@adcp/sdk 13.0.0-rc.6 → 13.0.0-rc.8

package/dist/lib/auth/oauth/ClientCredentialsFlow.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/ClientCredentialsFlow.ts"],"sourcesContent":["/**\n * OAuth 2.0 client credentials grant — RFC 6749 §4.4.\n *\n * For machine-to-machine use cases (CI compliance runs, automated checks)\n * where there is no user to walk through an authorization-code flow. The\n * client POSTs its ID + secret to the authorization server's token endpoint\n * and gets back an access token directly.\n *\n * This file provides:\n * - {@link exchangeClientCredentials}: one-shot token exchange. Use for the\n *   initial fetch during `--save-auth` and for forced refresh.\n * - {@link ensureClientCredentialsTokens}: reads the cached tokens on an\n *   `AgentConfig`, checks expiry, re-exchanges if needed, and persists the\n *   refreshed tokens via an optional {@link OAuthConfigStorage}.\n *\n * Why a dedicated module instead of the MCP SDK's `OAuthClientProvider`:\n * client credentials doesn't need discovery, dynamic client registration,\n * PKCE, or authorization code exchange — all the plumbing that provider\n * exists to coordinate. A direct token POST and a cached-token check is the\n * entire protocol. The call path keeps using the plain `Authorization:\n * Bearer` header path — the same path it already uses for `auth_token`.\n *\n * **Security note (library consumers):** `token_endpoint` is passed to\n * `fetch` directly. Callers that accept untrusted `AgentConfig` values\n * from network requests (e.g. a hosted compliance service accepting\n * user-supplied configs) MUST validate the URL against an allowlist or\n * SSRF-block private IPs before invoking these helpers. The CLI and\n * operator-driven flows are already trusted.\n */\n\nimport { fromMCPTokens, type OAuthTokens, type AgentConfig, type AgentOAuthTokens } from './types';\nimport type { AgentOAuthClientCredentials } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\nimport { resolveSecret } from './secret-resolver';\nimport { isLikelyPrivateUrl } from '../../net';\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\n\n/** Max length we'll echo from an AS-supplied error description into errors. */\nconst MAX_AS_ERROR_LENGTH = 200;\n\n/**\n * Raised when the authorization server rejects a client credentials\n * exchange or the token endpoint is unreachable/malformed.\n *\n * The {@link kind} discriminator lets callers branch without\n * string-matching on the message:\n * - `oauth`: the AS returned a structured OAuth error (RFC 6749 §5.2 —\n *   `invalid_client`, `invalid_grant`, `invalid_scope`, …). Read\n *   {@link oauthError} / {@link oauthErrorDescription}.\n * - `malformed`: the AS returned HTTP 200 but no `access_token`, or a\n *   non-JSON body.\n * - `network`: the exchange never reached the AS (DNS failure, connection\n *   refused, timeout, TLS error).\n */\nexport class ClientCredentialsExchangeError extends Error {\n  readonly code = 'client_credentials_exchange_failed';\n  constructor(\n    message: string,\n    public readonly kind: 'oauth' | 'malformed' | 'network',\n    public readonly oauthError?: string,\n    public readonly oauthErrorDescription?: string,\n    public readonly httpStatus?: number\n  ) {\n    super(message);\n    this.name = 'ClientCredentialsExchangeError';\n  }\n}\n\n/**\n * Options for {@link exchangeClientCredentials}.\n */\nexport interface ExchangeClientCredentialsOptions {\n  /**\n   * Custom fetch implementation (default: global `fetch`).\n   * Primarily a testing hook — lets unit tests stub the authorization server\n   * without intercepting the global.\n   */\n  fetch?: typeof fetch;\n  /**\n   * Request timeout in milliseconds (default: 30_000). Guards against a\n   * silently hung authorization server blocking the caller indefinitely.\n   */\n  timeoutMs?: number;\n  /**\n   * Allow `token_endpoint` to resolve to a private / loopback IP address.\n   * Default: false (SSRF guard). The CLI opts in because the operator is\n   * explicitly configuring the endpoint; hosted consumers accepting\n   * user-supplied configs should leave this off.\n   */\n  allowPrivateIp?: boolean;\n}\n\n/**\n * RFC 6749 §2.3.1 application/x-www-form-urlencoded encoding.\n *\n * Differs from `encodeURIComponent` in two important ways:\n * 1. Spaces are encoded as `+`, not `%20`.\n * 2. The characters `!'()*` are percent-encoded (URI component leaves them\n *    alone).\n *\n * A secret containing any of those chars would hash to a different Basic\n * string than the AS computes, producing a spurious `invalid_client`.\n */\nfunction formUrlEncode(value: string): string {\n  return encodeURIComponent(value)\n    .replace(/%20/g, '+')\n    .replace(/!/g, '%21')\n    .replace(/'/g, '%27')\n    .replace(/\\(/g, '%28')\n    .replace(/\\)/g, '%29')\n    .replace(/\\*/g, '%2A');\n}\n\n/**\n * Strip control chars (C0, C1, DEL) and truncate.\n *\n * Defensive cleanup on AS-controlled strings we print to a TTY. A\n * malicious or compromised AS could emit ANSI escape sequences or CRLF\n * payloads in `error_description`; we don't want those rewriting terminal\n * titles or forging log lines.\n */\nfunction sanitizeAsMessage(raw: string): string {\n  // eslint-disable-next-line no-control-regex\n  const stripped = raw.replace(/[\\x00-\\x1F\\x7F-\\x9F]/g, ' ');\n  if (stripped.length <= MAX_AS_ERROR_LENGTH) return stripped;\n  return stripped.slice(0, MAX_AS_ERROR_LENGTH) + '…';\n}\n\n/**\n * Validate the token endpoint before we hit it. Three checks, in order:\n *\n * 1. Parse as a URL. Unparseable → `malformed`.\n * 2. Reject URLs that carry `user:pass@` userinfo — they'd leak via error\n *    messages and log aggregators, and the OAuth client credentials live\n *    in `client_id` / `client_secret`, never the URL.\n * 3. Reject plaintext `http://` outside `localhost` / loopback IPs.\n *    RFC 6749 §3.1 requires TLS; the loopback carve-out covers local dev\n *    authorization servers where plaintext is not a leak risk.\n * 4. Reject private / loopback / link-local IPs unless `allowPrivateIp`.\n *    The library default is a SSRF guard; the CLI (operator-driven) opts\n *    in because a user pointing at `localhost:8080` is legitimate. Network\n *    code behind this call will still do DNS resolution, so this is a\n *    best-effort literal-IP / known-loopback check — host allowlisting\n *    upstream is the right control for adversarial environments.\n */\nfunction validateTokenEndpoint(tokenEndpoint: string, options: { allowPrivateIp?: boolean } = {}): URL {\n  let url: URL;\n  try {\n    url = new URL(tokenEndpoint);\n  } catch {\n    throw new ClientCredentialsExchangeError(`Invalid token_endpoint URL: ${tokenEndpoint}`, 'malformed');\n  }\n\n  if (url.username || url.password) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must not contain userinfo (user:pass@). Put credentials in client_id / client_secret instead.`,\n      'malformed'\n    );\n  }\n\n  const host = url.hostname;\n  const isLoopback = host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';\n\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must be HTTPS (got ${url.protocol}//${host}). The client secret would be sent in plaintext over HTTP. Use https:// (or http://localhost for local dev).`,\n      'malformed'\n    );\n  }\n\n  if (!options.allowPrivateIp && isLikelyPrivateUrl(tokenEndpoint)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint resolves to a private or loopback address (${host}). Pass { allowPrivateIp: true } to exchangeClientCredentials / ensureClientCredentialsTokens if this is intentional (operator-driven CLI or local test setups).`,\n      'malformed'\n    );\n  }\n\n  return url;\n}\n\n/**\n * Exchange client credentials for an access token.\n *\n * Secret values in `credentials.client_id` / `client_secret` may be `$ENV:VAR`\n * references — they are resolved here at exchange time. Missing env vars\n * surface as `MissingEnvSecretError` (from `secret-resolver`), which\n * callers typically print with the variable name for the user to fix.\n *\n * @throws {ClientCredentialsExchangeError} on any non-2xx response, malformed 200, or network failure\n * @throws {MissingEnvSecretError} if a `$ENV:VAR` ref points at an unset var\n */\nexport async function exchangeClientCredentials(\n  credentials: AgentOAuthClientCredentials,\n  options: ExchangeClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  // Wrap with the response-size-limit guard so a hostile token endpoint\n  // can't buffer-bomb on every refresh. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const fetchImpl = wrapFetchWithSizeLimit(options.fetch ?? fetch);\n  const timeoutMs = options.timeoutMs ?? 30_000;\n\n  validateTokenEndpoint(credentials.token_endpoint, { allowPrivateIp: options.allowPrivateIp });\n\n  const clientId = resolveSecret(credentials.client_id);\n  const clientSecret = resolveSecret(credentials.client_secret);\n  const authMethod = credentials.auth_method ?? 'basic';\n\n  const body = new URLSearchParams();\n  body.set('grant_type', 'client_credentials');\n  if (credentials.scope) {\n    body.set('scope', credentials.scope);\n  }\n  // RFC 8707 resource indicators — emitted as one `resource` field per URI\n  // so the AS receives the full list. URLSearchParams#append is the only\n  // way to produce repeated keys in form encoding.\n  if (credentials.resource) {\n    const resources = Array.isArray(credentials.resource) ? credentials.resource : [credentials.resource];\n    for (const r of resources) body.append('resource', r);\n  }\n  if (credentials.audience) {\n    body.set('audience', credentials.audience);\n  }\n\n  const headers: Record<string, string> = {\n    'content-type': 'application/x-www-form-urlencoded',\n    accept: 'application/json',\n  };\n\n  if (authMethod === 'basic') {\n    // RFC 6749 §2.3.1: form-urlencode ID/secret before base64 (NOT URI\n    // component encoding — space is `+`, and `!'()*` must be percent-\n    // encoded). Most deployed servers accept raw values too, but spec\n    // compliance avoids a footgun with secrets containing those chars.\n    const encoded = Buffer.from(`${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`, 'utf-8').toString(\n      'base64'\n    );\n    headers.authorization = `Basic ${encoded}`;\n  } else {\n    body.set('client_id', clientId);\n    body.set('client_secret', clientSecret);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), timeoutMs);\n\n  let response: Response;\n  try {\n    response = await fetchImpl(credentials.token_endpoint, {\n      method: 'POST',\n      headers,\n      body: body.toString(),\n      signal: controller.signal,\n    });\n  } catch (err) {\n    if ((err as { name?: string }).name === 'AbortError') {\n      throw new ClientCredentialsExchangeError(\n        `Token endpoint ${credentials.token_endpoint} did not respond within ${timeoutMs}ms.`,\n        'network'\n      );\n    }\n    throw new ClientCredentialsExchangeError(\n      `Failed to reach token endpoint ${credentials.token_endpoint}: ${(err as Error).message}`,\n      'network'\n    );\n  } finally {\n    clearTimeout(timeout);\n  }\n\n  const bodyText = await response.text();\n  let parsed: Record<string, unknown> | undefined;\n  try {\n    parsed = bodyText ? (JSON.parse(bodyText) as Record<string, unknown>) : undefined;\n  } catch {\n    // Non-JSON response; parsed stays undefined, handled below.\n  }\n\n  if (!response.ok) {\n    const rawOauthError = typeof parsed?.error === 'string' ? parsed.error : undefined;\n    const rawOauthDesc = typeof parsed?.error_description === 'string' ? parsed.error_description : undefined;\n    const oauthError = rawOauthError ? sanitizeAsMessage(rawOauthError) : undefined;\n    const oauthDesc = rawOauthDesc ? sanitizeAsMessage(rawOauthDesc) : undefined;\n    const message =\n      oauthError || oauthDesc\n        ? `Client credentials exchange failed: ${oauthError ?? 'error'}${oauthDesc ? ` — ${oauthDesc}` : ''}`\n        : `Client credentials exchange failed with HTTP ${response.status}: ${sanitizeAsMessage(bodyText) || '(empty body)'}`;\n    const kind = rawOauthError ? 'oauth' : 'malformed';\n    throw new ClientCredentialsExchangeError(message, kind, oauthError, oauthDesc, response.status);\n  }\n\n  if (!parsed || typeof parsed.access_token !== 'string') {\n    throw new ClientCredentialsExchangeError(\n      `Token endpoint returned HTTP ${response.status} but no access_token. Body: ${sanitizeAsMessage(bodyText)}`,\n      'malformed',\n      undefined,\n      undefined,\n      response.status\n    );\n  }\n\n  return fromMCPTokens(parsed as unknown as OAuthTokens);\n}\n\n/**\n * Options for {@link ensureClientCredentialsTokens}.\n */\nexport interface EnsureClientCredentialsOptions extends ExchangeClientCredentialsOptions {\n  /**\n   * Storage backend used to persist refreshed tokens. Optional — if omitted,\n   * tokens are only mutated on the in-memory `agent` object and the caller\n   * is responsible for persisting.\n   */\n  storage?: OAuthConfigStorage;\n  /**\n   * Force a re-exchange even if the cached token looks valid. Useful after a\n   * 401 in case the authorization server rotated something out-of-band.\n   */\n  force?: boolean;\n  /**\n   * Expiration skew (ms). Treat the token as expired this many milliseconds\n   * before its nominal `expires_at` — protects against clock skew and\n   * in-flight requests. Default: 60_000 (1 minute). The interactive auth\n   * code flow uses 5 minutes; client credentials refresh is cheap (single\n   * POST) so the shorter window is fine here.\n   */\n  expirationSkewMs?: number;\n}\n\n/**\n * In-flight refresh coalescing map. Keyed by the tuple\n * `(agent.id, token_endpoint, client_id)` — concurrent\n * `ensureClientCredentialsTokens` calls for the same credentials share a\n * single token POST instead of each racing to exchange the same secret.\n *\n * Two different `AgentConfig` objects that accidentally reuse the same\n * `id` (e.g. two tenants both creating `cli-agent`) but hold different\n * credentials won't cross-contaminate — the endpoint + client_id in the\n * key keeps them distinct.\n *\n * Cleared on completion regardless of success/failure.\n *\n * Note: this is an in-process map. Multi-process deployments (worker\n * pools, multiple CLI invocations, horizontally scaled Node servers)\n * don't coalesce across workers — each process will do its own refresh.\n * For the CLI this is fine; for high-throughput server deployments,\n * coalesce upstream at the storage layer.\n */\nconst inFlightRefresh = new Map<string, Promise<AgentOAuthTokens>>();\n\n/**\n * Compute the coalesce key for `ensureClientCredentialsTokens`. `force: true`\n * uses a distinct bucket so a 401-triggered forced refresh never piggybacks\n * on a still-pending non-forced exchange — the whole point of forcing is\n * that the in-flight token is *known* stale, so awaiting it would defeat\n * the retry.