@adcp/sdk 13.0.0-rc.6 → 13.0.0-rc.8

package/dist/lib/auth/oauth/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,+BAA+B;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,4BAA4B;IAC5B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,4CAA4C;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,uBAAuB;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAyD/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAGtG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpH"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,+BAA+B;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,4BAA4B;IAC5B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,4CAA4C;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,uBAAuB;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA0D/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAGtG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpH"}

package/dist/lib/auth/oauth/discovery.js

@@ -24,9 +24,11 @@ __export(discovery_exports, {
 });
 module.exports = __toCommonJS(discovery_exports);
 var import_responseSizeLimit = require('../../protocols/responseSizeLimit.js');
+var import_abort = require('../../protocols/abort.js');
 async function discoverOAuthMetadata(agentUrl, options = {}) {
   const { timeout = 5e3, fetch: providedFetch = fetch } = options;
   const customFetch = (0, import_responseSizeLimit.wrapFetchWithSizeLimit)(providedFetch);
+  (0, import_abort.throwIfAborted)(options.signal);
   try {
     const baseUrl = new URL(agentUrl);
     const pathname = baseUrl.pathname.endsWith("/") ? baseUrl.pathname.slice(0, -1) : baseUrl.pathname;
@@ -35,12 +37,12 @@ async function discoverOAuthMetadata(agentUrl, options = {}) {
     const rootUrl = new URL("/.well-known/oauth-authorization-server", baseUrl.origin);
     const urlsToTry = pathAwareUrl ? [pathAwareUrl, rootUrl] : [rootUrl];
     for (const metadataUrl of urlsToTry) {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), timeout);
+      const timeoutSignal = AbortSignal.timeout(timeout);
+      const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
       try {
         const response = await customFetch(metadataUrl.toString(), {
           headers: { Accept: "application/json" },
-          signal: controller.signal
+          signal
         });
         if (!response.ok) {
           continue;
@@ -51,13 +53,13 @@ async function discoverOAuthMetadata(agentUrl, options = {}) {
         }
         return metadata;
       } catch {
+        (0, import_abort.throwIfAborted)(options.signal);
         continue;
-      } finally {
-        clearTimeout(timeoutId);
       }
     }
     return null;
   } catch {
+    (0, import_abort.throwIfAborted)(options.signal);
     return null;
   }
 }

package/dist/lib/auth/oauth/discovery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/discovery.ts"],"sourcesContent":["/**\n * OAuth Discovery utilities\n *\n * Functions to discover OAuth capabilities of MCP servers.\n * MCP servers expose OAuth metadata at /.well-known/oauth-authorization-server\n */\n\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\n\n/**\n * OAuth Authorization Server Metadata\n * @see https://datatracker.ietf.org/doc/html/rfc8414\n */\nexport interface OAuthMetadata {\n  /** URL of the authorization endpoint */\n  authorization_endpoint: string;\n  /** URL of the token endpoint */\n  token_endpoint: string;\n  /** URL of the dynamic client registration endpoint (optional) */\n  registration_endpoint?: string;\n  /** Issuer identifier */\n  issuer?: string;\n  /** PKCE code challenge methods supported */\n  code_challenge_methods_supported?: string[];\n  /** Response types supported */\n  response_types_supported?: string[];\n  /** Grant types supported */\n  grant_types_supported?: string[];\n  /** Token endpoint auth methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Scopes supported */\n  scopes_supported?: string[];\n}\n\n/**\n * Options for OAuth discovery\n */\nexport interface DiscoveryOptions {\n  /** Timeout in milliseconds (default: 5000) */\n  timeout?: number;\n  /** Custom fetch function (for testing or custom HTTP handling) */\n  fetch?: typeof fetch;\n}\n\n/**\n * Discover OAuth metadata from an MCP server\n *\n * Fetches the OAuth Authorization Server Metadata from the well-known endpoint.\n * Returns null if the server doesn't support OAuth or the metadata isn't available.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns OAuth metadata or null if not available\n *\n * @example\n * ```typescript\n * const metadata = await discoverOAuthMetadata('https://agent.example.com/mcp');\n * if (metadata) {\n *   console.log('Authorization URL:', metadata.authorization_endpoint);\n *   console.log('Supports dynamic registration:', !!metadata.registration_endpoint);\n * }\n * ```\n */\nexport async function discoverOAuthMetadata(\n  agentUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<OAuthMetadata | null> {\n  // Wrap with the response-size-limit guard so a hostile metadata endpoint\n  // can't buffer-bomb during discovery. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const { timeout = 5000, fetch: providedFetch = fetch } = options;\n  const customFetch = wrapFetchWithSizeLimit(providedFetch);\n\n  try {\n    const baseUrl = new URL(agentUrl);\n\n    // RFC 8414 path-aware discovery: try path-suffixed URL first, then fall back to root.\n    // For https://example.com/mcp, try:\n    //   1. https://example.com/.well-known/oauth-authorization-server/mcp\n    //   2. https://example.com/.well-known/oauth-authorization-server (fallback)\n    const pathname = baseUrl.pathname.endsWith('/') ? baseUrl.pathname.slice(0, -1) : baseUrl.pathname;\n    const hasPath = pathname !== '' && pathname !== '/';\n\n    const pathAwareUrl = hasPath ? new URL(`/.well-known/oauth-authorization-server${pathname}`, baseUrl.origin) : null;\n    const rootUrl = new URL('/.well-known/oauth-authorization-server', baseUrl.origin);\n\n    const urlsToTry = pathAwareUrl ? [pathAwareUrl, rootUrl] : [rootUrl];\n\n    for (const metadataUrl of urlsToTry) {\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n      try {\n        const response = await customFetch(metadataUrl.toString(), {\n          headers: { Accept: 'application/json' },\n          signal: controller.signal,\n        });\n\n        if (!response.ok) {\n          continue;\n        }\n\n        const metadata = (await response.json()) as OAuthMetadata;\n\n        // Validate required fields\n        if (!metadata.authorization_endpoint || !metadata.token_endpoint) {\n          continue;\n        }\n\n        return metadata;\n      } catch {\n        // Parse error, timeout, or network error on this URL -- try next\n        continue;\n      } finally {\n        clearTimeout(timeoutId);\n      }\n    }\n\n    return null;\n  } catch {\n    // Network error, timeout, or invalid URL - agent doesn't support OAuth\n    return null;\n  }\n}\n\n/**\n * Check if an MCP server supports OAuth authentication\n *\n * This is a simple boolean check - use discoverOAuthMetadata() if you need\n * the actual endpoints.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports OAuth\n *\n * @example\n * ```typescript\n * if (await supportsOAuth('https://agent.example.com/mcp')) {\n *   console.log('Agent requires OAuth authentication');\n * }\n * ```\n */\nexport async function supportsOAuth(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata !== null;\n}\n\n/**\n * Check if an MCP server supports dynamic client registration\n *\n * Servers that support dynamic registration allow clients to register\n * automatically without pre-configured credentials.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports dynamic client registration\n *\n * @example\n * ```typescript\n * if (await supportsDynamicRegistration('https://agent.example.com/mcp')) {\n *   console.log('Agent supports automatic client registration');\n * }\n * ```\n */\nexport async function supportsDynamicRegistration(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata?.registration_endpoint !== undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,+BAAuC;AAwDvC,eAAsB,sBACpB,UACA,UAA4B,CAAC,GACE;AAI/B,QAAM,EAAE,UAAU,KAAM,OAAO,gBAAgB,MAAM,IAAI;AACzD,QAAM,kBAAc,iDAAuB,aAAa;AAExD,MAAI;AACF,UAAM,UAAU,IAAI,IAAI,QAAQ;AAMhC,UAAM,WAAW,QAAQ,SAAS,SAAS,GAAG,IAAI,QAAQ,SAAS,MAAM,GAAG,EAAE,IAAI,QAAQ;AAC1F,UAAM,UAAU,aAAa,MAAM,aAAa;AAEhD,UAAM,eAAe,UAAU,IAAI,IAAI,0CAA0C,QAAQ,IAAI,QAAQ,MAAM,IAAI;AAC/G,UAAM,UAAU,IAAI,IAAI,2CAA2C,QAAQ,MAAM;AAEjF,UAAM,YAAY,eAAe,CAAC,cAAc,OAAO,IAAI,CAAC,OAAO;AAEnE,eAAW,eAAe,WAAW;AACnC,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAE9D,UAAI;AACF,cAAM,WAAW,MAAM,YAAY,YAAY,SAAS,GAAG;AAAA,UACzD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,UACtC,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB;AAAA,QACF;AAEA,cAAM,WAAY,MAAM,SAAS,KAAK;AAGtC,YAAI,CAAC,SAAS,0BAA0B,CAAC,SAAS,gBAAgB;AAChE;AAAA,QACF;AAEA,eAAO;AAAA,MACT,QAAQ;AAEN;AAAA,MACF,UAAE;AACA,qBAAa,SAAS;AAAA,MACxB;AAAA,IACF;AAEA,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,cAAc,UAAkB,UAA4B,CAAC,GAAqB;AACtG,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,aAAa;AACtB;AAmBA,eAAsB,4BAA4B,UAAkB,UAA4B,CAAC,GAAqB;AACpH,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,UAAU,0BAA0B;AAC7C;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/discovery.ts"],"sourcesContent":["/**\n * OAuth Discovery utilities\n *\n * Functions to discover OAuth capabilities of MCP servers.\n * MCP servers expose OAuth metadata at /.well-known/oauth-authorization-server\n */\n\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\nimport { throwIfAborted } from '../../protocols/abort';\n\n/**\n * OAuth Authorization Server Metadata\n * @see https://datatracker.ietf.org/doc/html/rfc8414\n */\nexport interface OAuthMetadata {\n  /** URL of the authorization endpoint */\n  authorization_endpoint: string;\n  /** URL of the token endpoint */\n  token_endpoint: string;\n  /** URL of the dynamic client registration endpoint (optional) */\n  registration_endpoint?: string;\n  /** Issuer identifier */\n  issuer?: string;\n  /** PKCE code challenge methods supported */\n  code_challenge_methods_supported?: string[];\n  /** Response types supported */\n  response_types_supported?: string[];\n  /** Grant types supported */\n  grant_types_supported?: string[];\n  /** Token endpoint auth methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Scopes supported */\n  scopes_supported?: string[];\n}\n\n/**\n * Options for OAuth discovery\n */\nexport interface DiscoveryOptions {\n  /** Timeout in milliseconds (default: 5000) */\n  timeout?: number;\n  /** Custom fetch function (for testing or custom HTTP handling) */\n  fetch?: typeof fetch;\n  /** Caller cancellation, including the absolute task deadline. */\n  signal?: AbortSignal;\n}\n\n/**\n * Discover OAuth metadata from an MCP server\n *\n * Fetches the OAuth Authorization Server Metadata from the well-known endpoint.\n * Returns null if the server doesn't support OAuth or the metadata isn't available.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns OAuth metadata or null if not available\n *\n * @example\n * ```typescript\n * const metadata = await discoverOAuthMetadata('https://agent.example.com/mcp');\n * if (metadata) {\n *   console.log('Authorization URL:', metadata.authorization_endpoint);\n *   console.log('Supports dynamic registration:', !!metadata.registration_endpoint);\n * }\n * ```\n */\nexport async function discoverOAuthMetadata(\n  agentUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<OAuthMetadata | null> {\n  // Wrap with the response-size-limit guard so a hostile metadata endpoint\n  // can't buffer-bomb during discovery. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const { timeout = 5000, fetch: providedFetch = fetch } = options;\n  const customFetch = wrapFetchWithSizeLimit(providedFetch);\n  throwIfAborted(options.signal);\n\n  try {\n    const baseUrl = new URL(agentUrl);\n\n    // RFC 8414 path-aware discovery: try path-suffixed URL first, then fall back to root.\n    // For https://example.com/mcp, try:\n    //   1. https://example.com/.well-known/oauth-authorization-server/mcp\n    //   2. https://example.com/.well-known/oauth-authorization-server (fallback)\n    const pathname = baseUrl.pathname.endsWith('/') ? baseUrl.pathname.slice(0, -1) : baseUrl.pathname;\n    const hasPath = pathname !== '' && pathname !== '/';\n\n    const pathAwareUrl = hasPath ? new URL(`/.well-known/oauth-authorization-server${pathname}`, baseUrl.origin) : null;\n    const rootUrl = new URL('/.well-known/oauth-authorization-server', baseUrl.origin);\n\n    const urlsToTry = pathAwareUrl ? [pathAwareUrl, rootUrl] : [rootUrl];\n\n    for (const metadataUrl of urlsToTry) {\n      const timeoutSignal = AbortSignal.timeout(timeout);\n      const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;\n\n      try {\n        const response = await customFetch(metadataUrl.toString(), {\n          headers: { Accept: 'application/json' },\n          signal,\n        });\n\n        if (!response.ok) {\n          continue;\n        }\n\n        const metadata = (await response.json()) as OAuthMetadata;\n\n        // Validate required fields\n        if (!metadata.authorization_endpoint || !metadata.token_endpoint) {\n          continue;\n        }\n\n        return metadata;\n      } catch {\n        throwIfAborted(options.signal);\n        // Parse error, timeout, or network error on this URL -- try next\n        continue;\n      }\n    }\n\n    return null;\n  } catch {\n    throwIfAborted(options.signal);\n    // Network error, timeout, or invalid URL - agent doesn't support OAuth\n    return null;\n  }\n}\n\n/**\n * Check if an MCP server supports OAuth authentication\n *\n * This is a simple boolean check - use discoverOAuthMetadata() if you need\n * the actual endpoints.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports OAuth\n *\n * @example\n * ```typescript\n * if (await supportsOAuth('https://agent.example.com/mcp')) {\n *   console.log('Agent requires OAuth authentication');\n * }\n * ```\n */\nexport async function supportsOAuth(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata !== null;\n}\n\n/**\n * Check if an MCP server supports dynamic client registration\n *\n * Servers that support dynamic registration allow clients to register\n * automatically without pre-configured credentials.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports dynamic client registration\n *\n * @example\n * ```typescript\n * if (await supportsDynamicRegistration('https://agent.example.com/mcp')) {\n *   console.log('Agent supports automatic client registration');\n * }\n * ```\n */\nexport async function supportsDynamicRegistration(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata?.registration_endpoint !== undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,+BAAuC;AACvC,mBAA+B;AA0D/B,eAAsB,sBACpB,UACA,UAA4B,CAAC,GACE;AAI/B,QAAM,EAAE,UAAU,KAAM,OAAO,gBAAgB,MAAM,IAAI;AACzD,QAAM,kBAAc,iDAAuB,aAAa;AACxD,mCAAe,QAAQ,MAAM;AAE7B,MAAI;AACF,UAAM,UAAU,IAAI,IAAI,QAAQ;AAMhC,UAAM,WAAW,QAAQ,SAAS,SAAS,GAAG,IAAI,QAAQ,SAAS,MAAM,GAAG,EAAE,IAAI,QAAQ;AAC1F,UAAM,UAAU,aAAa,MAAM,aAAa;AAEhD,UAAM,eAAe,UAAU,IAAI,IAAI,0CAA0C,QAAQ,IAAI,QAAQ,MAAM,IAAI;AAC/G,UAAM,UAAU,IAAI,IAAI,2CAA2C,QAAQ,MAAM;AAEjF,UAAM,YAAY,eAAe,CAAC,cAAc,OAAO,IAAI,CAAC,OAAO;AAEnE,eAAW,eAAe,WAAW;AACnC,YAAM,gBAAgB,YAAY,QAAQ,OAAO;AACjD,YAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,aAAa,CAAC,IAAI;AAEnF,UAAI;AACF,cAAM,WAAW,MAAM,YAAY,YAAY,SAAS,GAAG;AAAA,UACzD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,UACtC;AAAA,QACF,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB;AAAA,QACF;AAEA,cAAM,WAAY,MAAM,SAAS,KAAK;AAGtC,YAAI,CAAC,SAAS,0BAA0B,CAAC,SAAS,gBAAgB;AAChE;AAAA,QACF;AAEA,eAAO;AAAA,MACT,QAAQ;AACN,yCAAe,QAAQ,MAAM;AAE7B;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT,QAAQ;AACN,qCAAe,QAAQ,MAAM;AAE7B,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,cAAc,UAAkB,UAA4B,CAAC,GAAqB;AACtG,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,aAAa;AACtB;AAmBA,eAAsB,4BAA4B,UAAkB,UAA4B,CAAC,GAAqB;AACpH,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,UAAU,0BAA0B;AAC7C;","names":[]}

