npm - @adcp/sdk - Versions diffs - 13.0.0-rc.6 → 13.0.0-rc.7 - Mend

@adcp/sdk 13.0.0-rc.6 → 13.0.0-rc.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1441) hide show

package/dist/lib/auth/oauth/web-flow.js CHANGED Viewed

@@ -18,6 +18,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var web_flow_exports = {};
 __export(web_flow_exports, {
+  AgentChangedDuringFlowError: () => AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError: () => AgentVanishedDuringFlowError,
   BrowserBindingRequiredError: () => BrowserBindingRequiredError,
   ConfidentialClientNotAllowedError: () => ConfidentialClientNotAllowedError,
@@ -36,6 +37,7 @@ var import_crypto = require("crypto");
 var import_auth = require("@modelcontextprotocol/sdk/client/auth.js");
 var import_auth_utils = require("@modelcontextprotocol/sdk/shared/auth-utils.js");
 var import_types = require('./types.js');
+var import_resource_url = require('./resource-url.js');
 const DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1e3;
 class InvalidOrExpiredFlowError extends import_types.OAuthError {
   constructor(state) {
@@ -77,6 +79,16 @@ class AgentVanishedDuringFlowError extends import_types.OAuthError {
     this.name = "AgentVanishedDuringFlowError";
   }
 }
+class AgentChangedDuringFlowError extends import_types.OAuthError {
+  constructor(agentId) {
+    super(
+      `Agent ${agentId} changed while OAuth authorization was pending; tokens were not saved`,
+      "agent_changed_during_flow",
+      agentId
+    );
+    this.name = "AgentChangedDuringFlowError";
+  }
+}
 class ConfidentialClientNotAllowedError extends import_types.OAuthError {
   constructor(agentId) {
     super(
@@ -104,6 +116,9 @@ async function startWebOAuthFlow(opts) {
     agentStorage,
     carry,
     scopeHint,
+    resourceOverride: requestedResourceOverride,
+    audience,
+    allowHttp = false,
     ttlMs = DEFAULT_WEB_FLOW_TTL_MS,
     generateState,
     fetch: fetchFn,
@@ -113,8 +128,11 @@ async function startWebOAuthFlow(opts) {
   if (!agent.agent_uri) {
     throw new import_types.OAuthError("Agent missing agent_uri", "invalid_agent", agent.id);
   }
+  const resourceOverrideAction = requestedResourceOverride === null ? "clear" : requestedResourceOverride !== void 0 ? "set" : void 0;
+  const rawResourceOverride = requestedResourceOverride === null ? void 0 : requestedResourceOverride ?? agent.oauth_resource;
+  const resourceOverride = rawResourceOverride ? (0, import_resource_url.validateOAuthResourceUrl)(rawResourceOverride, { allowHttp }).href : void 0;
   const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);
-  if (prm?.resource) {
+  if (!resourceOverride && prm?.resource) {
     assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);
   }
   const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);
@@ -122,7 +140,7 @@ async function startWebOAuthFlow(opts) {
   if (!asMetadata) {
     throw new import_types.OAuthError(`No OAuth metadata at ${asUrl.toString()}`, "no_authorization_server_metadata", agent.id);
   }
-  const resource = prm?.resource ? new URL(prm.resource) : (0, import_auth_utils.resourceUrlFromServerUrl)(new URL(agent.agent_uri));
+  const resource = resourceOverride ? new URL(resourceOverride) : prm?.resource ? new URL(prm.resource) : (0, import_auth_utils.resourceUrlFromServerUrl)(new URL(agent.agent_uri));
   const baseClientMetadata = {
     ...import_types.DEFAULT_CLIENT_METADATA,
     ...clientMetadataOverrides,
@@ -147,6 +165,9 @@ async function startWebOAuthFlow(opts) {
     state,
     resource
   });
+  if (audience) {
+    authorizationUrl.searchParams.set("audience", audience);
+  }
   const now = /* @__PURE__ */ new Date();
   const expiresAt = new Date(now.getTime() + ttlMs);
   const flow = {
@@ -156,6 +177,9 @@ async function startWebOAuthFlow(opts) {
     codeVerifier,
     redirectUri,
     resource: resource.href,
+    resourceOverride,
+    resourceOverrideAction,
+    resourceOverrideSnapshot: agent.oauth_resource ?? null,
     scope,
     authorizationServerUrl: asUrl.toString(),
     clientInformation,
@@ -186,6 +210,11 @@ async function completeWebOAuthFlow(opts) {
   if (!flow || flow.expiresAt.getTime() < Date.now()) {
     throw new InvalidOrExpiredFlowError(state);
   }
+  let agentForPersistence;
+  if (agentStorage) {
+    agentForPersistence = await agentStorage.loadAgent(flow.agentId);
+    assertAgentUnchangedForFlow(agentForPersistence, flow);
+  }
   const asMetadata = await (0, import_auth.discoverAuthorizationServerMetadata)(flow.authorizationServerUrl, {
     fetchFn
   });
@@ -205,13 +234,16 @@ async function completeWebOAuthFlow(opts) {
   }
   let persisted = false;
   if (agentStorage) {
-    const agent = await agentStorage.loadAgent(flow.agentId);
-    if (!agent) {
-      throw new AgentVanishedDuringFlowError(flow.agentId);
+    agentForPersistence = await agentStorage.loadAgent(flow.agentId);
+    assertAgentUnchangedForFlow(agentForPersistence, flow);
+    agentForPersistence.oauth_tokens = (0, import_types.fromMCPTokens)(tokens);
+    if (flow.resourceOverrideAction === "set" && flow.resourceOverride) {
+      agentForPersistence.oauth_resource = flow.resourceOverride;
+    } else if (flow.resourceOverrideAction === "clear") {
+      delete agentForPersistence.oauth_resource;
     }
-    agent.oauth_tokens = (0, import_types.fromMCPTokens)(tokens);
-    delete agent.oauth_code_verifier;
-    await agentStorage.saveAgent(agent);
+    delete agentForPersistence.oauth_code_verifier;
+    await agentStorage.saveAgent(agentForPersistence);
     persisted = true;
   }
   return {
@@ -222,6 +254,17 @@ async function completeWebOAuthFlow(opts) {
     persisted
   };
 }
+function assertAgentUnchangedForFlow(agent, flow) {
+  if (!agent) {
+    throw new AgentVanishedDuringFlowError(flow.agentId);
+  }
+  if (agent.agent_uri !== flow.agentUrl) {
+    throw new AgentChangedDuringFlowError(flow.agentId);
+  }
+  if (Object.prototype.hasOwnProperty.call(flow, "resourceOverrideSnapshot") && (agent.oauth_resource ?? null) !== flow.resourceOverrideSnapshot) {
+    throw new AgentChangedDuringFlowError(flow.agentId);
+  }
+}
 function safeReturnTo(value, options = {}) {
   if (typeof value !== "string" || value.length === 0) return void 0;
   if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\")) {
@@ -343,6 +386,7 @@ function redactTokens(input) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   ConfidentialClientNotAllowedError,

package/dist/lib/auth/oauth/web-flow.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/*\n Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n \n Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n \n Wire contract:\n * - PRM (RFC 9728) is consulted first; `prm.resource` is the source of\n * truth for the RFC 8707 `resource` indicator. We fall back to\n * `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n * server does not implement PRM (404). Connection / parse / 5xx\n * errors throw `ProtectedResourceMetadataError` — never silently\n * downgrade to local guessing.\n * - `prm.resource` must share an origin with the agent URL; the MCP\n * SDK's `checkResourceAllowed` guards against a poisoned PRM\n * pointing the audience at a third party.\n * - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n * the agent origin.\n * - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n * `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n * > `clientMetadata.scope`.\n * - Refresh is NOT this module's concern. Once `oauth_tokens` are\n * persisted, `MCPOAuthProvider` handles refresh on the next agent\n * call and the MCP SDK forwards `resource` into the refresh request.\n * Callers who DIY refresh against `oauth_tokens` are responsible for\n * forwarding `resource` themselves.\n /\n\nimport { randomBytes } from 'crypto';\nimport {\n discoverAuthorizationServerMetadata,\n discoverOAuthProtectedResourceMetadata,\n exchangeAuthorization,\n registerClient,\n startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n AuthorizationServerMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthClientMetadata,\n OAuthProtectedResourceMetadata,\n OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\n\n/\n Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n /\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 60 * 1000;\n\n/*\n State persisted between `/oauth/start` and `/oauth/callback`.\n \n `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n \n `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n /\nexport interface PendingWebFlow {\n state: string;\n agentId: string;\n agentUrl: string;\n codeVerifier: string;\n redirectUri: string;\n resource?: string;\n scope?: string;\n authorizationServerUrl: string;\n /* Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. /\n clientInformation: OAuthClientInformation;\n createdAt: Date;\n expiresAt: Date;\n /* JSON-serializable, no secrets, attacker-influenced. /\n carry?: Record<string, unknown>;\n}\n\n/\n Persistence interface for in-flight web OAuth flows.\n \n Canonical implementations:\n \n Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n * VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n * WHERE state = $1 AND expires_at > now()\n * RETURNING payload;\n * ```\n \n Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX -- put\n * GETDEL pending:flow:<state> -- consume\n * ```\n \n `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n \n `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n \n Tradeoff: consume runs before token exchange. `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n /\nexport interface PendingWebFlowStore {\n /* Insert a new flow. MUST reject duplicate `state`. /\n put(flow: PendingWebFlow): Promise<void>;\n /\n Atomic delete-and-return. MUST NOT return the same row twice.\n * Returns null if the row is absent or expired.\n /\n consume(state: string): Promise<PendingWebFlow \| null>;\n /* Optional housekeeping for expired rows that were never claimed. /\n cleanupExpired?(): Promise<number>;\n}\n\n/* @deprecated Renamed to `PendingWebFlowStore`. /\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n constructor(state: string) {\n super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n this.name = 'InvalidOrExpiredFlowError';\n }\n}\n\nexport class StateMismatchError extends OAuthError {\n constructor() {\n super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n this.name = 'StateMismatchError';\n }\n}\n\nexport class TokenExchangeError extends OAuthError {\n constructor(\n message: string,\n public readonly status: number,\n public readonly body: string,\n /\n RFC 6749 §5.2 error code when the authorization server returned a\n * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n * Undefined when the AS returned a non-OAuth-shaped failure.\n /\n public readonly oauthErrorCode?: string\n ) {\n super(message, 'token_exchange_failed');\n this.name = 'TokenExchangeError';\n }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n constructor(message: string) {\n super(message, 'protected_resource_metadata_error');\n this.name = 'ProtectedResourceMetadataError';\n }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n constructor(agentId: string) {\n super(\n `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n 'agent_vanished_during_flow',\n agentId\n );\n this.name = 'AgentVanishedDuringFlowError';\n }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n constructor(agentId: string \| undefined) {\n super(\n 'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n 'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n 'confidential_client_not_allowed',\n agentId\n );\n this.name = 'ConfidentialClientNotAllowedError';\n }\n}\n\nexport class BrowserBindingRequiredError extends OAuthError {\n constructor() {\n super(\n 'completeWebOAuthFlow called with requireBrowserBinding:true but expectedState was not supplied — ' +\n 'pass the state value from the session cookie set at /oauth/start',\n 'browser_binding_required'\n );\n this.name = 'BrowserBindingRequiredError';\n }\n}\n\nexport interface StartWebFlowOptions {\n /* Agent the flow is for. Must include `agent_uri`. /\n agent: AgentConfig;\n /* Absolute URL of the consumer's `/callback` route (must match what the AS sees). /\n redirectUri: string;\n /* Where to persist the pending flow until callback. /\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, dynamic-registration results land in `agent.oauth_client`. /\n agentStorage?: OAuthConfigStorage;\n /\n Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n * Must be JSON-serializable. Do not store secrets here. Treated as\n * attacker-influenced — validate before reflecting (e.g. via\n * {@link safeReturnTo} for redirect targets).