = new CLIFlowHandler(flowConfig);\n\n  // Build complete client metadata\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Create an OAuth provider that uses and auto-refreshes saved tokens but\n * refuses to start a new interactive browser flow. Use this for storyboard\n * runs, scheduled jobs, and other non-interactive contexts where you've\n * already saved tokens via `createCLIOAuthProvider`.\n *\n * If refresh fails (e.g., the refresh_token is revoked or expired), the\n * MCP SDK will throw `UnauthorizedError` at call time — the caller should\n * treat that as a signal to run `adcp --save-auth <alias> --oauth` and retry.\n */\nexport function createNonInteractiveOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Hint shown in error messages if an interactive flow is attempted. */\n    agentHint?: string;\n    /** Custom client metadata overrides (inherited from saved registration in practice). */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Storage for persisting refreshed tokens back to disk. */\n    storage?: OAuthConfigStorage;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowHandler = new NonInteractiveFlowHandler({ agentHint: options?.agentHint });\n\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Check if an error indicates OAuth is required\n */\nexport function isOAuthRequired(error: unknown): boolean {\n  if (error instanceof Error) {\n    if (error.name === 'UnauthorizedError') return true;\n    const msg = error.message.toLowerCase();\n    if (msg.includes('unauthorized') || msg.includes('authentication required') || msg.includes('oauth')) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Check if an agent has valid OAuth tokens\n */\nexport function hasValidOAuthTokens(agent: AgentConfig): boolean {\n  const tokens = agent.oauth_tokens;\n  if (!tokens?.access_token) return false;\n\n  if (tokens.expires_at) {\n    const expiresAt = new Date(tokens.expires_at);\n    // Expired if within 5 minutes of expiration\n    if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\n/**\n * Clear OAuth tokens from an agent config\n */\nexport function clearOAuthTokens(agent: AgentConfig): void {\n  delete agent.oauth_tokens;\n  delete agent.oauth_client;\n  delete agent.oauth_code_verifier;\n}\n\n/**\n * Get the effective auth token for an agent\n * Returns OAuth access_token if available, otherwise static auth_token\n */\nexport function getEffectiveAuthToken(agent: AgentConfig): string | undefined {\n  // Prefer OAuth if available and valid\n  if (hasValidOAuthTokens(agent)) {\n    return agent.oauth_tokens!.access_token;\n  }\n  // Fall back to static token\n  return agent.auth_token;\n}\n\n// OAuth discovery\nexport {\n  discoverOAuthMetadata,\n  supportsOAuth,\n  supportsDynamicRegistration,\n  type OAuthMetadata,\n  type DiscoveryOptions,\n} from './discovery';\n\n// Diagnostics utilities — for `adcp diagnose-auth` and consumer introspection\nexport {\n  parseWWWAuthenticate,\n  decodeAccessTokenClaims,\n  validateTokenAudience,\n  type WWWAuthenticateChallenge,\n  type DecodedJWTHeader,\n  type DecodedJWTClaims,\n  type DecodedAccessToken,\n  type TokenAudienceResult,\n} from './diagnostics';\n\n// End-to-end OAuth handshake diagnosis (powers `adcp diagnose-auth`)\nexport {\n  runAuthDiagnosis,\n  AUTH_DIAGNOSIS_SCHEMA_VERSION,\n  type DiagnoseOptions,\n  type HttpCapture,\n  type DiagnosisStep,\n  type Hypothesis,\n  type HypothesisVerdict,\n  type AuthDiagnosisReport,\n} from './diagnose';\n\n// Zero-config authorization discovery + actionable error type.\n// Raised automatically by `ProtocolClient.callTool` when an MCP agent returns\n// a 401 Bearer challenge and the caller has no saved tokens.\nexport {\n  NeedsAuthorizationError,\n  discoverAuthorizationRequirements,\n  probeAuthChallenge,\n  type AuthorizationRequirements,\n  type DiscoverAuthorizationOptions,\n} from './authorization-required';\n\n// File-backed `OAuthConfigStorage` implementation (agents.json format).\nexport { createFileOAuthStorage, type FileOAuthStorageOptions } from './file-storage';\n\n// OAuth 2.0 client credentials grant (RFC 6749 §4.4) for machine-to-machine\n// token exchange. Used by the CLI for automated compliance runs where there\n// is no user to walk through an authorization-code flow.\nexport {\n  exchangeClientCredentials,\n  ensureClientCredentialsTokens,\n  ClientCredentialsExchangeError,\n  type ExchangeClientCredentialsOptions,\n  type EnsureClientCredentialsOptions,\n} from './ClientCredentialsFlow';\n\n// `$ENV:VAR` indirection for client credentials so secrets can live in env\n// vars (CI) rather than on disk in the agent config.\nexport {\n  resolveSecret,\n  isEnvSecretReference,\n  toEnvSecretReference,\n  extractEnvSecretName,\n  MissingEnvSecretError,\n} from './secret-resolver';\n\n// Type re-export — the credentials struct itself lives in the ADCP core types\n// module alongside `AgentOAuthTokens` / `AgentOAuthClient`.\nexport type { AgentOAuthClientCredentials } from '../../types/adcp';\n\n// Per-agent storage binding — the bridge that lets `callTool` pick up the\n// caller's chosen `OAuthConfigStorage` without a signature change.\nexport { bindAgentStorage, getAgentStorage, unbindAgentStorage } from './storage-registry';\n\n// Re-exported MCP SDK OAuth error types so consumers can discriminate 401 causes\n// without string-matching on error messages. These originate from the MCP server\n// auth module but are the canonical OAuth error classes for client-side handling too.\nexport { InvalidTokenError, InsufficientScopeError } from '@modelcontextprotocol/sdk/server/auth/errors.js';\n"],"mappings":"AA+CA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,sBAAiD;AAC1D,SAAS,iCAAuE;AAMhF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AAGP,SAAS,wBAAwB;AAMjC,SAAS,oBAAAA,yBAAwB;AACjC,SAAS,kBAAAC,uBAAiD;AAC1D,SAAS,6BAAAC,kCAAiC;AAE1C,SAAS,2BAAAC,gCAA+B;AAsCjC,SAAS,uBACd,OACA,SAiBkB;AAClB,QAAM,aAAmC;AAAA,IACvC,cAAc,SAAS;AAAA,IACvB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS;AAAA,EAClB;AACA,QAAM,cAAc,IAAIF,gBAAe,UAAU;AAGjD,QAAM,iBAAsC;AAAA,IAC1C,GAAGE;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAIH,kBAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAYO,SAAS,kCACd,OACA,SAakB;AAClB,QAAM,cAAc,IAAIE,2BAA0B,EAAE,WAAW,SAAS,UAAU,CAAC;AAEnF,QAAM,iBAAsC;AAAA,IAC1C,GAAGC;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAIH,kBAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,gBAAgB,OAAyB;AACvD,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,oBAAqB,QAAO;AAC/C,UAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,yBAAyB,KAAK,IAAI,SAAS,OAAO,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,OAA6B;AAC/D,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,aAAc,QAAO;AAElC,MAAI,OAAO,YAAY;AACrB,UAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,QAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,iBAAiB,OAA0B;AACzD,SAAO,MAAM;AACb,SAAO,MAAM;AACb,SAAO,MAAM;AACf;AAMO,SAAS,sBAAsB,OAAwC;AAE5E,MAAI,oBAAoB,KAAK,GAAG;AAC9B,WAAO,MAAM,aAAc;AAAA,EAC7B;AAEA,SAAO,MAAM;AACf;AAGA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,OAOK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAGP,SAAS,8BAA4D;AAKrE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,SAAS,kBAAkB,iBAAiB,0BAA0B;AAKtE,SAAS,mBAAmB,8BAA8B;","names":["MCPOAuthProvider","CLIFlowHandler","NonInteractiveFlowHandler","DEFAULT_CLIENT_METADATA"]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/index.ts"],"sourcesContent":["/**\n * OAuth module for MCP authentication\n *\n * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.\n *\n * @example\n * ```typescript\n * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/sdk';\n *\n * // Agent config - tokens will be stored here\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // After OAuth flow completes:\n *   // oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * // Create provider with CLI flow handler\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens to file/db\n * });\n *\n * // Use with MCP transport\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\n\n// Types\nexport type {\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n  AgentConfig,\n  AgentOAuthTokens,\n  AgentOAuthClient,\n} from './types';\n\nexport {\n  DEFAULT_CLIENT_METADATA,\n  OAuthError,\n  OAuthCancelledError,\n  OAuthTimeoutError,\n  toMCPTokens,\n  fromMCPTokens,\n  toMCPClientInfo,\n  fromMCPClientInfo,\n} from './types';\n\n// Flow handlers\nexport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nexport { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';\n\n// Web (server-side) OAuth flow — companion to CLIFlowHandler for environments\n// where /oauth/start and /oauth/callback may be served by different processes.\n// Note: standalone functions, NOT a class implementing OAuthFlowHandler — see\n// docs/guides/WEB-OAUTH.md for the rationale (the contract spans two requests).