package/dist/lib/auth/oauth/discovery.mjs

@@ -1,7 +1,9 @@
 import { wrapFetchWithSizeLimit } from "../../protocols/responseSizeLimit.mjs";
+import { throwIfAborted } from "../../protocols/abort.mjs";
 async function discoverOAuthMetadata(agentUrl, options = {}) {
   const { timeout = 5e3, fetch: providedFetch = fetch } = options;
   const customFetch = wrapFetchWithSizeLimit(providedFetch);
+  throwIfAborted(options.signal);
   try {
     const baseUrl = new URL(agentUrl);
     const pathname = baseUrl.pathname.endsWith("/") ? baseUrl.pathname.slice(0, -1) : baseUrl.pathname;
@@ -10,12 +12,12 @@ async function discoverOAuthMetadata(agentUrl, options = {}) {
     const rootUrl = new URL("/.well-known/oauth-authorization-server", baseUrl.origin);
     const urlsToTry = pathAwareUrl ? [pathAwareUrl, rootUrl] : [rootUrl];
     for (const metadataUrl of urlsToTry) {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), timeout);
+      const timeoutSignal = AbortSignal.timeout(timeout);
+      const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
       try {
         const response = await customFetch(metadataUrl.toString(), {
           headers: { Accept: "application/json" },
-          signal: controller.signal
+          signal
         });
         if (!response.ok) {
           continue;
@@ -26,13 +28,13 @@ async function discoverOAuthMetadata(agentUrl, options = {}) {
         }
         return metadata;
       } catch {
+        throwIfAborted(options.signal);
         continue;
-      } finally {
-        clearTimeout(timeoutId);
       }
     }
     return null;
   } catch {
+    throwIfAborted(options.signal);
     return null;
   }
 }