\n */\nfunction coalesceKeyFor(agent: AgentConfig, credentials: AgentOAuthClientCredentials, force: boolean): string {\n  return `${force ? 'force' : 'normal'}\\u0000${agent.id}\\u0000${credentials.token_endpoint}\\u0000${credentials.client_id}`;\n}\n\n/**\n * Ensure an agent has a valid access token, refreshing via client credentials\n * if the cached one is missing or expired. Idempotent and safe to call\n * before every request.\n *\n * Concurrent calls for the same `agent.id` are coalesced into a single\n * token POST via an in-process promise map — the common case of a\n * storyboard fan-out firing 10 tool calls in parallel does one refresh,\n * not ten.\n *\n * **Mutation:** this function writes `agent.oauth_tokens` in place. That is\n * the contract the MCP SDK's `OAuthClientProvider` pattern also uses, and\n * it lets the CLI's file-backed storage see the same object. Callers that\n * share an `AgentConfig` across different logical agents must copy first.\n *\n * Precondition: `agent.oauth_client_credentials` must be set. Throws a plain\n * Error if not — callers are expected to branch on its presence before\n * calling this.\n */\nexport async function ensureClientCredentialsTokens(\n  agent: AgentConfig,\n  options: EnsureClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  if (!agent.oauth_client_credentials) {\n    throw new Error(\n      `ensureClientCredentialsTokens called for agent '${agent.id}' with no oauth_client_credentials configured.`\n    );\n  }\n\n  const skew = options.expirationSkewMs ?? 60_000;\n  const cached = agent.oauth_tokens;\n  const cachedIsValid =\n    !options.force &&\n    cached?.access_token &&\n    (!cached.expires_at || new Date(cached.expires_at).getTime() - Date.now() > skew);\n\n  if (cachedIsValid) {\n    return cached!;\n  }\n\n  const coalesceKey = coalesceKeyFor(agent, agent.oauth_client_credentials, options.force === true);\n  const existing = inFlightRefresh.get(coalesceKey);\n  if (existing) {\n    const tokens = await existing;\n    agent.oauth_tokens = tokens;\n    return tokens;\n  }\n\n  const exchange = (async () => {\n    try {\n      const tokens = await exchangeClientCredentials(agent.oauth_client_credentials!, {\n        fetch: options.fetch,\n        timeoutMs: options.timeoutMs,\n        allowPrivateIp: options.allowPrivateIp,\n      });\n      agent.oauth_tokens = tokens;\n      if (options.storage) {\n        await options.storage.saveAgent(agent);\n      }\n      return tokens;\n    } finally {\n      inFlightRefresh.delete(coalesceKey);\n    }\n  })();\n\n  inFlightRefresh.set(coalesceKey, exchange);\n  return exchange;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BA,mBAAyF;AAGzF,6BAA8B;AAC9B,iBAAmC;AACnC,+BAAuC;AAGvC,MAAM,sBAAsB;AAgBrB,MAAM,uCAAuC,MAAM;AAAA,EAExD,YACE,SACgB,MACA,YACA,uBACA,YAChB;AACA,UAAM,OAAO;AALG;AACA;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAPkB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANT,OAAO;AAWlB;AAqCA,SAAS,cAAc,OAAuB;AAC5C,SAAO,mBAAmB,KAAK,EAC5B,QAAQ,QAAQ,GAAG,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAUA,SAAS,kBAAkB,KAAqB;AAE9C,QAAM,WAAW,IAAI,QAAQ,yBAAyB,GAAG;AACzD,MAAI,SAAS,UAAU,oBAAqB,QAAO;AACnD,SAAO,SAAS,MAAM,GAAG,mBAAmB,IAAI;AAClD;AAmBA,SAAS,sBAAsB,eAAuB,UAAwC,CAAC,GAAQ;AACrG,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,aAAa;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,+BAA+B,+BAA+B,aAAa,IAAI,WAAW;AAAA,EACtG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,IAAI;AACjB,QAAM,aAAa,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AAEhG,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAAa;AAC1E,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI,QAAQ,KAAK,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,sBAAkB,+BAAmB,aAAa,GAAG;AAChE,UAAM,IAAI;AAAA,MACR,6DAA6D,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,0BACpB,aACA,UAA4C,CAAC,GAClB;AAI3B,QAAM,gBAAY,iDAAuB,QAAQ,SAAS,KAAK;AAC/D,QAAM,YAAY,QAAQ,aAAa;AAEvC,wBAAsB,YAAY,gBAAgB,EAAE,gBAAgB,QAAQ,eAAe,CAAC;AAE5F,QAAM,eAAW,sCAAc,YAAY,SAAS;AACpD,QAAM,mBAAe,sCAAc,YAAY,aAAa;AAC5D,QAAM,aAAa,YAAY,eAAe;AAE9C,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,cAAc,oBAAoB;AAC3C,MAAI,YAAY,OAAO;AACrB,SAAK,IAAI,SAAS,YAAY,KAAK;AAAA,EACrC;AAIA,MAAI,YAAY,UAAU;AACxB,UAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,IAAI,YAAY,WAAW,CAAC,YAAY,QAAQ;AACpG,eAAW,KAAK,UAAW,MAAK,OAAO,YAAY,CAAC;AAAA,EACtD;AACA,MAAI,YAAY,UAAU;AACxB,SAAK,IAAI,YAAY,YAAY,QAAQ;AAAA,EAC3C;AAEA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAEA,MAAI,eAAe,SAAS;AAK1B,UAAM,UAAU,OAAO,KAAK,GAAG,cAAc,QAAQ,CAAC,IAAI,cAAc,YAAY,CAAC,IAAI,OAAO,EAAE;AAAA,MAChG;AAAA,IACF;AACA,YAAQ,gBAAgB,SAAS,OAAO;AAAA,EAC1C,OAAO;AACL,SAAK,IAAI,aAAa,QAAQ;AAC9B,SAAK,IAAI,iBAAiB,YAAY;AAAA,EACxC;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAE9D,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,YAAY,gBAAgB;AAAA,MACrD,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,SAAS;AAAA,MACpB,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAK,IAA0B,SAAS,cAAc;AACpD,YAAM,IAAI;AAAA,QACR,kBAAkB,YAAY,cAAc,2BAA2B,SAAS;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,kCAAkC,YAAY,cAAc,KAAM,IAAc,OAAO;AAAA,MACvF;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AAEA,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,MAAI;AACJ,MAAI;AACF,aAAS,WAAY,KAAK,MAAM,QAAQ,IAAgC;AAAA,EAC1E,QAAQ;AAAA,EAER;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACzE,UAAM,eAAe,OAAO,QAAQ,sBAAsB,WAAW,OAAO,oBAAoB;AAChG,UAAM,aAAa,gBAAgB,kBAAkB,aAAa,IAAI;AACtE,UAAM,YAAY,eAAe,kBAAkB,YAAY,IAAI;AACnE,UAAM,UACJ,cAAc,YACV,uCAAuC,cAAc,OAAO,GAAG,YAAY,WAAM,SAAS,KAAK,EAAE,KACjG,gDAAgD,SAAS,MAAM,KAAK,kBAAkB,QAAQ,KAAK,cAAc;AACvH,UAAM,OAAO,gBAAgB,UAAU;AACvC,UAAM,IAAI,+BAA+B,SAAS,MAAM,YAAY,WAAW,SAAS,MAAM;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,OAAO,OAAO,iBAAiB,UAAU;AACtD,UAAM,IAAI;AAAA,MACR,gCAAgC,SAAS,MAAM,+BAA+B,kBAAkB,QAAQ,CAAC;AAAA,MACzG;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AAEA,aAAO,4BAAc,MAAgC;AACvD;AA8CA,MAAM,kBAAkB,oBAAI,IAAuC;AASnE,SAAS,eAAe,OAAoB,aAA0C,OAAwB;AAC5G,SAAO,GAAG,QAAQ,UAAU,QAAQ,KAAS,MAAM,EAAE,KAAS,YAAY,cAAc,KAAS,YAAY,SAAS;AACxH;AAqBA,eAAsB,8BACpB,OACA,UAA0C,CAAC,GAChB;AAC3B,MAAI,CAAC,MAAM,0BAA0B;AACnC,UAAM,IAAI;AAAA,MACR,mDAAmD,MAAM,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,oBAAoB;AACzC,QAAM,SAAS,MAAM;AACrB,QAAM,gBACJ,CAAC,QAAQ,SACT,QAAQ,iBACP,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI,IAAI;AAE9E,MAAI,eAAe;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,eAAe,OAAO,MAAM,0BAA0B,QAAQ,UAAU,IAAI;AAChG,QAAM,WAAW,gBAAgB,IAAI,WAAW;AAChD,MAAI,UAAU;AACZ,UAAM,SAAS,MAAM;AACrB,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,YAAY;AAC5B,QAAI;AACF,YAAM,SAAS,MAAM,0BAA0B,MAAM,0BAA2B;AAAA,QAC9E,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AACD,YAAM,eAAe;AACrB,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,QAAQ,UAAU,KAAK;AAAA,MACvC;AACA,aAAO;AAAA,IACT,UAAE;AACA,sBAAgB,OAAO,WAAW;AAAA,IACpC;AAAA,EACF,GAAG;AAEH,kBAAgB,IAAI,aAAa,QAAQ;AACzC,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/ClientCredentialsFlow.ts"],"sourcesContent":["/**\n * OAuth 2.0 client credentials grant — RFC 6749 §4.4.\n *\n * For machine-to-machine use cases (CI compliance runs, automated checks)\n * where there is no user to walk through an authorization-code flow. The\n * client POSTs its ID + secret to the authorization server's token endpoint\n * and gets back an access token directly.\n *\n * This file provides:\n * - {@link exchangeClientCredentials}: one-shot token exchange. Use for the\n *   initial fetch during `--save-auth` and for forced refresh.\n * - {@link ensureClientCredentialsTokens}: reads the cached tokens on an\n *   `AgentConfig`, checks expiry, re-exchanges if needed, and persists the\n *   refreshed tokens via an optional {@link OAuthConfigStorage}.\n *\n * Why a dedicated module instead of the MCP SDK's `OAuthClientProvider`:\n * client credentials doesn't need discovery, dynamic client registration,\n * PKCE, or authorization code exchange — all the plumbing that provider\n * exists to coordinate. A direct token POST and a cached-token check is the\n * entire protocol. The call path keeps using the plain `Authorization:\n * Bearer` header path — the same path it already uses for `auth_token`.\n *\n * **Security note (library consumers):** `token_endpoint` is passed to\n * `fetch` directly. Callers that accept untrusted `AgentConfig` values\n * from network requests (e.g. a hosted compliance service accepting\n * user-supplied configs) MUST validate the URL against an allowlist or\n * SSRF-block private IPs before invoking these helpers. The CLI and\n * operator-driven flows are already trusted.\n */\n\nimport { fromMCPTokens, type OAuthTokens, type AgentConfig, type AgentOAuthTokens } from './types';\nimport type { AgentOAuthClientCredentials } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\nimport { resolveSecret } from './secret-resolver';\nimport { isLikelyPrivateUrl } from '../../net';\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\nimport { createAbortError, throwIfAborted, withAbortSignal } from '../../protocols/abort';\n\n/** Max length we'll echo from an AS-supplied error description into errors. */\nconst MAX_AS_ERROR_LENGTH = 200;\n\n/**\n * Raised when the authorization server rejects a client credentials\n * exchange or the token endpoint is unreachable/malformed.\n *\n * The {@link kind} discriminator lets callers branch without\n * string-matching on the message:\n * - `oauth`: the AS returned a structured OAuth error (RFC 6749 §5.2 —\n *   `invalid_client`, `invalid_grant`, `invalid_scope`, …). Read\n *   {@link oauthError} / {@link oauthErrorDescription}.\n * - `malformed`: the AS returned HTTP 200 but no `access_token`, or a\n *   non-JSON body.\n * - `network`: the exchange never reached the AS (DNS failure, connection\n *   refused, timeout, TLS error).\n */\nexport class ClientCredentialsExchangeError extends Error {\n  readonly code = 'client_credentials_exchange_failed';\n  constructor(\n    message: string,\n    public readonly kind: 'oauth' | 'malformed' | 'network',\n    public readonly oauthError?: string,\n    public readonly oauthErrorDescription?: string,\n    public readonly httpStatus?: number\n  ) {\n    super(message);\n    this.name = 'ClientCredentialsExchangeError';\n  }\n}\n\n/**\n * Options for {@link exchangeClientCredentials}.\n */\nexport interface ExchangeClientCredentialsOptions {\n  /**\n   * Custom fetch implementation (default: global `fetch`).\n   * Primarily a testing hook — lets unit tests stub the authorization server\n   * without intercepting the global.\n   */\n  fetch?: typeof fetch;\n  /**\n   * Request timeout in milliseconds (default: 30_000). Guards against a\n   * silently hung authorization server blocking the caller indefinitely.\n   */\n  timeoutMs?: number;\n  /**\n   * Allow `token_endpoint` to resolve to a private / loopback IP address.\n   * Default: false (SSRF guard). The CLI opts in because the operator is\n   * explicitly configuring the endpoint; hosted consumers accepting\n   * user-supplied configs should leave this off.\n   */\n  allowPrivateIp?: boolean;\n  /** Caller-owned cancellation signal, composed with `timeoutMs`. */\n  signal?: AbortSignal;\n}\n\n/**\n * RFC 6749 §2.3.1 application/x-www-form-urlencoded encoding.\n *\n * Differs from `encodeURIComponent` in two important ways:\n * 1. Spaces are encoded as `+`, not `%20`.\n * 2. The characters `!'()*` are percent-encoded (URI component leaves them\n *    alone).\n *\n * A secret containing any of those chars would hash to a different Basic\n * string than the AS computes, producing a spurious `invalid_client`.\n */\nfunction formUrlEncode(value: string): string {\n  return encodeURIComponent(value)\n    .replace(/%20/g, '+')\n    .replace(/!/g, '%21')\n    .replace(/'/g, '%27')\n    .replace(/\\(/g, '%28')\n    .replace(/\\)/g, '%29')\n    .replace(/\\*/g, '%2A');\n}\n\n/**\n * Strip control chars (C0, C1, DEL) and truncate.\n *\n * Defensive cleanup on AS-controlled strings we print to a TTY. A\n * malicious or compromised AS could emit ANSI escape sequences or CRLF\n * payloads in `error_description`; we don't want those rewriting terminal\n * titles or forging log lines.\n */\nfunction sanitizeAsMessage(raw: string): string {\n  // eslint-disable-next-line no-control-regex\n  const stripped = raw.replace(/[\\x00-\\x1F\\x7F-\\x9F]/g, ' ');\n  if (stripped.length <= MAX_AS_ERROR_LENGTH) return stripped;\n  return stripped.slice(0, MAX_AS_ERROR_LENGTH) + '…';\n}\n\n/**\n * Validate the token endpoint before we hit it. Three checks, in order:\n *\n * 1. Parse as a URL. Unparseable → `malformed`.\n * 2. Reject URLs that carry `user:pass@` userinfo — they'd leak via error\n *    messages and log aggregators, and the OAuth client credentials live\n *    in `client_id` / `client_secret`, never the URL.\n * 3. Reject plaintext `http://` outside `localhost` / loopback IPs.\n *    RFC 6749 §3.1 requires TLS; the loopback carve-out covers local dev\n *    authorization servers where plaintext is not a leak risk.\n * 4. Reject private / loopback / link-local IPs unless `allowPrivateIp`.\n *    The library default is a SSRF guard; the CLI (operator-driven) opts\n *    in because a user pointing at `localhost:8080` is legitimate. Network\n *    code behind this call will still do DNS resolution, so this is a\n *    best-effort literal-IP / known-loopback check — host allowlisting\n *    upstream is the right control for adversarial environments.\n */\nfunction validateTokenEndpoint(tokenEndpoint: string, options: { allowPrivateIp?: boolean } = {}): URL {\n  let url: URL;\n  try {\n    url = new URL(tokenEndpoint);\n  } catch {\n    throw new ClientCredentialsExchangeError(`Invalid token_endpoint URL: ${tokenEndpoint}`, 'malformed');\n  }\n\n  if (url.username || url.password) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must not contain userinfo (user:pass@). Put credentials in client_id / client_secret instead.`,\n      'malformed'\n    );\n  }\n\n  const host = url.hostname;\n  const isLoopback = host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';\n\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must be HTTPS (got ${url.protocol}//${host}). The client secret would be sent in plaintext over HTTP. Use https:// (or http://localhost for local dev).`,\n      'malformed'\n    );\n  }\n\n  if (!options.allowPrivateIp && isLikelyPrivateUrl(tokenEndpoint)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint resolves to a private or loopback address (${host}). Pass { allowPrivateIp: true } to exchangeClientCredentials / ensureClientCredentialsTokens if this is intentional (operator-driven CLI or local test setups).