\nexport {\n  startWebOAuthFlow,\n  completeWebOAuthFlow,\n  safeReturnTo,\n  InMemoryPendingFlowStore,\n  InvalidOrExpiredFlowError,\n  StateMismatchError,\n  BrowserBindingRequiredError,\n  TokenExchangeError,\n  ProtectedResourceMetadataError,\n  AgentVanishedDuringFlowError,\n  AgentChangedDuringFlowError,\n  ConfidentialClientNotAllowedError,\n  DEFAULT_WEB_FLOW_TTL_MS,\n  type PendingWebFlow,\n  type PendingWebFlowStore,\n  type PendingFlowStore,\n  type StartWebFlowOptions,\n  type StartWebFlowResult,\n  type CompleteWebFlowOptions,\n  type CompleteWebFlowResult,\n} from './web-flow';\n\n// Main provider\nexport { MCPOAuthProvider } from './MCPOAuthProvider';\n\n// ========================================\n// Convenience factory functions\n// ========================================\n\nimport { MCPOAuthProvider } from './MCPOAuthProvider';\nimport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nimport { NonInteractiveFlowHandler } from './NonInteractiveFlowHandler';\nimport type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';\nimport { DEFAULT_CLIENT_METADATA } from './types';\n\n/**\n * Create an OAuth provider for CLI usage\n *\n * @param agent Agent configuration (tokens stored here)\n * @param options Optional configuration\n * @returns Configured OAuth provider\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp'\n * };\n *\n * const provider = createCLIOAuthProvider(agent);\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n *\n * try {\n *   await client.connect(transport);\n * } catch (error) {\n *   if (error instanceof UnauthorizedError) {\n *     const code = await provider.waitForCallback();\n *     await transport.finishAuth(code);\n *     await client.connect(transport);\n *   }\n * }\n *\n * // After successful auth, agent.oauth_tokens is populated\n * console.log(agent.oauth_tokens);\n * ```\n */\nexport function createCLIOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Callback port (default: 8766) */\n    callbackPort?: number;\n    /** Auth timeout in ms (default: 300000 = 5 min) */\n    timeout?: number;\n    /** Custom client metadata overrides */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Suppress console output */\n    quiet?: boolean;\n    /** Storage for persisting agent config */\n    storage?: OAuthConfigStorage;\n    /** Operator RFC 8707 override; `null` returns to metadata discovery. */\n    resourceOverride?: string | null;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowConfig: CLIFlowHandlerConfig = {\n    callbackPort: options?.callbackPort,\n    timeout: options?.timeout,\n    quiet: options?.quiet,\n  };\n  const flowHandler = new CLIFlowHandler(flowConfig);\n\n  // Build complete client metadata\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    resourceOverride: options?.resourceOverride,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Create an OAuth provider that uses and auto-refreshes saved tokens but\n * refuses to start a new interactive browser flow. Use this for storyboard\n * runs, scheduled jobs, and other non-interactive contexts where you've\n * already saved tokens via `createCLIOAuthProvider`.\n *\n * If refresh fails (e.g., the refresh_token is revoked or expired), the\n * MCP SDK will throw `UnauthorizedError` at call time — the caller should\n * treat that as a signal to run `adcp --save-auth <alias> --oauth` and retry.\n */\nexport function createNonInteractiveOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Hint shown in error messages if an interactive flow is attempted. */\n    agentHint?: string;\n    /** Custom client metadata overrides (inherited from saved registration in practice). */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Storage for persisting refreshed tokens back to disk. */\n    storage?: OAuthConfigStorage;\n    /** Operator RFC 8707 override reused during refresh; `null` disables it. */\n    resourceOverride?: string | null;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowHandler = new NonInteractiveFlowHandler({ agentHint: options?.agentHint });\n\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    resourceOverride: options?.resourceOverride,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Check if an error indicates OAuth is required\n */\nexport function isOAuthRequired(error: unknown): boolean {\n  if (error instanceof Error) {\n    if (error.name === 'UnauthorizedError') return true;\n    const msg = error.message.toLowerCase();\n    if (msg.includes('unauthorized') || msg.includes('authentication required') || msg.includes('oauth')) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Check if an agent has valid OAuth tokens\n */\nexport function hasValidOAuthTokens(agent: AgentConfig): boolean {\n  const tokens = agent.oauth_tokens;\n  if (!tokens?.access_token) return false;\n\n  if (tokens.expires_at) {\n    const expiresAt = new Date(tokens.expires_at);\n    // Expired if within 5 minutes of expiration\n    if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\n/**\n * Clear OAuth tokens from an agent config\n */\nexport function clearOAuthTokens(agent: AgentConfig): void {\n  delete agent.oauth_tokens;\n  delete agent.oauth_client;\n  delete agent.oauth_code_verifier;\n}\n\n/**\n * Get the effective auth token for an agent\n * Returns OAuth access_token if available, otherwise static auth_token\n */\nexport function getEffectiveAuthToken(agent: AgentConfig): string | undefined {\n  // Prefer OAuth if available and valid\n  if (hasValidOAuthTokens(agent)) {\n    return agent.oauth_tokens!.access_token;\n  }\n  // Fall back to static token\n  return agent.auth_token;\n}\n\n// OAuth discovery\nexport {\n  discoverOAuthMetadata,\n  supportsOAuth,\n  supportsDynamicRegistration,\n  type OAuthMetadata,\n  type DiscoveryOptions,\n} from './discovery';\n\n// Diagnostics utilities — for `adcp diagnose-auth` and consumer introspection\nexport {\n  parseWWWAuthenticate,\n  decodeAccessTokenClaims,\n  validateTokenAudience,\n  type WWWAuthenticateChallenge,\n  type DecodedJWTHeader,\n  type DecodedJWTClaims,\n  type DecodedAccessToken,\n  type TokenAudienceResult,\n} from './diagnostics';\n\n// End-to-end OAuth handshake diagnosis (powers `adcp diagnose-auth`)\nexport {\n  runAuthDiagnosis,\n  AUTH_DIAGNOSIS_SCHEMA_VERSION,\n  type DiagnoseOptions,\n  type HttpCapture,\n  type DiagnosisStep,\n  type Hypothesis,\n  type HypothesisVerdict,\n  type AuthDiagnosisReport,\n} from './diagnose';\n\n// Zero-config authorization discovery + actionable error type.\n// Raised automatically by `ProtocolClient.callTool` when an MCP agent returns\n// a 401 Bearer challenge and the caller has no saved tokens.\nexport {\n  NeedsAuthorizationError,\n  discoverAuthorizationRequirements,\n  probeAuthChallenge,\n  type AuthorizationRequirements,\n  type DiscoverAuthorizationOptions,\n} from './authorization-required';\n\n// File-backed `OAuthConfigStorage` implementation (agents.json format).\nexport { createFileOAuthStorage, type FileOAuthStorageOptions } from './file-storage';\n\n// OAuth 2.0 client credentials grant (RFC 6749 §4.4) for machine-to-machine\n// token exchange. Used by the CLI for automated compliance runs where there\n// is no user to walk through an authorization-code flow.\nexport {\n  exchangeClientCredentials,\n  ensureClientCredentialsTokens,\n  ClientCredentialsExchangeError,\n  type ExchangeClientCredentialsOptions,\n  type EnsureClientCredentialsOptions,\n} from './ClientCredentialsFlow';\n\n// `$ENV:VAR` indirection for client credentials so secrets can live in env\n// vars (CI) rather than on disk in the agent config.\nexport {\n  resolveSecret,\n  isEnvSecretReference,\n  toEnvSecretReference,\n  extractEnvSecretName,\n  MissingEnvSecretError,\n} from './secret-resolver';\n\n// Type re-export — the credentials struct itself lives in the ADCP core types\n// module alongside `AgentOAuthTokens` / `AgentOAuthClient`.\nexport type { AgentOAuthClientCredentials } from '../../types/adcp';\n\n// Per-agent storage binding — the bridge that lets `callTool` pick up the\n// caller's chosen `OAuthConfigStorage` without a signature change.\nexport { bindAgentStorage, getAgentStorage, unbindAgentStorage } from './storage-registry';\n\n// Re-exported MCP SDK OAuth error types so consumers can discriminate 401 causes\n// without string-matching on error messages. These originate from the MCP server\n// auth module but are the canonical OAuth error classes for client-side handling too.\nexport { InvalidTokenError, InsufficientScopeError } from '@modelcontextprotocol/sdk/server/auth/errors.js';\n"],"mappings":"AA+CA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,sBAAiD;AAC1D,SAAS,iCAAuE;AAMhF;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AAGP,SAAS,wBAAwB;AAMjC,SAAS,oBAAAA,yBAAwB;AACjC,SAAS,kBAAAC,uBAAiD;AAC1D,SAAS,6BAAAC,kCAAiC;AAE1C,SAAS,2BAAAC,gCAA+B;AAsCjC,SAAS,uBACd,OACA,SAmBkB;AAClB,QAAM,aAAmC;AAAA,IACvC,cAAc,SAAS;AAAA,IACvB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS;AAAA,EAClB;AACA,QAAM,cAAc,IAAIF,gBAAe,UAAU;AAGjD,QAAM,iBAAsC;AAAA,IAC1C,GAAGE;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAIH,kBAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAYO,SAAS,kCACd,OACA,SAekB;AAClB,QAAM,cAAc,IAAIE,2BAA0B,EAAE,WAAW,SAAS,UAAU,CAAC;AAEnF,QAAM,iBAAsC;AAAA,IAC1C,GAAGC;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAIH,kBAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,gBAAgB,OAAyB;AACvD,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,oBAAqB,QAAO;AAC/C,UAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,yBAAyB,KAAK,IAAI,SAAS,OAAO,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,OAA6B;AAC/D,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,aAAc,QAAO;AAElC,MAAI,OAAO,YAAY;AACrB,UAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,QAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,iBAAiB,OAA0B;AACzD,SAAO,MAAM;AACb,SAAO,MAAM;AACb,SAAO,MAAM;AACf;AAMO,SAAS,sBAAsB,OAAwC;AAE5E,MAAI,oBAAoB,KAAK,GAAG;AAC9B,WAAO,MAAM,aAAc;AAAA,EAC7B;AAEA,SAAO,MAAM;AACf;AAGA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,OAOK;AAKP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAGP,SAAS,8BAA4D;AAKrE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,SAAS,kBAAkB,iBAAiB,0BAA0B;AAKtE,SAAS,mBAAmB,8BAA8B;","names":["MCPOAuthProvider","CLIFlowHandler","NonInteractiveFlowHandler","DEFAULT_CLIENT_METADATA"]}