package/dist/lib/auth/oauth/discovery.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/discovery.ts"],"sourcesContent":["/**\n * OAuth Discovery utilities\n *\n * Functions to discover OAuth capabilities of MCP servers.\n * MCP servers expose OAuth metadata at /.well-known/oauth-authorization-server\n */\n\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\n\n/**\n * OAuth Authorization Server Metadata\n * @see https://datatracker.ietf.org/doc/html/rfc8414\n */\nexport interface OAuthMetadata {\n  /** URL of the authorization endpoint */\n  authorization_endpoint: string;\n  /** URL of the token endpoint */\n  token_endpoint: string;\n  /** URL of the dynamic client registration endpoint (optional) */\n  registration_endpoint?: string;\n  /** Issuer identifier */\n  issuer?: string;\n  /** PKCE code challenge methods supported */\n  code_challenge_methods_supported?: string[];\n  /** Response types supported */\n  response_types_supported?: string[];\n  /** Grant types supported */\n  grant_types_supported?: string[];\n  /** Token endpoint auth methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Scopes supported */\n  scopes_supported?: string[];\n}\n\n/**\n * Options for OAuth discovery\n */\nexport interface DiscoveryOptions {\n  /** Timeout in milliseconds (default: 5000) */\n  timeout?: number;\n  /** Custom fetch function (for testing or custom HTTP handling) */\n  fetch?: typeof fetch;\n}\n\n/**\n * Discover OAuth metadata from an MCP server\n *\n * Fetches the OAuth Authorization Server Metadata from the well-known endpoint.\n * Returns null if the server doesn't support OAuth or the metadata isn't available.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns OAuth metadata or null if not available\n *\n * @example\n * ```typescript\n * const metadata = await discoverOAuthMetadata('https://agent.example.com/mcp');\n * if (metadata) {\n *   console.log('Authorization URL:', metadata.authorization_endpoint);\n *   console.log('Supports dynamic registration:', !!metadata.registration_endpoint);\n * }\n * ```\n */\nexport async function discoverOAuthMetadata(\n  agentUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<OAuthMetadata | null> {\n  // Wrap with the response-size-limit guard so a hostile metadata endpoint\n  // can't buffer-bomb during discovery. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const { timeout = 5000, fetch: providedFetch = fetch } = options;\n  const customFetch = wrapFetchWithSizeLimit(providedFetch);\n\n  try {\n    const baseUrl = new URL(agentUrl);\n\n    // RFC 8414 path-aware discovery: try path-suffixed URL first, then fall back to root.\n    // For https://example.com/mcp, try:\n    //   1. https://example.com/.well-known/oauth-authorization-server/mcp\n    //   2. https://example.com/.well-known/oauth-authorization-server (fallback)\n    const pathname = baseUrl.pathname.endsWith('/') ? baseUrl.pathname.slice(0, -1) : baseUrl.pathname;\n    const hasPath = pathname !== '' && pathname !== '/';\n\n    const pathAwareUrl = hasPath ? new URL(`/.well-known/oauth-authorization-server${pathname}`, baseUrl.origin) : null;\n    const rootUrl = new URL('/.well-known/oauth-authorization-server', baseUrl.origin);\n\n    const urlsToTry = pathAwareUrl ? [pathAwareUrl, rootUrl] : [rootUrl];\n\n    for (const metadataUrl of urlsToTry) {\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n      try {\n        const response = await customFetch(metadataUrl.toString(), {\n          headers: { Accept: 'application/json' },\n          signal: controller.signal,\n        });\n\n        if (!response.ok) {\n          continue;\n        }\n\n        const metadata = (await response.json()) as OAuthMetadata;\n\n        // Validate required fields\n        if (!metadata.authorization_endpoint || !metadata.token_endpoint) {\n          continue;\n        }\n\n        return metadata;\n      } catch {\n        // Parse error, timeout, or network error on this URL -- try next\n        continue;\n      } finally {\n        clearTimeout(timeoutId);\n      }\n    }\n\n    return null;\n  } catch {\n    // Network error, timeout, or invalid URL - agent doesn't support OAuth\n    return null;\n  }\n}\n\n/**\n * Check if an MCP server supports OAuth authentication\n *\n * This is a simple boolean check - use discoverOAuthMetadata() if you need\n * the actual endpoints.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports OAuth\n *\n * @example\n * ```typescript\n * if (await supportsOAuth('https://agent.example.com/mcp')) {\n *   console.log('Agent requires OAuth authentication');\n * }\n * ```\n */\nexport async function supportsOAuth(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata !== null;\n}\n\n/**\n * Check if an MCP server supports dynamic client registration\n *\n * Servers that support dynamic registration allow clients to register\n * automatically without pre-configured credentials.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports dynamic client registration\n *\n * @example\n * ```typescript\n * if (await supportsDynamicRegistration('https://agent.example.com/mcp')) {\n *   console.log('Agent supports automatic client registration');\n * }\n * ```\n */\nexport async function supportsDynamicRegistration(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata?.registration_endpoint !== undefined;\n}\n"],"mappings":"AAOA,SAAS,8BAA8B;AAwDvC,eAAsB,sBACpB,UACA,UAA4B,CAAC,GACE;AAI/B,QAAM,EAAE,UAAU,KAAM,OAAO,gBAAgB,MAAM,IAAI;AACzD,QAAM,cAAc,uBAAuB,aAAa;AAExD,MAAI;AACF,UAAM,UAAU,IAAI,IAAI,QAAQ;AAMhC,UAAM,WAAW,QAAQ,SAAS,SAAS,GAAG,IAAI,QAAQ,SAAS,MAAM,GAAG,EAAE,IAAI,QAAQ;AAC1F,UAAM,UAAU,aAAa,MAAM,aAAa;AAEhD,UAAM,eAAe,UAAU,IAAI,IAAI,0CAA0C,QAAQ,IAAI,QAAQ,MAAM,IAAI;AAC/G,UAAM,UAAU,IAAI,IAAI,2CAA2C,QAAQ,MAAM;AAEjF,UAAM,YAAY,eAAe,CAAC,cAAc,OAAO,IAAI,CAAC,OAAO;AAEnE,eAAW,eAAe,WAAW;AACnC,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAE9D,UAAI;AACF,cAAM,WAAW,MAAM,YAAY,YAAY,SAAS,GAAG;AAAA,UACzD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,UACtC,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB;AAAA,QACF;AAEA,cAAM,WAAY,MAAM,SAAS,KAAK;AAGtC,YAAI,CAAC,SAAS,0BAA0B,CAAC,SAAS,gBAAgB;AAChE;AAAA,QACF;AAEA,eAAO;AAAA,MACT,QAAQ;AAEN;AAAA,MACF,UAAE;AACA,qBAAa,SAAS;AAAA,MACxB;AAAA,IACF;AAEA,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,cAAc,UAAkB,UAA4B,CAAC,GAAqB;AACtG,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,aAAa;AACtB;AAmBA,eAAsB,4BAA4B,UAAkB,UAA4B,CAAC,GAAqB;AACpH,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,UAAU,0BAA0B;AAC7C;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/discovery.ts"],"sourcesContent":["/**\n * OAuth Discovery utilities\n *\n * Functions to discover OAuth capabilities of MCP servers.\n * MCP servers expose OAuth metadata at /.well-known/oauth-authorization-server\n */\n\nimport { wrapFetchWithSizeLimit } from '../../protocols/responseSizeLimit';\nimport { throwIfAborted } from '../../protocols/abort';\n\n/**\n * OAuth Authorization Server Metadata\n * @see https://datatracker.ietf.org/doc/html/rfc8414\n */\nexport interface OAuthMetadata {\n  /** URL of the authorization endpoint */\n  authorization_endpoint: string;\n  /** URL of the token endpoint */\n  token_endpoint: string;\n  /** URL of the dynamic client registration endpoint (optional) */\n  registration_endpoint?: string;\n  /** Issuer identifier */\n  issuer?: string;\n  /** PKCE code challenge methods supported */\n  code_challenge_methods_supported?: string[];\n  /** Response types supported */\n  response_types_supported?: string[];\n  /** Grant types supported */\n  grant_types_supported?: string[];\n  /** Token endpoint auth methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Scopes supported */\n  scopes_supported?: string[];\n}\n\n/**\n * Options for OAuth discovery\n */\nexport interface DiscoveryOptions {\n  /** Timeout in milliseconds (default: 5000) */\n  timeout?: number;\n  /** Custom fetch function (for testing or custom HTTP handling) */\n  fetch?: typeof fetch;\n  /** Caller cancellation, including the absolute task deadline. */\n  signal?: AbortSignal;\n}\n\n/**\n * Discover OAuth metadata from an MCP server\n *\n * Fetches the OAuth Authorization Server Metadata from the well-known endpoint.\n * Returns null if the server doesn't support OAuth or the metadata isn't available.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns OAuth metadata or null if not available\n *\n * @example\n * ```typescript\n * const metadata = await discoverOAuthMetadata('https://agent.example.com/mcp');\n * if (metadata) {\n *   console.log('Authorization URL:', metadata.authorization_endpoint);\n *   console.log('Supports dynamic registration:', !!metadata.registration_endpoint);\n * }\n * ```\n */\nexport async function discoverOAuthMetadata(\n  agentUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<OAuthMetadata | null> {\n  // Wrap with the response-size-limit guard so a hostile metadata endpoint\n  // can't buffer-bomb during discovery. Pass-through when no\n  // `withResponseSizeLimit` slot is active. (#1175)\n  const { timeout = 5000, fetch: providedFetch = fetch } = options;\n  const customFetch = wrapFetchWithSizeLimit(providedFetch);\n  throwIfAborted(options.signal);\n\n  try {\n    const baseUrl = new URL(agentUrl);\n\n    // RFC 8414 path-aware discovery: try path-suffixed URL first, then fall back to root.\n    // For https://example.com/mcp, try:\n    //   1. https://example.com/.well-known/oauth-authorization-server/mcp\n    //   2. https://example.com/.well-known/oauth-authorization-server (fallback)\n    const pathname = baseUrl.pathname.endsWith('/') ? baseUrl.pathname.slice(0, -1) : baseUrl.pathname;\n    const hasPath = pathname !== '' && pathname !== '/';\n\n    const pathAwareUrl = hasPath ? new URL(`/.well-known/oauth-authorization-server${pathname}`, baseUrl.origin) : null;\n    const rootUrl = new URL('/.well-known/oauth-authorization-server', baseUrl.origin);\n\n    const urlsToTry = pathAwareUrl ? [pathAwareUrl, rootUrl] : [rootUrl];\n\n    for (const metadataUrl of urlsToTry) {\n      const timeoutSignal = AbortSignal.timeout(timeout);\n      const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;\n\n      try {\n        const response = await customFetch(metadataUrl.toString(), {\n          headers: { Accept: 'application/json' },\n          signal,\n        });\n\n        if (!response.ok) {\n          continue;\n        }\n\n        const metadata = (await response.json()) as OAuthMetadata;\n\n        // Validate required fields\n        if (!metadata.authorization_endpoint || !metadata.token_endpoint) {\n          continue;\n        }\n\n        return metadata;\n      } catch {\n        throwIfAborted(options.signal);\n        // Parse error, timeout, or network error on this URL -- try next\n        continue;\n      }\n    }\n\n    return null;\n  } catch {\n    throwIfAborted(options.signal);\n    // Network error, timeout, or invalid URL - agent doesn't support OAuth\n    return null;\n  }\n}\n\n/**\n * Check if an MCP server supports OAuth authentication\n *\n * This is a simple boolean check - use discoverOAuthMetadata() if you need\n * the actual endpoints.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports OAuth\n *\n * @example\n * ```typescript\n * if (await supportsOAuth('https://agent.example.com/mcp')) {\n *   console.log('Agent requires OAuth authentication');\n * }\n * ```\n */\nexport async function supportsOAuth(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata !== null;\n}\n\n/**\n * Check if an MCP server supports dynamic client registration\n *\n * Servers that support dynamic registration allow clients to register\n * automatically without pre-configured credentials.\n *\n * @param agentUrl - The MCP server URL\n * @param options - Discovery options\n * @returns true if the server supports dynamic client registration\n *\n * @example\n * ```typescript\n * if (await supportsDynamicRegistration('https://agent.example.com/mcp')) {\n *   console.log('Agent supports automatic client registration');\n * }\n * ```\n */\nexport async function supportsDynamicRegistration(agentUrl: string, options: DiscoveryOptions = {}): Promise<boolean> {\n  const metadata = await discoverOAuthMetadata(agentUrl, options);\n  return metadata?.registration_endpoint !== undefined;\n}\n"],"mappings":"AAOA,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AA0D/B,eAAsB,sBACpB,UACA,UAA4B,CAAC,GACE;AAI/B,QAAM,EAAE,UAAU,KAAM,OAAO,gBAAgB,MAAM,IAAI;AACzD,QAAM,cAAc,uBAAuB,aAAa;AACxD,iBAAe,QAAQ,MAAM;AAE7B,MAAI;AACF,UAAM,UAAU,IAAI,IAAI,QAAQ;AAMhC,UAAM,WAAW,QAAQ,SAAS,SAAS,GAAG,IAAI,QAAQ,SAAS,MAAM,GAAG,EAAE,IAAI,QAAQ;AAC1F,UAAM,UAAU,aAAa,MAAM,aAAa;AAEhD,UAAM,eAAe,UAAU,IAAI,IAAI,0CAA0C,QAAQ,IAAI,QAAQ,MAAM,IAAI;AAC/G,UAAM,UAAU,IAAI,IAAI,2CAA2C,QAAQ,MAAM;AAEjF,UAAM,YAAY,eAAe,CAAC,cAAc,OAAO,IAAI,CAAC,OAAO;AAEnE,eAAW,eAAe,WAAW;AACnC,YAAM,gBAAgB,YAAY,QAAQ,OAAO;AACjD,YAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,aAAa,CAAC,IAAI;AAEnF,UAAI;AACF,cAAM,WAAW,MAAM,YAAY,YAAY,SAAS,GAAG;AAAA,UACzD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,UACtC;AAAA,QACF,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB;AAAA,QACF;AAEA,cAAM,WAAY,MAAM,SAAS,KAAK;AAGtC,YAAI,CAAC,SAAS,0BAA0B,CAAC,SAAS,gBAAgB;AAChE;AAAA,QACF;AAEA,eAAO;AAAA,MACT,QAAQ;AACN,uBAAe,QAAQ,MAAM;AAE7B;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT,QAAQ;AACN,mBAAe,QAAQ,MAAM;AAE7B,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,cAAc,UAAkB,UAA4B,CAAC,GAAqB;AACtG,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,aAAa;AACtB;AAmBA,eAAsB,4BAA4B,UAAkB,UAA4B,CAAC,GAAqB;AACpH,QAAM,WAAW,MAAM,sBAAsB,UAAU,OAAO;AAC9D,SAAO,UAAU,0BAA0B;AAC7C;","names":[]}