\n /\n carry?: Record<string, unknown>;\n /\n Scope hint (highest priority per SEP-835). Pass through the `scope`\n * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n /\n scopeHint?: string;\n /* Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. /\n ttlMs?: number;\n /* Override the random-state generator (defaults to 32 bytes base64url). /\n generateState?: () => string;\n /* Override `fetch` (timeouts, signing, mocks). /\n fetch?: typeof fetch;\n /\n Override base client metadata. `redirect_uris` is always replaced\n * with `[redirectUri]` regardless of what's passed here.\n /\n clientMetadata?: Partial<OAuthClientMetadata>;\n /\n Permit the AS to register a confidential client (i.e. one that\n * returns a `client_secret` from dynamic registration). Default false:\n * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n * rather than silently persisting a long-lived credential to your\n * agent storage.\n /\n allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n authorizationUrl: string;\n state: string;\n expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n state: string;\n code: string;\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, the issued tokens are persisted to `agent.oauth_tokens`. /\n agentStorage?: OAuthConfigStorage;\n fetch?: typeof fetch;\n /\n The caller-bound expected state (e.g. from a session cookie set at\n * `/oauth/start`). When provided, must equal `state`; mismatch throws\n * {@link StateMismatchError}. Without this, `state` is replay-protected\n * but not browser-bound — see WEB-OAUTH.md.\n /\n expectedState?: string;\n /\n When `true`, throws {@link BrowserBindingRequiredError} if `expectedState`\n * is omitted instead of emitting a `console.warn`. Use this in frameworks\n * where session cookies are always available so that a missing bind is caught\n * at development time rather than silently permitted in production.\n \n Default: `false`.\n /\n requireBrowserBinding?: boolean;\n}\n\nexport interface CompleteWebFlowResult {\n agentId: string;\n agentUrl: string;\n tokens: OAuthTokens;\n carry?: Record<string, unknown>;\n /* True if `agentStorage` was provided AND `saveAgent` succeeded. /\n persisted: boolean;\n}\n\n/\n Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n /\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n const {\n agent,\n redirectUri,\n pendingFlowStore,\n agentStorage,\n carry,\n scopeHint,\n ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n generateState,\n fetch: fetchFn,\n clientMetadata: clientMetadataOverrides,\n allowConfidentialClient = false,\n } = opts;\n\n if (!agent.agent_uri) {\n throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n }\n\n const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n if (prm?.resource) {\n assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n }\n\n const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n if (!asMetadata) {\n throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n }\n\n const resource = prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n const baseClientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n ...clientMetadataOverrides,\n redirect_uris: [redirectUri],\n };\n\n const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n const clientInformation = await resolveClientInformation({\n agent,\n agentStorage,\n asUrl,\n asMetadata,\n clientMetadata: baseClientMetadata,\n fetchFn,\n allowConfidentialClient,\n });\n\n const state = (generateState ?? defaultGenerateState)();\n const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n metadata: asMetadata,\n clientInformation,\n redirectUrl: redirectUri,\n scope,\n state,\n resource,\n });\n\n const now = new Date();\n const expiresAt = new Date(now.getTime() + ttlMs);\n const flow: PendingWebFlow = {\n state,\n agentId: agent.id,\n agentUrl: agent.agent_uri,\n codeVerifier,\n redirectUri,\n resource: resource.href,\n scope,\n authorizationServerUrl: asUrl.toString(),\n clientInformation,\n createdAt: now,\n expiresAt,\n carry,\n };\n await pendingFlowStore.put(flow);\n\n return {\n authorizationUrl: authorizationUrl.toString(),\n state,\n expiresAt,\n };\n}\n\n/\n Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n \n The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n /\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState, requireBrowserBinding } = opts;\n\n if (expectedState === undefined) {\n if (requireBrowserBinding) {\n throw new BrowserBindingRequiredError();\n }\n // Warn callers who omit expectedState: the flow is replay-protected via\n // atomic consume but is not browser-bound (any request carrying the correct\n // state + code would be accepted). Pass expectedState from a session cookie\n // set at /oauth/start to fully bind the callback to the initiating browser.\n // Set requireBrowserBinding:true to make this a hard error instead.\n console.warn(\n '[adcp/sdk] completeWebOAuthFlow: expectedState not supplied — the callback is replay-protected ' +\n 'but not browser-bound. Pass expectedState from a session cookie set at /oauth/start, ' +\n 'or set requireBrowserBinding:true to enforce it.'\n );\n } else if (expectedState !== state) {\n throw new StateMismatchError();\n }\n\n const flow = await pendingFlowStore.consume(state);\n if (!flow \|\| flow.expiresAt.getTime() < Date.now()) {\n throw new InvalidOrExpiredFlowError(state);\n }\n\n const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n fetchFn,\n });\n\n let tokens: OAuthTokens;\n try {\n tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n metadata: asMetadata ?? undefined,\n clientInformation: flow.clientInformation,\n authorizationCode: code,\n codeVerifier: flow.codeVerifier,\n redirectUri: flow.redirectUri,\n resource: flow.resource ? new URL(flow.resource) : undefined,\n fetchFn,\n });\n } catch (err) {\n throw wrapTokenExchangeError(err);\n }\n\n let persisted = false;\n if (agentStorage) {\n const agent = await agentStorage.loadAgent(flow.agentId);\n if (!agent) {\n throw new AgentVanishedDuringFlowError(flow.agentId);\n }\n agent.oauth_tokens = fromMCPTokens(tokens);\n delete agent.oauth_code_verifier;\n await agentStorage.saveAgent(agent);\n persisted = true;\n }\n\n return {\n agentId: flow.agentId,\n agentUrl: flow.agentUrl,\n tokens,\n carry: flow.carry,\n persisted,\n };\n}\n\n/\n Validate a redirect target supplied via `carry`.\n \n Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n \n Defaults to path-only redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n \n @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n /\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string \| undefined {\n if (typeof value !== 'string' \|\| value.length === 0) return undefined;\n\n // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n return value;\n }\n\n const allowed = options.allowedReturnHosts;\n if (!allowed \|\| allowed.length === 0) return undefined;\n\n let parsed: URL;\n try {\n parsed = new URL(value);\n } catch {\n return undefined;\n }\n if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n if (!allowed.includes(parsed.host)) return undefined;\n return parsed.toString();\n}\n\n/\n In-memory pending-flow store for tests and single-instance dev.\n \n Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n /\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n private readonly flows = new Map<string, PendingWebFlow>();\n\n async put(flow: PendingWebFlow): Promise<void> {\n if (this.flows.has(flow.state)) {\n throw new Error(`Pending flow already exists for state ${flow.state}`);\n }\n this.flows.set(flow.state, flow);\n }\n\n async consume(state: string): Promise<PendingWebFlow \| null> {\n const flow = this.flows.get(state);\n if (!flow) return null;\n this.flows.delete(state);\n if (flow.expiresAt.getTime() < Date.now()) return null;\n return flow;\n }\n\n async cleanupExpired(): Promise<number> {\n const now = Date.now();\n let removed = 0;\n for (const [state, flow] of this.flows) {\n if (flow.expiresAt.getTime() < now) {\n this.flows.delete(state);\n removed++;\n }\n }\n return removed;\n }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/\n The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n \n Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n * `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n * throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n * when `response.status === 404` (or no response was returned).\n \n If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n /\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n agentUrl: string,\n fetchFn: typeof fetch \| undefined\n): Promise<OAuthProtectedResourceMetadata \| undefined> {\n try {\n return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n } catch (err) {\n if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n // PRM is optional under RFC 9728 — fall back to local resource\n // derivation. Connection/parse/5xx errors fall through.\n return undefined;\n }\n const message = err instanceof Error ? err.message : String(err);\n throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n throw new ProtectedResourceMetadataError(\n `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n );\n }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata \| undefined): URL {\n const first = prm?.authorization_servers?.[0];\n if (first) {\n return new URL(first);\n }\n return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n agent: AgentConfig;\n agentStorage?: OAuthConfigStorage;\n asUrl: URL;\n asMetadata: AuthorizationServerMetadata;\n clientMetadata: OAuthClientMetadata;\n fetchFn?: typeof fetch;\n allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n if (agent.oauth_client) {\n return toMCPClientInfo(agent.oauth_client);\n }\n\n if (!asMetadata.registration_endpoint) {\n throw new OAuthError(\n 'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n 'no_client_credentials',\n agent.id\n );\n }\n\n const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n metadata: asMetadata,\n clientMetadata,\n fetchFn,\n });\n\n if (registered.client_secret && !allowConfidentialClient) {\n throw new ConfidentialClientNotAllowedError(agent.id);\n }\n\n if (agentStorage) {\n // Load fresh and save fresh so two concurrent /start calls for the\n // same agentId do not trample each other's `oauth_client` via a\n // shared in-memory reference.\n const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n fresh.oauth_client = fromMCPClientInfo(registered);\n await agentStorage.saveAgent(fresh);\n }\n\n return registered;\n}\n\nfunction defaultGenerateState(): string {\n return randomBytes(32).toString('base64url');\n}\n\n/\n Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n /\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n // `InvalidGrantError`). Malformed responses come through as\n // `ServerError` with the raw body in `message`, so the redaction pass\n // covers both cases.\n const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n const message = err instanceof Error ? err.message : String(err);\n const status = (err as { status?: number })?.status ?? 0;\n const rawBody = (err as { body?: string })?.body ?? message;\n const body = redactTokens(rawBody);\n const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/\n Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n /\nfunction redactTokens(input: string): string {\n let out = input;\n for (const key of SENSITIVE_TOKEN_KEYS) {\n // JSON form: \"key\":\"…\"\n out = out.replace(new RegExp(`(\"${key}\"\\\\s:\\\\s\")[^\"](\")`, 'gi'), '$1<redacted>$2');\n // form-encoded: key=…\n out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n }\n return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+BA,oBAA4B;AAC5B,kBAMO;AACP,wBAA+D;AAW/D,mBAAuG;AAOhG,MAAM,0BAA0B,KAAK,KAAK;AAoF1C,MAAM,kCAAkC,wBAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,wBAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,wBAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,wBAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,wBAAW;AAAA,EAC1D,cAAc;AACZ;AAAA,MACE;AAAA,MAEA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAyFA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,wBAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,KAAK,UAAU;AACjB,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,UAAM,iDAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,wBAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,KAAK,WAAW,IAAI,IAAI,IAAI,QAAQ,QAAI,4CAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAE1G,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,UAAM,gCAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,eAAe,sBAAsB,IAAI;AAE9G,MAAI,kBAAkB,QAAW;AAC/B,QAAI,uBAAuB;AACzB,YAAM,IAAI,4BAA4B;AAAA,IACxC;AAMA,YAAQ;AAAA,MACN;AAAA,IAGF;AAAA,EACF,WAAW,kBAAkB,OAAO;AAClC,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,QAAM,aAAa,UAAM,iDAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,UAAM,mCAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAChB,UAAM,QAAQ,MAAM,aAAa,UAAU,KAAK,OAAO;AACvD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,IACrD;AACA,UAAM,mBAAe,4BAAc,MAAM;AACzC,WAAO,MAAM;AACb,UAAM,aAAa,UAAU,KAAK;AAClC,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,UAAM,oDAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,gBAAY,4CAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,KAAC,wCAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,eAAO,8BAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,UAAM,4BAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,mBAAe,gCAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,aAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}