package/dist/lib/auth/oauth/resource-url.d.mts

@@ -0,0 +1,4 @@
+/** Validate and canonicalize an operator-configured RFC 8707 resource URI. */
+export declare function validateOAuthResourceUrl(value: string, options?: {
+    allowHttp?: boolean;
+}): URL;

package/dist/lib/auth/oauth/resource-url.d.ts

@@ -0,0 +1,5 @@
+/** Validate and canonicalize an operator-configured RFC 8707 resource URI. */
+export declare function validateOAuthResourceUrl(value: string, options?: {
+    allowHttp?: boolean;
+}): URL;
+//# sourceMappingURL=resource-url.d.ts.map

package/dist/lib/auth/oauth/resource-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-url.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/resource-url.ts"],"names":[],"mappings":"AAIA,8EAA8E;AAC9E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,GAAG,CAuBlG"}

package/dist/lib/auth/oauth/resource-url.js

@@ -0,0 +1,51 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resource_url_exports = {};
+__export(resource_url_exports, {
+  validateOAuthResourceUrl: () => validateOAuthResourceUrl
+});
+module.exports = __toCommonJS(resource_url_exports);
+var import_types = require('./types.js');
+const MAX_RESOURCE_URL_LENGTH = 2048;
+function validateOAuthResourceUrl(value, options = {}) {
+  if (value.length === 0 || value.length > MAX_RESOURCE_URL_LENGTH) {
+    throw new import_types.OAuthError("OAuth resource override must be between 1 and 2048 characters", "invalid_resource_override");
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new import_types.OAuthError("OAuth resource override must be an absolute URL", "invalid_resource_override");
+  }
+  if (url.username || url.password) {
+    throw new import_types.OAuthError("OAuth resource override must not contain URL userinfo", "invalid_resource_override");
+  }
+  if (url.hash) {
+    throw new import_types.OAuthError("OAuth resource override must not contain a fragment", "invalid_resource_override");
+  }
+  if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) {
+    throw new import_types.OAuthError("OAuth resource override must use HTTPS", "invalid_resource_override");
+  }
+  return url;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  validateOAuthResourceUrl
+});
+//# sourceMappingURL=resource-url.js.map

package/dist/lib/auth/oauth/resource-url.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/lib/auth/oauth/resource-url.ts"],"sourcesContent":["import { OAuthError } from './types';\n\nconst MAX_RESOURCE_URL_LENGTH = 2048;\n\n/** Validate and canonicalize an operator-configured RFC 8707 resource URI. */\nexport function validateOAuthResourceUrl(value: string, options: { allowHttp?: boolean } = {}): URL {\n  if (value.length === 0 || value.length > MAX_RESOURCE_URL_LENGTH) {\n    throw new OAuthError('OAuth resource override must be between 1 and 2048 characters', 'invalid_resource_override');\n  }\n\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new OAuthError('OAuth resource override must be an absolute URL', 'invalid_resource_override');\n  }\n\n  if (url.username || url.password) {\n    throw new OAuthError('OAuth resource override must not contain URL userinfo', 'invalid_resource_override');\n  }\n  if (url.hash) {\n    throw new OAuthError('OAuth resource override must not contain a fragment', 'invalid_resource_override');\n  }\n  if (url.protocol !== 'https:' && !(options.allowHttp && url.protocol === 'http:')) {\n    throw new OAuthError('OAuth resource override must use HTTPS', 'invalid_resource_override');\n  }\n\n  return url;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA2B;AAE3B,MAAM,0BAA0B;AAGzB,SAAS,yBAAyB,OAAe,UAAmC,CAAC,GAAQ;AAClG,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,yBAAyB;AAChE,UAAM,IAAI,wBAAW,iEAAiE,2BAA2B;AAAA,EACnH;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,wBAAW,mDAAmD,2BAA2B;AAAA,EACrG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,wBAAW,yDAAyD,2BAA2B;AAAA,EAC3G;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,wBAAW,uDAAuD,2BAA2B;AAAA,EACzG;AACA,MAAI,IAAI,aAAa,YAAY,EAAE,QAAQ,aAAa,IAAI,aAAa,UAAU;AACjF,UAAM,IAAI,wBAAW,0CAA0C,2BAA2B;AAAA,EAC5F;AAEA,SAAO;AACT;","names":[]}

package/dist/lib/auth/oauth/resource-url.mjs

@@ -0,0 +1,27 @@
+import { OAuthError } from "./types.mjs";
+const MAX_RESOURCE_URL_LENGTH = 2048;
+function validateOAuthResourceUrl(value, options = {}) {
+  if (value.length === 0 || value.length > MAX_RESOURCE_URL_LENGTH) {
+    throw new OAuthError("OAuth resource override must be between 1 and 2048 characters", "invalid_resource_override");
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new OAuthError("OAuth resource override must be an absolute URL", "invalid_resource_override");
+  }
+  if (url.username || url.password) {
+    throw new OAuthError("OAuth resource override must not contain URL userinfo", "invalid_resource_override");
+  }
+  if (url.hash) {
+    throw new OAuthError("OAuth resource override must not contain a fragment", "invalid_resource_override");
+  }
+  if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) {
+    throw new OAuthError("OAuth resource override must use HTTPS", "invalid_resource_override");
+  }
+  return url;
+}
+export {
+  validateOAuthResourceUrl
+};
+//# sourceMappingURL=resource-url.mjs.map

package/dist/lib/auth/oauth/resource-url.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/lib/auth/oauth/resource-url.ts"],"sourcesContent":["import { OAuthError } from './types';\n\nconst MAX_RESOURCE_URL_LENGTH = 2048;\n\n/** Validate and canonicalize an operator-configured RFC 8707 resource URI. */\nexport function validateOAuthResourceUrl(value: string, options: { allowHttp?: boolean } = {}): URL {\n  if (value.length === 0 || value.length > MAX_RESOURCE_URL_LENGTH) {\n    throw new OAuthError('OAuth resource override must be between 1 and 2048 characters', 'invalid_resource_override');\n  }\n\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new OAuthError('OAuth resource override must be an absolute URL', 'invalid_resource_override');\n  }\n\n  if (url.username || url.password) {\n    throw new OAuthError('OAuth resource override must not contain URL userinfo', 'invalid_resource_override');\n  }\n  if (url.hash) {\n    throw new OAuthError('OAuth resource override must not contain a fragment', 'invalid_resource_override');\n  }\n  if (url.protocol !== 'https:' && !(options.allowHttp && url.protocol === 'http:')) {\n    throw new OAuthError('OAuth resource override must use HTTPS', 'invalid_resource_override');\n  }\n\n  return url;\n}\n"],"mappings":"AAAA,SAAS,kBAAkB;AAE3B,MAAM,0BAA0B;AAGzB,SAAS,yBAAyB,OAAe,UAAmC,CAAC,GAAQ;AAClG,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,yBAAyB;AAChE,UAAM,IAAI,WAAW,iEAAiE,2BAA2B;AAAA,EACnH;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,WAAW,mDAAmD,2BAA2B;AAAA,EACrG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,WAAW,yDAAyD,2BAA2B;AAAA,EAC3G;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,WAAW,uDAAuD,2BAA2B;AAAA,EACzG;AACA,MAAI,IAAI,aAAa,YAAY,EAAE,QAAQ,aAAa,IAAI,aAAa,UAAU;AACjF,UAAM,IAAI,WAAW,0CAA0C,2BAA2B;AAAA,EAC5F;AAEA,SAAO;AACT;","names":[]}

package/dist/lib/auth/oauth/types.d.mts

@@ -76,6 +76,13 @@ export interface OAuthProviderConfig {
     flowHandler: OAuthFlowHandler;
     /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */
     clientMetadata: OAuthClientMetadata;
+    /**
+     * Operator-supplied RFC 8707 resource override. Takes precedence over the
+     * resource advertised by protected-resource metadata and is forwarded by
+     * the MCP SDK during authorization, code exchange, and refresh. Pass `null`
+     * to ignore `agent.oauth_resource` and return to metadata discovery.
+     */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs in RFC 9728 protected-resource metadata.
      * Mirrors the CLI's `--allow-http` flag and matches the operator-driven