package/dist/lib/auth/oauth/file-storage.d.mts

@@ -28,7 +28,8 @@ export interface FileOAuthStorageOptions {
  *
  * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom
  * fields) when saving — the MCP provider only mutates `oauth_tokens`,
- * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.
+ * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve
+ * everything else.
  *
  * @example
  * ```ts

package/dist/lib/auth/oauth/file-storage.d.ts

@@ -28,7 +28,8 @@ export interface FileOAuthStorageOptions {
  *
  * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom
  * fields) when saving — the MCP provider only mutates `oauth_tokens`,
- * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.
+ * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve
+ * everything else.
  *
  * @example
  * ```ts

package/dist/lib/auth/oauth/file-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-storage.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAuBlD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,kBAAkB,CAsE3F"}
+{"version":3,"file":"file-storage.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAwBlD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,kBAAkB,CA0E3F"}

package/dist/lib/auth/oauth/file-storage.js

@@ -73,6 +73,7 @@ function createFileOAuthStorage(options) {
         auth_token: stored.auth_token,
         oauth_tokens: stored.oauth_tokens,
         oauth_client: stored.oauth_client,
+        oauth_resource: stored.oauth_resource,
         oauth_client_credentials: stored.oauth_client_credentials,
         oauth_code_verifier: stored.oauth_code_verifier
       };
@@ -81,16 +82,19 @@ function createFileOAuthStorage(options) {
       const key = agentKeyOverride ?? agent.id;
       const config = await readConfig();
       const existing = config.agents[key] ?? { url: agent.agent_uri };
-      config.agents[key] = {
+      const next = {
         ...existing,
         url: agent.agent_uri,
         protocol: agent.protocol,
         ...agent.auth_token !== void 0 ? { auth_token: agent.auth_token } : {},
         ...agent.oauth_tokens !== void 0 ? { oauth_tokens: agent.oauth_tokens } : {},
         ...agent.oauth_client !== void 0 ? { oauth_client: agent.oauth_client } : {},
+        ...agent.oauth_resource !== void 0 ? { oauth_resource: agent.oauth_resource } : {},
         ...agent.oauth_client_credentials !== void 0 ? { oauth_client_credentials: agent.oauth_client_credentials } : {},
         ...agent.oauth_code_verifier !== void 0 ? { oauth_code_verifier: agent.oauth_code_verifier } : {}
       };
+      if (agent.oauth_resource === void 0) delete next.oauth_resource;
+      config.agents[key] = next;
       await writeConfig(config);
     }
   };