`,\n      'malformed'\n    );\n  }\n\n  return url;\n}\n\n/**\n * Exchange client credentials for an access token.\n *\n * Secret values in `credentials.client_id` / `client_secret` may be `$ENV:VAR`\n * references — they are resolved here at exchange time. Missing env vars\n * surface as `MissingEnvSecretError` (from `secret-resolver`), which\n * callers typically print with the variable name for the user to fix.\n *\n * @throws {ClientCredentialsExchangeError} on any non-2xx response, malformed 200, or network failure\n * @throws {MissingEnvSecretError} if a `$ENV:VAR` ref points at an unset var\n */\nexport async function exchangeClientCredentials(\n  credentials: AgentOAuthClientCredentials,\n  options: ExchangeClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  throwIfAborted(options.signal);\n\n  // Wrap with the response-size-limit guard so a hostile token endpoint\n  // can't buffer-bomb on every refresh. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const fetchImpl = wrapFetchWithSizeLimit(options.fetch ?? fetch);\n  const timeoutMs = options.timeoutMs ?? 30_000;\n\n  validateTokenEndpoint(credentials.token_endpoint, { allowPrivateIp: options.allowPrivateIp });\n\n  const clientId = resolveSecret(credentials.client_id);\n  const clientSecret = resolveSecret(credentials.client_secret);\n  const authMethod = credentials.auth_method ?? 'basic';\n\n  const body = new URLSearchParams();\n  body.set('grant_type', 'client_credentials');\n  if (credentials.scope) {\n    body.set('scope', credentials.scope);\n  }\n  // RFC 8707 resource indicators — emitted as one `resource` field per URI\n  // so the AS receives the full list. URLSearchParams#append is the only\n  // way to produce repeated keys in form encoding.\n  if (credentials.resource) {\n    const resources = Array.isArray(credentials.resource) ? credentials.resource : [credentials.resource];\n    for (const r of resources) body.append('resource', r);\n  }\n  if (credentials.audience) {\n    body.set('audience', credentials.audience);\n  }\n\n  const headers: Record<string, string> = {\n    'content-type': 'application/x-www-form-urlencoded',\n    accept: 'application/json',\n  };\n\n  if (authMethod === 'basic') {\n    // RFC 6749 §2.3.1: form-urlencode ID/secret before base64 (NOT URI\n    // component encoding — space is `+`, and `!'()*` must be percent-\n    // encoded). Most deployed servers accept raw values too, but spec\n    // compliance avoids a footgun with secrets containing those chars.\n    const encoded = Buffer.from(`${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`, 'utf-8').toString(\n      'base64'\n    );\n    headers.authorization = `Basic ${encoded}`;\n  } else {\n    body.set('client_id', clientId);\n    body.set('client_secret', clientSecret);\n  }\n\n  let response: Response;\n  let bodyText: string;\n  const timeoutError = new Error(`Client credentials exchange timed out after ${timeoutMs}ms`);\n  timeoutError.name = 'TimeoutError';\n  try {\n    ({ response, bodyText } = await withAbortSignal(\n      [options.signal],\n      timeoutMs,\n      async signal => {\n        const tokenResponse = await fetchImpl(credentials.token_endpoint, {\n          method: 'POST',\n          headers,\n          body: body.toString(),\n          signal,\n        });\n        return { response: tokenResponse, bodyText: await tokenResponse.text() };\n      },\n      { timeoutError }\n    ));\n  } catch (err) {\n    if (options.signal?.aborted) {\n      throw createAbortError(options.signal.reason);\n    }\n    if (err === timeoutError) {\n      throw new ClientCredentialsExchangeError(\n        `Token endpoint ${credentials.token_endpoint} did not respond within ${timeoutMs}ms.`,\n        'network'\n      );\n    }\n    throw new ClientCredentialsExchangeError(\n      `Failed to reach token endpoint ${credentials.token_endpoint}: ${(err as Error).message}`,\n      'network'\n    );\n  }\n\n  let parsed: Record<string, unknown> | undefined;\n  try {\n    parsed = bodyText ? (JSON.parse(bodyText) as Record<string, unknown>) : undefined;\n  } catch {\n    // Non-JSON response; parsed stays undefined, handled below.\n  }\n\n  if (!response.ok) {\n    const rawOauthError = typeof parsed?.error === 'string' ? parsed.error : undefined;\n    const rawOauthDesc = typeof parsed?.error_description === 'string' ? parsed.error_description : undefined;\n    const oauthError = rawOauthError ? sanitizeAsMessage(rawOauthError) : undefined;\n    const oauthDesc = rawOauthDesc ? sanitizeAsMessage(rawOauthDesc) : undefined;\n    const message =\n      oauthError || oauthDesc\n        ? `Client credentials exchange failed: ${oauthError ?? 'error'}${oauthDesc ? ` — ${oauthDesc}` : ''}`\n        : `Client credentials exchange failed with HTTP ${response.status}: ${sanitizeAsMessage(bodyText) || '(empty body)'}`;\n    const kind = rawOauthError ? 'oauth' : 'malformed';\n    throw new ClientCredentialsExchangeError(message, kind, oauthError, oauthDesc, response.status);\n  }\n\n  if (!parsed || typeof parsed.access_token !== 'string') {\n    throw new ClientCredentialsExchangeError(\n      `Token endpoint returned HTTP ${response.status} but no access_token. Body: ${sanitizeAsMessage(bodyText)}`,\n      'malformed',\n      undefined,\n      undefined,\n      response.status\n    );\n  }\n\n  return fromMCPTokens(parsed as unknown as OAuthTokens);\n}\n\n/**\n * Options for {@link ensureClientCredentialsTokens}.\n */\nexport interface EnsureClientCredentialsOptions extends ExchangeClientCredentialsOptions {\n  /**\n   * Storage backend used to persist refreshed tokens. Optional — if omitted,\n   * tokens are only mutated on the in-memory `agent` object and the caller\n   * is responsible for persisting.\n   */\n  storage?: OAuthConfigStorage;\n  /**\n   * Force a re-exchange even if the cached token looks valid. Useful after a\n   * 401 in case the authorization server rotated something out-of-band.\n   */\n  force?: boolean;\n  /**\n   * Expiration skew (ms). Treat the token as expired this many milliseconds\n   * before its nominal `expires_at` — protects against clock skew and\n   * in-flight requests. Default: 60_000 (1 minute). The interactive auth\n   * code flow uses 5 minutes; client credentials refresh is cheap (single\n   * POST) so the shorter window is fine here.\n   */\n  expirationSkewMs?: number;\n}\n\n/**\n * In-flight refresh coalescing map. Scoped by `AgentConfig` object identity\n * so only callers deliberately sharing one configuration can share a bearer.\n * A string key built from public OAuth fields is insufficient here: two\n * tenants can reuse an agent id, endpoint, and client id while differing in\n * secret, scope, audience, or resource.\n *\n * Cleared on completion regardless of success/failure.\n *\n * Note: this is an in-process map. Multi-process deployments (worker\n * pools, multiple CLI invocations, horizontally scaled Node servers)\n * don't coalesce across workers — each process will do its own refresh.\n * For the CLI this is fine; for high-throughput server deployments,\n * coalesce upstream at the storage layer.\n */\ninterface InFlightRefresh {\n  promise: Promise<AgentOAuthTokens>;\n  controller: AbortController;\n  waiters: number;\n  settled: boolean;\n}\n\ntype RefreshMode = 'normal' | 'force';\n\nconst inFlightRefresh = new WeakMap<AgentConfig, Map<RefreshMode, InFlightRefresh>>();\n\nasync function waitForRefresh(entry: InFlightRefresh, signal?: AbortSignal): Promise<AgentOAuthTokens> {\n  if (signal?.aborted) throw createAbortError(signal.reason);\n  entry.waiters += 1;\n  let abortListener: (() => void) | undefined;\n  try {\n    if (!signal) return await entry.promise;\n    const aborted = new Promise<never>((_resolve, reject) => {\n      abortListener = () => reject(createAbortError(signal.reason));\n      signal.addEventListener('abort', abortListener, { once: true });\n    });\n    return await Promise.race([entry.promise, aborted]);\n  } finally {\n    if (abortListener && signal) signal.removeEventListener('abort', abortListener);\n    entry.waiters -= 1;\n    if (entry.waiters === 0 && !entry.settled && !entry.controller.signal.aborted) {\n      entry.controller.abort(createAbortError(signal?.reason ?? 'No callers remain for token refresh'));\n    }\n  }\n}\n\n/**\n * Ensure an agent has a valid access token, refreshing via client credentials\n * if the cached one is missing or expired. Idempotent and safe to call\n * before every request.\n *\n * Concurrent calls for the same `agent.id` are coalesced into a single\n * token POST via an in-process promise map — the common case of a\n * storyboard fan-out firing 10 tool calls in parallel does one refresh,\n * not ten.\n *\n * **Mutation:** this function writes `agent.oauth_tokens` in place. That is\n * the contract the MCP SDK's `OAuthClientProvider` pattern also uses, and\n * it lets the CLI's file-backed storage see the same object. Callers that\n * share an `AgentConfig` across different logical agents must copy first.\n *\n * Precondition: `agent.oauth_client_credentials` must be set. Throws a plain\n * Error if not — callers are expected to branch on its presence before\n * calling this.\n */\nexport async function ensureClientCredentialsTokens(\n  agent: AgentConfig,\n  options: EnsureClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  throwIfAborted(options.signal);\n\n  if (!agent.oauth_client_credentials) {\n    throw new Error(\n      `ensureClientCredentialsTokens called for agent '${agent.id}' with no oauth_client_credentials configured.`\n    );\n  }\n\n  const skew = options.expirationSkewMs ?? 60_000;\n  const cached = agent.oauth_tokens;\n  const cachedIsValid =\n    !options.force &&\n    cached?.access_token &&\n    (!cached.expires_at || new Date(cached.expires_at).getTime() - Date.now() > skew);\n\n  if (cachedIsValid) {\n    return cached!;\n  }\n\n  const refreshMode: RefreshMode = options.force ? 'force' : 'normal';\n  let agentRefreshes = inFlightRefresh.get(agent);\n  const existing = agentRefreshes?.get(refreshMode);\n  if (existing && !existing.controller.signal.aborted) {\n    const tokens = await waitForRefresh(existing, options.signal);\n    agent.oauth_tokens = tokens;\n    return tokens;\n  }\n\n  const controller = new AbortController();\n  const entry: InFlightRefresh = {\n    promise: undefined as unknown as Promise<AgentOAuthTokens>,\n    controller,\n    waiters: 0,\n    settled: false,\n  };\n  if (!agentRefreshes) {\n    agentRefreshes = new Map();\n    inFlightRefresh.set(agent, agentRefreshes);\n  }\n  entry.promise = (async () => {\n    try {\n      const tokens = await exchangeClientCredentials(agent.oauth_client_credentials!, {\n        fetch: options.fetch,\n        timeoutMs: options.timeoutMs,\n        allowPrivateIp: options.allowPrivateIp,\n        signal: controller.signal,\n      });\n      agent.oauth_tokens = tokens;\n      if (options.storage) {\n        await options.storage.saveAgent(agent);\n      }\n      return tokens;\n    } finally {\n      entry.settled = true;\n      if (agentRefreshes?.get(refreshMode) === entry) {\n        agentRefreshes.delete(refreshMode);\n        if (agentRefreshes.size === 0) inFlightRefresh.delete(agent);\n      }\n    }\n  })();\n\n  agentRefreshes.set(refreshMode, entry);\n  return waitForRefresh(entry, options.signal);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BA,mBAAyF;AAGzF,6BAA8B;AAC9B,iBAAmC;AACnC,+BAAuC;AACvC,mBAAkE;AAGlE,MAAM,sBAAsB;AAgBrB,MAAM,uCAAuC,MAAM;AAAA,EAExD,YACE,SACgB,MACA,YACA,uBACA,YAChB;AACA,UAAM,OAAO;AALG;AACA;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAPkB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANT,OAAO;AAWlB;AAuCA,SAAS,cAAc,OAAuB;AAC5C,SAAO,mBAAmB,KAAK,EAC5B,QAAQ,QAAQ,GAAG,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAUA,SAAS,kBAAkB,KAAqB;AAE9C,QAAM,WAAW,IAAI,QAAQ,yBAAyB,GAAG;AACzD,MAAI,SAAS,UAAU,oBAAqB,QAAO;AACnD,SAAO,SAAS,MAAM,GAAG,mBAAmB,IAAI;AAClD;AAmBA,SAAS,sBAAsB,eAAuB,UAAwC,CAAC,GAAQ;AACrG,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,aAAa;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,+BAA+B,+BAA+B,aAAa,IAAI,WAAW;AAAA,EACtG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,IAAI;AACjB,QAAM,aAAa,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AAEhG,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAAa;AAC1E,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI,QAAQ,KAAK,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,sBAAkB,+BAAmB,aAAa,GAAG;AAChE,UAAM,IAAI;AAAA,MACR,6DAA6D,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,0BACpB,aACA,UAA4C,CAAC,GAClB;AAC3B,mCAAe,QAAQ,MAAM;AAK7B,QAAM,gBAAY,iDAAuB,QAAQ,SAAS,KAAK;AAC/D,QAAM,YAAY,QAAQ,aAAa;AAEvC,wBAAsB,YAAY,gBAAgB,EAAE,gBAAgB,QAAQ,eAAe,CAAC;AAE5F,QAAM,eAAW,sCAAc,YAAY,SAAS;AACpD,QAAM,mBAAe,sCAAc,YAAY,aAAa;AAC5D,QAAM,aAAa,YAAY,eAAe;AAE9C,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,cAAc,oBAAoB;AAC3C,MAAI,YAAY,OAAO;AACrB,SAAK,IAAI,SAAS,YAAY,KAAK;AAAA,EACrC;AAIA,MAAI,YAAY,UAAU;AACxB,UAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,IAAI,YAAY,WAAW,CAAC,YAAY,QAAQ;AACpG,eAAW,KAAK,UAAW,MAAK,OAAO,YAAY,CAAC;AAAA,EACtD;AACA,MAAI,YAAY,UAAU;AACxB,SAAK,IAAI,YAAY,YAAY,QAAQ;AAAA,EAC3C;AAEA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAEA,MAAI,eAAe,SAAS;AAK1B,UAAM,UAAU,OAAO,KAAK,GAAG,cAAc,QAAQ,CAAC,IAAI,cAAc,YAAY,CAAC,IAAI,OAAO,EAAE;AAAA,MAChG;AAAA,IACF;AACA,YAAQ,gBAAgB,SAAS,OAAO;AAAA,EAC1C,OAAO;AACL,SAAK,IAAI,aAAa,QAAQ;AAC9B,SAAK,IAAI,iBAAiB,YAAY;AAAA,EACxC;AAEA,MAAI;AACJ,MAAI;AACJ,QAAM,eAAe,IAAI,MAAM,+CAA+C,SAAS,IAAI;AAC3F,eAAa,OAAO;AACpB,MAAI;AACF,KAAC,EAAE,UAAU,SAAS,IAAI,UAAM;AAAA,MAC9B,CAAC,QAAQ,MAAM;AAAA,MACf;AAAA,MACA,OAAM,WAAU;AACd,cAAM,gBAAgB,MAAM,UAAU,YAAY,gBAAgB;AAAA,UAChE,QAAQ;AAAA,UACR;AAAA,UACA,MAAM,KAAK,SAAS;AAAA,UACpB;AAAA,QACF,CAAC;AACD,eAAO,EAAE,UAAU,eAAe,UAAU,MAAM,cAAc,KAAK,EAAE;AAAA,MACzE;AAAA,MACA,EAAE,aAAa;AAAA,IACjB;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,QAAQ,QAAQ,SAAS;AAC3B,gBAAM,+BAAiB,QAAQ,OAAO,MAAM;AAAA,IAC9C;AACA,QAAI,QAAQ,cAAc;AACxB,YAAM,IAAI;AAAA,QACR,kBAAkB,YAAY,cAAc,2BAA2B,SAAS;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,kCAAkC,YAAY,cAAc,KAAM,IAAc,OAAO;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,WAAY,KAAK,MAAM,QAAQ,IAAgC;AAAA,EAC1E,QAAQ;AAAA,EAER;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACzE,UAAM,eAAe,OAAO,QAAQ,sBAAsB,WAAW,OAAO,oBAAoB;AAChG,UAAM,aAAa,gBAAgB,kBAAkB,aAAa,IAAI;AACtE,UAAM,YAAY,eAAe,kBAAkB,YAAY,IAAI;AACnE,UAAM,UACJ,cAAc,YACV,uCAAuC,cAAc,OAAO,GAAG,YAAY,WAAM,SAAS,KAAK,EAAE,KACjG,gDAAgD,SAAS,MAAM,KAAK,kBAAkB,QAAQ,KAAK,cAAc;AACvH,UAAM,OAAO,gBAAgB,UAAU;AACvC,UAAM,IAAI,+BAA+B,SAAS,MAAM,YAAY,WAAW,SAAS,MAAM;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,OAAO,OAAO,iBAAiB,UAAU;AACtD,UAAM,IAAI;AAAA,MACR,gCAAgC,SAAS,MAAM,+BAA+B,kBAAkB,QAAQ,CAAC;AAAA,MACzG;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AAEA,aAAO,4BAAc,MAAgC;AACvD;AAmDA,MAAM,kBAAkB,oBAAI,QAAwD;AAEpF,eAAe,eAAe,OAAwB,QAAiD;AACrG,MAAI,QAAQ,QAAS,WAAM,+BAAiB,OAAO,MAAM;AACzD,QAAM,WAAW;AACjB,MAAI;AACJ,MAAI;AACF,QAAI,CAAC,OAAQ,QAAO,MAAM,MAAM;AAChC,UAAM,UAAU,IAAI,QAAe,CAAC,UAAU,WAAW;AACvD,sBAAgB,MAAM,WAAO,+BAAiB,OAAO,MAAM,CAAC;AAC5D,aAAO,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;AAAA,IAChE,CAAC;AACD,WAAO,MAAM,QAAQ,KAAK,CAAC,MAAM,SAAS,OAAO,CAAC;AAAA,EACpD,UAAE;AACA,QAAI,iBAAiB,OAAQ,QAAO,oBAAoB,SAAS,aAAa;AAC9E,UAAM,WAAW;AACjB,QAAI,MAAM,YAAY,KAAK,CAAC,MAAM,WAAW,CAAC,MAAM,WAAW,OAAO,SAAS;AAC7E,YAAM,WAAW,UAAM,+BAAiB,QAAQ,UAAU,qCAAqC,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAqBA,eAAsB,8BACpB,OACA,UAA0C,CAAC,GAChB;AAC3B,mCAAe,QAAQ,MAAM;AAE7B,MAAI,CAAC,MAAM,0BAA0B;AACnC,UAAM,IAAI;AAAA,MACR,mDAAmD,MAAM,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,oBAAoB;AACzC,QAAM,SAAS,MAAM;AACrB,QAAM,gBACJ,CAAC,QAAQ,SACT,QAAQ,iBACP,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI,IAAI;AAE9E,MAAI,eAAe;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,cAA2B,QAAQ,QAAQ,UAAU;AAC3D,MAAI,iBAAiB,gBAAgB,IAAI,KAAK;AAC9C,QAAM,WAAW,gBAAgB,IAAI,WAAW;AAChD,MAAI,YAAY,CAAC,SAAS,WAAW,OAAO,SAAS;AACnD,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,MAAM;AAC5D,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAyB;AAAA,IAC7B,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AACA,MAAI,CAAC,gBAAgB;AACnB,qBAAiB,oBAAI,IAAI;AACzB,oBAAgB,IAAI,OAAO,cAAc;AAAA,EAC3C;AACA,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,SAAS,MAAM,0BAA0B,MAAM,0BAA2B;AAAA,QAC9E,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ,WAAW;AAAA,MACrB,CAAC;AACD,YAAM,eAAe;AACrB,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,QAAQ,UAAU,KAAK;AAAA,MACvC;AACA,aAAO;AAAA,IACT,UAAE;AACA,YAAM,UAAU;AAChB,UAAI,gBAAgB,IAAI,WAAW,MAAM,OAAO;AAC9C,uBAAe,OAAO,WAAW;AACjC,YAAI,eAAe,SAAS,EAAG,iBAAgB,OAAO,KAAK;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,GAAG;AAEH,iBAAe,IAAI,aAAa,KAAK;AACrC,SAAO,eAAe,OAAO,QAAQ,MAAM;AAC7C;","names":[]}