package/dist/lib/auth/oauth/types.d.ts

@@ -76,6 +76,13 @@ export interface OAuthProviderConfig {
     flowHandler: OAuthFlowHandler;
     /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */
     clientMetadata: OAuthClientMetadata;
+    /**
+     * Operator-supplied RFC 8707 resource override. Takes precedence over the
+     * resource advertised by protected-resource metadata and is forwarded by
+     * the MCP SDK during authorization, code exchange, and refresh. Pass `null`
+     * to ignore `agent.oauth_resource` and return to metadata discovery.
+     */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs in RFC 9728 protected-resource metadata.
      * Mirrors the CLI's `--allow-http` flag and matches the operator-driven

package/dist/lib/auth/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGxF,YAAY,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;AAGrG,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAE7D;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,GAAG,CAAC;IAE/B;;;;;;;OAOG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;;;OAMG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,WAAW,CAAC;IAEnB,kDAAkD;IAClD,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B,iCAAiC;IACjC,WAAW,EAAE,gBAAgB,CAAC;IAE9B,6EAA6E;IAC7E,cAAc,EAAE,mBAAmB,CAAC;IAEpC;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAMrC,CAAC;AAEF;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAGjB,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,MAAM;gBAFhC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,YAAA;CAKnC;AAED,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,CAAC,EAAE,MAAM;CAI7B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAQjE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAkBnE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CAMhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,0BAA0B,GAAG,gBAAgB,CAMpF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGxF,YAAY,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC;AAGrG,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAE7D;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,GAAG,CAAC;IAE/B;;;;;;;OAOG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;;;OAMG;IACH,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,WAAW,CAAC;IAEnB,kDAAkD;IAClD,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B,iCAAiC;IACjC,WAAW,EAAE,gBAAgB,CAAC;IAE9B,6EAA6E;IAC7E,cAAc,EAAE,mBAAmB,CAAC;IAEpC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAMrC,CAAC;AAEF;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAGjB,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,MAAM;gBAFhC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,YAAA;CAKnC;AAED,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,CAAC,EAAE,MAAM;CAI7B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIjD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAQjE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAkBnE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CAMhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,0BAA0B,GAAG,gBAAgB,CAMpF"}