1	+ {"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/*\n Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n \n Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n \n Wire contract:\n * - An operator `resourceOverride` takes precedence for legacy or\n * non-conformant integrations. Otherwise PRM (RFC 9728) is consulted;\n * `prm.resource` is the source of truth for the RFC 8707 `resource`\n * indicator. We fall back to\n * `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n * server does not implement PRM (404). Connection / parse / 5xx\n * errors throw `ProtectedResourceMetadataError` — never silently\n * downgrade to local guessing.\n * - Without a trusted override, `prm.resource` must share an origin with\n * the agent URL; the MCP SDK's `checkResourceAllowed` guards against a\n * poisoned PRM pointing the audience at a third party.\n * - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n * the agent origin.\n * - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n * `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n * > `clientMetadata.scope`.\n * - Refresh is NOT this module's concern. Once `oauth_tokens` are\n * persisted, `MCPOAuthProvider` handles refresh on the next agent\n * call and the MCP SDK forwards `resource` into the refresh request.\n * Callers who DIY refresh against `oauth_tokens` are responsible for\n * forwarding `resource` themselves.\n /\n\nimport { randomBytes } from 'crypto';\nimport {\n discoverAuthorizationServerMetadata,\n discoverOAuthProtectedResourceMetadata,\n exchangeAuthorization,\n registerClient,\n startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n AuthorizationServerMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthClientMetadata,\n OAuthProtectedResourceMetadata,\n OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\nimport { validateOAuthResourceUrl } from './resource-url';\n\n/\n Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n /\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 60 * 1000;\n\n/*\n State persisted between `/oauth/start` and `/oauth/callback`.\n \n `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n \n `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n /\nexport interface PendingWebFlow {\n state: string;\n agentId: string;\n agentUrl: string;\n codeVerifier: string;\n redirectUri: string;\n resource?: string;\n /* Explicit operator override, persisted separately so refresh can retain it. /\n resourceOverride?: string;\n /* Mutation requested by this flow. Absent on legacy rows and preserve-only flows. /\n resourceOverrideAction?: 'set' \| 'clear';\n /* Value observed at flow start; used to reject concurrent operator edits. /\n resourceOverrideSnapshot?: string \| null;\n scope?: string;\n authorizationServerUrl: string;\n /* Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. /\n clientInformation: OAuthClientInformation;\n createdAt: Date;\n expiresAt: Date;\n /* JSON-serializable, no secrets, attacker-influenced. /\n carry?: Record<string, unknown>;\n}\n\n/\n Persistence interface for in-flight web OAuth flows.\n \n Canonical implementations:\n \n Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n * VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n * WHERE state = $1 AND expires_at > now()\n * RETURNING payload;\n * ```\n \n Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX -- put\n * GETDEL pending:flow:<state> -- consume\n * ```\n \n `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n \n `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n \n Tradeoff: consume runs before token exchange. `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n /\nexport interface PendingWebFlowStore {\n /* Insert a new flow. MUST reject duplicate `state`. /\n put(flow: PendingWebFlow): Promise<void>;\n /\n Atomic delete-and-return. MUST NOT return the same row twice.\n * Returns null if the row is absent or expired.\n /\n consume(state: string): Promise<PendingWebFlow \| null>;\n /* Optional housekeeping for expired rows that were never claimed. /\n cleanupExpired?(): Promise<number>;\n}\n\n/* @deprecated Renamed to `PendingWebFlowStore`. /\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n constructor(state: string) {\n super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n this.name = 'InvalidOrExpiredFlowError';\n }\n}\n\nexport class StateMismatchError extends OAuthError {\n constructor() {\n super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n this.name = 'StateMismatchError';\n }\n}\n\nexport class TokenExchangeError extends OAuthError {\n constructor(\n message: string,\n public readonly status: number,\n public readonly body: string,\n /\n RFC 6749 §5.2 error code when the authorization server returned a\n * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n * Undefined when the AS returned a non-OAuth-shaped failure.\n /\n public readonly oauthErrorCode?: string\n ) {\n super(message, 'token_exchange_failed');\n this.name = 'TokenExchangeError';\n }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n constructor(message: string) {\n super(message, 'protected_resource_metadata_error');\n this.name = 'ProtectedResourceMetadataError';\n }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n constructor(agentId: string) {\n super(\n `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n 'agent_vanished_during_flow',\n agentId\n );\n this.name = 'AgentVanishedDuringFlowError';\n }\n}\n\nexport class AgentChangedDuringFlowError extends OAuthError {\n constructor(agentId: string) {\n super(\n `Agent ${agentId} changed while OAuth authorization was pending; tokens were not saved`,\n 'agent_changed_during_flow',\n agentId\n );\n this.name = 'AgentChangedDuringFlowError';\n }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n constructor(agentId: string \| undefined) {\n super(\n 'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n 'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n 'confidential_client_not_allowed',\n agentId\n );\n this.name = 'ConfidentialClientNotAllowedError';\n }\n}\n\nexport class BrowserBindingRequiredError extends OAuthError {\n constructor() {\n super(\n 'completeWebOAuthFlow called with requireBrowserBinding:true but expectedState was not supplied — ' +\n 'pass the state value from the session cookie set at /oauth/start',\n 'browser_binding_required'\n );\n this.name = 'BrowserBindingRequiredError';\n }\n}\n\nexport interface StartWebFlowOptions {\n /* Agent the flow is for. Must include `agent_uri`. /\n agent: AgentConfig;\n /* Absolute URL of the consumer's `/callback` route (must match what the AS sees). /\n redirectUri: string;\n /* Where to persist the pending flow until callback. /\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, dynamic-registration results land in `agent.oauth_client`. /\n agentStorage?: OAuthConfigStorage;\n /\n Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n * Must be JSON-serializable. Do not store secrets here. Treated as\n * attacker-influenced — validate before reflecting (e.g. via\n * {@link safeReturnTo} for redirect targets).\n /\n carry?: Record<string, unknown>;\n /\n Scope hint (highest priority per SEP-835). Pass through the `scope`\n * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n /\n scopeHint?: string;\n /\n Operator-supplied RFC 8707 resource override. Takes precedence over\n * `prm.resource` and the agent-URL-derived fallback, and is sent during\n * both authorization and code exchange. Pass `null` to explicitly clear a\n * persisted override and return to metadata/agent-URL discovery.\n /\n resourceOverride?: string \| null;\n /\n Non-standard Auth0-compatible audience parameter. Sent only to the\n * authorization endpoint. Prefer `resourceOverride` for RFC 8707 servers.\n /\n audience?: string;\n /* Permit an HTTP resource override for local development. Default false. /\n allowHttp?: boolean;\n /* Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. /\n ttlMs?: number;\n /* Override the random-state generator (defaults to 32 bytes base64url). /\n generateState?: () => string;\n /* Override `fetch` (timeouts, signing, mocks). /\n fetch?: typeof fetch;\n /\n Override base client metadata. `redirect_uris` is always replaced\n * with `[redirectUri]` regardless of what's passed here.\n /\n clientMetadata?: Partial<OAuthClientMetadata>;\n /\n Permit the AS to register a confidential client (i.e. one that\n * returns a `client_secret` from dynamic registration). Default false:\n * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n * rather than silently persisting a long-lived credential to your\n * agent storage.\n /\n allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n authorizationUrl: string;\n state: string;\n expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n state: string;\n code: string;\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, the issued tokens are persisted to `agent.oauth_tokens`. /\n agentStorage?: OAuthConfigStorage;\n fetch?: typeof fetch;\n /\n The caller-bound expected state (e.g. from a session cookie set at\n * `/oauth/start`). When provided, must equal `state`; mismatch throws\n * {@link StateMismatchError}. Without this, `state` is replay-protected\n * but not browser-bound — see WEB-OAUTH.md.\n /\n expectedState?: string;\n /\n When `true`, throws {@link BrowserBindingRequiredError} if `expectedState`\n * is omitted instead of emitting a `console.warn`. Use this in frameworks\n * where session cookies are always available so that a missing bind is caught\n * at development time rather than silently permitted in production.\n \n Default: `false`.\n /\n requireBrowserBinding?: boolean;\n}\n\nexport interface CompleteWebFlowResult {\n agentId: string;\n agentUrl: string;\n tokens: OAuthTokens;\n carry?: Record<string, unknown>;\n /* True if `agentStorage` was provided AND `saveAgent` succeeded. /\n persisted: boolean;\n}\n\n/\n Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n /\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n const {\n agent,\n redirectUri,\n pendingFlowStore,\n agentStorage,\n carry,\n scopeHint,\n resourceOverride: requestedResourceOverride,\n audience,\n allowHttp = false,\n ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n generateState,\n fetch: fetchFn,\n clientMetadata: clientMetadataOverrides,\n allowConfidentialClient = false,\n } = opts;\n\n if (!agent.agent_uri) {\n throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n }\n\n const resourceOverrideAction =\n requestedResourceOverride === null ? 'clear' : requestedResourceOverride !== undefined ? 'set' : undefined;\n const rawResourceOverride =\n requestedResourceOverride === null ? undefined : (requestedResourceOverride ?? agent.oauth_resource);\n const resourceOverride = rawResourceOverride\n ? validateOAuthResourceUrl(rawResourceOverride, { allowHttp }).href\n : undefined;\n\n const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n if (!resourceOverride && prm?.resource) {\n assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n }\n\n const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n if (!asMetadata) {\n throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n }\n\n const resource = resourceOverride\n ? new URL(resourceOverride)\n : prm?.resource\n ? new URL(prm.resource)\n : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n const baseClientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n ...clientMetadataOverrides,\n redirect_uris: [redirectUri],\n };\n\n const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n const clientInformation = await resolveClientInformation({\n agent,\n agentStorage,\n asUrl,\n asMetadata,\n clientMetadata: baseClientMetadata,\n fetchFn,\n allowConfidentialClient,\n });\n\n const state = (generateState ?? defaultGenerateState)();\n const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n metadata: asMetadata,\n clientInformation,\n redirectUrl: redirectUri,\n scope,\n state,\n resource,\n });\n if (audience) {\n authorizationUrl.searchParams.set('audience', audience);\n }\n\n const now = new Date();\n const expiresAt = new Date(now.getTime() + ttlMs);\n const flow: PendingWebFlow = {\n state,\n agentId: agent.id,\n agentUrl: agent.agent_uri,\n codeVerifier,\n redirectUri,\n resource: resource.href,\n resourceOverride,\n resourceOverrideAction,\n resourceOverrideSnapshot: agent.oauth_resource ?? null,\n scope,\n authorizationServerUrl: asUrl.toString(),\n clientInformation,\n createdAt: now,\n expiresAt,\n carry,\n };\n await pendingFlowStore.put(flow);\n\n return {\n authorizationUrl: authorizationUrl.toString(),\n state,\n expiresAt,\n };\n}\n\n/\n Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n \n The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n /\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState, requireBrowserBinding } = opts;\n\n if (expectedState === undefined) {\n if (requireBrowserBinding) {\n throw new BrowserBindingRequiredError();\n }\n // Warn callers who omit expectedState: the flow is replay-protected via\n // atomic consume but is not browser-bound (any request carrying the correct\n // state + code would be accepted). Pass expectedState from a session cookie\n // set at /oauth/start to fully bind the callback to the initiating browser.