package/dist/lib/auth/oauth/ClientCredentialsFlow.mjs

@@ -2,6 +2,7 @@ import { fromMCPTokens } from "./types.mjs";
 import { resolveSecret } from "./secret-resolver.mjs";
 import { isLikelyPrivateUrl } from "../../net/index.mjs";
 import { wrapFetchWithSizeLimit } from "../../protocols/responseSizeLimit.mjs";
+import { createAbortError, throwIfAborted, withAbortSignal } from "../../protocols/abort.mjs";
 const MAX_AS_ERROR_LENGTH = 200;
 class ClientCredentialsExchangeError extends Error {
   constructor(message, kind, oauthError, oauthErrorDescription, httpStatus) {
@@ -56,6 +57,7 @@ function validateTokenEndpoint(tokenEndpoint, options = {}) {
   return url;
 }
 async function exchangeClientCredentials(credentials, options = {}) {
+  throwIfAborted(options.signal);
   const fetchImpl = wrapFetchWithSizeLimit(options.fetch ?? fetch);
   const timeoutMs = options.timeoutMs ?? 3e4;
   validateTokenEndpoint(credentials.token_endpoint, { allowPrivateIp: options.allowPrivateIp });
@@ -87,18 +89,30 @@ async function exchangeClientCredentials(credentials, options = {}) {
     body.set("client_id", clientId);
     body.set("client_secret", clientSecret);
   }
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
   let response;
+  let bodyText;
+  const timeoutError = new Error(`Client credentials exchange timed out after ${timeoutMs}ms`);
+  timeoutError.name = "TimeoutError";
   try {
-    response = await fetchImpl(credentials.token_endpoint, {
-      method: "POST",
-      headers,
-      body: body.toString(),
-      signal: controller.signal
-    });
+    ({ response, bodyText } = await withAbortSignal(
+      [options.signal],
+      timeoutMs,
+      async (signal) => {
+        const tokenResponse = await fetchImpl(credentials.token_endpoint, {
+          method: "POST",
+          headers,
+          body: body.toString(),
+          signal
+        });
+        return { response: tokenResponse, bodyText: await tokenResponse.text() };
+      },
+      { timeoutError }
+    ));
   } catch (err) {
-    if (err.name === "AbortError") {
+    if (options.signal?.aborted) {
+      throw createAbortError(options.signal.reason);
+    }
+    if (err === timeoutError) {
       throw new ClientCredentialsExchangeError(
         `Token endpoint ${credentials.token_endpoint} did not respond within ${timeoutMs}ms.`,
         "network"
@@ -108,10 +122,7 @@ async function exchangeClientCredentials(credentials, options = {}) {
       `Failed to reach token endpoint ${credentials.token_endpoint}: ${err.message}`,
       "network"
     );
-  } finally {
-    clearTimeout(timeout);
   }
-  const bodyText = await response.text();
   let parsed;
   try {
     parsed = bodyText ? JSON.parse(bodyText) : void 0;
@@ -137,11 +148,28 @@ async function exchangeClientCredentials(credentials, options = {}) {
   }
   return fromMCPTokens(parsed);
 }
-const inFlightRefresh = /* @__PURE__ */ new Map();
-function coalesceKeyFor(agent, credentials, force) {
-  return `${force ? "force" : "normal"}\0${agent.id}\0${credentials.token_endpoint}\0${credentials.client_id}`;
+const inFlightRefresh = /* @__PURE__ */ new WeakMap();
+async function waitForRefresh(entry, signal) {
+  if (signal?.aborted) throw createAbortError(signal.reason);
+  entry.waiters += 1;
+  let abortListener;
+  try {
+    if (!signal) return await entry.promise;
+    const aborted = new Promise((_resolve, reject) => {
+      abortListener = () => reject(createAbortError(signal.reason));
+      signal.addEventListener("abort", abortListener, { once: true });
+    });
+    return await Promise.race([entry.promise, aborted]);
+  } finally {
+    if (abortListener && signal) signal.removeEventListener("abort", abortListener);
+    entry.waiters -= 1;
+    if (entry.waiters === 0 && !entry.settled && !entry.controller.signal.aborted) {
+      entry.controller.abort(createAbortError(signal?.reason ?? "No callers remain for token refresh"));
+    }
+  }
 }
 async function ensureClientCredentialsTokens(agent, options = {}) {
+  throwIfAborted(options.signal);
   if (!agent.oauth_client_credentials) {
     throw new Error(
       `ensureClientCredentialsTokens called for agent '${agent.id}' with no oauth_client_credentials configured.`
@@ -153,19 +181,32 @@ async function ensureClientCredentialsTokens(agent, options = {}) {
   if (cachedIsValid) {
     return cached;
   }
-  const coalesceKey = coalesceKeyFor(agent, agent.oauth_client_credentials, options.force === true);
-  const existing = inFlightRefresh.get(coalesceKey);
-  if (existing) {
-    const tokens = await existing;
+  const refreshMode = options.force ? "force" : "normal";
+  let agentRefreshes = inFlightRefresh.get(agent);
+  const existing = agentRefreshes?.get(refreshMode);
+  if (existing && !existing.controller.signal.aborted) {
+    const tokens = await waitForRefresh(existing, options.signal);
     agent.oauth_tokens = tokens;
     return tokens;
   }
-  const exchange = (async () => {
+  const controller = new AbortController();
+  const entry = {
+    promise: void 0,
+    controller,
+    waiters: 0,
+    settled: false
+  };
+  if (!agentRefreshes) {
+    agentRefreshes = /* @__PURE__ */ new Map();
+    inFlightRefresh.set(agent, agentRefreshes);
+  }
+  entry.promise = (async () => {
     try {
       const tokens = await exchangeClientCredentials(agent.oauth_client_credentials, {
         fetch: options.fetch,
         timeoutMs: options.timeoutMs,
-        allowPrivateIp: options.allowPrivateIp
+        allowPrivateIp: options.allowPrivateIp,
+        signal: controller.signal
       });
       agent.oauth_tokens = tokens;
       if (options.storage) {
@@ -173,11 +214,15 @@ async function ensureClientCredentialsTokens(agent, options = {}) {
       }
       return tokens;
     } finally {
-      inFlightRefresh.delete(coalesceKey);
+      entry.settled = true;
+      if (agentRefreshes?.get(refreshMode) === entry) {
+        agentRefreshes.delete(refreshMode);
+        if (agentRefreshes.size === 0) inFlightRefresh.delete(agent);
+      }
     }
   })();
-  inFlightRefresh.set(coalesceKey, exchange);
-  return exchange;
+  agentRefreshes.set(refreshMode, entry);
+  return waitForRefresh(entry, options.signal);
 }
 export {
   ClientCredentialsExchangeError,

package/dist/lib/auth/oauth/ClientCredentialsFlow.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/ClientCredentialsFlow.ts"],"sourcesContent":["/**\n * OAuth 2.0 client credentials grant — RFC 6749 §4.4.\n *\n * For machine-to-machine use cases (CI compliance runs, automated checks)\n * where there is no user to walk through an authorization-code flow. The\n * client POSTs its ID + secret to the authorization server's token endpoint\n * and gets back an access token directly.\n *\n * This file provides:\n * - {@link exchangeClientCredentials}: one-shot token exchange. Use for the\n *   initial fetch during `--save-auth` and for forced refresh.\n * - {@link ensureClientCredentialsTokens}: reads the cached tokens on an\n *   `AgentConfig`, checks expiry, re-exchanges if needed, and persists the\n *   refreshed tokens via an optional {@link OAuthConfigStorage}.\n *\n * Why a dedicated module instead of the MCP SDK's `OAuthClientProvider`:\n * client credentials doesn't need discovery, dynamic client registration,\n * PKCE, or authorization code exchange — all the plumbing that provider\n * exists to coordinate. A direct token POST and a cached-token check is the\n * entire protocol. The call path keeps using the plain `Authorization:\n * Bearer` header path — the same path it already uses for `auth_token`.\n *\n * **Security note (library consumers):** `token_endpoint` is passed to\n * `fetch` directly. Callers that accept untrusted `AgentConfig` values\n * from network requests (e.g. a hosted compliance service accepting\n * user-supplied configs) MUST validate the URL against an allowlist or\n * SSRF-block private IPs before invoking these helpers. The CLI and\n * operator-driven flows are already trusted.\n */\n\nimport { fromMCPTokens, type OAuthTokens, type AgentConfig, type AgentOAuthTokens } from './types';\nimport type { AgentOAuthClientCredentials } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\nimport { resolveSecret } from './secret-resolver';\nimport { isLikelyPrivateUrl } from '../../net';\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\n\n/** Max length we'll echo from an AS-supplied error description into errors. */\nconst MAX_AS_ERROR_LENGTH = 200;\n\n/**\n * Raised when the authorization server rejects a client credentials\n * exchange or the token endpoint is unreachable/malformed.\n *\n * The {@link kind} discriminator lets callers branch without\n * string-matching on the message:\n * - `oauth`: the AS returned a structured OAuth error (RFC 6749 §5.2 —\n *   `invalid_client`, `invalid_grant`, `invalid_scope`, …). Read\n *   {@link oauthError} / {@link oauthErrorDescription}.\n * - `malformed`: the AS returned HTTP 200 but no `access_token`, or a\n *   non-JSON body.\n * - `network`: the exchange never reached the AS (DNS failure, connection\n *   refused, timeout, TLS error).\n */\nexport class ClientCredentialsExchangeError extends Error {\n  readonly code = 'client_credentials_exchange_failed';\n  constructor(\n    message: string,\n    public readonly kind: 'oauth' | 'malformed' | 'network',\n    public readonly oauthError?: string,\n    public readonly oauthErrorDescription?: string,\n    public readonly httpStatus?: number\n  ) {\n    super(message);\n    this.name = 'ClientCredentialsExchangeError';\n  }\n}\n\n/**\n * Options for {@link exchangeClientCredentials}.\n */\nexport interface ExchangeClientCredentialsOptions {\n  /**\n   * Custom fetch implementation (default: global `fetch`).\n   * Primarily a testing hook — lets unit tests stub the authorization server\n   * without intercepting the global.\n   */\n  fetch?: typeof fetch;\n  /**\n   * Request timeout in milliseconds (default: 30_000). Guards against a\n   * silently hung authorization server blocking the caller indefinitely.\n   */\n  timeoutMs?: number;\n  /**\n   * Allow `token_endpoint` to resolve to a private / loopback IP address.\n   * Default: false (SSRF guard). The CLI opts in because the operator is\n   * explicitly configuring the endpoint; hosted consumers accepting\n   * user-supplied configs should leave this off.\n   */\n  allowPrivateIp?: boolean;\n}\n\n/**\n * RFC 6749 §2.3.1 application/x-www-form-urlencoded encoding.\n *\n * Differs from `encodeURIComponent` in two important ways:\n * 1. Spaces are encoded as `+`, not `%20`.\n * 2. The characters `!'()*` are percent-encoded (URI component leaves them\n *    alone).\n *\n * A secret containing any of those chars would hash to a different Basic\n * string than the AS computes, producing a spurious `invalid_client`.\n */\nfunction formUrlEncode(value: string): string {\n  return encodeURIComponent(value)\n    .replace(/%20/g, '+')\n    .replace(/!/g, '%21')\n    .replace(/'/g, '%27')\n    .replace(/\\(/g, '%28')\n    .replace(/\\)/g, '%29')\n    .replace(/\\*/g, '%2A');\n}\n\n/**\n * Strip control chars (C0, C1, DEL) and truncate.\n *\n * Defensive cleanup on AS-controlled strings we print to a TTY. A\n * malicious or compromised AS could emit ANSI escape sequences or CRLF\n * payloads in `error_description`; we don't want those rewriting terminal\n * titles or forging log lines.\n */\nfunction sanitizeAsMessage(raw: string): string {\n  // eslint-disable-next-line no-control-regex\n  const stripped = raw.replace(/[\\x00-\\x1F\\x7F-\\x9F]/g, ' ');\n  if (stripped.length <= MAX_AS_ERROR_LENGTH) return stripped;\n  return stripped.slice(0, MAX_AS_ERROR_LENGTH) + '…';\n}\n\n/**\n * Validate the token endpoint before we hit it. Three checks, in order:\n *\n * 1. Parse as a URL. Unparseable → `malformed`.\n * 2. Reject URLs that carry `user:pass@` userinfo — they'd leak via error\n *    messages and log aggregators, and the OAuth client credentials live\n *    in `client_id` / `client_secret`, never the URL.\n * 3. Reject plaintext `http://` outside `localhost` / loopback IPs.\n *    RFC 6749 §3.1 requires TLS; the loopback carve-out covers local dev\n *    authorization servers where plaintext is not a leak risk.\n * 4. Reject private / loopback / link-local IPs unless `allowPrivateIp`.\n *    The library default is a SSRF guard; the CLI (operator-driven) opts\n *    in because a user pointing at `localhost:8080` is legitimate. Network\n *    code behind this call will still do DNS resolution, so this is a\n *    best-effort literal-IP / known-loopback check — host allowlisting\n *    upstream is the right control for adversarial environments.