package/dist/lib/auth/oauth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/types.ts"],"sourcesContent":["/**\n * OAuth types for MCP authentication\n *\n * These types support the pluggable OAuth architecture:\n * - OAuthConfigStorage: Interface for reading/writing agent config with OAuth data\n * - OAuthFlowHandler: Abstract interface for authorization flow (CLI vs web)\n */\n\nimport type {\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\nimport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient } from '../../types/adcp';\n\n// Re-export MCP SDK types for convenience\nexport type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens };\n\n// Re-export agent types\nexport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient };\n\n/**\n * Agent config storage interface\n *\n * Implement this to persist OAuth tokens back to agent configuration.\n * This allows different storage backends (file, database, memory)\n * while keeping tokens in the agent config structure.\n */\nexport interface OAuthConfigStorage {\n  /**\n   * Load agent configuration\n   * @param agentId The agent ID\n   * @returns Agent config or undefined if not found\n   */\n  loadAgent(agentId: string): Promise<AgentConfig | undefined>;\n\n  /**\n   * Save agent configuration (with updated OAuth data)\n   * @param agent The agent config to save\n   */\n  saveAgent(agent: AgentConfig): Promise<void>;\n}\n\n/**\n * Authorization flow handler - implement this for different environments\n *\n * Examples:\n * - CLIFlowHandler: Opens browser, starts callback server\n * - WebFlowHandler: HTTP redirects\n * - HeadlessFlowHandler: Device code flow (future)\n */\nexport interface OAuthFlowHandler {\n  /**\n   * Get the callback URL for OAuth redirects\n   */\n  getRedirectUrl(): string | URL;\n\n  /**\n   * Redirect the user to the authorization URL\n   * For CLI: Opens browser\n   * For web: HTTP redirect or return URL for client-side redirect\n   *\n   * @param authorizationUrl The OAuth authorization URL\n   * @returns Promise that resolves when user is redirected\n   */\n  redirectToAuthorization(authorizationUrl: URL): Promise<void>;\n\n  /**\n   * Wait for the authorization callback and extract the auth code\n   * For CLI: Starts a local HTTP server and waits\n   * For web: Called by the callback route handler\n   *\n   * @returns Promise resolving to the authorization code\n   */\n  waitForCallback(): Promise<string>;\n\n  /**\n   * Clean up any resources (e.g., callback server)\n   */\n  cleanup(): Promise<void>;\n}\n\n/**\n * Configuration for creating an OAuth provider\n */\nexport interface OAuthProviderConfig {\n  /** Agent configuration (tokens will be stored here) */\n  agent: AgentConfig;\n\n  /** Storage for persisting agent config changes */\n  storage?: OAuthConfigStorage;\n\n  /** Authorization flow handler */\n  flowHandler: OAuthFlowHandler;\n\n  /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */\n  clientMetadata: OAuthClientMetadata;\n\n  /**\n   * Allow non-HTTPS resource URLs in RFC 9728 protected-resource metadata.\n   * Mirrors the CLI's `--allow-http` flag and matches the operator-driven\n   * trust model used elsewhere in the SDK (`ssrfSafeFetch.allowPrivateIp`,\n   * the agent-entry URL validators). Defaults to `false`.\n   *\n   * Scope: relaxes only the HTTPS-only check on the PRM `resource` value.\n   * Does NOT widen network-layer SSRF posture (that knob is\n   * `ADCP_ALLOW_INTERNAL_PROBES` at module load, fed by the CLI). Intended\n   * for local dev loops; do not enable when talking to remote authorization\n   * servers — the AS remains the audience gatekeeper, but a non-HTTPS\n   * resource URL implies the transport itself is unauthenticated.\n   */\n  allowHttp?: boolean;\n}\n\n/**\n * Default OAuth client metadata for ADCP clients\n */\nexport const DEFAULT_CLIENT_METADATA: OAuthClientMetadata = {\n  client_name: 'ADCP Client',\n  redirect_uris: ['http://localhost:8766/callback'],\n  grant_types: ['authorization_code', 'refresh_token'],\n  response_types: ['code'],\n  token_endpoint_auth_method: 'none', // Public client (no client_secret)\n};\n\n/**\n * OAuth error types\n */\nexport class OAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly agentId?: string\n  ) {\n    super(message);\n    this.name = 'OAuthError';\n  }\n}\n\nexport class OAuthCancelledError extends OAuthError {\n  constructor(agentId?: string) {\n    super('OAuth flow was cancelled by user', 'cancelled', agentId);\n    this.name = 'OAuthCancelledError';\n  }\n}\n\nexport class OAuthTimeoutError extends OAuthError {\n  constructor(agentId?: string, timeoutMs?: number) {\n    super(`OAuth flow timed out${timeoutMs ? ` after ${timeoutMs}ms` : ''}`, 'timeout', agentId);\n    this.name = 'OAuthTimeoutError';\n  }\n}\n\n/**\n * Convert AgentOAuthTokens to MCP SDK OAuthTokens format\n */\nexport function toMCPTokens(tokens: AgentOAuthTokens): OAuthTokens {\n  return {\n    access_token: tokens.access_token,\n    refresh_token: tokens.refresh_token,\n    token_type: tokens.token_type || 'Bearer',\n    expires_in: tokens.expires_in,\n    scope: tokens.scope,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthTokens to AgentOAuthTokens format\n */\nexport function fromMCPTokens(tokens: OAuthTokens): AgentOAuthTokens {\n  const result: AgentOAuthTokens = {\n    access_token: tokens.access_token,\n    token_type: tokens.token_type,\n    scope: tokens.scope,\n  };\n\n  if (tokens.refresh_token) {\n    result.refresh_token = tokens.refresh_token;\n  }\n\n  if (tokens.expires_in) {\n    result.expires_in = tokens.expires_in;\n    // Calculate expiration timestamp\n    result.expires_at = new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n  }\n\n  return result;\n}\n\n/**\n * Convert AgentOAuthClient to MCP SDK OAuthClientInformation format\n */\nexport function toMCPClientInfo(client: AgentOAuthClient): OAuthClientInformation {\n  return {\n    client_id: client.client_id,\n    client_secret: client.client_secret,\n    client_secret_expires_at: client.client_secret_expires_at,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthClientInformationFull to AgentOAuthClient format\n */\nexport function fromMCPClientInfo(info: OAuthClientInformationFull): AgentOAuthClient {\n  return {\n    client_id: info.client_id,\n    client_secret: info.client_secret,\n    client_secret_expires_at: info.client_secret_expires_at,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsHO,MAAM,0BAA+C;AAAA,EAC1D,aAAa;AAAA,EACb,eAAe,CAAC,gCAAgC;AAAA,EAChD,aAAa,CAAC,sBAAsB,eAAe;AAAA,EACnD,gBAAgB,CAAC,MAAM;AAAA,EACvB,4BAA4B;AAAA;AAC9B;AAKO,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAKpB;AAEO,MAAM,4BAA4B,WAAW;AAAA,EAClD,YAAY,SAAkB;AAC5B,UAAM,oCAAoC,aAAa,OAAO;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0BAA0B,WAAW;AAAA,EAChD,YAAY,SAAkB,WAAoB;AAChD,UAAM,uBAAuB,YAAY,UAAU,SAAS,OAAO,EAAE,IAAI,WAAW,OAAO;AAC3F,SAAK,OAAO;AAAA,EACd;AACF;AAKO,SAAS,YAAY,QAAuC;AACjE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,YAAY,OAAO,cAAc;AAAA,IACjC,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AACF;AAKO,SAAS,cAAc,QAAuC;AACnE,QAAM,SAA2B;AAAA,IAC/B,cAAc,OAAO;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AAEA,MAAI,OAAO,eAAe;AACxB,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAEA,MAAI,OAAO,YAAY;AACrB,WAAO,aAAa,OAAO;AAE3B,WAAO,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAAA,EAClF;AAEA,SAAO;AACT;AAKO,SAAS,gBAAgB,QAAkD;AAChF,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,eAAe,OAAO;AAAA,IACtB,0BAA0B,OAAO;AAAA,EACnC;AACF;AAKO,SAAS,kBAAkB,MAAoD;AACpF,SAAO;AAAA,IACL,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,0BAA0B,KAAK;AAAA,EACjC;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/types.ts"],"sourcesContent":["/**\n * OAuth types for MCP authentication\n *\n * These types support the pluggable OAuth architecture:\n * - OAuthConfigStorage: Interface for reading/writing agent config with OAuth data\n * - OAuthFlowHandler: Abstract interface for authorization flow (CLI vs web)\n */\n\nimport type {\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\nimport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient } from '../../types/adcp';\n\n// Re-export MCP SDK types for convenience\nexport type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens };\n\n// Re-export agent types\nexport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient };\n\n/**\n * Agent config storage interface\n *\n * Implement this to persist OAuth tokens back to agent configuration.\n * This allows different storage backends (file, database, memory)\n * while keeping tokens in the agent config structure.\n */\nexport interface OAuthConfigStorage {\n  /**\n   * Load agent configuration\n   * @param agentId The agent ID\n   * @returns Agent config or undefined if not found\n   */\n  loadAgent(agentId: string): Promise<AgentConfig | undefined>;\n\n  /**\n   * Save agent configuration (with updated OAuth data)\n   * @param agent The agent config to save\n   */\n  saveAgent(agent: AgentConfig): Promise<void>;\n}\n\n/**\n * Authorization flow handler - implement this for different environments\n *\n * Examples:\n * - CLIFlowHandler: Opens browser, starts callback server\n * - WebFlowHandler: HTTP redirects\n * - HeadlessFlowHandler: Device code flow (future)\n */\nexport interface OAuthFlowHandler {\n  /**\n   * Get the callback URL for OAuth redirects\n   */\n  getRedirectUrl(): string | URL;\n\n  /**\n   * Redirect the user to the authorization URL\n   * For CLI: Opens browser\n   * For web: HTTP redirect or return URL for client-side redirect\n   *\n   * @param authorizationUrl The OAuth authorization URL\n   * @returns Promise that resolves when user is redirected\n   */\n  redirectToAuthorization(authorizationUrl: URL): Promise<void>;\n\n  /**\n   * Wait for the authorization callback and extract the auth code\n   * For CLI: Starts a local HTTP server and waits\n   * For web: Called by the callback route handler\n   *\n   * @returns Promise resolving to the authorization code\n   */\n  waitForCallback(): Promise<string>;\n\n  /**\n   * Clean up any resources (e.g., callback server)\n   */\n  cleanup(): Promise<void>;\n}\n\n/**\n * Configuration for creating an OAuth provider\n */\nexport interface OAuthProviderConfig {\n  /** Agent configuration (tokens will be stored here) */\n  agent: AgentConfig;\n\n  /** Storage for persisting agent config changes */\n  storage?: OAuthConfigStorage;\n\n  /** Authorization flow handler */\n  flowHandler: OAuthFlowHandler;\n\n  /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */\n  clientMetadata: OAuthClientMetadata;\n\n  /**\n   * Operator-supplied RFC 8707 resource override. Takes precedence over the\n   * resource advertised by protected-resource metadata and is forwarded by\n   * the MCP SDK during authorization, code exchange, and refresh. Pass `null`\n   * to ignore `agent.oauth_resource` and return to metadata discovery.\n   */\n  resourceOverride?: string | null;\n\n  /**\n   * Allow non-HTTPS resource URLs in RFC 9728 protected-resource metadata.\n   * Mirrors the CLI's `--allow-http` flag and matches the operator-driven\n   * trust model used elsewhere in the SDK (`ssrfSafeFetch.allowPrivateIp`,\n   * the agent-entry URL validators). Defaults to `false`.\n   *\n   * Scope: relaxes only the HTTPS-only check on the PRM `resource` value.\n   * Does NOT widen network-layer SSRF posture (that knob is\n   * `ADCP_ALLOW_INTERNAL_PROBES` at module load, fed by the CLI). Intended\n   * for local dev loops; do not enable when talking to remote authorization\n   * servers — the AS remains the audience gatekeeper, but a non-HTTPS\n   * resource URL implies the transport itself is unauthenticated.\n   */\n  allowHttp?: boolean;\n}\n\n/**\n * Default OAuth client metadata for ADCP clients\n */\nexport const DEFAULT_CLIENT_METADATA: OAuthClientMetadata = {\n  client_name: 'ADCP Client',\n  redirect_uris: ['http://localhost:8766/callback'],\n  grant_types: ['authorization_code', 'refresh_token'],\n  response_types: ['code'],\n  token_endpoint_auth_method: 'none', // Public client (no client_secret)\n};\n\n/**\n * OAuth error types\n */\nexport class OAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly agentId?: string\n  ) {\n    super(message);\n    this.name = 'OAuthError';\n  }\n}\n\nexport class OAuthCancelledError extends OAuthError {\n  constructor(agentId?: string) {\n    super('OAuth flow was cancelled by user', 'cancelled', agentId);\n    this.name = 'OAuthCancelledError';\n  }\n}\n\nexport class OAuthTimeoutError extends OAuthError {\n  constructor(agentId?: string, timeoutMs?: number) {\n    super(`OAuth flow timed out${timeoutMs ? ` after ${timeoutMs}ms` : ''}`, 'timeout', agentId);\n    this.name = 'OAuthTimeoutError';\n  }\n}\n\n/**\n * Convert AgentOAuthTokens to MCP SDK OAuthTokens format\n */\nexport function toMCPTokens(tokens: AgentOAuthTokens): OAuthTokens {\n  return {\n    access_token: tokens.access_token,\n    refresh_token: tokens.refresh_token,\n    token_type: tokens.token_type || 'Bearer',\n    expires_in: tokens.expires_in,\n    scope: tokens.scope,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthTokens to AgentOAuthTokens format\n */\nexport function fromMCPTokens(tokens: OAuthTokens): AgentOAuthTokens {\n  const result: AgentOAuthTokens = {\n    access_token: tokens.access_token,\n    token_type: tokens.token_type,\n    scope: tokens.scope,\n  };\n\n  if (tokens.refresh_token) {\n    result.refresh_token = tokens.refresh_token;\n  }\n\n  if (tokens.expires_in) {\n    result.expires_in = tokens.expires_in;\n    // Calculate expiration timestamp\n    result.expires_at = new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n  }\n\n  return result;\n}\n\n/**\n * Convert AgentOAuthClient to MCP SDK OAuthClientInformation format\n */\nexport function toMCPClientInfo(client: AgentOAuthClient): OAuthClientInformation {\n  return {\n    client_id: client.client_id,\n    client_secret: client.client_secret,\n    client_secret_expires_at: client.client_secret_expires_at,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthClientInformationFull to AgentOAuthClient format\n */\nexport function fromMCPClientInfo(info: OAuthClientInformationFull): AgentOAuthClient {\n  return {\n    client_id: info.client_id,\n    client_secret: info.client_secret,\n    client_secret_expires_at: info.client_secret_expires_at,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8HO,MAAM,0BAA+C;AAAA,EAC1D,aAAa;AAAA,EACb,eAAe,CAAC,gCAAgC;AAAA,EAChD,aAAa,CAAC,sBAAsB,eAAe;AAAA,EACnD,gBAAgB,CAAC,MAAM;AAAA,EACvB,4BAA4B;AAAA;AAC9B;AAKO,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAKpB;AAEO,MAAM,4BAA4B,WAAW;AAAA,EAClD,YAAY,SAAkB;AAC5B,UAAM,oCAAoC,aAAa,OAAO;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0BAA0B,WAAW;AAAA,EAChD,YAAY,SAAkB,WAAoB;AAChD,UAAM,uBAAuB,YAAY,UAAU,SAAS,OAAO,EAAE,IAAI,WAAW,OAAO;AAC3F,SAAK,OAAO;AAAA,EACd;AACF;AAKO,SAAS,YAAY,QAAuC;AACjE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,YAAY,OAAO,cAAc;AAAA,IACjC,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AACF;AAKO,SAAS,cAAc,QAAuC;AACnE,QAAM,SAA2B;AAAA,IAC/B,cAAc,OAAO;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AAEA,MAAI,OAAO,eAAe;AACxB,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAEA,MAAI,OAAO,YAAY;AACrB,WAAO,aAAa,OAAO;AAE3B,WAAO,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAAA,EAClF;AAEA,SAAO;AACT;AAKO,SAAS,gBAAgB,QAAkD;AAChF,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,eAAe,OAAO;AAAA,IACtB,0BAA0B,OAAO;AAAA,EACnC;AACF;AAKO,SAAS,kBAAkB,MAAoD;AACpF,SAAO;AAAA,IACL,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,0BAA0B,KAAK;AAAA,EACjC;AACF;","names":[]}