\n // Set requireBrowserBinding:true to make this a hard error instead.\n console.warn(\n '[adcp/sdk] completeWebOAuthFlow: expectedState not supplied — the callback is replay-protected ' +\n 'but not browser-bound. Pass expectedState from a session cookie set at /oauth/start, ' +\n 'or set requireBrowserBinding:true to enforce it.'\n );\n } else if (expectedState !== state) {\n throw new StateMismatchError();\n }\n\n const flow = await pendingFlowStore.consume(state);\n if (!flow \|\| flow.expiresAt.getTime() < Date.now()) {\n throw new InvalidOrExpiredFlowError(state);\n }\n\n let agentForPersistence: AgentConfig \| undefined;\n if (agentStorage) {\n agentForPersistence = await agentStorage.loadAgent(flow.agentId);\n assertAgentUnchangedForFlow(agentForPersistence, flow);\n }\n\n const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n fetchFn,\n });\n\n let tokens: OAuthTokens;\n try {\n tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n metadata: asMetadata ?? undefined,\n clientInformation: flow.clientInformation,\n authorizationCode: code,\n codeVerifier: flow.codeVerifier,\n redirectUri: flow.redirectUri,\n resource: flow.resource ? new URL(flow.resource) : undefined,\n fetchFn,\n });\n } catch (err) {\n throw wrapTokenExchangeError(err);\n }\n\n let persisted = false;\n if (agentStorage) {\n // Re-read after the network round trips so we do not save the stale object\n // loaded before token exchange or overwrite an edit made while the AS was\n // responding. Storage implementations that need a hard same-ID/same-URI\n // tenant guarantee should additionally make saveAgent revision-aware.\n agentForPersistence = await agentStorage.loadAgent(flow.agentId);\n assertAgentUnchangedForFlow(agentForPersistence, flow);\n agentForPersistence.oauth_tokens = fromMCPTokens(tokens);\n if (flow.resourceOverrideAction === 'set' && flow.resourceOverride) {\n agentForPersistence.oauth_resource = flow.resourceOverride;\n } else if (flow.resourceOverrideAction === 'clear') {\n delete agentForPersistence.oauth_resource;\n }\n delete agentForPersistence.oauth_code_verifier;\n await agentStorage.saveAgent(agentForPersistence);\n persisted = true;\n }\n\n return {\n agentId: flow.agentId,\n agentUrl: flow.agentUrl,\n tokens,\n carry: flow.carry,\n persisted,\n };\n}\n\nfunction assertAgentUnchangedForFlow(\n agent: AgentConfig \| undefined,\n flow: PendingWebFlow\n): asserts agent is AgentConfig {\n if (!agent) {\n throw new AgentVanishedDuringFlowError(flow.agentId);\n }\n if (agent.agent_uri !== flow.agentUrl) {\n throw new AgentChangedDuringFlowError(flow.agentId);\n }\n if (\n Object.prototype.hasOwnProperty.call(flow, 'resourceOverrideSnapshot') &&\n (agent.oauth_resource ?? null) !== flow.resourceOverrideSnapshot\n ) {\n throw new AgentChangedDuringFlowError(flow.agentId);\n }\n}\n\n/\n Validate a redirect target supplied via `carry`.\n \n Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n \n Defaults to path-only redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n \n @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n /\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string \| undefined {\n if (typeof value !== 'string' \|\| value.length === 0) return undefined;\n\n // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n return value;\n }\n\n const allowed = options.allowedReturnHosts;\n if (!allowed \|\| allowed.length === 0) return undefined;\n\n let parsed: URL;\n try {\n parsed = new URL(value);\n } catch {\n return undefined;\n }\n if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n if (!allowed.includes(parsed.host)) return undefined;\n return parsed.toString();\n}\n\n/\n In-memory pending-flow store for tests and single-instance dev.\n \n Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n /\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n private readonly flows = new Map<string, PendingWebFlow>();\n\n async put(flow: PendingWebFlow): Promise<void> {\n if (this.flows.has(flow.state)) {\n throw new Error(`Pending flow already exists for state ${flow.state}`);\n }\n this.flows.set(flow.state, flow);\n }\n\n async consume(state: string): Promise<PendingWebFlow \| null> {\n const flow = this.flows.get(state);\n if (!flow) return null;\n this.flows.delete(state);\n if (flow.expiresAt.getTime() < Date.now()) return null;\n return flow;\n }\n\n async cleanupExpired(): Promise<number> {\n const now = Date.now();\n let removed = 0;\n for (const [state, flow] of this.flows) {\n if (flow.expiresAt.getTime() < now) {\n this.flows.delete(state);\n removed++;\n }\n }\n return removed;\n }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/\n The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n \n Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n * `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n * throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n * when `response.status === 404` (or no response was returned).\n \n If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n /\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n agentUrl: string,\n fetchFn: typeof fetch \| undefined\n): Promise<OAuthProtectedResourceMetadata \| undefined> {\n try {\n return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n } catch (err) {\n if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n // PRM is optional under RFC 9728 — fall back to local resource\n // derivation. Connection/parse/5xx errors fall through.\n return undefined;\n }\n const message = err instanceof Error ? err.message : String(err);\n throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n throw new ProtectedResourceMetadataError(\n `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n );\n }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata \| undefined): URL {\n const first = prm?.authorization_servers?.[0];\n if (first) {\n return new URL(first);\n }\n return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n agent: AgentConfig;\n agentStorage?: OAuthConfigStorage;\n asUrl: URL;\n asMetadata: AuthorizationServerMetadata;\n clientMetadata: OAuthClientMetadata;\n fetchFn?: typeof fetch;\n allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n if (agent.oauth_client) {\n return toMCPClientInfo(agent.oauth_client);\n }\n\n if (!asMetadata.registration_endpoint) {\n throw new OAuthError(\n 'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n 'no_client_credentials',\n agent.id\n );\n }\n\n const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n metadata: asMetadata,\n clientMetadata,\n fetchFn,\n });\n\n if (registered.client_secret && !allowConfidentialClient) {\n throw new ConfidentialClientNotAllowedError(agent.id);\n }\n\n if (agentStorage) {\n // Load fresh and save fresh so two concurrent /start calls for the\n // same agentId do not trample each other's `oauth_client` via a\n // shared in-memory reference.\n const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n fresh.oauth_client = fromMCPClientInfo(registered);\n await agentStorage.saveAgent(fresh);\n }\n\n return registered;\n}\n\nfunction defaultGenerateState(): string {\n return randomBytes(32).toString('base64url');\n}\n\n/\n Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n /\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n // `InvalidGrantError`). Malformed responses come through as\n // `ServerError` with the raw body in `message`, so the redaction pass\n // covers both cases.\n const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n const message = err instanceof Error ? err.message : String(err);\n const status = (err as { status?: number })?.status ?? 0;\n const rawBody = (err as { body?: string })?.body ?? message;\n const body = redactTokens(rawBody);\n const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/\n Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n /\nfunction redactTokens(input: string): string {\n let out = input;\n for (const key of SENSITIVE_TOKEN_KEYS) {\n // JSON form: \"key\":\"…\"\n out = out.replace(new RegExp(`(\"${key}\"\\\\s:\\\\s\")[^\"](\")`, 'gi'), '$1<redacted>$2');\n // form-encoded: key=…\n out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n }\n return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiCA,oBAA4B;AAC5B,kBAMO;AACP,wBAA+D;AAW/D,mBAAuG;AACvG,0BAAyC;AAOlC,MAAM,0BAA0B,KAAK,KAAK;AA0F1C,MAAM,kCAAkC,wBAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,wBAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,wBAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,wBAAW;AAAA,EAC1D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,wBAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,wBAAW;AAAA,EAC1D,cAAc;AACZ;AAAA,MACE;AAAA,MAEA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAuGA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,wBAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,yBACJ,8BAA8B,OAAO,UAAU,8BAA8B,SAAY,QAAQ;AACnG,QAAM,sBACJ,8BAA8B,OAAO,SAAa,6BAA6B,MAAM;AACvF,QAAM,mBAAmB,0BACrB,8CAAyB,qBAAqB,EAAE,UAAU,CAAC,EAAE,OAC7D;AAEJ,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,CAAC,oBAAoB,KAAK,UAAU;AACtC,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,UAAM,iDAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,wBAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,mBACb,IAAI,IAAI,gBAAgB,IACxB,KAAK,WACH,IAAI,IAAI,IAAI,QAAQ,QACpB,4CAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAEvD,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,UAAM,gCAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU;AACZ,qBAAiB,aAAa,IAAI,YAAY,QAAQ;AAAA,EACxD;AAEA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA;AAAA,IACA,0BAA0B,MAAM,kBAAkB;AAAA,IAClD;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,eAAe,sBAAsB,IAAI;AAE9G,MAAI,kBAAkB,QAAW;AAC/B,QAAI,uBAAuB;AACzB,YAAM,IAAI,4BAA4B;AAAA,IACxC;AAMA,YAAQ;AAAA,MACN;AAAA,IAGF;AAAA,EACF,WAAW,kBAAkB,OAAO;AAClC,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,MAAI;AACJ,MAAI,cAAc;AAChB,0BAAsB,MAAM,aAAa,UAAU,KAAK,OAAO;AAC/D,gCAA4B,qBAAqB,IAAI;AAAA,EACvD;AAEA,QAAM,aAAa,UAAM,iDAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,UAAM,mCAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAKhB,0BAAsB,MAAM,aAAa,UAAU,KAAK,OAAO;AAC/D,gCAA4B,qBAAqB,IAAI;AACrD,wBAAoB,mBAAe,4BAAc,MAAM;AACvD,QAAI,KAAK,2BAA2B,SAAS,KAAK,kBAAkB;AAClE,0BAAoB,iBAAiB,KAAK;AAAA,IAC5C,WAAW,KAAK,2BAA2B,SAAS;AAClD,aAAO,oBAAoB;AAAA,IAC7B;AACA,WAAO,oBAAoB;AAC3B,UAAM,aAAa,UAAU,mBAAmB;AAChD,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAEA,SAAS,4BACP,OACA,MAC8B;AAC9B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,EACrD;AACA,MAAI,MAAM,cAAc,KAAK,UAAU;AACrC,UAAM,IAAI,4BAA4B,KAAK,OAAO;AAAA,EACpD;AACA,MACE,OAAO,UAAU,eAAe,KAAK,MAAM,0BAA0B,MACpE,MAAM,kBAAkB,UAAU,KAAK,0BACxC;AACA,UAAM,IAAI,4BAA4B,KAAK,OAAO;AAAA,EACpD;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,UAAM,oDAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,gBAAY,4CAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,KAAC,wCAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,eAAO,8BAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,UAAM,4BAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,mBAAe,gCAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,aAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}

package/dist/lib/auth/oauth/web-flow.mjs CHANGED Viewed

@@ -8,6 +8,7 @@ import {
 } from "@modelcontextprotocol/sdk/client/auth.js";
 import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
 import { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from "./types.mjs";