\n */\nfunction validateTokenEndpoint(tokenEndpoint: string, options: { allowPrivateIp?: boolean } = {}): URL {\n  let url: URL;\n  try {\n    url = new URL(tokenEndpoint);\n  } catch {\n    throw new ClientCredentialsExchangeError(`Invalid token_endpoint URL: ${tokenEndpoint}`, 'malformed');\n  }\n\n  if (url.username || url.password) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must not contain userinfo (user:pass@). Put credentials in client_id / client_secret instead.`,\n      'malformed'\n    );\n  }\n\n  const host = url.hostname;\n  const isLoopback = host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';\n\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must be HTTPS (got ${url.protocol}//${host}). The client secret would be sent in plaintext over HTTP. Use https:// (or http://localhost for local dev).`,\n      'malformed'\n    );\n  }\n\n  if (!options.allowPrivateIp && isLikelyPrivateUrl(tokenEndpoint)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint resolves to a private or loopback address (${host}). Pass { allowPrivateIp: true } to exchangeClientCredentials / ensureClientCredentialsTokens if this is intentional (operator-driven CLI or local test setups).`,\n      'malformed'\n    );\n  }\n\n  return url;\n}\n\n/**\n * Exchange client credentials for an access token.\n *\n * Secret values in `credentials.client_id` / `client_secret` may be `$ENV:VAR`\n * references — they are resolved here at exchange time. Missing env vars\n * surface as `MissingEnvSecretError` (from `secret-resolver`), which\n * callers typically print with the variable name for the user to fix.\n *\n * @throws {ClientCredentialsExchangeError} on any non-2xx response, malformed 200, or network failure\n * @throws {MissingEnvSecretError} if a `$ENV:VAR` ref points at an unset var\n */\nexport async function exchangeClientCredentials(\n  credentials: AgentOAuthClientCredentials,\n  options: ExchangeClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  // Wrap with the response-size-limit guard so a hostile token endpoint\n  // can't buffer-bomb on every refresh. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const fetchImpl = wrapFetchWithSizeLimit(options.fetch ?? fetch);\n  const timeoutMs = options.timeoutMs ?? 30_000;\n\n  validateTokenEndpoint(credentials.token_endpoint, { allowPrivateIp: options.allowPrivateIp });\n\n  const clientId = resolveSecret(credentials.client_id);\n  const clientSecret = resolveSecret(credentials.client_secret);\n  const authMethod = credentials.auth_method ?? 'basic';\n\n  const body = new URLSearchParams();\n  body.set('grant_type', 'client_credentials');\n  if (credentials.scope) {\n    body.set('scope', credentials.scope);\n  }\n  // RFC 8707 resource indicators — emitted as one `resource` field per URI\n  // so the AS receives the full list. URLSearchParams#append is the only\n  // way to produce repeated keys in form encoding.\n  if (credentials.resource) {\n    const resources = Array.isArray(credentials.resource) ? credentials.resource : [credentials.resource];\n    for (const r of resources) body.append('resource', r);\n  }\n  if (credentials.audience) {\n    body.set('audience', credentials.audience);\n  }\n\n  const headers: Record<string, string> = {\n    'content-type': 'application/x-www-form-urlencoded',\n    accept: 'application/json',\n  };\n\n  if (authMethod === 'basic') {\n    // RFC 6749 §2.3.1: form-urlencode ID/secret before base64 (NOT URI\n    // component encoding — space is `+`, and `!'()*` must be percent-\n    // encoded). Most deployed servers accept raw values too, but spec\n    // compliance avoids a footgun with secrets containing those chars.\n    const encoded = Buffer.from(`${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`, 'utf-8').toString(\n      'base64'\n    );\n    headers.authorization = `Basic ${encoded}`;\n  } else {\n    body.set('client_id', clientId);\n    body.set('client_secret', clientSecret);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), timeoutMs);\n\n  let response: Response;\n  try {\n    response = await fetchImpl(credentials.token_endpoint, {\n      method: 'POST',\n      headers,\n      body: body.toString(),\n      signal: controller.signal,\n    });\n  } catch (err) {\n    if ((err as { name?: string }).name === 'AbortError') {\n      throw new ClientCredentialsExchangeError(\n        `Token endpoint ${credentials.token_endpoint} did not respond within ${timeoutMs}ms.`,\n        'network'\n      );\n    }\n    throw new ClientCredentialsExchangeError(\n      `Failed to reach token endpoint ${credentials.token_endpoint}: ${(err as Error).message}`,\n      'network'\n    );\n  } finally {\n    clearTimeout(timeout);\n  }\n\n  const bodyText = await response.text();\n  let parsed: Record<string, unknown> | undefined;\n  try {\n    parsed = bodyText ? (JSON.parse(bodyText) as Record<string, unknown>) : undefined;\n  } catch {\n    // Non-JSON response; parsed stays undefined, handled below.\n  }\n\n  if (!response.ok) {\n    const rawOauthError = typeof parsed?.error === 'string' ? parsed.error : undefined;\n    const rawOauthDesc = typeof parsed?.error_description === 'string' ? parsed.error_description : undefined;\n    const oauthError = rawOauthError ? sanitizeAsMessage(rawOauthError) : undefined;\n    const oauthDesc = rawOauthDesc ? sanitizeAsMessage(rawOauthDesc) : undefined;\n    const message =\n      oauthError || oauthDesc\n        ? `Client credentials exchange failed: ${oauthError ?? 'error'}${oauthDesc ? ` — ${oauthDesc}` : ''}`\n        : `Client credentials exchange failed with HTTP ${response.status}: ${sanitizeAsMessage(bodyText) || '(empty body)'}`;\n    const kind = rawOauthError ? 'oauth' : 'malformed';\n    throw new ClientCredentialsExchangeError(message, kind, oauthError, oauthDesc, response.status);\n  }\n\n  if (!parsed || typeof parsed.access_token !== 'string') {\n    throw new ClientCredentialsExchangeError(\n      `Token endpoint returned HTTP ${response.status} but no access_token. Body: ${sanitizeAsMessage(bodyText)}`,\n      'malformed',\n      undefined,\n      undefined,\n      response.status\n    );\n  }\n\n  return fromMCPTokens(parsed as unknown as OAuthTokens);\n}\n\n/**\n * Options for {@link ensureClientCredentialsTokens}.\n */\nexport interface EnsureClientCredentialsOptions extends ExchangeClientCredentialsOptions {\n  /**\n   * Storage backend used to persist refreshed tokens. Optional — if omitted,\n   * tokens are only mutated on the in-memory `agent` object and the caller\n   * is responsible for persisting.\n   */\n  storage?: OAuthConfigStorage;\n  /**\n   * Force a re-exchange even if the cached token looks valid. Useful after a\n   * 401 in case the authorization server rotated something out-of-band.\n   */\n  force?: boolean;\n  /**\n   * Expiration skew (ms). Treat the token as expired this many milliseconds\n   * before its nominal `expires_at` — protects against clock skew and\n   * in-flight requests. Default: 60_000 (1 minute). The interactive auth\n   * code flow uses 5 minutes; client credentials refresh is cheap (single\n   * POST) so the shorter window is fine here.\n   */\n  expirationSkewMs?: number;\n}\n\n/**\n * In-flight refresh coalescing map. Keyed by the tuple\n * `(agent.id, token_endpoint, client_id)` — concurrent\n * `ensureClientCredentialsTokens` calls for the same credentials share a\n * single token POST instead of each racing to exchange the same secret.\n *\n * Two different `AgentConfig` objects that accidentally reuse the same\n * `id` (e.g. two tenants both creating `cli-agent`) but hold different\n * credentials won't cross-contaminate — the endpoint + client_id in the\n * key keeps them distinct.\n *\n * Cleared on completion regardless of success/failure.\n *\n * Note: this is an in-process map. Multi-process deployments (worker\n * pools, multiple CLI invocations, horizontally scaled Node servers)\n * don't coalesce across workers — each process will do its own refresh.\n * For the CLI this is fine; for high-throughput server deployments,\n * coalesce upstream at the storage layer.\n */\nconst inFlightRefresh = new Map<string, Promise<AgentOAuthTokens>>();\n\n/**\n * Compute the coalesce key for `ensureClientCredentialsTokens`. `force: true`\n * uses a distinct bucket so a 401-triggered forced refresh never piggybacks\n * on a still-pending non-forced exchange — the whole point of forcing is\n * that the in-flight token is *known* stale, so awaiting it would defeat\n * the retry.\n */\nfunction coalesceKeyFor(agent: AgentConfig, credentials: AgentOAuthClientCredentials, force: boolean): string {\n  return `${force ? 'force' : 'normal'}\\u0000${agent.id}\\u0000${credentials.token_endpoint}\\u0000${credentials.client_id}`;\n}\n\n/**\n * Ensure an agent has a valid access token, refreshing via client credentials\n * if the cached one is missing or expired. Idempotent and safe to call\n * before every request.\n *\n * Concurrent calls for the same `agent.id` are coalesced into a single\n * token POST via an in-process promise map — the common case of a\n * storyboard fan-out firing 10 tool calls in parallel does one refresh,\n * not ten.\n *\n * **Mutation:** this function writes `agent.oauth_tokens` in place. That is\n * the contract the MCP SDK's `OAuthClientProvider` pattern also uses, and\n * it lets the CLI's file-backed storage see the same object. Callers that\n * share an `AgentConfig` across different logical agents must copy first.\n *\n * Precondition: `agent.oauth_client_credentials` must be set. Throws a plain\n * Error if not — callers are expected to branch on its presence before\n * calling this.\n */\nexport async function ensureClientCredentialsTokens(\n  agent: AgentConfig,\n  options: EnsureClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  if (!agent.oauth_client_credentials) {\n    throw new Error(\n      `ensureClientCredentialsTokens called for agent '${agent.id}' with no oauth_client_credentials configured.`\n    );\n  }\n\n  const skew = options.expirationSkewMs ?? 60_000;\n  const cached = agent.oauth_tokens;\n  const cachedIsValid =\n    !options.force &&\n    cached?.access_token &&\n    (!cached.expires_at || new Date(cached.expires_at).getTime() - Date.now() > skew);\n\n  if (cachedIsValid) {\n    return cached!;\n  }\n\n  const coalesceKey = coalesceKeyFor(agent, agent.oauth_client_credentials, options.force === true);\n  const existing = inFlightRefresh.get(coalesceKey);\n  if (existing) {\n    const tokens = await existing;\n    agent.oauth_tokens = tokens;\n    return tokens;\n  }\n\n  const exchange = (async () => {\n    try {\n      const tokens = await exchangeClientCredentials(agent.oauth_client_credentials!, {\n        fetch: options.fetch,\n        timeoutMs: options.timeoutMs,\n        allowPrivateIp: options.allowPrivateIp,\n      });\n      agent.oauth_tokens = tokens;\n      if (options.storage) {\n        await options.storage.saveAgent(agent);\n      }\n      return tokens;\n    } finally {\n      inFlightRefresh.delete(coalesceKey);\n    }\n  })();\n\n  inFlightRefresh.set(coalesceKey, exchange);\n  return exchange;\n}\n"],"mappings":"AA8BA,SAAS,qBAAgF;AAGzF,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,MAAM,sBAAsB;AAgBrB,MAAM,uCAAuC,MAAM;AAAA,EAExD,YACE,SACgB,MACA,YACA,uBACA,YAChB;AACA,UAAM,OAAO;AALG;AACA;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAPkB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANT,OAAO;AAWlB;AAqCA,SAAS,cAAc,OAAuB;AAC5C,SAAO,mBAAmB,KAAK,EAC5B,QAAQ,QAAQ,GAAG,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAUA,SAAS,kBAAkB,KAAqB;AAE9C,QAAM,WAAW,IAAI,QAAQ,yBAAyB,GAAG;AACzD,MAAI,SAAS,UAAU,oBAAqB,QAAO;AACnD,SAAO,SAAS,MAAM,GAAG,mBAAmB,IAAI;AAClD;AAmBA,SAAS,sBAAsB,eAAuB,UAAwC,CAAC,GAAQ;AACrG,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,aAAa;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,+BAA+B,+BAA+B,aAAa,IAAI,WAAW;AAAA,EACtG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,IAAI;AACjB,QAAM,aAAa,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AAEhG,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAAa;AAC1E,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI,QAAQ,KAAK,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,kBAAkB,mBAAmB,aAAa,GAAG;AAChE,UAAM,IAAI;AAAA,MACR,6DAA6D,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,0BACpB,aACA,UAA4C,CAAC,GAClB;AAI3B,QAAM,YAAY,uBAAuB,QAAQ,SAAS,KAAK;AAC/D,QAAM,YAAY,QAAQ,aAAa;AAEvC,wBAAsB,YAAY,gBAAgB,EAAE,gBAAgB,QAAQ,eAAe,CAAC;AAE5F,QAAM,WAAW,cAAc,YAAY,SAAS;AACpD,QAAM,eAAe,cAAc,YAAY,aAAa;AAC5D,QAAM,aAAa,YAAY,eAAe;AAE9C,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,cAAc,oBAAoB;AAC3C,MAAI,YAAY,OAAO;AACrB,SAAK,IAAI,SAAS,YAAY,KAAK;AAAA,EACrC;AAIA,MAAI,YAAY,UAAU;AACxB,UAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,IAAI,YAAY,WAAW,CAAC,YAAY,QAAQ;AACpG,eAAW,KAAK,UAAW,MAAK,OAAO,YAAY,CAAC;AAAA,EACtD;AACA,MAAI,YAAY,UAAU;AACxB,SAAK,IAAI,YAAY,YAAY,QAAQ;AAAA,EAC3C;AAEA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAEA,MAAI,eAAe,SAAS;AAK1B,UAAM,UAAU,OAAO,KAAK,GAAG,cAAc,QAAQ,CAAC,IAAI,cAAc,YAAY,CAAC,IAAI,OAAO,EAAE;AAAA,MAChG;AAAA,IACF;AACA,YAAQ,gBAAgB,SAAS,OAAO;AAAA,EAC1C,OAAO;AACL,SAAK,IAAI,aAAa,QAAQ;AAC9B,SAAK,IAAI,iBAAiB,YAAY;AAAA,EACxC;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAE9D,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,YAAY,gBAAgB;AAAA,MACrD,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,SAAS;AAAA,MACpB,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAK,IAA0B,SAAS,cAAc;AACpD,YAAM,IAAI;AAAA,QACR,kBAAkB,YAAY,cAAc,2BAA2B,SAAS;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,kCAAkC,YAAY,cAAc,KAAM,IAAc,OAAO;AAAA,MACvF;AAAA,IACF;AAAA,EACF,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AAEA,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,MAAI;AACJ,MAAI;AACF,aAAS,WAAY,KAAK,MAAM,QAAQ,IAAgC;AAAA,EAC1E,QAAQ;AAAA,EAER;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACzE,UAAM,eAAe,OAAO,QAAQ,sBAAsB,WAAW,OAAO,oBAAoB;AAChG,UAAM,aAAa,gBAAgB,kBAAkB,aAAa,IAAI;AACtE,UAAM,YAAY,eAAe,kBAAkB,YAAY,IAAI;AACnE,UAAM,UACJ,cAAc,YACV,uCAAuC,cAAc,OAAO,GAAG,YAAY,WAAM,SAAS,KAAK,EAAE,KACjG,gDAAgD,SAAS,MAAM,KAAK,kBAAkB,QAAQ,KAAK,cAAc;AACvH,UAAM,OAAO,gBAAgB,UAAU;AACvC,UAAM,IAAI,+BAA+B,SAAS,MAAM,YAAY,WAAW,SAAS,MAAM;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,OAAO,OAAO,iBAAiB,UAAU;AACtD,UAAM,IAAI;AAAA,MACR,gCAAgC,SAAS,MAAM,+BAA+B,kBAAkB,QAAQ,CAAC;AAAA,MACzG;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AAEA,SAAO,cAAc,MAAgC;AACvD;AA8CA,MAAM,kBAAkB,oBAAI,IAAuC;AASnE,SAAS,eAAe,OAAoB,aAA0C,OAAwB;AAC5G,SAAO,GAAG,QAAQ,UAAU,QAAQ,KAAS,MAAM,EAAE,KAAS,YAAY,cAAc,KAAS,YAAY,SAAS;AACxH;AAqBA,eAAsB,8BACpB,OACA,UAA0C,CAAC,GAChB;AAC3B,MAAI,CAAC,MAAM,0BAA0B;AACnC,UAAM,IAAI;AAAA,MACR,mDAAmD,MAAM,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,oBAAoB;AACzC,QAAM,SAAS,MAAM;AACrB,QAAM,gBACJ,CAAC,QAAQ,SACT,QAAQ,iBACP,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI,IAAI;AAE9E,MAAI,eAAe;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,eAAe,OAAO,MAAM,0BAA0B,QAAQ,UAAU,IAAI;AAChG,QAAM,WAAW,gBAAgB,IAAI,WAAW;AAChD,MAAI,UAAU;AACZ,UAAM,SAAS,MAAM;AACrB,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,YAAY;AAC5B,QAAI;AACF,YAAM,SAAS,MAAM,0BAA0B,MAAM,0BAA2B;AAAA,QAC9E,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AACD,YAAM,eAAe;AACrB,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,QAAQ,UAAU,KAAK;AAAA,MACvC;AACA,aAAO;AAAA,IACT,UAAE;AACA,sBAAgB,OAAO,WAAW;AAAA,IACpC;AAAA,EACF,GAAG;AAEH,kBAAgB,IAAI,aAAa,QAAQ;AACzC,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/ClientCredentialsFlow.ts"],"sourcesContent":["/**\n * OAuth 2.0 client credentials grant — RFC 6749 §4.4.