package/dist/lib/auth/oauth/types.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/types.ts"],"sourcesContent":["/**\n * OAuth types for MCP authentication\n *\n * These types support the pluggable OAuth architecture:\n * - OAuthConfigStorage: Interface for reading/writing agent config with OAuth data\n * - OAuthFlowHandler: Abstract interface for authorization flow (CLI vs web)\n */\n\nimport type {\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\nimport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient } from '../../types/adcp';\n\n// Re-export MCP SDK types for convenience\nexport type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens };\n\n// Re-export agent types\nexport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient };\n\n/**\n * Agent config storage interface\n *\n * Implement this to persist OAuth tokens back to agent configuration.\n * This allows different storage backends (file, database, memory)\n * while keeping tokens in the agent config structure.\n */\nexport interface OAuthConfigStorage {\n  /**\n   * Load agent configuration\n   * @param agentId The agent ID\n   * @returns Agent config or undefined if not found\n   */\n  loadAgent(agentId: string): Promise<AgentConfig | undefined>;\n\n  /**\n   * Save agent configuration (with updated OAuth data)\n   * @param agent The agent config to save\n   */\n  saveAgent(agent: AgentConfig): Promise<void>;\n}\n\n/**\n * Authorization flow handler - implement this for different environments\n *\n * Examples:\n * - CLIFlowHandler: Opens browser, starts callback server\n * - WebFlowHandler: HTTP redirects\n * - HeadlessFlowHandler: Device code flow (future)\n */\nexport interface OAuthFlowHandler {\n  /**\n   * Get the callback URL for OAuth redirects\n   */\n  getRedirectUrl(): string | URL;\n\n  /**\n   * Redirect the user to the authorization URL\n   * For CLI: Opens browser\n   * For web: HTTP redirect or return URL for client-side redirect\n   *\n   * @param authorizationUrl The OAuth authorization URL\n   * @returns Promise that resolves when user is redirected\n   */\n  redirectToAuthorization(authorizationUrl: URL): Promise<void>;\n\n  /**\n   * Wait for the authorization callback and extract the auth code\n   * For CLI: Starts a local HTTP server and waits\n   * For web: Called by the callback route handler\n   *\n   * @returns Promise resolving to the authorization code\n   */\n  waitForCallback(): Promise<string>;\n\n  /**\n   * Clean up any resources (e.g., callback server)\n   */\n  cleanup(): Promise<void>;\n}\n\n/**\n * Configuration for creating an OAuth provider\n */\nexport interface OAuthProviderConfig {\n  /** Agent configuration (tokens will be stored here) */\n  agent: AgentConfig;\n\n  /** Storage for persisting agent config changes */\n  storage?: OAuthConfigStorage;\n\n  /** Authorization flow handler */\n  flowHandler: OAuthFlowHandler;\n\n  /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */\n  clientMetadata: OAuthClientMetadata;\n\n  /**\n   * Allow non-HTTPS resource URLs in RFC 9728 protected-resource metadata.\n   * Mirrors the CLI's `--allow-http` flag and matches the operator-driven\n   * trust model used elsewhere in the SDK (`ssrfSafeFetch.allowPrivateIp`,\n   * the agent-entry URL validators). Defaults to `false`.\n   *\n   * Scope: relaxes only the HTTPS-only check on the PRM `resource` value.\n   * Does NOT widen network-layer SSRF posture (that knob is\n   * `ADCP_ALLOW_INTERNAL_PROBES` at module load, fed by the CLI). Intended\n   * for local dev loops; do not enable when talking to remote authorization\n   * servers — the AS remains the audience gatekeeper, but a non-HTTPS\n   * resource URL implies the transport itself is unauthenticated.\n   */\n  allowHttp?: boolean;\n}\n\n/**\n * Default OAuth client metadata for ADCP clients\n */\nexport const DEFAULT_CLIENT_METADATA: OAuthClientMetadata = {\n  client_name: 'ADCP Client',\n  redirect_uris: ['http://localhost:8766/callback'],\n  grant_types: ['authorization_code', 'refresh_token'],\n  response_types: ['code'],\n  token_endpoint_auth_method: 'none', // Public client (no client_secret)\n};\n\n/**\n * OAuth error types\n */\nexport class OAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly agentId?: string\n  ) {\n    super(message);\n    this.name = 'OAuthError';\n  }\n}\n\nexport class OAuthCancelledError extends OAuthError {\n  constructor(agentId?: string) {\n    super('OAuth flow was cancelled by user', 'cancelled', agentId);\n    this.name = 'OAuthCancelledError';\n  }\n}\n\nexport class OAuthTimeoutError extends OAuthError {\n  constructor(agentId?: string, timeoutMs?: number) {\n    super(`OAuth flow timed out${timeoutMs ? ` after ${timeoutMs}ms` : ''}`, 'timeout', agentId);\n    this.name = 'OAuthTimeoutError';\n  }\n}\n\n/**\n * Convert AgentOAuthTokens to MCP SDK OAuthTokens format\n */\nexport function toMCPTokens(tokens: AgentOAuthTokens): OAuthTokens {\n  return {\n    access_token: tokens.access_token,\n    refresh_token: tokens.refresh_token,\n    token_type: tokens.token_type || 'Bearer',\n    expires_in: tokens.expires_in,\n    scope: tokens.scope,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthTokens to AgentOAuthTokens format\n */\nexport function fromMCPTokens(tokens: OAuthTokens): AgentOAuthTokens {\n  const result: AgentOAuthTokens = {\n    access_token: tokens.access_token,\n    token_type: tokens.token_type,\n    scope: tokens.scope,\n  };\n\n  if (tokens.refresh_token) {\n    result.refresh_token = tokens.refresh_token;\n  }\n\n  if (tokens.expires_in) {\n    result.expires_in = tokens.expires_in;\n    // Calculate expiration timestamp\n    result.expires_at = new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n  }\n\n  return result;\n}\n\n/**\n * Convert AgentOAuthClient to MCP SDK OAuthClientInformation format\n */\nexport function toMCPClientInfo(client: AgentOAuthClient): OAuthClientInformation {\n  return {\n    client_id: client.client_id,\n    client_secret: client.client_secret,\n    client_secret_expires_at: client.client_secret_expires_at,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthClientInformationFull to AgentOAuthClient format\n */\nexport function fromMCPClientInfo(info: OAuthClientInformationFull): AgentOAuthClient {\n  return {\n    client_id: info.client_id,\n    client_secret: info.client_secret,\n    client_secret_expires_at: info.client_secret_expires_at,\n  };\n}\n"],"mappings":"AAsHO,MAAM,0BAA+C;AAAA,EAC1D,aAAa;AAAA,EACb,eAAe,CAAC,gCAAgC;AAAA,EAChD,aAAa,CAAC,sBAAsB,eAAe;AAAA,EACnD,gBAAgB,CAAC,MAAM;AAAA,EACvB,4BAA4B;AAAA;AAC9B;AAKO,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAKpB;AAEO,MAAM,4BAA4B,WAAW;AAAA,EAClD,YAAY,SAAkB;AAC5B,UAAM,oCAAoC,aAAa,OAAO;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0BAA0B,WAAW;AAAA,EAChD,YAAY,SAAkB,WAAoB;AAChD,UAAM,uBAAuB,YAAY,UAAU,SAAS,OAAO,EAAE,IAAI,WAAW,OAAO;AAC3F,SAAK,OAAO;AAAA,EACd;AACF;AAKO,SAAS,YAAY,QAAuC;AACjE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,YAAY,OAAO,cAAc;AAAA,IACjC,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AACF;AAKO,SAAS,cAAc,QAAuC;AACnE,QAAM,SAA2B;AAAA,IAC/B,cAAc,OAAO;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AAEA,MAAI,OAAO,eAAe;AACxB,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAEA,MAAI,OAAO,YAAY;AACrB,WAAO,aAAa,OAAO;AAE3B,WAAO,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAAA,EAClF;AAEA,SAAO;AACT;AAKO,SAAS,gBAAgB,QAAkD;AAChF,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,eAAe,OAAO;AAAA,IACtB,0BAA0B,OAAO;AAAA,EACnC;AACF;AAKO,SAAS,kBAAkB,MAAoD;AACpF,SAAO;AAAA,IACL,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,0BAA0B,KAAK;AAAA,EACjC;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/types.ts"],"sourcesContent":["/**\n * OAuth types for MCP authentication\n *\n * These types support the pluggable OAuth architecture:\n * - OAuthConfigStorage: Interface for reading/writing agent config with OAuth data\n * - OAuthFlowHandler: Abstract interface for authorization flow (CLI vs web)\n */\n\nimport type {\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\nimport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient } from '../../types/adcp';\n\n// Re-export MCP SDK types for convenience\nexport type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens };\n\n// Re-export agent types\nexport type { AgentConfig, AgentOAuthTokens, AgentOAuthClient };\n\n/**\n * Agent config storage interface\n *\n * Implement this to persist OAuth tokens back to agent configuration.