+import { validateOAuthResourceUrl } from "./resource-url.mjs";
 const DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1e3;
 class InvalidOrExpiredFlowError extends OAuthError {
   constructor(state) {
@@ -49,6 +50,16 @@ class AgentVanishedDuringFlowError extends OAuthError {
     this.name = "AgentVanishedDuringFlowError";
   }
 }
+class AgentChangedDuringFlowError extends OAuthError {
+  constructor(agentId) {
+    super(
+      `Agent ${agentId} changed while OAuth authorization was pending; tokens were not saved`,
+      "agent_changed_during_flow",
+      agentId
+    );
+    this.name = "AgentChangedDuringFlowError";
+  }
+}
 class ConfidentialClientNotAllowedError extends OAuthError {
   constructor(agentId) {
     super(
@@ -76,6 +87,9 @@ async function startWebOAuthFlow(opts) {
     agentStorage,
     carry,
     scopeHint,
+    resourceOverride: requestedResourceOverride,
+    audience,
+    allowHttp = false,
     ttlMs = DEFAULT_WEB_FLOW_TTL_MS,
     generateState,
     fetch: fetchFn,
@@ -85,8 +99,11 @@ async function startWebOAuthFlow(opts) {
   if (!agent.agent_uri) {
     throw new OAuthError("Agent missing agent_uri", "invalid_agent", agent.id);
   }
+  const resourceOverrideAction = requestedResourceOverride === null ? "clear" : requestedResourceOverride !== void 0 ? "set" : void 0;
+  const rawResourceOverride = requestedResourceOverride === null ? void 0 : requestedResourceOverride ?? agent.oauth_resource;
+  const resourceOverride = rawResourceOverride ? validateOAuthResourceUrl(rawResourceOverride, { allowHttp }).href : void 0;
   const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);
-  if (prm?.resource) {
+  if (!resourceOverride && prm?.resource) {
     assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);
   }
   const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);
@@ -94,7 +111,7 @@ async function startWebOAuthFlow(opts) {
   if (!asMetadata) {
     throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, "no_authorization_server_metadata", agent.id);
   }
-  const resource = prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));
+  const resource = resourceOverride ? new URL(resourceOverride) : prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));
   const baseClientMetadata = {
     ...DEFAULT_CLIENT_METADATA,
     ...clientMetadataOverrides,
@@ -119,6 +136,9 @@ async function startWebOAuthFlow(opts) {
     state,
     resource
   });
+  if (audience) {
+    authorizationUrl.searchParams.set("audience", audience);
+  }
   const now = /* @__PURE__ */ new Date();
   const expiresAt = new Date(now.getTime() + ttlMs);
   const flow = {
@@ -128,6 +148,9 @@ async function startWebOAuthFlow(opts) {
     codeVerifier,
     redirectUri,
     resource: resource.href,
+    resourceOverride,
+    resourceOverrideAction,
+    resourceOverrideSnapshot: agent.oauth_resource ?? null,
     scope,
     authorizationServerUrl: asUrl.toString(),
     clientInformation,
@@ -158,6 +181,11 @@ async function completeWebOAuthFlow(opts) {
   if (!flow || flow.expiresAt.getTime() < Date.now()) {
     throw new InvalidOrExpiredFlowError(state);
   }
+  let agentForPersistence;
+  if (agentStorage) {
+    agentForPersistence = await agentStorage.loadAgent(flow.agentId);
+    assertAgentUnchangedForFlow(agentForPersistence, flow);
+  }
   const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {
     fetchFn
   });
@@ -177,13 +205,16 @@ async function completeWebOAuthFlow(opts) {
   }
   let persisted = false;
   if (agentStorage) {
-    const agent = await agentStorage.loadAgent(flow.agentId);
-    if (!agent) {
-      throw new AgentVanishedDuringFlowError(flow.agentId);
+    agentForPersistence = await agentStorage.loadAgent(flow.agentId);
+    assertAgentUnchangedForFlow(agentForPersistence, flow);
+    agentForPersistence.oauth_tokens = fromMCPTokens(tokens);
+    if (flow.resourceOverrideAction === "set" && flow.resourceOverride) {
+      agentForPersistence.oauth_resource = flow.resourceOverride;
+    } else if (flow.resourceOverrideAction === "clear") {
+      delete agentForPersistence.oauth_resource;
     }
-    agent.oauth_tokens = fromMCPTokens(tokens);
-    delete agent.oauth_code_verifier;
-    await agentStorage.saveAgent(agent);
+    delete agentForPersistence.oauth_code_verifier;
+    await agentStorage.saveAgent(agentForPersistence);
     persisted = true;
   }
   return {
@@ -194,6 +225,17 @@ async function completeWebOAuthFlow(opts) {
     persisted
   };
 }
+function assertAgentUnchangedForFlow(agent, flow) {
+  if (!agent) {
+    throw new AgentVanishedDuringFlowError(flow.agentId);
+  }
+  if (agent.agent_uri !== flow.agentUrl) {
+    throw new AgentChangedDuringFlowError(flow.agentId);
+  }
+  if (Object.prototype.hasOwnProperty.call(flow, "resourceOverrideSnapshot") && (agent.oauth_resource ?? null) !== flow.resourceOverrideSnapshot) {
+    throw new AgentChangedDuringFlowError(flow.agentId);
+  }
+}
 function safeReturnTo(value, options = {}) {
   if (typeof value !== "string" || value.length === 0) return void 0;
   if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\")) {
@@ -314,6 +356,7 @@ function redactTokens(input) {
   return out;
 }
 export {
+  AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   ConfidentialClientNotAllowedError,

package/dist/lib/auth/oauth/web-flow.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/*\n Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n \n Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n \n Wire contract:\n * - PRM (RFC 9728) is consulted first; `prm.resource` is the source of\n * truth for the RFC 8707 `resource` indicator. We fall back to\n * `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n * server does not implement PRM (404). Connection / parse / 5xx\n * errors throw `ProtectedResourceMetadataError` — never silently\n * downgrade to local guessing.\n * - `prm.resource` must share an origin with the agent URL; the MCP\n * SDK's `checkResourceAllowed` guards against a poisoned PRM\n * pointing the audience at a third party.\n * - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n * the agent origin.\n * - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n * `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n * > `clientMetadata.scope`.\n * - Refresh is NOT this module's concern. Once `oauth_tokens` are\n * persisted, `MCPOAuthProvider` handles refresh on the next agent\n * call and the MCP SDK forwards `resource` into the refresh request.\n * Callers who DIY refresh against `oauth_tokens` are responsible for\n * forwarding `resource` themselves.\n /\n\nimport { randomBytes } from 'crypto';\nimport {\n discoverAuthorizationServerMetadata,\n discoverOAuthProtectedResourceMetadata,\n exchangeAuthorization,\n registerClient,\n startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n AuthorizationServerMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthClientMetadata,\n OAuthProtectedResourceMetadata,\n OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\n\n/\n Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n /\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 60 * 1000;\n\n/*\n State persisted between `/oauth/start` and `/oauth/callback`.\n \n `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n \n `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n /\nexport interface PendingWebFlow {\n state: string;\n agentId: string;\n agentUrl: string;\n codeVerifier: string;\n redirectUri: string;\n resource?: string;\n scope?: string;\n authorizationServerUrl: string;\n /* Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. /\n clientInformation: OAuthClientInformation;\n createdAt: Date;\n expiresAt: Date;\n /* JSON-serializable, no secrets, attacker-influenced. /\n carry?: Record<string, unknown>;\n}\n\n/\n Persistence interface for in-flight web OAuth flows.\n \n Canonical implementations:\n \n Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n * VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n * WHERE state = $1 AND expires_at > now()\n * RETURNING payload;\n * ```\n \n Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX -- put\n * GETDEL pending:flow:<state> -- consume\n * ```\n \n `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n \n `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n \n Tradeoff: consume runs before token exchange. `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n /\nexport interface PendingWebFlowStore {\n /* Insert a new flow. MUST reject duplicate `state`. /\n put(flow: PendingWebFlow): Promise<void>;\n /\n Atomic delete-and-return. MUST NOT return the same row twice.\n * Returns null if the row is absent or expired.\n /\n consume(state: string): Promise<PendingWebFlow \| null>;\n /* Optional housekeeping for expired rows that were never claimed. /\n cleanupExpired?(): Promise<number>;\n}\n\n/* @deprecated Renamed to `PendingWebFlowStore`. /\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n constructor(state: string) {\n super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n this.name = 'InvalidOrExpiredFlowError';\n }\n}\n\nexport class StateMismatchError extends OAuthError {\n constructor() {\n super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n this.name = 'StateMismatchError';\n }\n}\n\nexport class TokenExchangeError extends OAuthError {\n constructor(\n message: string,\n public readonly status: number,\n public readonly body: string,\n /\n RFC 6749 §5.2 error code when the authorization server returned a\n * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n * Undefined when the AS returned a non-OAuth-shaped failure.\n /\n public readonly oauthErrorCode?: string\n ) {\n super(message, 'token_exchange_failed');\n this.name = 'TokenExchangeError';\n }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n constructor(message: string) {\n super(message, 'protected_resource_metadata_error');\n this.name = 'ProtectedResourceMetadataError';\n }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n constructor(agentId: string) {\n super(\n `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n 'agent_vanished_during_flow',\n agentId\n );\n this.name = 'AgentVanishedDuringFlowError';\n }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n constructor(agentId: string \| undefined) {\n super(\n 'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n 'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n 'confidential_client_not_allowed',\n agentId\n );\n this.name = 'ConfidentialClientNotAllowedError';\n }\n}\n\nexport class BrowserBindingRequiredError extends OAuthError {\n constructor() {\n super(\n 'completeWebOAuthFlow called with requireBrowserBinding:true but expectedState was not supplied — ' +\n 'pass the state value from the session cookie set at /oauth/start',\n 'browser_binding_required'\n );\n this.name = 'BrowserBindingRequiredError';\n }\n}\n\nexport interface StartWebFlowOptions {\n /* Agent the flow is for. Must include `agent_uri`. /\n agent: AgentConfig;\n /* Absolute URL of the consumer's `/callback` route (must match what the AS sees). /\n redirectUri: string;\n /* Where to persist the pending flow until callback. /\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, dynamic-registration results land in `agent.oauth_client`. /\n agentStorage?: OAuthConfigStorage;\n /\n Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n * Must be JSON-serializable. Do not store secrets here. Treated as\n * attacker-influenced — validate before reflecting (e.g. via\n * {@link safeReturnTo} for redirect targets).\n /\n carry?: Record<string, unknown>;\n /\n Scope hint (highest priority per SEP-835). Pass through the `scope`\n * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n /\n scopeHint?: string;\n /* Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. /\n ttlMs?: number;\n /* Override the random-state generator (defaults to 32 bytes base64url). /\n generateState?: () => string;\n /* Override `fetch` (timeouts, signing, mocks). /\n fetch?: typeof fetch;\n /\n Override base client metadata. `redirect_uris` is always replaced\n * with `[redirectUri]` regardless of what's passed here.\n /\n clientMetadata?: Partial<OAuthClientMetadata>;\n /\n Permit the AS to register a confidential client (i.e. one that\n * returns a `client_secret` from dynamic registration). Default false:\n * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n * rather than silently persisting a long-lived credential to your\n * agent storage.