\n *\n * For machine-to-machine use cases (CI compliance runs, automated checks)\n * where there is no user to walk through an authorization-code flow. The\n * client POSTs its ID + secret to the authorization server's token endpoint\n * and gets back an access token directly.\n *\n * This file provides:\n * - {@link exchangeClientCredentials}: one-shot token exchange. Use for the\n *   initial fetch during `--save-auth` and for forced refresh.\n * - {@link ensureClientCredentialsTokens}: reads the cached tokens on an\n *   `AgentConfig`, checks expiry, re-exchanges if needed, and persists the\n *   refreshed tokens via an optional {@link OAuthConfigStorage}.\n *\n * Why a dedicated module instead of the MCP SDK's `OAuthClientProvider`:\n * client credentials doesn't need discovery, dynamic client registration,\n * PKCE, or authorization code exchange — all the plumbing that provider\n * exists to coordinate. A direct token POST and a cached-token check is the\n * entire protocol. The call path keeps using the plain `Authorization:\n * Bearer` header path — the same path it already uses for `auth_token`.\n *\n * **Security note (library consumers):** `token_endpoint` is passed to\n * `fetch` directly. Callers that accept untrusted `AgentConfig` values\n * from network requests (e.g. a hosted compliance service accepting\n * user-supplied configs) MUST validate the URL against an allowlist or\n * SSRF-block private IPs before invoking these helpers. The CLI and\n * operator-driven flows are already trusted.\n */\n\nimport { fromMCPTokens, type OAuthTokens, type AgentConfig, type AgentOAuthTokens } from './types';\nimport type { AgentOAuthClientCredentials } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\nimport { resolveSecret } from './secret-resolver';\nimport { isLikelyPrivateUrl } from '../../net';\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\nimport { createAbortError, throwIfAborted, withAbortSignal } from '../../protocols/abort';\n\n/** Max length we'll echo from an AS-supplied error description into errors. */\nconst MAX_AS_ERROR_LENGTH = 200;\n\n/**\n * Raised when the authorization server rejects a client credentials\n * exchange or the token endpoint is unreachable/malformed.\n *\n * The {@link kind} discriminator lets callers branch without\n * string-matching on the message:\n * - `oauth`: the AS returned a structured OAuth error (RFC 6749 §5.2 —\n *   `invalid_client`, `invalid_grant`, `invalid_scope`, …). Read\n *   {@link oauthError} / {@link oauthErrorDescription}.\n * - `malformed`: the AS returned HTTP 200 but no `access_token`, or a\n *   non-JSON body.\n * - `network`: the exchange never reached the AS (DNS failure, connection\n *   refused, timeout, TLS error).\n */\nexport class ClientCredentialsExchangeError extends Error {\n  readonly code = 'client_credentials_exchange_failed';\n  constructor(\n    message: string,\n    public readonly kind: 'oauth' | 'malformed' | 'network',\n    public readonly oauthError?: string,\n    public readonly oauthErrorDescription?: string,\n    public readonly httpStatus?: number\n  ) {\n    super(message);\n    this.name = 'ClientCredentialsExchangeError';\n  }\n}\n\n/**\n * Options for {@link exchangeClientCredentials}.\n */\nexport interface ExchangeClientCredentialsOptions {\n  /**\n   * Custom fetch implementation (default: global `fetch`).\n   * Primarily a testing hook — lets unit tests stub the authorization server\n   * without intercepting the global.\n   */\n  fetch?: typeof fetch;\n  /**\n   * Request timeout in milliseconds (default: 30_000). Guards against a\n   * silently hung authorization server blocking the caller indefinitely.\n   */\n  timeoutMs?: number;\n  /**\n   * Allow `token_endpoint` to resolve to a private / loopback IP address.\n   * Default: false (SSRF guard). The CLI opts in because the operator is\n   * explicitly configuring the endpoint; hosted consumers accepting\n   * user-supplied configs should leave this off.\n   */\n  allowPrivateIp?: boolean;\n  /** Caller-owned cancellation signal, composed with `timeoutMs`. */\n  signal?: AbortSignal;\n}\n\n/**\n * RFC 6749 §2.3.1 application/x-www-form-urlencoded encoding.\n *\n * Differs from `encodeURIComponent` in two important ways:\n * 1. Spaces are encoded as `+`, not `%20`.\n * 2. The characters `!'()*` are percent-encoded (URI component leaves them\n *    alone).\n *\n * A secret containing any of those chars would hash to a different Basic\n * string than the AS computes, producing a spurious `invalid_client`.\n */\nfunction formUrlEncode(value: string): string {\n  return encodeURIComponent(value)\n    .replace(/%20/g, '+')\n    .replace(/!/g, '%21')\n    .replace(/'/g, '%27')\n    .replace(/\\(/g, '%28')\n    .replace(/\\)/g, '%29')\n    .replace(/\\*/g, '%2A');\n}\n\n/**\n * Strip control chars (C0, C1, DEL) and truncate.\n *\n * Defensive cleanup on AS-controlled strings we print to a TTY. A\n * malicious or compromised AS could emit ANSI escape sequences or CRLF\n * payloads in `error_description`; we don't want those rewriting terminal\n * titles or forging log lines.\n */\nfunction sanitizeAsMessage(raw: string): string {\n  // eslint-disable-next-line no-control-regex\n  const stripped = raw.replace(/[\\x00-\\x1F\\x7F-\\x9F]/g, ' ');\n  if (stripped.length <= MAX_AS_ERROR_LENGTH) return stripped;\n  return stripped.slice(0, MAX_AS_ERROR_LENGTH) + '…';\n}\n\n/**\n * Validate the token endpoint before we hit it. Three checks, in order:\n *\n * 1. Parse as a URL. Unparseable → `malformed`.\n * 2. Reject URLs that carry `user:pass@` userinfo — they'd leak via error\n *    messages and log aggregators, and the OAuth client credentials live\n *    in `client_id` / `client_secret`, never the URL.\n * 3. Reject plaintext `http://` outside `localhost` / loopback IPs.\n *    RFC 6749 §3.1 requires TLS; the loopback carve-out covers local dev\n *    authorization servers where plaintext is not a leak risk.\n * 4. Reject private / loopback / link-local IPs unless `allowPrivateIp`.\n *    The library default is a SSRF guard; the CLI (operator-driven) opts\n *    in because a user pointing at `localhost:8080` is legitimate. Network\n *    code behind this call will still do DNS resolution, so this is a\n *    best-effort literal-IP / known-loopback check — host allowlisting\n *    upstream is the right control for adversarial environments.\n */\nfunction validateTokenEndpoint(tokenEndpoint: string, options: { allowPrivateIp?: boolean } = {}): URL {\n  let url: URL;\n  try {\n    url = new URL(tokenEndpoint);\n  } catch {\n    throw new ClientCredentialsExchangeError(`Invalid token_endpoint URL: ${tokenEndpoint}`, 'malformed');\n  }\n\n  if (url.username || url.password) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must not contain userinfo (user:pass@). Put credentials in client_id / client_secret instead.`,\n      'malformed'\n    );\n  }\n\n  const host = url.hostname;\n  const isLoopback = host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';\n\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint must be HTTPS (got ${url.protocol}//${host}). The client secret would be sent in plaintext over HTTP. Use https:// (or http://localhost for local dev).`,\n      'malformed'\n    );\n  }\n\n  if (!options.allowPrivateIp && isLikelyPrivateUrl(tokenEndpoint)) {\n    throw new ClientCredentialsExchangeError(\n      `token_endpoint resolves to a private or loopback address (${host}). Pass { allowPrivateIp: true } to exchangeClientCredentials / ensureClientCredentialsTokens if this is intentional (operator-driven CLI or local test setups).`,\n      'malformed'\n    );\n  }\n\n  return url;\n}\n\n/**\n * Exchange client credentials for an access token.\n *\n * Secret values in `credentials.client_id` / `client_secret` may be `$ENV:VAR`\n * references — they are resolved here at exchange time. Missing env vars\n * surface as `MissingEnvSecretError` (from `secret-resolver`), which\n * callers typically print with the variable name for the user to fix.\n *\n * @throws {ClientCredentialsExchangeError} on any non-2xx response, malformed 200, or network failure\n * @throws {MissingEnvSecretError} if a `$ENV:VAR` ref points at an unset var\n */\nexport async function exchangeClientCredentials(\n  credentials: AgentOAuthClientCredentials,\n  options: ExchangeClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  throwIfAborted(options.signal);\n\n  // Wrap with the response-size-limit guard so a hostile token endpoint\n  // can't buffer-bomb on every refresh. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const fetchImpl = wrapFetchWithSizeLimit(options.fetch ?? fetch);\n  const timeoutMs = options.timeoutMs ?? 30_000;\n\n  validateTokenEndpoint(credentials.token_endpoint, { allowPrivateIp: options.allowPrivateIp });\n\n  const clientId = resolveSecret(credentials.client_id);\n  const clientSecret = resolveSecret(credentials.client_secret);\n  const authMethod = credentials.auth_method ?? 'basic';\n\n  const body = new URLSearchParams();\n  body.set('grant_type', 'client_credentials');\n  if (credentials.scope) {\n    body.set('scope', credentials.scope);\n  }\n  // RFC 8707 resource indicators — emitted as one `resource` field per URI\n  // so the AS receives the full list. URLSearchParams#append is the only\n  // way to produce repeated keys in form encoding.\n  if (credentials.resource) {\n    const resources = Array.isArray(credentials.resource) ? credentials.resource : [credentials.resource];\n    for (const r of resources) body.append('resource', r);\n  }\n  if (credentials.audience) {\n    body.set('audience', credentials.audience);\n  }\n\n  const headers: Record<string, string> = {\n    'content-type': 'application/x-www-form-urlencoded',\n    accept: 'application/json',\n  };\n\n  if (authMethod === 'basic') {\n    // RFC 6749 §2.3.1: form-urlencode ID/secret before base64 (NOT URI\n    // component encoding — space is `+`, and `!'()*` must be percent-\n    // encoded). Most deployed servers accept raw values too, but spec\n    // compliance avoids a footgun with secrets containing those chars.\n    const encoded = Buffer.from(`${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`, 'utf-8').toString(\n      'base64'\n    );\n    headers.authorization = `Basic ${encoded}`;\n  } else {\n    body.set('client_id', clientId);\n    body.set('client_secret', clientSecret);\n  }\n\n  let response: Response;\n  let bodyText: string;\n  const timeoutError = new Error(`Client credentials exchange timed out after ${timeoutMs}ms`);\n  timeoutError.name = 'TimeoutError';\n  try {\n    ({ response, bodyText } = await withAbortSignal(\n      [options.signal],\n      timeoutMs,\n      async signal => {\n        const tokenResponse = await fetchImpl(credentials.token_endpoint, {\n          method: 'POST',\n          headers,\n          body: body.toString(),\n          signal,\n        });\n        return { response: tokenResponse, bodyText: await tokenResponse.text() };\n      },\n      { timeoutError }\n    ));\n  } catch (err) {\n    if (options.signal?.aborted) {\n      throw createAbortError(options.signal.reason);\n    }\n    if (err === timeoutError) {\n      throw new ClientCredentialsExchangeError(\n        `Token endpoint ${credentials.token_endpoint} did not respond within ${timeoutMs}ms.`,\n        'network'\n      );\n    }\n    throw new ClientCredentialsExchangeError(\n      `Failed to reach token endpoint ${credentials.token_endpoint}: ${(err as Error).message}`,\n      'network'\n    );\n  }\n\n  let parsed: Record<string, unknown> | undefined;\n  try {\n    parsed = bodyText ? (JSON.parse(bodyText) as Record<string, unknown>) : undefined;\n  } catch {\n    // Non-JSON response; parsed stays undefined, handled below.\n  }\n\n  if (!response.ok) {\n    const rawOauthError = typeof parsed?.error === 'string' ? parsed.error : undefined;\n    const rawOauthDesc = typeof parsed?.error_description === 'string' ? parsed.error_description : undefined;\n    const oauthError = rawOauthError ? sanitizeAsMessage(rawOauthError) : undefined;\n    const oauthDesc = rawOauthDesc ? sanitizeAsMessage(rawOauthDesc) : undefined;\n    const message =\n      oauthError || oauthDesc\n        ? `Client credentials exchange failed: ${oauthError ?? 'error'}${oauthDesc ? ` — ${oauthDesc}` : ''}`\n        : `Client credentials exchange failed with HTTP ${response.status}: ${sanitizeAsMessage(bodyText) || '(empty body)'}`;\n    const kind = rawOauthError ? 'oauth' : 'malformed';\n    throw new ClientCredentialsExchangeError(message, kind, oauthError, oauthDesc, response.status);\n  }\n\n  if (!parsed || typeof parsed.access_token !== 'string') {\n    throw new ClientCredentialsExchangeError(\n      `Token endpoint returned HTTP ${response.status} but no access_token. Body: ${sanitizeAsMessage(bodyText)}`,\n      'malformed',\n      undefined,\n      undefined,\n      response.status\n    );\n  }\n\n  return fromMCPTokens(parsed as unknown as OAuthTokens);\n}\n\n/**\n * Options for {@link ensureClientCredentialsTokens}.\n */\nexport interface EnsureClientCredentialsOptions extends ExchangeClientCredentialsOptions {\n  /**\n   * Storage backend used to persist refreshed tokens. Optional — if omitted,\n   * tokens are only mutated on the in-memory `agent` object and the caller\n   * is responsible for persisting.\n   */\n  storage?: OAuthConfigStorage;\n  /**\n   * Force a re-exchange even if the cached token looks valid. Useful after a\n   * 401 in case the authorization server rotated something out-of-band.\n   */\n  force?: boolean;\n  /**\n   * Expiration skew (ms). Treat the token as expired this many milliseconds\n   * before its nominal `expires_at` — protects against clock skew and\n   * in-flight requests. Default: 60_000 (1 minute). The interactive auth\n   * code flow uses 5 minutes; client credentials refresh is cheap (single\n   * POST) so the shorter window is fine here.\n   */\n  expirationSkewMs?: number;\n}\n\n/**\n * In-flight refresh coalescing map. Scoped by `AgentConfig` object identity\n * so only callers deliberately sharing one configuration can share a bearer.\n * A string key built from public OAuth fields is insufficient here: two\n * tenants can reuse an agent id, endpoint, and client id while differing in\n * secret, scope, audience, or resource.