\n * This allows different storage backends (file, database, memory)\n * while keeping tokens in the agent config structure.\n */\nexport interface OAuthConfigStorage {\n  /**\n   * Load agent configuration\n   * @param agentId The agent ID\n   * @returns Agent config or undefined if not found\n   */\n  loadAgent(agentId: string): Promise<AgentConfig | undefined>;\n\n  /**\n   * Save agent configuration (with updated OAuth data)\n   * @param agent The agent config to save\n   */\n  saveAgent(agent: AgentConfig): Promise<void>;\n}\n\n/**\n * Authorization flow handler - implement this for different environments\n *\n * Examples:\n * - CLIFlowHandler: Opens browser, starts callback server\n * - WebFlowHandler: HTTP redirects\n * - HeadlessFlowHandler: Device code flow (future)\n */\nexport interface OAuthFlowHandler {\n  /**\n   * Get the callback URL for OAuth redirects\n   */\n  getRedirectUrl(): string | URL;\n\n  /**\n   * Redirect the user to the authorization URL\n   * For CLI: Opens browser\n   * For web: HTTP redirect or return URL for client-side redirect\n   *\n   * @param authorizationUrl The OAuth authorization URL\n   * @returns Promise that resolves when user is redirected\n   */\n  redirectToAuthorization(authorizationUrl: URL): Promise<void>;\n\n  /**\n   * Wait for the authorization callback and extract the auth code\n   * For CLI: Starts a local HTTP server and waits\n   * For web: Called by the callback route handler\n   *\n   * @returns Promise resolving to the authorization code\n   */\n  waitForCallback(): Promise<string>;\n\n  /**\n   * Clean up any resources (e.g., callback server)\n   */\n  cleanup(): Promise<void>;\n}\n\n/**\n * Configuration for creating an OAuth provider\n */\nexport interface OAuthProviderConfig {\n  /** Agent configuration (tokens will be stored here) */\n  agent: AgentConfig;\n\n  /** Storage for persisting agent config changes */\n  storage?: OAuthConfigStorage;\n\n  /** Authorization flow handler */\n  flowHandler: OAuthFlowHandler;\n\n  /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */\n  clientMetadata: OAuthClientMetadata;\n\n  /**\n   * Operator-supplied RFC 8707 resource override. Takes precedence over the\n   * resource advertised by protected-resource metadata and is forwarded by\n   * the MCP SDK during authorization, code exchange, and refresh. Pass `null`\n   * to ignore `agent.oauth_resource` and return to metadata discovery.\n   */\n  resourceOverride?: string | null;\n\n  /**\n   * Allow non-HTTPS resource URLs in RFC 9728 protected-resource metadata.\n   * Mirrors the CLI's `--allow-http` flag and matches the operator-driven\n   * trust model used elsewhere in the SDK (`ssrfSafeFetch.allowPrivateIp`,\n   * the agent-entry URL validators). Defaults to `false`.\n   *\n   * Scope: relaxes only the HTTPS-only check on the PRM `resource` value.\n   * Does NOT widen network-layer SSRF posture (that knob is\n   * `ADCP_ALLOW_INTERNAL_PROBES` at module load, fed by the CLI). Intended\n   * for local dev loops; do not enable when talking to remote authorization\n   * servers — the AS remains the audience gatekeeper, but a non-HTTPS\n   * resource URL implies the transport itself is unauthenticated.\n   */\n  allowHttp?: boolean;\n}\n\n/**\n * Default OAuth client metadata for ADCP clients\n */\nexport const DEFAULT_CLIENT_METADATA: OAuthClientMetadata = {\n  client_name: 'ADCP Client',\n  redirect_uris: ['http://localhost:8766/callback'],\n  grant_types: ['authorization_code', 'refresh_token'],\n  response_types: ['code'],\n  token_endpoint_auth_method: 'none', // Public client (no client_secret)\n};\n\n/**\n * OAuth error types\n */\nexport class OAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly agentId?: string\n  ) {\n    super(message);\n    this.name = 'OAuthError';\n  }\n}\n\nexport class OAuthCancelledError extends OAuthError {\n  constructor(agentId?: string) {\n    super('OAuth flow was cancelled by user', 'cancelled', agentId);\n    this.name = 'OAuthCancelledError';\n  }\n}\n\nexport class OAuthTimeoutError extends OAuthError {\n  constructor(agentId?: string, timeoutMs?: number) {\n    super(`OAuth flow timed out${timeoutMs ? ` after ${timeoutMs}ms` : ''}`, 'timeout', agentId);\n    this.name = 'OAuthTimeoutError';\n  }\n}\n\n/**\n * Convert AgentOAuthTokens to MCP SDK OAuthTokens format\n */\nexport function toMCPTokens(tokens: AgentOAuthTokens): OAuthTokens {\n  return {\n    access_token: tokens.access_token,\n    refresh_token: tokens.refresh_token,\n    token_type: tokens.token_type || 'Bearer',\n    expires_in: tokens.expires_in,\n    scope: tokens.scope,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthTokens to AgentOAuthTokens format\n */\nexport function fromMCPTokens(tokens: OAuthTokens): AgentOAuthTokens {\n  const result: AgentOAuthTokens = {\n    access_token: tokens.access_token,\n    token_type: tokens.token_type,\n    scope: tokens.scope,\n  };\n\n  if (tokens.refresh_token) {\n    result.refresh_token = tokens.refresh_token;\n  }\n\n  if (tokens.expires_in) {\n    result.expires_in = tokens.expires_in;\n    // Calculate expiration timestamp\n    result.expires_at = new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n  }\n\n  return result;\n}\n\n/**\n * Convert AgentOAuthClient to MCP SDK OAuthClientInformation format\n */\nexport function toMCPClientInfo(client: AgentOAuthClient): OAuthClientInformation {\n  return {\n    client_id: client.client_id,\n    client_secret: client.client_secret,\n    client_secret_expires_at: client.client_secret_expires_at,\n  };\n}\n\n/**\n * Convert MCP SDK OAuthClientInformationFull to AgentOAuthClient format\n */\nexport function fromMCPClientInfo(info: OAuthClientInformationFull): AgentOAuthClient {\n  return {\n    client_id: info.client_id,\n    client_secret: info.client_secret,\n    client_secret_expires_at: info.client_secret_expires_at,\n  };\n}\n"],"mappings":"AA8HO,MAAM,0BAA+C;AAAA,EAC1D,aAAa;AAAA,EACb,eAAe,CAAC,gCAAgC;AAAA,EAChD,aAAa,CAAC,sBAAsB,eAAe;AAAA,EACnD,gBAAgB,CAAC,MAAM;AAAA,EACvB,4BAA4B;AAAA;AAC9B;AAKO,MAAM,mBAAmB,MAAM;AAAA,EACpC,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAKpB;AAEO,MAAM,4BAA4B,WAAW;AAAA,EAClD,YAAY,SAAkB;AAC5B,UAAM,oCAAoC,aAAa,OAAO;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0BAA0B,WAAW;AAAA,EAChD,YAAY,SAAkB,WAAoB;AAChD,UAAM,uBAAuB,YAAY,UAAU,SAAS,OAAO,EAAE,IAAI,WAAW,OAAO;AAC3F,SAAK,OAAO;AAAA,EACd;AACF;AAKO,SAAS,YAAY,QAAuC;AACjE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,IACrB,eAAe,OAAO;AAAA,IACtB,YAAY,OAAO,cAAc;AAAA,IACjC,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AACF;AAKO,SAAS,cAAc,QAAuC;AACnE,QAAM,SAA2B;AAAA,IAC/B,cAAc,OAAO;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,OAAO,OAAO;AAAA,EAChB;AAEA,MAAI,OAAO,eAAe;AACxB,WAAO,gBAAgB,OAAO;AAAA,EAChC;AAEA,MAAI,OAAO,YAAY;AACrB,WAAO,aAAa,OAAO;AAE3B,WAAO,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAAA,EAClF;AAEA,SAAO;AACT;AAKO,SAAS,gBAAgB,QAAkD;AAChF,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,eAAe,OAAO;AAAA,IACtB,0BAA0B,OAAO;AAAA,EACnC;AACF;AAKO,SAAS,kBAAkB,MAAoD;AACpF,SAAO;AAAA,IACL,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,0BAA0B,KAAK;AAAA,EACjC;AACF;","names":[]}