\n /\n allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n authorizationUrl: string;\n state: string;\n expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n state: string;\n code: string;\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, the issued tokens are persisted to `agent.oauth_tokens`. /\n agentStorage?: OAuthConfigStorage;\n fetch?: typeof fetch;\n /\n The caller-bound expected state (e.g. from a session cookie set at\n * `/oauth/start`). When provided, must equal `state`; mismatch throws\n * {@link StateMismatchError}. Without this, `state` is replay-protected\n * but not browser-bound — see WEB-OAUTH.md.\n /\n expectedState?: string;\n /\n When `true`, throws {@link BrowserBindingRequiredError} if `expectedState`\n * is omitted instead of emitting a `console.warn`. Use this in frameworks\n * where session cookies are always available so that a missing bind is caught\n * at development time rather than silently permitted in production.\n \n Default: `false`.\n /\n requireBrowserBinding?: boolean;\n}\n\nexport interface CompleteWebFlowResult {\n agentId: string;\n agentUrl: string;\n tokens: OAuthTokens;\n carry?: Record<string, unknown>;\n /* True if `agentStorage` was provided AND `saveAgent` succeeded. /\n persisted: boolean;\n}\n\n/\n Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n /\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n const {\n agent,\n redirectUri,\n pendingFlowStore,\n agentStorage,\n carry,\n scopeHint,\n ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n generateState,\n fetch: fetchFn,\n clientMetadata: clientMetadataOverrides,\n allowConfidentialClient = false,\n } = opts;\n\n if (!agent.agent_uri) {\n throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n }\n\n const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n if (prm?.resource) {\n assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n }\n\n const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n if (!asMetadata) {\n throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n }\n\n const resource = prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n const baseClientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n ...clientMetadataOverrides,\n redirect_uris: [redirectUri],\n };\n\n const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n const clientInformation = await resolveClientInformation({\n agent,\n agentStorage,\n asUrl,\n asMetadata,\n clientMetadata: baseClientMetadata,\n fetchFn,\n allowConfidentialClient,\n });\n\n const state = (generateState ?? defaultGenerateState)();\n const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n metadata: asMetadata,\n clientInformation,\n redirectUrl: redirectUri,\n scope,\n state,\n resource,\n });\n\n const now = new Date();\n const expiresAt = new Date(now.getTime() + ttlMs);\n const flow: PendingWebFlow = {\n state,\n agentId: agent.id,\n agentUrl: agent.agent_uri,\n codeVerifier,\n redirectUri,\n resource: resource.href,\n scope,\n authorizationServerUrl: asUrl.toString(),\n clientInformation,\n createdAt: now,\n expiresAt,\n carry,\n };\n await pendingFlowStore.put(flow);\n\n return {\n authorizationUrl: authorizationUrl.toString(),\n state,\n expiresAt,\n };\n}\n\n/\n Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n \n The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n /\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState, requireBrowserBinding } = opts;\n\n if (expectedState === undefined) {\n if (requireBrowserBinding) {\n throw new BrowserBindingRequiredError();\n }\n // Warn callers who omit expectedState: the flow is replay-protected via\n // atomic consume but is not browser-bound (any request carrying the correct\n // state + code would be accepted). Pass expectedState from a session cookie\n // set at /oauth/start to fully bind the callback to the initiating browser.\n // Set requireBrowserBinding:true to make this a hard error instead.\n console.warn(\n '[adcp/sdk] completeWebOAuthFlow: expectedState not supplied — the callback is replay-protected ' +\n 'but not browser-bound. Pass expectedState from a session cookie set at /oauth/start, ' +\n 'or set requireBrowserBinding:true to enforce it.'\n );\n } else if (expectedState !== state) {\n throw new StateMismatchError();\n }\n\n const flow = await pendingFlowStore.consume(state);\n if (!flow \|\| flow.expiresAt.getTime() < Date.now()) {\n throw new InvalidOrExpiredFlowError(state);\n }\n\n const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n fetchFn,\n });\n\n let tokens: OAuthTokens;\n try {\n tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n metadata: asMetadata ?? undefined,\n clientInformation: flow.clientInformation,\n authorizationCode: code,\n codeVerifier: flow.codeVerifier,\n redirectUri: flow.redirectUri,\n resource: flow.resource ? new URL(flow.resource) : undefined,\n fetchFn,\n });\n } catch (err) {\n throw wrapTokenExchangeError(err);\n }\n\n let persisted = false;\n if (agentStorage) {\n const agent = await agentStorage.loadAgent(flow.agentId);\n if (!agent) {\n throw new AgentVanishedDuringFlowError(flow.agentId);\n }\n agent.oauth_tokens = fromMCPTokens(tokens);\n delete agent.oauth_code_verifier;\n await agentStorage.saveAgent(agent);\n persisted = true;\n }\n\n return {\n agentId: flow.agentId,\n agentUrl: flow.agentUrl,\n tokens,\n carry: flow.carry,\n persisted,\n };\n}\n\n/\n Validate a redirect target supplied via `carry`.\n \n Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n \n Defaults to path-only redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n \n @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n /\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string \| undefined {\n if (typeof value !== 'string' \|\| value.length === 0) return undefined;\n\n // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n return value;\n }\n\n const allowed = options.allowedReturnHosts;\n if (!allowed \|\| allowed.length === 0) return undefined;\n\n let parsed: URL;\n try {\n parsed = new URL(value);\n } catch {\n return undefined;\n }\n if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n if (!allowed.includes(parsed.host)) return undefined;\n return parsed.toString();\n}\n\n/\n In-memory pending-flow store for tests and single-instance dev.\n \n Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n /\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n private readonly flows = new Map<string, PendingWebFlow>();\n\n async put(flow: PendingWebFlow): Promise<void> {\n if (this.flows.has(flow.state)) {\n throw new Error(`Pending flow already exists for state ${flow.state}`);\n }\n this.flows.set(flow.state, flow);\n }\n\n async consume(state: string): Promise<PendingWebFlow \| null> {\n const flow = this.flows.get(state);\n if (!flow) return null;\n this.flows.delete(state);\n if (flow.expiresAt.getTime() < Date.now()) return null;\n return flow;\n }\n\n async cleanupExpired(): Promise<number> {\n const now = Date.now();\n let removed = 0;\n for (const [state, flow] of this.flows) {\n if (flow.expiresAt.getTime() < now) {\n this.flows.delete(state);\n removed++;\n }\n }\n return removed;\n }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/\n The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n \n Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n * `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n * throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n * when `response.status === 404` (or no response was returned).\n \n If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n /\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n agentUrl: string,\n fetchFn: typeof fetch \| undefined\n): Promise<OAuthProtectedResourceMetadata \| undefined> {\n try {\n return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n } catch (err) {\n if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n // PRM is optional under RFC 9728 — fall back to local resource\n // derivation. Connection/parse/5xx errors fall through.\n return undefined;\n }\n const message = err instanceof Error ? err.message : String(err);\n throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n throw new ProtectedResourceMetadataError(\n `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n );\n }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata \| undefined): URL {\n const first = prm?.authorization_servers?.[0];\n if (first) {\n return new URL(first);\n }\n return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n agent: AgentConfig;\n agentStorage?: OAuthConfigStorage;\n asUrl: URL;\n asMetadata: AuthorizationServerMetadata;\n clientMetadata: OAuthClientMetadata;\n fetchFn?: typeof fetch;\n allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n if (agent.oauth_client) {\n return toMCPClientInfo(agent.oauth_client);\n }\n\n if (!asMetadata.registration_endpoint) {\n throw new OAuthError(\n 'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n 'no_client_credentials',\n agent.id\n );\n }\n\n const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n metadata: asMetadata,\n clientMetadata,\n fetchFn,\n });\n\n if (registered.client_secret && !allowConfidentialClient) {\n throw new ConfidentialClientNotAllowedError(agent.id);\n }\n\n if (agentStorage) {\n // Load fresh and save fresh so two concurrent /start calls for the\n // same agentId do not trample each other's `oauth_client` via a\n // shared in-memory reference.\n const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n fresh.oauth_client = fromMCPClientInfo(registered);\n await agentStorage.saveAgent(fresh);\n }\n\n return registered;\n}\n\nfunction defaultGenerateState(): string {\n return randomBytes(32).toString('base64url');\n}\n\n/\n Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n /\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n // `InvalidGrantError`). Malformed responses come through as\n // `ServerError` with the raw body in `message`, so the redaction pass\n // covers both cases.\n const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n const message = err instanceof Error ? err.message : String(err);\n const status = (err as { status?: number })?.status ?? 0;\n const rawBody = (err as { body?: string })?.body ?? message;\n const body = redactTokens(rawBody);\n const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/\n Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n /\nfunction redactTokens(input: string): string {\n let out = input;\n for (const key of SENSITIVE_TOKEN_KEYS) {\n // JSON form: \"key\":\"…\"\n out = out.replace(new RegExp(`(\"${key}\"\\\\s:\\\\s\")[^\"](\")`, 'gi'), '$1<redacted>$2');\n // form-encoded: key=…\n out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n }\n return out;\n}\n"],"mappings":"AA+BA,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,gCAAgC;AAW/D,SAAS,yBAAyB,mBAAmB,eAAe,YAAY,uBAAuB;AAOhG,MAAM,0BAA0B,KAAK,KAAK;AAoF1C,MAAM,kCAAkC,WAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,WAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,WAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,WAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,WAAW;AAAA,EAC1D,cAAc;AACZ;AAAA,MACE;AAAA,MAEA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAyFA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,WAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,KAAK,UAAU;AACjB,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,MAAM,oCAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,WAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,KAAK,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,yBAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAE1G,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,MAAM,mBAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,eAAe,sBAAsB,IAAI;AAE9G,MAAI,kBAAkB,QAAW;AAC/B,QAAI,uBAAuB;AACzB,YAAM,IAAI,4BAA4B;AAAA,IACxC;AAMA,YAAQ;AAAA,MACN;AAAA,IAGF;AAAA,EACF,WAAW,kBAAkB,OAAO;AAClC,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,QAAM,aAAa,MAAM,oCAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,sBAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAChB,UAAM,QAAQ,MAAM,aAAa,UAAU,KAAK,OAAO;AACvD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,IACrD;AACA,UAAM,eAAe,cAAc,MAAM;AACzC,WAAO,MAAM;AACb,UAAM,aAAa,UAAU,KAAK;AAClC,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,MAAM,uCAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,YAAY,yBAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,CAAC,qBAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,WAAO,gBAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,MAAM,eAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,eAAe,kBAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}