\n *\n * Cleared on completion regardless of success/failure.\n *\n * Note: this is an in-process map. Multi-process deployments (worker\n * pools, multiple CLI invocations, horizontally scaled Node servers)\n * don't coalesce across workers — each process will do its own refresh.\n * For the CLI this is fine; for high-throughput server deployments,\n * coalesce upstream at the storage layer.\n */\ninterface InFlightRefresh {\n  promise: Promise<AgentOAuthTokens>;\n  controller: AbortController;\n  waiters: number;\n  settled: boolean;\n}\n\ntype RefreshMode = 'normal' | 'force';\n\nconst inFlightRefresh = new WeakMap<AgentConfig, Map<RefreshMode, InFlightRefresh>>();\n\nasync function waitForRefresh(entry: InFlightRefresh, signal?: AbortSignal): Promise<AgentOAuthTokens> {\n  if (signal?.aborted) throw createAbortError(signal.reason);\n  entry.waiters += 1;\n  let abortListener: (() => void) | undefined;\n  try {\n    if (!signal) return await entry.promise;\n    const aborted = new Promise<never>((_resolve, reject) => {\n      abortListener = () => reject(createAbortError(signal.reason));\n      signal.addEventListener('abort', abortListener, { once: true });\n    });\n    return await Promise.race([entry.promise, aborted]);\n  } finally {\n    if (abortListener && signal) signal.removeEventListener('abort', abortListener);\n    entry.waiters -= 1;\n    if (entry.waiters === 0 && !entry.settled && !entry.controller.signal.aborted) {\n      entry.controller.abort(createAbortError(signal?.reason ?? 'No callers remain for token refresh'));\n    }\n  }\n}\n\n/**\n * Ensure an agent has a valid access token, refreshing via client credentials\n * if the cached one is missing or expired. Idempotent and safe to call\n * before every request.\n *\n * Concurrent calls for the same `agent.id` are coalesced into a single\n * token POST via an in-process promise map — the common case of a\n * storyboard fan-out firing 10 tool calls in parallel does one refresh,\n * not ten.\n *\n * **Mutation:** this function writes `agent.oauth_tokens` in place. That is\n * the contract the MCP SDK's `OAuthClientProvider` pattern also uses, and\n * it lets the CLI's file-backed storage see the same object. Callers that\n * share an `AgentConfig` across different logical agents must copy first.\n *\n * Precondition: `agent.oauth_client_credentials` must be set. Throws a plain\n * Error if not — callers are expected to branch on its presence before\n * calling this.\n */\nexport async function ensureClientCredentialsTokens(\n  agent: AgentConfig,\n  options: EnsureClientCredentialsOptions = {}\n): Promise<AgentOAuthTokens> {\n  throwIfAborted(options.signal);\n\n  if (!agent.oauth_client_credentials) {\n    throw new Error(\n      `ensureClientCredentialsTokens called for agent '${agent.id}' with no oauth_client_credentials configured.`\n    );\n  }\n\n  const skew = options.expirationSkewMs ?? 60_000;\n  const cached = agent.oauth_tokens;\n  const cachedIsValid =\n    !options.force &&\n    cached?.access_token &&\n    (!cached.expires_at || new Date(cached.expires_at).getTime() - Date.now() > skew);\n\n  if (cachedIsValid) {\n    return cached!;\n  }\n\n  const refreshMode: RefreshMode = options.force ? 'force' : 'normal';\n  let agentRefreshes = inFlightRefresh.get(agent);\n  const existing = agentRefreshes?.get(refreshMode);\n  if (existing && !existing.controller.signal.aborted) {\n    const tokens = await waitForRefresh(existing, options.signal);\n    agent.oauth_tokens = tokens;\n    return tokens;\n  }\n\n  const controller = new AbortController();\n  const entry: InFlightRefresh = {\n    promise: undefined as unknown as Promise<AgentOAuthTokens>,\n    controller,\n    waiters: 0,\n    settled: false,\n  };\n  if (!agentRefreshes) {\n    agentRefreshes = new Map();\n    inFlightRefresh.set(agent, agentRefreshes);\n  }\n  entry.promise = (async () => {\n    try {\n      const tokens = await exchangeClientCredentials(agent.oauth_client_credentials!, {\n        fetch: options.fetch,\n        timeoutMs: options.timeoutMs,\n        allowPrivateIp: options.allowPrivateIp,\n        signal: controller.signal,\n      });\n      agent.oauth_tokens = tokens;\n      if (options.storage) {\n        await options.storage.saveAgent(agent);\n      }\n      return tokens;\n    } finally {\n      entry.settled = true;\n      if (agentRefreshes?.get(refreshMode) === entry) {\n        agentRefreshes.delete(refreshMode);\n        if (agentRefreshes.size === 0) inFlightRefresh.delete(agent);\n      }\n    }\n  })();\n\n  agentRefreshes.set(refreshMode, entry);\n  return waitForRefresh(entry, options.signal);\n}\n"],"mappings":"AA8BA,SAAS,qBAAgF;AAGzF,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,kBAAkB,gBAAgB,uBAAuB;AAGlE,MAAM,sBAAsB;AAgBrB,MAAM,uCAAuC,MAAM;AAAA,EAExD,YACE,SACgB,MACA,YACA,uBACA,YAChB;AACA,UAAM,OAAO;AALG;AACA;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAPkB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANT,OAAO;AAWlB;AAuCA,SAAS,cAAc,OAAuB;AAC5C,SAAO,mBAAmB,KAAK,EAC5B,QAAQ,QAAQ,GAAG,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAUA,SAAS,kBAAkB,KAAqB;AAE9C,QAAM,WAAW,IAAI,QAAQ,yBAAyB,GAAG;AACzD,MAAI,SAAS,UAAU,oBAAqB,QAAO;AACnD,SAAO,SAAS,MAAM,GAAG,mBAAmB,IAAI;AAClD;AAmBA,SAAS,sBAAsB,eAAuB,UAAwC,CAAC,GAAQ;AACrG,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,aAAa;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,+BAA+B,+BAA+B,aAAa,IAAI,WAAW;AAAA,EACtG;AAEA,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,IAAI;AACjB,QAAM,aAAa,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,SAAS;AAEhG,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,aAAa;AAC1E,UAAM,IAAI;AAAA,MACR,qCAAqC,IAAI,QAAQ,KAAK,IAAI;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,kBAAkB,mBAAmB,aAAa,GAAG;AAChE,UAAM,IAAI;AAAA,MACR,6DAA6D,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,0BACpB,aACA,UAA4C,CAAC,GAClB;AAC3B,iBAAe,QAAQ,MAAM;AAK7B,QAAM,YAAY,uBAAuB,QAAQ,SAAS,KAAK;AAC/D,QAAM,YAAY,QAAQ,aAAa;AAEvC,wBAAsB,YAAY,gBAAgB,EAAE,gBAAgB,QAAQ,eAAe,CAAC;AAE5F,QAAM,WAAW,cAAc,YAAY,SAAS;AACpD,QAAM,eAAe,cAAc,YAAY,aAAa;AAC5D,QAAM,aAAa,YAAY,eAAe;AAE9C,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,cAAc,oBAAoB;AAC3C,MAAI,YAAY,OAAO;AACrB,SAAK,IAAI,SAAS,YAAY,KAAK;AAAA,EACrC;AAIA,MAAI,YAAY,UAAU;AACxB,UAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,IAAI,YAAY,WAAW,CAAC,YAAY,QAAQ;AACpG,eAAW,KAAK,UAAW,MAAK,OAAO,YAAY,CAAC;AAAA,EACtD;AACA,MAAI,YAAY,UAAU;AACxB,SAAK,IAAI,YAAY,YAAY,QAAQ;AAAA,EAC3C;AAEA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,QAAQ;AAAA,EACV;AAEA,MAAI,eAAe,SAAS;AAK1B,UAAM,UAAU,OAAO,KAAK,GAAG,cAAc,QAAQ,CAAC,IAAI,cAAc,YAAY,CAAC,IAAI,OAAO,EAAE;AAAA,MAChG;AAAA,IACF;AACA,YAAQ,gBAAgB,SAAS,OAAO;AAAA,EAC1C,OAAO;AACL,SAAK,IAAI,aAAa,QAAQ;AAC9B,SAAK,IAAI,iBAAiB,YAAY;AAAA,EACxC;AAEA,MAAI;AACJ,MAAI;AACJ,QAAM,eAAe,IAAI,MAAM,+CAA+C,SAAS,IAAI;AAC3F,eAAa,OAAO;AACpB,MAAI;AACF,KAAC,EAAE,UAAU,SAAS,IAAI,MAAM;AAAA,MAC9B,CAAC,QAAQ,MAAM;AAAA,MACf;AAAA,MACA,OAAM,WAAU;AACd,cAAM,gBAAgB,MAAM,UAAU,YAAY,gBAAgB;AAAA,UAChE,QAAQ;AAAA,UACR;AAAA,UACA,MAAM,KAAK,SAAS;AAAA,UACpB;AAAA,QACF,CAAC;AACD,eAAO,EAAE,UAAU,eAAe,UAAU,MAAM,cAAc,KAAK,EAAE;AAAA,MACzE;AAAA,MACA,EAAE,aAAa;AAAA,IACjB;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,QAAQ,QAAQ,SAAS;AAC3B,YAAM,iBAAiB,QAAQ,OAAO,MAAM;AAAA,IAC9C;AACA,QAAI,QAAQ,cAAc;AACxB,YAAM,IAAI;AAAA,QACR,kBAAkB,YAAY,cAAc,2BAA2B,SAAS;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,kCAAkC,YAAY,cAAc,KAAM,IAAc,OAAO;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,WAAY,KAAK,MAAM,QAAQ,IAAgC;AAAA,EAC1E,QAAQ;AAAA,EAER;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,gBAAgB,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ;AACzE,UAAM,eAAe,OAAO,QAAQ,sBAAsB,WAAW,OAAO,oBAAoB;AAChG,UAAM,aAAa,gBAAgB,kBAAkB,aAAa,IAAI;AACtE,UAAM,YAAY,eAAe,kBAAkB,YAAY,IAAI;AACnE,UAAM,UACJ,cAAc,YACV,uCAAuC,cAAc,OAAO,GAAG,YAAY,WAAM,SAAS,KAAK,EAAE,KACjG,gDAAgD,SAAS,MAAM,KAAK,kBAAkB,QAAQ,KAAK,cAAc;AACvH,UAAM,OAAO,gBAAgB,UAAU;AACvC,UAAM,IAAI,+BAA+B,SAAS,MAAM,YAAY,WAAW,SAAS,MAAM;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,OAAO,OAAO,iBAAiB,UAAU;AACtD,UAAM,IAAI;AAAA,MACR,gCAAgC,SAAS,MAAM,+BAA+B,kBAAkB,QAAQ,CAAC;AAAA,MACzG;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AAEA,SAAO,cAAc,MAAgC;AACvD;AAmDA,MAAM,kBAAkB,oBAAI,QAAwD;AAEpF,eAAe,eAAe,OAAwB,QAAiD;AACrG,MAAI,QAAQ,QAAS,OAAM,iBAAiB,OAAO,MAAM;AACzD,QAAM,WAAW;AACjB,MAAI;AACJ,MAAI;AACF,QAAI,CAAC,OAAQ,QAAO,MAAM,MAAM;AAChC,UAAM,UAAU,IAAI,QAAe,CAAC,UAAU,WAAW;AACvD,sBAAgB,MAAM,OAAO,iBAAiB,OAAO,MAAM,CAAC;AAC5D,aAAO,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;AAAA,IAChE,CAAC;AACD,WAAO,MAAM,QAAQ,KAAK,CAAC,MAAM,SAAS,OAAO,CAAC;AAAA,EACpD,UAAE;AACA,QAAI,iBAAiB,OAAQ,QAAO,oBAAoB,SAAS,aAAa;AAC9E,UAAM,WAAW;AACjB,QAAI,MAAM,YAAY,KAAK,CAAC,MAAM,WAAW,CAAC,MAAM,WAAW,OAAO,SAAS;AAC7E,YAAM,WAAW,MAAM,iBAAiB,QAAQ,UAAU,qCAAqC,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAqBA,eAAsB,8BACpB,OACA,UAA0C,CAAC,GAChB;AAC3B,iBAAe,QAAQ,MAAM;AAE7B,MAAI,CAAC,MAAM,0BAA0B;AACnC,UAAM,IAAI;AAAA,MACR,mDAAmD,MAAM,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ,oBAAoB;AACzC,QAAM,SAAS,MAAM;AACrB,QAAM,gBACJ,CAAC,QAAQ,SACT,QAAQ,iBACP,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI,IAAI;AAE9E,MAAI,eAAe;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,cAA2B,QAAQ,QAAQ,UAAU;AAC3D,MAAI,iBAAiB,gBAAgB,IAAI,KAAK;AAC9C,QAAM,WAAW,gBAAgB,IAAI,WAAW;AAChD,MAAI,YAAY,CAAC,SAAS,WAAW,OAAO,SAAS;AACnD,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,MAAM;AAC5D,UAAM,eAAe;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAyB;AAAA,IAC7B,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AACA,MAAI,CAAC,gBAAgB;AACnB,qBAAiB,oBAAI,IAAI;AACzB,oBAAgB,IAAI,OAAO,cAAc;AAAA,EAC3C;AACA,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,SAAS,MAAM,0BAA0B,MAAM,0BAA2B;AAAA,QAC9E,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ,WAAW;AAAA,MACrB,CAAC;AACD,YAAM,eAAe;AACrB,UAAI,QAAQ,SAAS;AACnB,cAAM,QAAQ,QAAQ,UAAU,KAAK;AAAA,MACvC;AACA,aAAO;AAAA,IACT,UAAE;AACA,YAAM,UAAU;AAChB,UAAI,gBAAgB,IAAI,WAAW,MAAM,OAAO;AAC9C,uBAAe,OAAO,WAAW;AACjC,YAAI,eAAe,SAAS,EAAG,iBAAgB,OAAO,KAAK;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,GAAG;AAEH,iBAAe,IAAI,aAAa,KAAK;AACrC,SAAO,eAAe,OAAO,QAAQ,MAAM;AAC7C;","names":[]}

package/dist/lib/auth/oauth/MCPOAuthProvider.d.mts

@@ -40,12 +40,14 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     private readonly flowHandler;
     private readonly _clientMetadata;
     private readonly allowHttp;
+    private readonly configuredResourceOverride?;
     constructor(config: OAuthProviderConfig);
     /**
      * Create a provider for CLI usage
      */
     static forCLI(agent: AgentConfig, flowHandler: OAuthFlowHandler, storage?: OAuthConfigStorage, clientMetadataOverrides?: Partial<OAuthClientMetadata>, options?: {
         allowHttp?: boolean;
+        resourceOverride?: string | null;
     }): MCPOAuthProvider;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts

@@ -40,12 +40,14 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     private readonly flowHandler;
     private readonly _clientMetadata;
     private readonly allowHttp;
+    private readonly configuredResourceOverride?;
     constructor(config: OAuthProviderConfig);
     /**
      * Create a provider for CLI usage
      */
     static forCLI(agent: AgentConfig, flowHandler: OAuthFlowHandler, storage?: OAuthConfigStorage, clientMetadataOverrides?: Partial<OAuthClientMetadata>, options?: {
         allowHttp?: boolean;
+        resourceOverride?: string | null;
     }): MCPOAuthProvider;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MCPOAuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACZ,MAAM,SAAS,CAAC;AAIjB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAC1D,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;gBAExB,MAAM,EAAE,mBAAmB;IAQvC;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,EAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EACtD,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,gBAAgB;IAqBnB,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAE9B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAc/F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAI9B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAOtE;;OAEG;IACG,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAOhD;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAUrC;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3F;;OAEG;YACW,YAAY;IAM1B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,cAAc,IAAI,OAAO;IAgBzB;;;OAGG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACH,QAAQ,IAAI,WAAW;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}
+{"version":3,"file":"MCPOAuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACZ,MAAM,SAAS,CAAC;AAKjB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAC1D,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAgB;gBAEhD,MAAM,EAAE,mBAAmB;IASvC;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,EAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EACtD,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAClE,gBAAgB;IAsBnB,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAE9B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAY/F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAI9B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAOtE;;OAEG;IACG,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAOhD;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAUrC;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3F;;OAEG;YACW,YAAY;IAM1B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,cAAc,IAAI,OAAO;IAgBzB;;;OAGG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACH,QAAQ,IAAI,WAAW;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}

package/dist/lib/auth/oauth/MCPOAuthProvider.js

@@ -23,18 +23,21 @@ __export(MCPOAuthProvider_exports, {
 module.exports = __toCommonJS(MCPOAuthProvider_exports);
 var import_types = require('./types.js');
 var import_crypto = require("crypto");
+var import_resource_url = require('./resource-url.js');
 class MCPOAuthProvider {
   agent;
   storage;
   flowHandler;
   _clientMetadata;
   allowHttp;
+  configuredResourceOverride;
   constructor(config) {
     this.agent = config.agent;
     this.storage = config.storage;
     this.flowHandler = config.flowHandler;
     this._clientMetadata = config.clientMetadata;
     this.allowHttp = config.allowHttp === true;
+    this.configuredResourceOverride = config.resourceOverride;
   }
   /**
    * Create a provider for CLI usage
@@ -50,7 +53,8 @@ class MCPOAuthProvider {
       flowHandler,
       storage,
       clientMetadata,
-      allowHttp: options?.allowHttp
+      allowHttp: options?.allowHttp,
+      resourceOverride: options?.resourceOverride
     });
   }
   // ========================================
@@ -76,14 +80,11 @@ class MCPOAuthProvider {
    * mirrors the CLI's `--allow-http` flag.