package/dist/lib/auth/oauth/file-storage.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/**\n * File-backed {@link OAuthConfigStorage} implementation.\n *\n * Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n *\n * On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with `{ url, protocol, auth_token?, oauth_tokens?, oauth_client? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n */\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/**\n * Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n */\ninterface StoredAgent {\n  url: string;\n  protocol?: 'mcp' | 'a2a';\n  auth_token?: string;\n  oauth_tokens?: AgentConfig['oauth_tokens'];\n  oauth_client?: AgentConfig['oauth_client'];\n  oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n  oauth_code_verifier?: string;\n}\n\n/**\n * Shape of the whole config file.\n */\ninterface StoredConfig {\n  agents: Record<string, StoredAgent>;\n  defaults?: Record<string, unknown>;\n}\n\n/**\n * Options for {@link createFileOAuthStorage}.\n */\nexport interface FileOAuthStorageOptions {\n  /** Absolute path to the config JSON file. Must be a file, not a directory. */\n  configPath: string;\n  /**\n   * Key persistence under a stable alias regardless of `agent.id`. Use this\n   * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n   * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n   * should be organized by a long-lived alias chosen by the operator.\n   */\n  agentKey?: string;\n  /**\n   * Create the parent directory (with mode 0o700) if it doesn't exist.\n   * Default true — CLI users expect first-run to create `~/.adcp/`.\n   */\n  autoCreateDir?: boolean;\n  /** File mode for the config file when we create it. Default 0o600. */\n  fileMode?: number;\n}\n\n/**\n * Create a file-backed `OAuthConfigStorage`.\n *\n * Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n *\n * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.\n *\n * @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n  const configPath = options.configPath;\n  const agentKeyOverride = options.agentKey;\n  const autoCreateDir = options.autoCreateDir ?? true;\n  const fileMode = options.fileMode ?? 0o600;\n\n  async function readConfig(): Promise<StoredConfig> {\n    try {\n      const raw = await fs.readFile(configPath, 'utf-8');\n      const parsed = JSON.parse(raw) as StoredConfig;\n      if (!parsed.agents || typeof parsed.agents !== 'object') parsed.agents = {};\n      return parsed;\n    } catch (err) {\n      if (isNotFound(err)) return { agents: {} };\n      throw err;\n    }\n  }\n\n  async function writeConfig(config: StoredConfig): Promise<void> {\n    if (autoCreateDir) {\n      await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n    }\n    // Atomic write: stage next to the target, then rename. Same filesystem →\n    // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n    // Random suffix guards against two concurrent saves in the same process\n    // racing on the same temp path.\n    const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n    const serialized = JSON.stringify(config, null, 2);\n    await fs.writeFile(tempPath, serialized, { mode: fileMode });\n    await fs.rename(tempPath, configPath);\n  }\n\n  return {\n    async loadAgent(agentId: string): Promise<AgentConfig | undefined> {\n      const key = agentKeyOverride ?? agentId;\n      const config = await readConfig();\n      const stored = config.agents[key];\n      if (!stored) return undefined;\n      return {\n        id: agentId,\n        name: agentId,\n        agent_uri: stored.url,\n        protocol: stored.protocol ?? 'mcp',\n        auth_token: stored.auth_token,\n        oauth_tokens: stored.oauth_tokens,\n        oauth_client: stored.oauth_client,\n        oauth_client_credentials: stored.oauth_client_credentials,\n        oauth_code_verifier: stored.oauth_code_verifier,\n      };\n    },\n\n    async saveAgent(agent: AgentConfig): Promise<void> {\n      const key = agentKeyOverride ?? agent.id;\n      const config = await readConfig();\n      const existing = config.agents[key] ?? { url: agent.agent_uri };\n      config.agents[key] = {\n        ...existing,\n        url: agent.agent_uri,\n        protocol: agent.protocol,\n        ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n        ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n        ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n        ...(agent.oauth_client_credentials !== undefined\n          ? { oauth_client_credentials: agent.oauth_client_credentials }\n          : {}),\n        ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n      };\n      await writeConfig(config);\n    },\n  };\n}\n\nfunction isNotFound(err: unknown): boolean {\n  return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,gBAA+B;AAC/B,kBAAiB;AACjB,oBAA4B;AA+DrB,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,UAAAA,SAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,UAAAA,SAAG,MAAM,YAAAC,QAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,QAAI,2BAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,UAAAD,SAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,UAAAA,SAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,aAAO,OAAO,GAAG,IAAI;AAAA,QACnB,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":["fs","path"]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/**\n * File-backed {@link OAuthConfigStorage} implementation.\n *\n * Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n *\n * On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with\n * `{ url, protocol, auth_token?, oauth_tokens?, oauth_client?, oauth_resource? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n */\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/**\n * Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n */\ninterface StoredAgent {\n  url: string;\n  protocol?: 'mcp' | 'a2a';\n  auth_token?: string;\n  oauth_tokens?: AgentConfig['oauth_tokens'];\n  oauth_client?: AgentConfig['oauth_client'];\n  oauth_resource?: string;\n  oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n  oauth_code_verifier?: string;\n}\n\n/**\n * Shape of the whole config file.\n */\ninterface StoredConfig {\n  agents: Record<string, StoredAgent>;\n  defaults?: Record<string, unknown>;\n}\n\n/**\n * Options for {@link createFileOAuthStorage}.\n */\nexport interface FileOAuthStorageOptions {\n  /** Absolute path to the config JSON file. Must be a file, not a directory. */\n  configPath: string;\n  /**\n   * Key persistence under a stable alias regardless of `agent.id`. Use this\n   * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n   * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n   * should be organized by a long-lived alias chosen by the operator.\n   */\n  agentKey?: string;\n  /**\n   * Create the parent directory (with mode 0o700) if it doesn't exist.\n   * Default true — CLI users expect first-run to create `~/.adcp/`.\n   */\n  autoCreateDir?: boolean;\n  /** File mode for the config file when we create it. Default 0o600. */\n  fileMode?: number;\n}\n\n/**\n * Create a file-backed `OAuthConfigStorage`.\n *\n * Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n *\n * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve\n * everything else.\n *\n * @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n  const configPath = options.configPath;\n  const agentKeyOverride = options.agentKey;\n  const autoCreateDir = options.autoCreateDir ?? true;\n  const fileMode = options.fileMode ?? 0o600;\n\n  async function readConfig(): Promise<StoredConfig> {\n    try {\n      const raw = await fs.readFile(configPath, 'utf-8');\n      const parsed = JSON.parse(raw) as StoredConfig;\n      if (!parsed.agents || typeof parsed.agents !== 'object') parsed.agents = {};\n      return parsed;\n    } catch (err) {\n      if (isNotFound(err)) return { agents: {} };\n      throw err;\n    }\n  }\n\n  async function writeConfig(config: StoredConfig): Promise<void> {\n    if (autoCreateDir) {\n      await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n    }\n    // Atomic write: stage next to the target, then rename. Same filesystem →\n    // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n    // Random suffix guards against two concurrent saves in the same process\n    // racing on the same temp path.\n    const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n    const serialized = JSON.stringify(config, null, 2);\n    await fs.writeFile(tempPath, serialized, { mode: fileMode });\n    await fs.rename(tempPath, configPath);\n  }\n\n  return {\n    async loadAgent(agentId: string): Promise<AgentConfig | undefined> {\n      const key = agentKeyOverride ?? agentId;\n      const config = await readConfig();\n      const stored = config.agents[key];\n      if (!stored) return undefined;\n      return {\n        id: agentId,\n        name: agentId,\n        agent_uri: stored.url,\n        protocol: stored.protocol ?? 'mcp',\n        auth_token: stored.auth_token,\n        oauth_tokens: stored.oauth_tokens,\n        oauth_client: stored.oauth_client,\n        oauth_resource: stored.oauth_resource,\n        oauth_client_credentials: stored.oauth_client_credentials,\n        oauth_code_verifier: stored.oauth_code_verifier,\n      };\n    },\n\n    async saveAgent(agent: AgentConfig): Promise<void> {\n      const key = agentKeyOverride ?? agent.id;\n      const config = await readConfig();\n      const existing = config.agents[key] ?? { url: agent.agent_uri };\n      const next: StoredAgent = {\n        ...existing,\n        url: agent.agent_uri,\n        protocol: agent.protocol,\n        ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n        ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n        ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n        ...(agent.oauth_resource !== undefined ? { oauth_resource: agent.oauth_resource } : {}),\n        ...(agent.oauth_client_credentials !== undefined\n          ? { oauth_client_credentials: agent.oauth_client_credentials }\n          : {}),\n        ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n      };\n      if (agent.oauth_resource === undefined) delete next.oauth_resource;\n      config.agents[key] = next;\n      await writeConfig(config);\n    },\n  };\n}\n\nfunction isNotFound(err: unknown): boolean {\n  return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,gBAA+B;AAC/B,kBAAiB;AACjB,oBAA4B;AAiErB,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,UAAAA,SAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,UAAAA,SAAG,MAAM,YAAAC,QAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,QAAI,2BAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,UAAAD,SAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,UAAAA,SAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,YAAM,OAAoB;AAAA,QACxB,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,mBAAmB,SAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,QACrF,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,UAAI,MAAM,mBAAmB,OAAW,QAAO,KAAK;AACpD,aAAO,OAAO,GAAG,IAAI;AACrB,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":["fs","path"]}

package/dist/lib/auth/oauth/file-storage.mjs

@@ -40,6 +40,7 @@ function createFileOAuthStorage(options) {
         auth_token: stored.auth_token,
         oauth_tokens: stored.oauth_tokens,
         oauth_client: stored.oauth_client,
+        oauth_resource: stored.oauth_resource,
         oauth_client_credentials: stored.oauth_client_credentials,
         oauth_code_verifier: stored.oauth_code_verifier
       };
@@ -48,16 +49,19 @@ function createFileOAuthStorage(options) {
       const key = agentKeyOverride ?? agent.id;
       const config = await readConfig();
       const existing = config.agents[key] ?? { url: agent.agent_uri };
-      config.agents[key] = {
+      const next = {
         ...existing,
         url: agent.agent_uri,
         protocol: agent.protocol,
         ...agent.auth_token !== void 0 ? { auth_token: agent.auth_token } : {},
         ...agent.oauth_tokens !== void 0 ? { oauth_tokens: agent.oauth_tokens } : {},
         ...agent.oauth_client !== void 0 ? { oauth_client: agent.oauth_client } : {},
+        ...agent.oauth_resource !== void 0 ? { oauth_resource: agent.oauth_resource } : {},
         ...agent.oauth_client_credentials !== void 0 ? { oauth_client_credentials: agent.oauth_client_credentials } : {},
         ...agent.oauth_code_verifier !== void 0 ? { oauth_code_verifier: agent.oauth_code_verifier } : {}
       };
+      if (agent.oauth_resource === void 0) delete next.oauth_resource;
+      config.agents[key] = next;
       await writeConfig(config);
     }
   };