1	+ {"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/*\n Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n \n Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n \n Wire contract:\n * - An operator `resourceOverride` takes precedence for legacy or\n * non-conformant integrations. Otherwise PRM (RFC 9728) is consulted;\n * `prm.resource` is the source of truth for the RFC 8707 `resource`\n * indicator. We fall back to\n * `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n * server does not implement PRM (404). Connection / parse / 5xx\n * errors throw `ProtectedResourceMetadataError` — never silently\n * downgrade to local guessing.\n * - Without a trusted override, `prm.resource` must share an origin with\n * the agent URL; the MCP SDK's `checkResourceAllowed` guards against a\n * poisoned PRM pointing the audience at a third party.\n * - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n * the agent origin.\n * - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n * `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n * > `clientMetadata.scope`.\n * - Refresh is NOT this module's concern. Once `oauth_tokens` are\n * persisted, `MCPOAuthProvider` handles refresh on the next agent\n * call and the MCP SDK forwards `resource` into the refresh request.\n * Callers who DIY refresh against `oauth_tokens` are responsible for\n * forwarding `resource` themselves.\n /\n\nimport { randomBytes } from 'crypto';\nimport {\n discoverAuthorizationServerMetadata,\n discoverOAuthProtectedResourceMetadata,\n exchangeAuthorization,\n registerClient,\n startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n AuthorizationServerMetadata,\n OAuthClientInformation,\n OAuthClientInformationFull,\n OAuthClientMetadata,\n OAuthProtectedResourceMetadata,\n OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\nimport { validateOAuthResourceUrl } from './resource-url';\n\n/\n Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n /\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 60 * 1000;\n\n/*\n State persisted between `/oauth/start` and `/oauth/callback`.\n \n `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n \n `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n /\nexport interface PendingWebFlow {\n state: string;\n agentId: string;\n agentUrl: string;\n codeVerifier: string;\n redirectUri: string;\n resource?: string;\n /* Explicit operator override, persisted separately so refresh can retain it. /\n resourceOverride?: string;\n /* Mutation requested by this flow. Absent on legacy rows and preserve-only flows. /\n resourceOverrideAction?: 'set' \| 'clear';\n /* Value observed at flow start; used to reject concurrent operator edits. /\n resourceOverrideSnapshot?: string \| null;\n scope?: string;\n authorizationServerUrl: string;\n /* Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. /\n clientInformation: OAuthClientInformation;\n createdAt: Date;\n expiresAt: Date;\n /* JSON-serializable, no secrets, attacker-influenced. /\n carry?: Record<string, unknown>;\n}\n\n/\n Persistence interface for in-flight web OAuth flows.\n \n Canonical implementations:\n \n Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n * VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n * WHERE state = $1 AND expires_at > now()\n * RETURNING payload;\n * ```\n \n Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX -- put\n * GETDEL pending:flow:<state> -- consume\n * ```\n \n `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n \n `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n \n Tradeoff: consume runs before token exchange. `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n /\nexport interface PendingWebFlowStore {\n /* Insert a new flow. MUST reject duplicate `state`. /\n put(flow: PendingWebFlow): Promise<void>;\n /\n Atomic delete-and-return. MUST NOT return the same row twice.\n * Returns null if the row is absent or expired.\n /\n consume(state: string): Promise<PendingWebFlow \| null>;\n /* Optional housekeeping for expired rows that were never claimed. /\n cleanupExpired?(): Promise<number>;\n}\n\n/* @deprecated Renamed to `PendingWebFlowStore`. /\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n constructor(state: string) {\n super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n this.name = 'InvalidOrExpiredFlowError';\n }\n}\n\nexport class StateMismatchError extends OAuthError {\n constructor() {\n super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n this.name = 'StateMismatchError';\n }\n}\n\nexport class TokenExchangeError extends OAuthError {\n constructor(\n message: string,\n public readonly status: number,\n public readonly body: string,\n /\n RFC 6749 §5.2 error code when the authorization server returned a\n * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n * Undefined when the AS returned a non-OAuth-shaped failure.\n /\n public readonly oauthErrorCode?: string\n ) {\n super(message, 'token_exchange_failed');\n this.name = 'TokenExchangeError';\n }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n constructor(message: string) {\n super(message, 'protected_resource_metadata_error');\n this.name = 'ProtectedResourceMetadataError';\n }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n constructor(agentId: string) {\n super(\n `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n 'agent_vanished_during_flow',\n agentId\n );\n this.name = 'AgentVanishedDuringFlowError';\n }\n}\n\nexport class AgentChangedDuringFlowError extends OAuthError {\n constructor(agentId: string) {\n super(\n `Agent ${agentId} changed while OAuth authorization was pending; tokens were not saved`,\n 'agent_changed_during_flow',\n agentId\n );\n this.name = 'AgentChangedDuringFlowError';\n }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n constructor(agentId: string \| undefined) {\n super(\n 'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n 'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n 'confidential_client_not_allowed',\n agentId\n );\n this.name = 'ConfidentialClientNotAllowedError';\n }\n}\n\nexport class BrowserBindingRequiredError extends OAuthError {\n constructor() {\n super(\n 'completeWebOAuthFlow called with requireBrowserBinding:true but expectedState was not supplied — ' +\n 'pass the state value from the session cookie set at /oauth/start',\n 'browser_binding_required'\n );\n this.name = 'BrowserBindingRequiredError';\n }\n}\n\nexport interface StartWebFlowOptions {\n /* Agent the flow is for. Must include `agent_uri`. /\n agent: AgentConfig;\n /* Absolute URL of the consumer's `/callback` route (must match what the AS sees). /\n redirectUri: string;\n /* Where to persist the pending flow until callback. /\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, dynamic-registration results land in `agent.oauth_client`. /\n agentStorage?: OAuthConfigStorage;\n /\n Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n * Must be JSON-serializable. Do not store secrets here. Treated as\n * attacker-influenced — validate before reflecting (e.g. via\n * {@link safeReturnTo} for redirect targets).\n /\n carry?: Record<string, unknown>;\n /\n Scope hint (highest priority per SEP-835). Pass through the `scope`\n * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n /\n scopeHint?: string;\n /\n Operator-supplied RFC 8707 resource override. Takes precedence over\n * `prm.resource` and the agent-URL-derived fallback, and is sent during\n * both authorization and code exchange. Pass `null` to explicitly clear a\n * persisted override and return to metadata/agent-URL discovery.\n /\n resourceOverride?: string \| null;\n /\n Non-standard Auth0-compatible audience parameter. Sent only to the\n * authorization endpoint. Prefer `resourceOverride` for RFC 8707 servers.\n /\n audience?: string;\n /* Permit an HTTP resource override for local development. Default false. /\n allowHttp?: boolean;\n /* Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. /\n ttlMs?: number;\n /* Override the random-state generator (defaults to 32 bytes base64url). /\n generateState?: () => string;\n /* Override `fetch` (timeouts, signing, mocks). /\n fetch?: typeof fetch;\n /\n Override base client metadata. `redirect_uris` is always replaced\n * with `[redirectUri]` regardless of what's passed here.\n /\n clientMetadata?: Partial<OAuthClientMetadata>;\n /\n Permit the AS to register a confidential client (i.e. one that\n * returns a `client_secret` from dynamic registration). Default false:\n * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n * rather than silently persisting a long-lived credential to your\n * agent storage.\n /\n allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n authorizationUrl: string;\n state: string;\n expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n state: string;\n code: string;\n pendingFlowStore: PendingWebFlowStore;\n /* When provided, the issued tokens are persisted to `agent.oauth_tokens`. /\n agentStorage?: OAuthConfigStorage;\n fetch?: typeof fetch;\n /\n The caller-bound expected state (e.g. from a session cookie set at\n * `/oauth/start`). When provided, must equal `state`; mismatch throws\n * {@link StateMismatchError}. Without this, `state` is replay-protected\n * but not browser-bound — see WEB-OAUTH.md.\n /\n expectedState?: string;\n /\n When `true`, throws {@link BrowserBindingRequiredError} if `expectedState`\n * is omitted instead of emitting a `console.warn`. Use this in frameworks\n * where session cookies are always available so that a missing bind is caught\n * at development time rather than silently permitted in production.\n \n Default: `false`.\n /\n requireBrowserBinding?: boolean;\n}\n\nexport interface CompleteWebFlowResult {\n agentId: string;\n agentUrl: string;\n tokens: OAuthTokens;\n carry?: Record<string, unknown>;\n /* True if `agentStorage` was provided AND `saveAgent` succeeded. /\n persisted: boolean;\n}\n\n/\n Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n /\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n const {\n agent,\n redirectUri,\n pendingFlowStore,\n agentStorage,\n carry,\n scopeHint,\n resourceOverride: requestedResourceOverride,\n audience,\n allowHttp = false,\n ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n generateState,\n fetch: fetchFn,\n clientMetadata: clientMetadataOverrides,\n allowConfidentialClient = false,\n } = opts;\n\n if (!agent.agent_uri) {\n throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n }\n\n const resourceOverrideAction =\n requestedResourceOverride === null ? 'clear' : requestedResourceOverride !== undefined ? 'set' : undefined;\n const rawResourceOverride =\n requestedResourceOverride === null ? undefined : (requestedResourceOverride ?? agent.oauth_resource);\n const resourceOverride = rawResourceOverride\n ? validateOAuthResourceUrl(rawResourceOverride, { allowHttp }).href\n : undefined;\n\n const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n if (!resourceOverride && prm?.resource) {\n assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n }\n\n const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n if (!asMetadata) {\n throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n }\n\n const resource = resourceOverride\n ? new URL(resourceOverride)\n : prm?.resource\n ? new URL(prm.resource)\n : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n const baseClientMetadata: OAuthClientMetadata = {\n ...DEFAULT_CLIENT_METADATA,\n ...clientMetadataOverrides,\n redirect_uris: [redirectUri],\n };\n\n const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n const clientInformation = await resolveClientInformation({\n agent,\n agentStorage,\n asUrl,\n asMetadata,\n clientMetadata: baseClientMetadata,\n fetchFn,\n allowConfidentialClient,\n });\n\n const state = (generateState ?? defaultGenerateState)();\n const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n metadata: asMetadata,\n clientInformation,\n redirectUrl: redirectUri,\n scope,\n state,\n resource,\n });\n if (audience) {\n authorizationUrl.searchParams.set('audience', audience);\n }\n\n const now = new Date();\n const expiresAt = new Date(now.getTime() + ttlMs);\n const flow: PendingWebFlow = {\n state,\n agentId: agent.id,\n agentUrl: agent.agent_uri,\n codeVerifier,\n redirectUri,\n resource: resource.href,\n resourceOverride,\n resourceOverrideAction,\n resourceOverrideSnapshot: agent.oauth_resource ?? null,\n scope,\n authorizationServerUrl: asUrl.toString(),\n clientInformation,\n createdAt: now,\n expiresAt,\n carry,\n };\n await pendingFlowStore.put(flow);\n\n return {\n authorizationUrl: authorizationUrl.toString(),\n state,\n expiresAt,\n };\n}\n\n/\n Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n \n The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n /\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState, requireBrowserBinding } = opts;\n\n if (expectedState === undefined) {\n if (requireBrowserBinding) {\n throw new BrowserBindingRequiredError();\n }\n // Warn callers who omit expectedState: the flow is replay-protected via\n // atomic consume but is not browser-bound (any request carrying the correct\n // state + code would be accepted). Pass expectedState from a session cookie\n // set at /oauth/start to fully bind the callback to the initiating browser.