    */
   async validateResourceURL(serverUrl, resource) {
-    if (!resource) {
+    const selectedResource = this.configuredResourceOverride === null ? resource : this.configuredResourceOverride ?? this.agent.oauth_resource ?? resource;
+    if (!selectedResource) {
       return void 0;
     }
-    const resourceURL = new URL(resource);
-    if (resourceURL.protocol !== "https:" && !this.allowHttp) {
-      throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);
-    }
-    return resourceURL;
+    return (0, import_resource_url.validateOAuthResourceUrl)(selectedResource, { allowHttp: this.allowHttp });
   }
   /**
    * Generate OAuth state parameter

package/dist/lib/auth/oauth/MCPOAuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/**\n * MCP OAuth Provider\n *\n * Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n */\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n  OAuthClientMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthTokens,\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\n\n/**\n * MCP OAuth Client Provider\n *\n * This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // OAuth tokens stored here after auth flow\n *   oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens\n * });\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\nexport class MCPOAuthProvider implements OAuthClientProvider {\n  private agent: AgentConfig;\n  private readonly storage?: OAuthConfigStorage;\n  private readonly flowHandler: OAuthFlowHandler;\n  private readonly _clientMetadata: OAuthClientMetadata;\n  private readonly allowHttp: boolean;\n\n  constructor(config: OAuthProviderConfig) {\n    this.agent = config.agent;\n    this.storage = config.storage;\n    this.flowHandler = config.flowHandler;\n    this._clientMetadata = config.clientMetadata;\n    this.allowHttp = config.allowHttp === true;\n  }\n\n  /**\n   * Create a provider for CLI usage\n   */\n  static forCLI(\n    agent: AgentConfig,\n    flowHandler: OAuthFlowHandler,\n    storage?: OAuthConfigStorage,\n    clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n    options?: { allowHttp?: boolean }\n  ): MCPOAuthProvider {\n    // Build complete client metadata with required fields\n    const clientMetadata: OAuthClientMetadata = {\n      ...DEFAULT_CLIENT_METADATA,\n      redirect_uris: [flowHandler.getRedirectUrl().toString()],\n      ...clientMetadataOverrides,\n    };\n\n    return new MCPOAuthProvider({\n      agent,\n      flowHandler,\n      storage,\n      clientMetadata,\n      allowHttp: options?.allowHttp,\n    });\n  }\n\n  // ========================================\n  // OAuthClientProvider interface\n  // ========================================\n\n  get redirectUrl(): string | URL {\n    return this.flowHandler.getRedirectUrl();\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return this._clientMetadata;\n  }\n\n  /**\n   * Validate the protected resource URL from server metadata (RFC 9728).\n   *\n   * Servers behind reverse proxies or DNS aliases may advertise a canonical\n   * resource URL (RFC 8707) that differs from the URL the client connected to.\n   * We allow cross-origin resource URLs because agent configs are pre-configured\n   * by the user, not discovered from untrusted sources. The authorization server\n   * remains the final gatekeeper for token audience validation.\n   *\n   * Non-HTTPS resource URLs are rejected by default. Construct the provider\n   * with `allowHttp: true` to lift that restriction for local development —\n   * mirrors the CLI's `--allow-http` flag.\n   */\n  async validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined> {\n    if (!resource) {\n      return undefined;\n    }\n\n    const resourceURL = new URL(resource);\n\n    if (resourceURL.protocol !== 'https:' && !this.allowHttp) {\n      throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);\n    }\n\n    return resourceURL;\n  }\n\n  /**\n   * Generate OAuth state parameter\n   */\n  async state(): Promise<string> {\n    return randomBytes(32).toString('base64url');\n  }\n\n  /**\n   * Load client information from agent config\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    if (this.agent.oauth_client) {\n      return toMCPClientInfo(this.agent.oauth_client);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save client information after dynamic registration\n   */\n  async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n    this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n    await this.persistAgent();\n  }\n\n  /**\n   * Load existing tokens from agent config\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    if (this.agent.oauth_tokens) {\n      return toMCPTokens(this.agent.oauth_tokens);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save tokens after authorization\n   * Also cleans up the temporary code verifier\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    this.agent.oauth_tokens = fromMCPTokens(tokens);\n    // Clean up temporary code verifier after successful token exchange\n    delete this.agent.oauth_code_verifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Redirect user to authorization URL\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    await this.flowHandler.redirectToAuthorization(authorizationUrl);\n  }\n\n  /**\n   * Save PKCE code verifier\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    this.agent.oauth_code_verifier = codeVerifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Load PKCE code verifier\n   * The MCP SDK calls saveCodeVerifier() before authorization and\n   * retrieves it here during token exchange.\n   */\n  async codeVerifier(): Promise<string> {\n    if (!this.agent.oauth_code_verifier) {\n      throw new Error(\n        'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n          'the agent config was modified. Please try authenticating again.'\n      );\n    }\n    return this.agent.oauth_code_verifier;\n  }\n\n  /**\n   * Invalidate credentials when server indicates they're invalid\n   */\n  async invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): Promise<void> {\n    switch (scope) {\n      case 'all':\n        delete this.agent.oauth_tokens;\n        delete this.agent.oauth_client;\n        delete this.agent.oauth_code_verifier;\n        break;\n      case 'tokens':\n        delete this.agent.oauth_tokens;\n        break;\n      case 'client':\n        delete this.agent.oauth_client;\n        break;\n      case 'verifier':\n        delete this.agent.oauth_code_verifier;\n        break;\n    }\n    await this.persistAgent();\n  }\n\n  // ========================================\n  // Additional methods\n  // ========================================\n\n  /**\n   * Persist agent config to storage if configured\n   */\n  private async persistAgent(): Promise<void> {\n    if (this.storage) {\n      await this.storage.saveAgent(this.agent);\n    }\n  }\n\n  /**\n   * Wait for the OAuth callback\n   * Call this after UnauthorizedError is thrown\n   */\n  async waitForCallback(): Promise<string> {\n    return this.flowHandler.waitForCallback();\n  }\n\n  /**\n   * Clean up resources\n   */\n  async cleanup(): Promise<void> {\n    await this.flowHandler.cleanup();\n  }\n\n  /**\n   * Check if we have valid, non-expired OAuth tokens\n   * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n   */\n  hasValidTokens(): boolean {\n    const tokens = this.agent.oauth_tokens;\n    if (!tokens?.access_token) return false;\n\n    // Check expiration if available\n    if (tokens.expires_at) {\n      const expiresAt = new Date(tokens.expires_at);\n      // Consider expired if within 5 minutes of expiration\n      if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Check if we have a refresh token available for token refresh\n   * @returns true if refresh_token is present\n   */\n  hasRefreshToken(): boolean {\n    return !!this.agent.oauth_tokens?.refresh_token;\n  }\n\n  /**\n   * Clear all OAuth data for this agent\n   */\n  async clearAuth(): Promise<void> {\n    await this.invalidateCredentials('all');\n  }\n\n  /**\n   * Get the agent config this provider manages\n   * @returns The AgentConfig with OAuth tokens populated after successful auth\n   */\n  getAgent(): AgentConfig {\n    return this.agent;\n  }\n\n  /**\n   * Get the agent identifier\n   * @returns The agent's unique ID\n   */\n  getAgentId(): string {\n    return this.agent.id;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,mBAAwG;AACxG,oBAA4B;AA8BrB,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,QAAI,YAAY,aAAa,YAAY,CAAC,KAAK,WAAW;AACxD,YAAM,IAAI,MAAM,aAAa,SAAS,uCAAuC,QAAQ,EAAE;AAAA,IACzF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,eAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,8BAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,mBAAe,gCAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,0BAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,mBAAe,4BAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"sourcesContent":["/**\n * MCP OAuth Provider\n *\n * Implements the MCP SDK's OAuthClientProvider interface\n * using AgentConfig for token storage.\n */\n\nimport type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';\nimport type {\n  OAuthClientMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthTokens,\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  AgentConfig,\n} from './types';\nimport { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from './types';\nimport { randomBytes } from 'crypto';\nimport { validateOAuthResourceUrl } from './resource-url';\n\n/**\n * MCP OAuth Client Provider\n *\n * This provider stores OAuth tokens directly in the AgentConfig,\n * using the same structure as static auth tokens.\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // OAuth tokens stored here after auth flow\n *   oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens\n * });\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\nexport class MCPOAuthProvider implements OAuthClientProvider {\n  private agent: AgentConfig;\n  private readonly storage?: OAuthConfigStorage;\n  private readonly flowHandler: OAuthFlowHandler;\n  private readonly _clientMetadata: OAuthClientMetadata;\n  private readonly allowHttp: boolean;\n  private readonly configuredResourceOverride?: string | null;\n\n  constructor(config: OAuthProviderConfig) {\n    this.agent = config.agent;\n    this.storage = config.storage;\n    this.flowHandler = config.flowHandler;\n    this._clientMetadata = config.clientMetadata;\n    this.allowHttp = config.allowHttp === true;\n    this.configuredResourceOverride = config.resourceOverride;\n  }\n\n  /**\n   * Create a provider for CLI usage\n   */\n  static forCLI(\n    agent: AgentConfig,\n    flowHandler: OAuthFlowHandler,\n    storage?: OAuthConfigStorage,\n    clientMetadataOverrides?: Partial<OAuthClientMetadata>,\n    options?: { allowHttp?: boolean; resourceOverride?: string | null }\n  ): MCPOAuthProvider {\n    // Build complete client metadata with required fields\n    const clientMetadata: OAuthClientMetadata = {\n      ...DEFAULT_CLIENT_METADATA,\n      redirect_uris: [flowHandler.getRedirectUrl().toString()],\n      ...clientMetadataOverrides,\n    };\n\n    return new MCPOAuthProvider({\n      agent,\n      flowHandler,\n      storage,\n      clientMetadata,\n      allowHttp: options?.allowHttp,\n      resourceOverride: options?.resourceOverride,\n    });\n  }\n\n  // ========================================\n  // OAuthClientProvider interface\n  // ========================================\n\n  get redirectUrl(): string | URL {\n    return this.flowHandler.getRedirectUrl();\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return this._clientMetadata;\n  }\n\n  /**\n   * Validate the protected resource URL from server metadata (RFC 9728).\n   *\n   * Servers behind reverse proxies or DNS aliases may advertise a canonical\n   * resource URL (RFC 8707) that differs from the URL the client connected to.\n   * We allow cross-origin resource URLs because agent configs are pre-configured\n   * by the user, not discovered from untrusted sources. The authorization server\n   * remains the final gatekeeper for token audience validation.\n   *\n   * Non-HTTPS resource URLs are rejected by default. Construct the provider\n   * with `allowHttp: true` to lift that restriction for local development —\n   * mirrors the CLI's `--allow-http` flag.\n   */\n  async validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined> {\n    const selectedResource =\n      this.configuredResourceOverride === null\n        ? resource\n        : (this.configuredResourceOverride ?? this.agent.oauth_resource ?? resource);\n    if (!selectedResource) {\n      return undefined;\n    }\n\n    return validateOAuthResourceUrl(selectedResource, { allowHttp: this.allowHttp });\n  }\n\n  /**\n   * Generate OAuth state parameter\n   */\n  async state(): Promise<string> {\n    return randomBytes(32).toString('base64url');\n  }\n\n  /**\n   * Load client information from agent config\n   */\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    if (this.agent.oauth_client) {\n      return toMCPClientInfo(this.agent.oauth_client);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save client information after dynamic registration\n   */\n  async saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void> {\n    this.agent.oauth_client = fromMCPClientInfo(clientInfo);\n    await this.persistAgent();\n  }\n\n  /**\n   * Load existing tokens from agent config\n   */\n  async tokens(): Promise<OAuthTokens | undefined> {\n    if (this.agent.oauth_tokens) {\n      return toMCPTokens(this.agent.oauth_tokens);\n    }\n    return undefined;\n  }\n\n  /**\n   * Save tokens after authorization\n   * Also cleans up the temporary code verifier\n   */\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    this.agent.oauth_tokens = fromMCPTokens(tokens);\n    // Clean up temporary code verifier after successful token exchange\n    delete this.agent.oauth_code_verifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Redirect user to authorization URL\n   */\n  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n    await this.flowHandler.redirectToAuthorization(authorizationUrl);\n  }\n\n  /**\n   * Save PKCE code verifier\n   */\n  async saveCodeVerifier(codeVerifier: string): Promise<void> {\n    this.agent.oauth_code_verifier = codeVerifier;\n    await this.persistAgent();\n  }\n\n  /**\n   * Load PKCE code verifier\n   * The MCP SDK calls saveCodeVerifier() before authorization and\n   * retrieves it here during token exchange.\n   */\n  async codeVerifier(): Promise<string> {\n    if (!this.agent.oauth_code_verifier) {\n      throw new Error(\n        'No PKCE code verifier found. The OAuth flow may have been interrupted or ' +\n          'the agent config was modified. Please try authenticating again.'\n      );\n    }\n    return this.agent.oauth_code_verifier;\n  }\n\n  /**\n   * Invalidate credentials when server indicates they're invalid\n   */\n  async invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): Promise<void> {\n    switch (scope) {\n      case 'all':\n        delete this.agent.oauth_tokens;\n        delete this.agent.oauth_client;\n        delete this.agent.oauth_code_verifier;\n        break;\n      case 'tokens':\n        delete this.agent.oauth_tokens;\n        break;\n      case 'client':\n        delete this.agent.oauth_client;\n        break;\n      case 'verifier':\n        delete this.agent.oauth_code_verifier;\n        break;\n    }\n    await this.persistAgent();\n  }\n\n  // ========================================\n  // Additional methods\n  // ========================================\n\n  /**\n   * Persist agent config to storage if configured\n   */\n  private async persistAgent(): Promise<void> {\n    if (this.storage) {\n      await this.storage.saveAgent(this.agent);\n    }\n  }\n\n  /**\n   * Wait for the OAuth callback\n   * Call this after UnauthorizedError is thrown\n   */\n  async waitForCallback(): Promise<string> {\n    return this.flowHandler.waitForCallback();\n  }\n\n  /**\n   * Clean up resources\n   */\n  async cleanup(): Promise<void> {\n    await this.flowHandler.cleanup();\n  }\n\n  /**\n   * Check if we have valid, non-expired OAuth tokens\n   * @returns true if access_token exists and hasn't expired (with 5 minute buffer)\n   */\n  hasValidTokens(): boolean {\n    const tokens = this.agent.oauth_tokens;\n    if (!tokens?.access_token) return false;\n\n    // Check expiration if available\n    if (tokens.expires_at) {\n      const expiresAt = new Date(tokens.expires_at);\n      // Consider expired if within 5 minutes of expiration\n      if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  /**\n   * Check if we have a refresh token available for token refresh\n   * @returns true if refresh_token is present\n   */\n  hasRefreshToken(): boolean {\n    return !!this.agent.oauth_tokens?.refresh_token;\n  }\n\n  /**\n   * Clear all OAuth data for this agent\n   */\n  async clearAuth(): Promise<void> {\n    await this.invalidateCredentials('all');\n  }\n\n  /**\n   * Get the agent config this provider manages\n   * @returns The AgentConfig with OAuth tokens populated after successful auth\n   */\n  getAgent(): AgentConfig {\n    return this.agent;\n  }\n\n  /**\n   * Get the agent identifier\n   * @returns The agent's unique ID\n   */\n  getAgentId(): string {\n    return this.agent.id;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,mBAAwG;AACxG,oBAA4B;AAC5B,0BAAyC;AA8BlC,MAAM,iBAAgD;AAAA,EACnD;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,QAA6B;AACvC,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,cAAc,OAAO;AAC1B,SAAK,kBAAkB,OAAO;AAC9B,SAAK,YAAY,OAAO,cAAc;AACtC,SAAK,6BAA6B,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OACL,OACA,aACA,SACA,yBACA,SACkB;AAElB,UAAM,iBAAsC;AAAA,MAC1C,GAAG;AAAA,MACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,MACvD,GAAG;AAAA,IACL;AAEA,WAAO,IAAI,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,SAAS;AAAA,MACpB,kBAAkB,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAA4B;AAC9B,WAAO,KAAK,YAAY,eAAe;AAAA,EACzC;AAAA,EAEA,IAAI,iBAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,oBAAoB,WAAyB,UAA6C;AAC9F,UAAM,mBACJ,KAAK,+BAA+B,OAChC,WACC,KAAK,8BAA8B,KAAK,MAAM,kBAAkB;AACvE,QAAI,CAAC,kBAAkB;AACrB,aAAO;AAAA,IACT;AAEA,eAAO,8CAAyB,kBAAkB,EAAE,WAAW,KAAK,UAAU,CAAC;AAAA,EACjF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAyB;AAC7B,eAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBAAiE;AACrE,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,8BAAgB,KAAK,MAAM,YAAY;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,YAAuD;AACjF,SAAK,MAAM,mBAAe,gCAAkB,UAAU;AACtD,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAA2C;AAC/C,QAAI,KAAK,MAAM,cAAc;AAC3B,iBAAO,0BAAY,KAAK,MAAM,YAAY;AAAA,IAC5C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,QAAoC;AACnD,SAAK,MAAM,mBAAe,4BAAc,MAAM;AAE9C,WAAO,KAAK,MAAM;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,wBAAwB,kBAAsC;AAClE,UAAM,KAAK,YAAY,wBAAwB,gBAAgB;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqC;AAC1D,SAAK,MAAM,sBAAsB;AACjC,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAgC;AACpC,QAAI,CAAC,KAAK,MAAM,qBAAqB;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,sBAAsB,OAAgE;AAC1F,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,MACF,KAAK;AACH,eAAO,KAAK,MAAM;AAClB;AAAA,IACJ;AACA,UAAM,KAAK,aAAa;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,eAA8B;AAC1C,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,QAAQ,UAAU,KAAK,KAAK;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAmC;AACvC,WAAO,KAAK,YAAY,gBAAgB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,UAAM,KAAK,YAAY,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA0B;AACxB,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,CAAC,QAAQ,aAAc,QAAO;AAGlC,QAAI,OAAO,YAAY;AACrB,YAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,UAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,MAAM,cAAc;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAA2B;AAC/B,UAAM,KAAK,sBAAsB,KAAK;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAqB;AACnB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;","names":[]}

package/dist/lib/auth/oauth/MCPOAuthProvider.mjs

@@ -1,17 +1,20 @@
 import { DEFAULT_CLIENT_METADATA, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo } from "./types.mjs";
 import { randomBytes } from "crypto";
+import { validateOAuthResourceUrl } from "./resource-url.mjs";
 class MCPOAuthProvider {
   agent;
   storage;
   flowHandler;
   _clientMetadata;
   allowHttp;
+  configuredResourceOverride;
   constructor(config) {
     this.agent = config.agent;
     this.storage = config.storage;
     this.flowHandler = config.flowHandler;
     this._clientMetadata = config.clientMetadata;
     this.allowHttp = config.allowHttp === true;
+    this.configuredResourceOverride = config.resourceOverride;
   }
   /**
    * Create a provider for CLI usage
@@ -27,7 +30,8 @@ class MCPOAuthProvider {
       flowHandler,
       storage,
       clientMetadata,
-      allowHttp: options?.allowHttp
+      allowHttp: options?.allowHttp,
+      resourceOverride: options?.resourceOverride
     });
   }
   // ========================================
@@ -53,14 +57,11 @@ class MCPOAuthProvider {
    * mirrors the CLI's `--allow-http` flag.
    */
   async validateResourceURL(serverUrl, resource) {
-    if (!resource) {
+    const selectedResource = this.configuredResourceOverride === null ? resource : this.configuredResourceOverride ?? this.agent.oauth_resource ?? resource;
+    if (!selectedResource) {
       return void 0;
     }
-    const resourceURL = new URL(resource);
-    if (resourceURL.protocol !== "https:" && !this.allowHttp) {
-      throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);
-    }
-    return resourceURL;
+    return validateOAuthResourceUrl(selectedResource, { allowHttp: this.allowHttp });
   }
   /**
    * Generate OAuth state parameter