package/dist/lib/auth/oauth/web-flow.d.mts

@@ -8,15 +8,17 @@
  * store interface — not reimplemented protocol logic.
  *
  * Wire contract:
- *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of
- *     truth for the RFC 8707 `resource` indicator. We fall back to
+ *   - An operator `resourceOverride` takes precedence for legacy or
+ *     non-conformant integrations. Otherwise PRM (RFC 9728) is consulted;
+ *     `prm.resource` is the source of truth for the RFC 8707 `resource`
+ *     indicator. We fall back to
  *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource
  *     server does not implement PRM (404). Connection / parse / 5xx
  *     errors throw `ProtectedResourceMetadataError` — never silently
  *     downgrade to local guessing.
- *   - `prm.resource` must share an origin with the agent URL; the MCP
- *     SDK's `checkResourceAllowed` guards against a poisoned PRM
- *     pointing the audience at a third party.
+ *   - Without a trusted override, `prm.resource` must share an origin with
+ *     the agent URL; the MCP SDK's `checkResourceAllowed` guards against a
+ *     poisoned PRM pointing the audience at a third party.
  *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else
  *     the agent origin.
  *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401
@@ -56,6 +58,12 @@ export interface PendingWebFlow {
     codeVerifier: string;
     redirectUri: string;
     resource?: string;
+    /** Explicit operator override, persisted separately so refresh can retain it. */
+    resourceOverride?: string;
+    /** Mutation requested by this flow. Absent on legacy rows and preserve-only flows. */
+    resourceOverrideAction?: 'set' | 'clear';
+    /** Value observed at flow start; used to reject concurrent operator edits. */
+    resourceOverrideSnapshot?: string | null;
     scope?: string;
     authorizationServerUrl: string;
     /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */
@@ -145,6 +153,9 @@ export declare class ProtectedResourceMetadataError extends OAuthError {
 export declare class AgentVanishedDuringFlowError extends OAuthError {
     constructor(agentId: string);
 }
+export declare class AgentChangedDuringFlowError extends OAuthError {
+    constructor(agentId: string);
+}
 export declare class ConfidentialClientNotAllowedError extends OAuthError {
     constructor(agentId: string | undefined);
 }
@@ -172,6 +183,20 @@ export interface StartWebFlowOptions {
      * value from a prior 401 `WWW-Authenticate` challenge if you have one.
      */
     scopeHint?: string;
+    /**
+     * Operator-supplied RFC 8707 resource override. Takes precedence over
+     * `prm.resource` and the agent-URL-derived fallback, and is sent during
+     * both authorization and code exchange. Pass `null` to explicitly clear a
+     * persisted override and return to metadata/agent-URL discovery.
+     */
+    resourceOverride?: string | null;
+    /**
+     * Non-standard Auth0-compatible audience parameter. Sent only to the
+     * authorization endpoint. Prefer `resourceOverride` for RFC 8707 servers.
+     */
+    audience?: string;
+    /** Permit an HTTP resource override for local development. Default false. */
+    allowHttp?: boolean;
     /** Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. */
     ttlMs?: number;
     /** Override the random-state generator (defaults to 32 bytes base64url). */

package/dist/lib/auth/oauth/web-flow.d.ts

@@ -8,15 +8,17 @@
  * store interface — not reimplemented protocol logic.
  *
  * Wire contract:
- *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of
- *     truth for the RFC 8707 `resource` indicator. We fall back to
+ *   - An operator `resourceOverride` takes precedence for legacy or
+ *     non-conformant integrations. Otherwise PRM (RFC 9728) is consulted;
+ *     `prm.resource` is the source of truth for the RFC 8707 `resource`
+ *     indicator. We fall back to
  *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource
  *     server does not implement PRM (404). Connection / parse / 5xx
  *     errors throw `ProtectedResourceMetadataError` — never silently
  *     downgrade to local guessing.
- *   - `prm.resource` must share an origin with the agent URL; the MCP
- *     SDK's `checkResourceAllowed` guards against a poisoned PRM
- *     pointing the audience at a third party.
+ *   - Without a trusted override, `prm.resource` must share an origin with
+ *     the agent URL; the MCP SDK's `checkResourceAllowed` guards against a
+ *     poisoned PRM pointing the audience at a third party.
  *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else
  *     the agent origin.
  *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401
@@ -56,6 +58,12 @@ export interface PendingWebFlow {
     codeVerifier: string;
     redirectUri: string;
     resource?: string;
+    /** Explicit operator override, persisted separately so refresh can retain it. */
+    resourceOverride?: string;
+    /** Mutation requested by this flow. Absent on legacy rows and preserve-only flows. */
+    resourceOverrideAction?: 'set' | 'clear';
+    /** Value observed at flow start; used to reject concurrent operator edits. */
+    resourceOverrideSnapshot?: string | null;
     scope?: string;
     authorizationServerUrl: string;
     /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */
@@ -145,6 +153,9 @@ export declare class ProtectedResourceMetadataError extends OAuthError {
 export declare class AgentVanishedDuringFlowError extends OAuthError {
     constructor(agentId: string);
 }
+export declare class AgentChangedDuringFlowError extends OAuthError {
+    constructor(agentId: string);
+}
 export declare class ConfidentialClientNotAllowedError extends OAuthError {
     constructor(agentId: string | undefined);
 }
@@ -172,6 +183,20 @@ export interface StartWebFlowOptions {
      * value from a prior 401 `WWW-Authenticate` challenge if you have one.
      */
     scopeHint?: string;
+    /**
+     * Operator-supplied RFC 8707 resource override. Takes precedence over
+     * `prm.resource` and the agent-URL-derived fallback, and is sent during
+     * both authorization and code exchange. Pass `null` to explicitly clear a
+     * persisted override and return to metadata/agent-URL discovery.
+     */
+    resourceOverride?: string | null;
+    /**
+     * Non-standard Auth0-compatible audience parameter. Sent only to the
+     * authorization endpoint. Prefer `resourceOverride` for RFC 8707 servers.
+     */
+    audience?: string;
+    /** Permit an HTTP resource override for local development. Default false. */
+    allowHttp?: boolean;
     /** Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. */
     ttlMs?: number;
     /** Override the random-state generator (defaults to 32 bytes base64url). */

package/dist/lib/auth/oauth/web-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-flow.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH,OAAO,KAAK,EAEV,sBAAsB,EAEtB,mBAAmB,EAEnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAA6D,UAAU,EAAmB,MAAM,SAAS,CAAC;AAEjH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvD,sEAAsE;IACtE,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,qBAAa,yBAA0B,SAAQ,UAAU;gBAC3C,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,kBAAmB,SAAQ,UAAU;;CAKjD;AAED,qBAAa,kBAAmB,SAAQ,UAAU;aAG9B,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;IAC5B;;;;OAIG;aACa,cAAc,CAAC,EAAE,MAAM;gBARvC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM;IAC5B;;;;OAIG;IACa,cAAc,CAAC,EAAE,MAAM,YAAA;CAK1C;AAED,qBAAa,8BAA+B,SAAQ,UAAU;gBAChD,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,4BAA6B,SAAQ,UAAU;gBAC9C,OAAO,EAAE,MAAM;CAQ5B;AAED,qBAAa,iCAAkC,SAAQ,UAAU;gBACnD,OAAO,EAAE,MAAM,GAAG,SAAS;CASxC;AAED,qBAAa,2BAA4B,SAAQ,UAAU;;CAS1D;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,WAAW,CAAC;IACnB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,gFAAgF;IAChF,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoF9F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgEvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,GAAG,SAAS,CAoBhH;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAErD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQtD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;CAWxC"}
+{"version":3,"file":"web-flow.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAWH,OAAO,KAAK,EAEV,sBAAsB,EAEtB,mBAAmB,EAEnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAA6D,UAAU,EAAmB,MAAM,SAAS,CAAC;AAGjH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sFAAsF;IACtF,sBAAsB,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;IACzC,8EAA8E;IAC9E,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvD,sEAAsE;IACtE,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,qBAAa,yBAA0B,SAAQ,UAAU;gBAC3C,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,kBAAmB,SAAQ,UAAU;;CAKjD;AAED,qBAAa,kBAAmB,SAAQ,UAAU;aAG9B,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;IAC5B;;;;OAIG;aACa,cAAc,CAAC,EAAE,MAAM;gBARvC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM;IAC5B;;;;OAIG;IACa,cAAc,CAAC,EAAE,MAAM,YAAA;CAK1C;AAED,qBAAa,8BAA+B,SAAQ,UAAU;gBAChD,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,4BAA6B,SAAQ,UAAU;gBAC9C,OAAO,EAAE,MAAM;CAQ5B;AAED,qBAAa,2BAA4B,SAAQ,UAAU;gBAC7C,OAAO,EAAE,MAAM;CAQ5B;AAED,qBAAa,iCAAkC,SAAQ,UAAU;gBACnD,OAAO,EAAE,MAAM,GAAG,SAAS;CASxC;AAED,qBAAa,2BAA4B,SAAQ,UAAU;;CAS1D;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,WAAW,CAAC;IACnB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,gFAAgF;IAChF,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyG9F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6EvG;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,GAAG,SAAS,CAoBhH;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAErD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQtD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;CAWxC"}