package/dist/lib/auth/oauth/file-storage.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/**\n * File-backed {@link OAuthConfigStorage} implementation.\n *\n * Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n *\n * On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with `{ url, protocol, auth_token?, oauth_tokens?, oauth_client? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n */\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/**\n * Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n */\ninterface StoredAgent {\n  url: string;\n  protocol?: 'mcp' | 'a2a';\n  auth_token?: string;\n  oauth_tokens?: AgentConfig['oauth_tokens'];\n  oauth_client?: AgentConfig['oauth_client'];\n  oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n  oauth_code_verifier?: string;\n}\n\n/**\n * Shape of the whole config file.\n */\ninterface StoredConfig {\n  agents: Record<string, StoredAgent>;\n  defaults?: Record<string, unknown>;\n}\n\n/**\n * Options for {@link createFileOAuthStorage}.\n */\nexport interface FileOAuthStorageOptions {\n  /** Absolute path to the config JSON file. Must be a file, not a directory. */\n  configPath: string;\n  /**\n   * Key persistence under a stable alias regardless of `agent.id`. Use this\n   * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n   * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n   * should be organized by a long-lived alias chosen by the operator.\n   */\n  agentKey?: string;\n  /**\n   * Create the parent directory (with mode 0o700) if it doesn't exist.\n   * Default true — CLI users expect first-run to create `~/.adcp/`.\n   */\n  autoCreateDir?: boolean;\n  /** File mode for the config file when we create it. Default 0o600. */\n  fileMode?: number;\n}\n\n/**\n * Create a file-backed `OAuthConfigStorage`.\n *\n * Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n *\n * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, and `oauth_code_verifier`, and we preserve everything else.\n *\n * @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n  const configPath = options.configPath;\n  const agentKeyOverride = options.agentKey;\n  const autoCreateDir = options.autoCreateDir ?? true;\n  const fileMode = options.fileMode ?? 0o600;\n\n  async function readConfig(): Promise<StoredConfig> {\n    try {\n      const raw = await fs.readFile(configPath, 'utf-8');\n      const parsed = JSON.parse(raw) as StoredConfig;\n      if (!parsed.agents || typeof parsed.agents !== 'object') parsed.agents = {};\n      return parsed;\n    } catch (err) {\n      if (isNotFound(err)) return { agents: {} };\n      throw err;\n    }\n  }\n\n  async function writeConfig(config: StoredConfig): Promise<void> {\n    if (autoCreateDir) {\n      await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n    }\n    // Atomic write: stage next to the target, then rename. Same filesystem →\n    // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n    // Random suffix guards against two concurrent saves in the same process\n    // racing on the same temp path.\n    const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n    const serialized = JSON.stringify(config, null, 2);\n    await fs.writeFile(tempPath, serialized, { mode: fileMode });\n    await fs.rename(tempPath, configPath);\n  }\n\n  return {\n    async loadAgent(agentId: string): Promise<AgentConfig | undefined> {\n      const key = agentKeyOverride ?? agentId;\n      const config = await readConfig();\n      const stored = config.agents[key];\n      if (!stored) return undefined;\n      return {\n        id: agentId,\n        name: agentId,\n        agent_uri: stored.url,\n        protocol: stored.protocol ?? 'mcp',\n        auth_token: stored.auth_token,\n        oauth_tokens: stored.oauth_tokens,\n        oauth_client: stored.oauth_client,\n        oauth_client_credentials: stored.oauth_client_credentials,\n        oauth_code_verifier: stored.oauth_code_verifier,\n      };\n    },\n\n    async saveAgent(agent: AgentConfig): Promise<void> {\n      const key = agentKeyOverride ?? agent.id;\n      const config = await readConfig();\n      const existing = config.agents[key] ?? { url: agent.agent_uri };\n      config.agents[key] = {\n        ...existing,\n        url: agent.agent_uri,\n        protocol: agent.protocol,\n        ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n        ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n        ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n        ...(agent.oauth_client_credentials !== undefined\n          ? { oauth_client_credentials: agent.oauth_client_credentials }\n          : {}),\n        ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n      };\n      await writeConfig(config);\n    },\n  };\n}\n\nfunction isNotFound(err: unknown): boolean {\n  return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":"AAYA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,mBAAmB;AA+DrB,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,GAAG,MAAM,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,GAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,GAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,aAAO,OAAO,GAAG,IAAI;AAAA,QACnB,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/file-storage.ts"],"sourcesContent":["/**\n * File-backed {@link OAuthConfigStorage} implementation.\n *\n * Persists refreshed OAuth tokens back to a JSON file so that subsequent\n * `callTool` invocations use the latest access + refresh tokens without\n * triggering a redundant refresh (or worse, a re-login).\n *\n * On-disk format is the shape used by the `adcp` CLI's agents.json — agents\n * keyed by alias, each with\n * `{ url, protocol, auth_token?, oauth_tokens?, oauth_client?, oauth_resource? }`.\n * Library consumers who want a different shape can implement\n * {@link OAuthConfigStorage} directly.\n */\nimport { promises as fs } from 'fs';\nimport path from 'path';\nimport { randomBytes } from 'crypto';\nimport type { AgentConfig } from '../../types/adcp';\nimport type { OAuthConfigStorage } from './types';\n\n/**\n * Shape of a single agent record on disk (matches the `adcp` CLI's config format).\n */\ninterface StoredAgent {\n  url: string;\n  protocol?: 'mcp' | 'a2a';\n  auth_token?: string;\n  oauth_tokens?: AgentConfig['oauth_tokens'];\n  oauth_client?: AgentConfig['oauth_client'];\n  oauth_resource?: string;\n  oauth_client_credentials?: AgentConfig['oauth_client_credentials'];\n  oauth_code_verifier?: string;\n}\n\n/**\n * Shape of the whole config file.\n */\ninterface StoredConfig {\n  agents: Record<string, StoredAgent>;\n  defaults?: Record<string, unknown>;\n}\n\n/**\n * Options for {@link createFileOAuthStorage}.\n */\nexport interface FileOAuthStorageOptions {\n  /** Absolute path to the config JSON file. Must be a file, not a directory. */\n  configPath: string;\n  /**\n   * Key persistence under a stable alias regardless of `agent.id`. Use this\n   * when the in-memory `AgentConfig` carries an ephemeral identifier (e.g.\n   * a per-request tenant id, or a synthetic `cli-agent`) but on-disk storage\n   * should be organized by a long-lived alias chosen by the operator.\n   */\n  agentKey?: string;\n  /**\n   * Create the parent directory (with mode 0o700) if it doesn't exist.\n   * Default true — CLI users expect first-run to create `~/.adcp/`.\n   */\n  autoCreateDir?: boolean;\n  /** File mode for the config file when we create it. Default 0o600. */\n  fileMode?: number;\n}\n\n/**\n * Create a file-backed `OAuthConfigStorage`.\n *\n * Reads are cheap: a single JSON.parse per call. Writes are atomic via\n * `write-then-rename` so a crash mid-save cannot produce a half-written file.\n *\n * Does NOT touch fields outside the OAuth envelope (`auth_token`, custom\n * fields) when saving — the MCP provider only mutates `oauth_tokens`,\n * `oauth_client`, `oauth_resource`, and `oauth_code_verifier`, and we preserve\n * everything else.\n *\n * @example\n * ```ts\n * const storage = createFileOAuthStorage({ configPath: '/home/user/.adcp/config.json' });\n * const provider = createNonInteractiveOAuthProvider(agent, { storage });\n * ```\n */\nexport function createFileOAuthStorage(options: FileOAuthStorageOptions): OAuthConfigStorage {\n  const configPath = options.configPath;\n  const agentKeyOverride = options.agentKey;\n  const autoCreateDir = options.autoCreateDir ?? true;\n  const fileMode = options.fileMode ?? 0o600;\n\n  async function readConfig(): Promise<StoredConfig> {\n    try {\n      const raw = await fs.readFile(configPath, 'utf-8');\n      const parsed = JSON.parse(raw) as StoredConfig;\n      if (!parsed.agents || typeof parsed.agents !== 'object') parsed.agents = {};\n      return parsed;\n    } catch (err) {\n      if (isNotFound(err)) return { agents: {} };\n      throw err;\n    }\n  }\n\n  async function writeConfig(config: StoredConfig): Promise<void> {\n    if (autoCreateDir) {\n      await fs.mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });\n    }\n    // Atomic write: stage next to the target, then rename. Same filesystem →\n    // rename is atomic on POSIX and on NTFS (MoveFileEx under the hood).\n    // Random suffix guards against two concurrent saves in the same process\n    // racing on the same temp path.\n    const tempPath = `${configPath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;\n    const serialized = JSON.stringify(config, null, 2);\n    await fs.writeFile(tempPath, serialized, { mode: fileMode });\n    await fs.rename(tempPath, configPath);\n  }\n\n  return {\n    async loadAgent(agentId: string): Promise<AgentConfig | undefined> {\n      const key = agentKeyOverride ?? agentId;\n      const config = await readConfig();\n      const stored = config.agents[key];\n      if (!stored) return undefined;\n      return {\n        id: agentId,\n        name: agentId,\n        agent_uri: stored.url,\n        protocol: stored.protocol ?? 'mcp',\n        auth_token: stored.auth_token,\n        oauth_tokens: stored.oauth_tokens,\n        oauth_client: stored.oauth_client,\n        oauth_resource: stored.oauth_resource,\n        oauth_client_credentials: stored.oauth_client_credentials,\n        oauth_code_verifier: stored.oauth_code_verifier,\n      };\n    },\n\n    async saveAgent(agent: AgentConfig): Promise<void> {\n      const key = agentKeyOverride ?? agent.id;\n      const config = await readConfig();\n      const existing = config.agents[key] ?? { url: agent.agent_uri };\n      const next: StoredAgent = {\n        ...existing,\n        url: agent.agent_uri,\n        protocol: agent.protocol,\n        ...(agent.auth_token !== undefined ? { auth_token: agent.auth_token } : {}),\n        ...(agent.oauth_tokens !== undefined ? { oauth_tokens: agent.oauth_tokens } : {}),\n        ...(agent.oauth_client !== undefined ? { oauth_client: agent.oauth_client } : {}),\n        ...(agent.oauth_resource !== undefined ? { oauth_resource: agent.oauth_resource } : {}),\n        ...(agent.oauth_client_credentials !== undefined\n          ? { oauth_client_credentials: agent.oauth_client_credentials }\n          : {}),\n        ...(agent.oauth_code_verifier !== undefined ? { oauth_code_verifier: agent.oauth_code_verifier } : {}),\n      };\n      if (agent.oauth_resource === undefined) delete next.oauth_resource;\n      config.agents[key] = next;\n      await writeConfig(config);\n    },\n  };\n}\n\nfunction isNotFound(err: unknown): boolean {\n  return Boolean(err && typeof err === 'object' && (err as { code?: string }).code === 'ENOENT');\n}\n"],"mappings":"AAaA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,mBAAmB;AAiErB,SAAS,uBAAuB,SAAsD;AAC3F,QAAM,aAAa,QAAQ;AAC3B,QAAM,mBAAmB,QAAQ;AACjC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,aAAoC;AACjD,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,SAAS,YAAY,OAAO;AACjD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,CAAC,OAAO,UAAU,OAAO,OAAO,WAAW,SAAU,QAAO,SAAS,CAAC;AAC1E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,WAAW,GAAG,EAAG,QAAO,EAAE,QAAQ,CAAC,EAAE;AACzC,YAAM;AAAA,IACR;AAAA,EACF;AAEA,iBAAe,YAAY,QAAqC;AAC9D,QAAI,eAAe;AACjB,YAAM,GAAG,MAAM,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IAC3E;AAKA,UAAM,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAC/E,UAAM,aAAa,KAAK,UAAU,QAAQ,MAAM,CAAC;AACjD,UAAM,GAAG,UAAU,UAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3D,UAAM,GAAG,OAAO,UAAU,UAAU;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,SAAmD;AACjE,YAAM,MAAM,oBAAoB;AAChC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,SAAS,OAAO,OAAO,GAAG;AAChC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO,YAAY;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,0BAA0B,OAAO;AAAA,QACjC,qBAAqB,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,OAAmC;AACjD,YAAM,MAAM,oBAAoB,MAAM;AACtC,YAAM,SAAS,MAAM,WAAW;AAChC,YAAM,WAAW,OAAO,OAAO,GAAG,KAAK,EAAE,KAAK,MAAM,UAAU;AAC9D,YAAM,OAAoB;AAAA,QACxB,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,QACzE,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,QAC/E,GAAI,MAAM,mBAAmB,SAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,QACrF,GAAI,MAAM,6BAA6B,SACnC,EAAE,0BAA0B,MAAM,yBAAyB,IAC3D,CAAC;AAAA,QACL,GAAI,MAAM,wBAAwB,SAAY,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,MACtG;AACA,UAAI,MAAM,mBAAmB,OAAW,QAAO,KAAK;AACpD,aAAO,OAAO,GAAG,IAAI;AACrB,YAAM,YAAY,MAAM;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO,QAAQ,OAAO,OAAO,QAAQ,YAAa,IAA0B,SAAS,QAAQ;AAC/F;","names":[]}