\n // Set requireBrowserBinding:true to make this a hard error instead.\n console.warn(\n '[adcp/sdk] completeWebOAuthFlow: expectedState not supplied — the callback is replay-protected ' +\n 'but not browser-bound. Pass expectedState from a session cookie set at /oauth/start, ' +\n 'or set requireBrowserBinding:true to enforce it.'\n );\n } else if (expectedState !== state) {\n throw new StateMismatchError();\n }\n\n const flow = await pendingFlowStore.consume(state);\n if (!flow \|\| flow.expiresAt.getTime() < Date.now()) {\n throw new InvalidOrExpiredFlowError(state);\n }\n\n let agentForPersistence: AgentConfig \| undefined;\n if (agentStorage) {\n agentForPersistence = await agentStorage.loadAgent(flow.agentId);\n assertAgentUnchangedForFlow(agentForPersistence, flow);\n }\n\n const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n fetchFn,\n });\n\n let tokens: OAuthTokens;\n try {\n tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n metadata: asMetadata ?? undefined,\n clientInformation: flow.clientInformation,\n authorizationCode: code,\n codeVerifier: flow.codeVerifier,\n redirectUri: flow.redirectUri,\n resource: flow.resource ? new URL(flow.resource) : undefined,\n fetchFn,\n });\n } catch (err) {\n throw wrapTokenExchangeError(err);\n }\n\n let persisted = false;\n if (agentStorage) {\n // Re-read after the network round trips so we do not save the stale object\n // loaded before token exchange or overwrite an edit made while the AS was\n // responding. Storage implementations that need a hard same-ID/same-URI\n // tenant guarantee should additionally make saveAgent revision-aware.\n agentForPersistence = await agentStorage.loadAgent(flow.agentId);\n assertAgentUnchangedForFlow(agentForPersistence, flow);\n agentForPersistence.oauth_tokens = fromMCPTokens(tokens);\n if (flow.resourceOverrideAction === 'set' && flow.resourceOverride) {\n agentForPersistence.oauth_resource = flow.resourceOverride;\n } else if (flow.resourceOverrideAction === 'clear') {\n delete agentForPersistence.oauth_resource;\n }\n delete agentForPersistence.oauth_code_verifier;\n await agentStorage.saveAgent(agentForPersistence);\n persisted = true;\n }\n\n return {\n agentId: flow.agentId,\n agentUrl: flow.agentUrl,\n tokens,\n carry: flow.carry,\n persisted,\n };\n}\n\nfunction assertAgentUnchangedForFlow(\n agent: AgentConfig \| undefined,\n flow: PendingWebFlow\n): asserts agent is AgentConfig {\n if (!agent) {\n throw new AgentVanishedDuringFlowError(flow.agentId);\n }\n if (agent.agent_uri !== flow.agentUrl) {\n throw new AgentChangedDuringFlowError(flow.agentId);\n }\n if (\n Object.prototype.hasOwnProperty.call(flow, 'resourceOverrideSnapshot') &&\n (agent.oauth_resource ?? null) !== flow.resourceOverrideSnapshot\n ) {\n throw new AgentChangedDuringFlowError(flow.agentId);\n }\n}\n\n/\n Validate a redirect target supplied via `carry`.\n \n Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n \n Defaults to path-only redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n \n @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n /\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string \| undefined {\n if (typeof value !== 'string' \|\| value.length === 0) return undefined;\n\n // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n return value;\n }\n\n const allowed = options.allowedReturnHosts;\n if (!allowed \|\| allowed.length === 0) return undefined;\n\n let parsed: URL;\n try {\n parsed = new URL(value);\n } catch {\n return undefined;\n }\n if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n if (!allowed.includes(parsed.host)) return undefined;\n return parsed.toString();\n}\n\n/\n In-memory pending-flow store for tests and single-instance dev.\n \n Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n /\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n private readonly flows = new Map<string, PendingWebFlow>();\n\n async put(flow: PendingWebFlow): Promise<void> {\n if (this.flows.has(flow.state)) {\n throw new Error(`Pending flow already exists for state ${flow.state}`);\n }\n this.flows.set(flow.state, flow);\n }\n\n async consume(state: string): Promise<PendingWebFlow \| null> {\n const flow = this.flows.get(state);\n if (!flow) return null;\n this.flows.delete(state);\n if (flow.expiresAt.getTime() < Date.now()) return null;\n return flow;\n }\n\n async cleanupExpired(): Promise<number> {\n const now = Date.now();\n let removed = 0;\n for (const [state, flow] of this.flows) {\n if (flow.expiresAt.getTime() < now) {\n this.flows.delete(state);\n removed++;\n }\n }\n return removed;\n }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/\n The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n \n Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n * `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n * throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n * when `response.status === 404` (or no response was returned).\n \n If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n /\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n agentUrl: string,\n fetchFn: typeof fetch \| undefined\n): Promise<OAuthProtectedResourceMetadata \| undefined> {\n try {\n return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n } catch (err) {\n if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n // PRM is optional under RFC 9728 — fall back to local resource\n // derivation. Connection/parse/5xx errors fall through.\n return undefined;\n }\n const message = err instanceof Error ? err.message : String(err);\n throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n throw new ProtectedResourceMetadataError(\n `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n );\n }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata \| undefined): URL {\n const first = prm?.authorization_servers?.[0];\n if (first) {\n return new URL(first);\n }\n return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n agent: AgentConfig;\n agentStorage?: OAuthConfigStorage;\n asUrl: URL;\n asMetadata: AuthorizationServerMetadata;\n clientMetadata: OAuthClientMetadata;\n fetchFn?: typeof fetch;\n allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n if (agent.oauth_client) {\n return toMCPClientInfo(agent.oauth_client);\n }\n\n if (!asMetadata.registration_endpoint) {\n throw new OAuthError(\n 'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n 'no_client_credentials',\n agent.id\n );\n }\n\n const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n metadata: asMetadata,\n clientMetadata,\n fetchFn,\n });\n\n if (registered.client_secret && !allowConfidentialClient) {\n throw new ConfidentialClientNotAllowedError(agent.id);\n }\n\n if (agentStorage) {\n // Load fresh and save fresh so two concurrent /start calls for the\n // same agentId do not trample each other's `oauth_client` via a\n // shared in-memory reference.\n const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n fresh.oauth_client = fromMCPClientInfo(registered);\n await agentStorage.saveAgent(fresh);\n }\n\n return registered;\n}\n\nfunction defaultGenerateState(): string {\n return randomBytes(32).toString('base64url');\n}\n\n/\n Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n /\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n // `InvalidGrantError`). Malformed responses come through as\n // `ServerError` with the raw body in `message`, so the redaction pass\n // covers both cases.\n const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n const message = err instanceof Error ? err.message : String(err);\n const status = (err as { status?: number })?.status ?? 0;\n const rawBody = (err as { body?: string })?.body ?? message;\n const body = redactTokens(rawBody);\n const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/\n Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n /\nfunction redactTokens(input: string): string {\n let out = input;\n for (const key of SENSITIVE_TOKEN_KEYS) {\n // JSON form: \"key\":\"…\"\n out = out.replace(new RegExp(`(\"${key}\"\\\\s:\\\\s\")[^\"](\")`, 'gi'), '$1<redacted>$2');\n // form-encoded: key=…\n out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n }\n return out;\n}\n"],"mappings":"AAiCA,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,gCAAgC;AAW/D,SAAS,yBAAyB,mBAAmB,eAAe,YAAY,uBAAuB;AACvG,SAAS,gCAAgC;AAOlC,MAAM,0BAA0B,KAAK,KAAK;AA0F1C,MAAM,kCAAkC,WAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,WAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,WAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,WAAW;AAAA,EAC1D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,WAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,WAAW;AAAA,EAC1D,cAAc;AACZ;AAAA,MACE;AAAA,MAEA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAuGA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,WAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,yBACJ,8BAA8B,OAAO,UAAU,8BAA8B,SAAY,QAAQ;AACnG,QAAM,sBACJ,8BAA8B,OAAO,SAAa,6BAA6B,MAAM;AACvF,QAAM,mBAAmB,sBACrB,yBAAyB,qBAAqB,EAAE,UAAU,CAAC,EAAE,OAC7D;AAEJ,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,CAAC,oBAAoB,KAAK,UAAU;AACtC,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,MAAM,oCAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,WAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,mBACb,IAAI,IAAI,gBAAgB,IACxB,KAAK,WACH,IAAI,IAAI,IAAI,QAAQ,IACpB,yBAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAEvD,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,MAAM,mBAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,UAAU;AACZ,qBAAiB,aAAa,IAAI,YAAY,QAAQ;AAAA,EACxD;AAEA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA;AAAA,IACA,0BAA0B,MAAM,kBAAkB;AAAA,IAClD;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,eAAe,sBAAsB,IAAI;AAE9G,MAAI,kBAAkB,QAAW;AAC/B,QAAI,uBAAuB;AACzB,YAAM,IAAI,4BAA4B;AAAA,IACxC;AAMA,YAAQ;AAAA,MACN;AAAA,IAGF;AAAA,EACF,WAAW,kBAAkB,OAAO;AAClC,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,MAAI;AACJ,MAAI,cAAc;AAChB,0BAAsB,MAAM,aAAa,UAAU,KAAK,OAAO;AAC/D,gCAA4B,qBAAqB,IAAI;AAAA,EACvD;AAEA,QAAM,aAAa,MAAM,oCAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,sBAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAKhB,0BAAsB,MAAM,aAAa,UAAU,KAAK,OAAO;AAC/D,gCAA4B,qBAAqB,IAAI;AACrD,wBAAoB,eAAe,cAAc,MAAM;AACvD,QAAI,KAAK,2BAA2B,SAAS,KAAK,kBAAkB;AAClE,0BAAoB,iBAAiB,KAAK;AAAA,IAC5C,WAAW,KAAK,2BAA2B,SAAS;AAClD,aAAO,oBAAoB;AAAA,IAC7B;AACA,WAAO,oBAAoB;AAC3B,UAAM,aAAa,UAAU,mBAAmB;AAChD,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAEA,SAAS,4BACP,OACA,MAC8B;AAC9B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,EACrD;AACA,MAAI,MAAM,cAAc,KAAK,UAAU;AACrC,UAAM,IAAI,4BAA4B,KAAK,OAAO;AAAA,EACpD;AACA,MACE,OAAO,UAAU,eAAe,KAAK,MAAM,0BAA0B,MACpE,MAAM,kBAAkB,UAAU,KAAK,0BACxC;AACA,UAAM,IAAI,4BAA4B,KAAK,OAAO;AAAA,EACpD;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,MAAM,uCAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,YAAY,yBAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,CAAC,qBAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,WAAO,gBAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,MAAM,eAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,eAAe,kBAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}

package/dist/lib/core/AgentClient.d.mts CHANGED Viewed

@@ -1,6 +1,6 @@
 import type { Client as MCPClient } from '@modelcontextprotocol/sdk/client/index.js';
 import type { AgentConfig } from '../types/index.mjs';
-import type { MCPWebhookPayload, GetBrandIdentityRequest, GetBrandIdentityResponse, ContextMatchRequest, ContextMatchResponse, IdentityMatchRequest, IdentityMatchResponse } from '../types/core.generated.mjs';
+import type { MCPWebhookPayload, GetBrandIdentityRequest, GetBrandIdentityResponse, ContextMatchRequest, ContextMatchResponse, IdentityMatchRequest, IdentityMatchResponseRouterPublisher } from '../types/core.generated.mjs';
 import type { Task as A2ATask, TaskStatusUpdateEvent } from '@a2a-js/sdk';
 import { type CanonicalReadTaskOptions, type CreativeDeliveryTaskOptions, type SingleAgentClientConfig, type SyncCreativesTaskOptions, type VerifyAndParseWebhookOptions, type WebhookParseResult } from './SingleAgentClient.mjs';
 import type { InputHandler, TaskOptions, TaskResult, TaskInfo, Message } from './ConversationTypes.mjs';
@@ -68,7 +68,7 @@ export type TaskResponseTypeMap = {
     report_plan_outcome: ReportPlanOutcomeResponse;
     get_plan_audit_logs: GetPlanAuditLogsResponse;
     context_match: ContextMatchResponse;
-    identity_match: IdentityMatchResponse;
+    identity_match: IdentityMatchResponseRouterPublisher;
 };
 /**
  * Valid ADCP task names