package/dist/lib/auth/oauth/index.d.mts

@@ -34,7 +34,7 @@ export type { OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, OAuthCl
 export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutError, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo, } from './types.mjs';
 export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler.mjs';
 export { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler.mjs';
-export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow.mjs';
+export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, AgentChangedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow.mjs';
 export { MCPOAuthProvider } from './MCPOAuthProvider.mjs';
 import { MCPOAuthProvider } from './MCPOAuthProvider.mjs';
 import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types.mjs';
@@ -85,6 +85,8 @@ export declare function createCLIOAuthProvider(agent: AgentConfig, options?: {
     quiet?: boolean;
     /** Storage for persisting agent config */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override; `null` returns to metadata discovery. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.
@@ -108,6 +110,8 @@ export declare function createNonInteractiveOAuthProvider(agent: AgentConfig, op
     clientMetadata?: Partial<OAuthClientMetadata>;
     /** Storage for persisting refreshed tokens back to disk. */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override reused during refresh; `null` disables it. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.

package/dist/lib/auth/oauth/index.d.ts

@@ -34,7 +34,7 @@ export type { OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, OAuthCl
 export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutError, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo, } from './types';
 export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';
 export { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';
-export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow';
+export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, AgentChangedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow';
 export { MCPOAuthProvider } from './MCPOAuthProvider';
 import { MCPOAuthProvider } from './MCPOAuthProvider';
 import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';
@@ -85,6 +85,8 @@ export declare function createCLIOAuthProvider(agent: AgentConfig, options?: {
     quiet?: boolean;
     /** Storage for persisting agent config */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override; `null` returns to metadata discovery. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.
@@ -108,6 +110,8 @@ export declare function createNonInteractiveOAuthProvider(agent: AgentConfig, op
     clientMetadata?: Partial<OAuthClientMetadata>;
     /** Storage for persisting refreshed tokens back to disk. */
     storage?: OAuthConfigStorage;
+    /** Operator RFC 8707 override reused during refresh; `null` disables it. */
+    resourceOverride?: string | null;
     /**
      * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource
      * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.

package/dist/lib/auth/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAM9G,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,kBAAkB,EAClB,8BAA8B,EAC9B,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,8BAA8B;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,CAsBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,CAgBlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAa/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAIzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAO5E;AAGD,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAKpB,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAKtF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACpC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,YAAY,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK3F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAM9G,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,kBAAkB,EAClB,8BAA8B,EAC9B,4BAA4B,EAC5B,2BAA2B,EAC3B,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,8BAA8B;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,CAuBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,gBAAgB,CAiBlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAa/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAIzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAO5E;AAGD,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAKpB,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAKtF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACpC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,YAAY,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK3F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC"}

package/dist/lib/auth/oauth/index.js

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var oauth_exports = {};
 __export(oauth_exports, {
   AUTH_DIAGNOSIS_SCHEMA_VERSION: () => import_diagnose.AUTH_DIAGNOSIS_SCHEMA_VERSION,
+  AgentChangedDuringFlowError: () => import_web_flow.AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError: () => import_web_flow.AgentVanishedDuringFlowError,
   BrowserBindingRequiredError: () => import_web_flow.BrowserBindingRequiredError,
   CLIFlowHandler: () => import_CLIFlowHandler.CLIFlowHandler,
@@ -108,6 +109,7 @@ function createCLIOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -123,6 +125,7 @@ function createNonInteractiveOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -162,6 +165,7 @@ function getEffectiveAuthToken(agent) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
+  AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   CLIFlowHandler,

package/dist/lib/auth/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/index.ts"],"sourcesContent":["/**\n * OAuth module for MCP authentication\n *\n * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.\n *\n * @example\n * ```typescript\n * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/sdk';\n *\n * // Agent config - tokens will be stored here\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // After OAuth flow completes:\n *   // oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * // Create provider with CLI flow handler\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens to file/db\n * });\n *\n * // Use with MCP transport\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\n\n// Types\nexport type {\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n  AgentConfig,\n  AgentOAuthTokens,\n  AgentOAuthClient,\n} from './types';\n\nexport {\n  DEFAULT_CLIENT_METADATA,\n  OAuthError,\n  OAuthCancelledError,\n  OAuthTimeoutError,\n  toMCPTokens,\n  fromMCPTokens,\n  toMCPClientInfo,\n  fromMCPClientInfo,\n} from './types';\n\n// Flow handlers\nexport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nexport { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';\n\n// Web (server-side) OAuth flow — companion to CLIFlowHandler for environments\n// where /oauth/start and /oauth/callback may be served by different processes.\n// Note: standalone functions, NOT a class implementing OAuthFlowHandler — see\n// docs/guides/WEB-OAUTH.md for the rationale (the contract spans two requests).\nexport {\n  startWebOAuthFlow,\n  completeWebOAuthFlow,\n  safeReturnTo,\n  InMemoryPendingFlowStore,\n  InvalidOrExpiredFlowError,\n  StateMismatchError,\n  BrowserBindingRequiredError,\n  TokenExchangeError,\n  ProtectedResourceMetadataError,\n  AgentVanishedDuringFlowError,\n  ConfidentialClientNotAllowedError,\n  DEFAULT_WEB_FLOW_TTL_MS,\n  type PendingWebFlow,\n  type PendingWebFlowStore,\n  type PendingFlowStore,\n  type StartWebFlowOptions,\n  type StartWebFlowResult,\n  type CompleteWebFlowOptions,\n  type CompleteWebFlowResult,\n} from './web-flow';\n\n// Main provider\nexport { MCPOAuthProvider } from './MCPOAuthProvider';\n\n// ========================================\n// Convenience factory functions\n// ========================================\n\nimport { MCPOAuthProvider } from './MCPOAuthProvider';\nimport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nimport { NonInteractiveFlowHandler } from './NonInteractiveFlowHandler';\nimport type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';\nimport { DEFAULT_CLIENT_METADATA } from './types';\n\n/**\n * Create an OAuth provider for CLI usage\n *\n * @param agent Agent configuration (tokens stored here)\n * @param options Optional configuration\n * @returns Configured OAuth provider\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp'\n * };\n *\n * const provider = createCLIOAuthProvider(agent);\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n *\n * try {\n *   await client.connect(transport);\n * } catch (error) {\n *   if (error instanceof UnauthorizedError) {\n *     const code = await provider.waitForCallback();\n *     await transport.finishAuth(code);\n *     await client.connect(transport);\n *   }\n * }\n *\n * // After successful auth, agent.oauth_tokens is populated\n * console.log(agent.oauth_tokens);\n * ```\n */\nexport function createCLIOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Callback port (default: 8766) */\n    callbackPort?: number;\n    /** Auth timeout in ms (default: 300000 = 5 min) */\n    timeout?: number;\n    /** Custom client metadata overrides */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Suppress console output */\n    quiet?: boolean;\n    /** Storage for persisting agent config */\n    storage?: OAuthConfigStorage;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowConfig: CLIFlowHandlerConfig = {\n    callbackPort: options?.callbackPort,\n    timeout: options?.timeout,\n    quiet: options?.quiet,\n  };\n  const flowHandler = new CLIFlowHandler(flowConfig);\n\n  // Build complete client metadata\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Create an OAuth provider that uses and auto-refreshes saved tokens but\n * refuses to start a new interactive browser flow. Use this for storyboard\n * runs, scheduled jobs, and other non-interactive contexts where you've\n * already saved tokens via `createCLIOAuthProvider`.\n *\n * If refresh fails (e.g., the refresh_token is revoked or expired), the\n * MCP SDK will throw `UnauthorizedError` at call time — the caller should\n * treat that as a signal to run `adcp --save-auth <alias> --oauth` and retry.\n */\nexport function createNonInteractiveOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Hint shown in error messages if an interactive flow is attempted. */\n    agentHint?: string;\n    /** Custom client metadata overrides (inherited from saved registration in practice). */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Storage for persisting refreshed tokens back to disk. */\n    storage?: OAuthConfigStorage;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowHandler = new NonInteractiveFlowHandler({ agentHint: options?.agentHint });\n\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Check if an error indicates OAuth is required\n */\nexport function isOAuthRequired(error: unknown): boolean {\n  if (error instanceof Error) {\n    if (error.name === 'UnauthorizedError') return true;\n    const msg = error.message.toLowerCase();\n    if (msg.includes('unauthorized') || msg.includes('authentication required') || msg.includes('oauth')) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Check if an agent has valid OAuth tokens\n */\nexport function hasValidOAuthTokens(agent: AgentConfig): boolean {\n  const tokens = agent.oauth_tokens;\n  if (!tokens?.access_token) return false;\n\n  if (tokens.expires_at) {\n    const expiresAt = new Date(tokens.expires_at);\n    // Expired if within 5 minutes of expiration\n    if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\n/**\n * Clear OAuth tokens from an agent config\n */\nexport function clearOAuthTokens(agent: AgentConfig): void {\n  delete agent.oauth_tokens;\n  delete agent.oauth_client;\n  delete agent.oauth_code_verifier;\n}\n\n/**\n * Get the effective auth token for an agent\n * Returns OAuth access_token if available, otherwise static auth_token\n */\nexport function getEffectiveAuthToken(agent: AgentConfig): string | undefined {\n  // Prefer OAuth if available and valid\n  if (hasValidOAuthTokens(agent)) {\n    return agent.oauth_tokens!.access_token;\n  }\n  // Fall back to static token\n  return agent.auth_token;\n}\n\n// OAuth discovery\nexport {\n  discoverOAuthMetadata,\n  supportsOAuth,\n  supportsDynamicRegistration,\n  type OAuthMetadata,\n  type DiscoveryOptions,\n} from './discovery';\n\n// Diagnostics utilities — for `adcp diagnose-auth` and consumer introspection\nexport {\n  parseWWWAuthenticate,\n  decodeAccessTokenClaims,\n  validateTokenAudience,\n  type WWWAuthenticateChallenge,\n  type DecodedJWTHeader,\n  type DecodedJWTClaims,\n  type DecodedAccessToken,\n  type TokenAudienceResult,\n} from './diagnostics';\n\n// End-to-end OAuth handshake diagnosis (powers `adcp diagnose-auth`)\nexport {\n  runAuthDiagnosis,\n  AUTH_DIAGNOSIS_SCHEMA_VERSION,\n  type DiagnoseOptions,\n  type HttpCapture,\n  type DiagnosisStep,\n  type Hypothesis,\n  type HypothesisVerdict,\n  type AuthDiagnosisReport,\n} from './diagnose';\n\n// Zero-config authorization discovery + actionable error type.\n// Raised automatically by `ProtocolClient.callTool` when an MCP agent returns\n// a 401 Bearer challenge and the caller has no saved tokens.\nexport {\n  NeedsAuthorizationError,\n  discoverAuthorizationRequirements,\n  probeAuthChallenge,\n  type AuthorizationRequirements,\n  type DiscoverAuthorizationOptions,\n} from './authorization-required';\n\n// File-backed `OAuthConfigStorage` implementation (agents.json format).\nexport { createFileOAuthStorage, type FileOAuthStorageOptions } from './file-storage';\n\n// OAuth 2.0 client credentials grant (RFC 6749 §4.4) for machine-to-machine\n// token exchange. Used by the CLI for automated compliance runs where there\n// is no user to walk through an authorization-code flow.\nexport {\n  exchangeClientCredentials,\n  ensureClientCredentialsTokens,\n  ClientCredentialsExchangeError,\n  type ExchangeClientCredentialsOptions,\n  type EnsureClientCredentialsOptions,\n} from './ClientCredentialsFlow';\n\n// `$ENV:VAR` indirection for client credentials so secrets can live in env\n// vars (CI) rather than on disk in the agent config.\nexport {\n  resolveSecret,\n  isEnvSecretReference,\n  toEnvSecretReference,\n  extractEnvSecretName,\n  MissingEnvSecretError,\n} from './secret-resolver';\n\n// Type re-export — the credentials struct itself lives in the ADCP core types\n// module alongside `AgentOAuthTokens` / `AgentOAuthClient`.\nexport type { AgentOAuthClientCredentials } from '../../types/adcp';\n\n// Per-agent storage binding — the bridge that lets `callTool` pick up the\n// caller's chosen `OAuthConfigStorage` without a signature change.\nexport { bindAgentStorage, getAgentStorage, unbindAgentStorage } from './storage-registry';\n\n// Re-exported MCP SDK OAuth error types so consumers can discriminate 401 causes\n// without string-matching on error messages. These originate from the MCP server\n// auth module but are the canonical OAuth error classes for client-side handling too.\nexport { InvalidTokenError, InsufficientScopeError } from '@modelcontextprotocol/sdk/server/auth/errors.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+CA,mBASO;AAGP,4BAA0D;AAC1D,uCAAgF;AAMhF,sBAoBO;AAGP,8BAAiC;AAMjC,IAAAA,2BAAiC;AACjC,IAAAC,yBAA0D;AAC1D,IAAAC,oCAA0C;AAE1C,IAAAC,gBAAwC;AAmLxC,uBAMO;AAGP,yBASO;AAGP,sBASO;AAKP,oCAMO;AAGP,0BAAqE;AAKrE,mCAMO;AAIP,6BAMO;AAQP,8BAAsE;AAKtE,oBAA0D;AA3NnD,SAAS,uBACd,OACA,SAiBkB;AAClB,QAAM,aAAmC;AAAA,IACvC,cAAc,SAAS;AAAA,IACvB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS;AAAA,EAClB;AACA,QAAM,cAAc,IAAI,sCAAe,UAAU;AAGjD,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAYO,SAAS,kCACd,OACA,SAakB;AAClB,QAAM,cAAc,IAAI,4DAA0B,EAAE,WAAW,SAAS,UAAU,CAAC;AAEnF,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,gBAAgB,OAAyB;AACvD,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,oBAAqB,QAAO;AAC/C,UAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,yBAAyB,KAAK,IAAI,SAAS,OAAO,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,OAA6B;AAC/D,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,aAAc,QAAO;AAElC,MAAI,OAAO,YAAY;AACrB,UAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,QAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,iBAAiB,OAA0B;AACzD,SAAO,MAAM;AACb,SAAO,MAAM;AACb,SAAO,MAAM;AACf;AAMO,SAAS,sBAAsB,OAAwC;AAE5E,MAAI,oBAAoB,KAAK,GAAG;AAC9B,WAAO,MAAM,aAAc;AAAA,EAC7B;AAEA,SAAO,MAAM;AACf;","names":["import_MCPOAuthProvider","import_CLIFlowHandler","import_NonInteractiveFlowHandler","import_types"]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/index.ts"],"sourcesContent":["/**\n * OAuth module for MCP authentication\n *\n * OAuth tokens are stored directly in AgentConfig, same as static auth tokens.\n *\n * @example\n * ```typescript\n * import { MCPOAuthProvider, CLIFlowHandler } from '@adcp/sdk';\n *\n * // Agent config - tokens will be stored here\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp',\n *   // After OAuth flow completes:\n *   // oauth_tokens: { access_token: '...', refresh_token: '...' }\n * };\n *\n * // Create provider with CLI flow handler\n * const provider = new MCPOAuthProvider({\n *   agent,\n *   flowHandler: new CLIFlowHandler(),\n *   storage: myConfigStorage  // Optional: persists tokens to file/db\n * });\n *\n * // Use with MCP transport\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n * ```\n */\n\n// Types\nexport type {\n  OAuthFlowHandler,\n  OAuthProviderConfig,\n  OAuthConfigStorage,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens,\n  AgentConfig,\n  AgentOAuthTokens,\n  AgentOAuthClient,\n} from './types';\n\nexport {\n  DEFAULT_CLIENT_METADATA,\n  OAuthError,\n  OAuthCancelledError,\n  OAuthTimeoutError,\n  toMCPTokens,\n  fromMCPTokens,\n  toMCPClientInfo,\n  fromMCPClientInfo,\n} from './types';\n\n// Flow handlers\nexport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nexport { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';\n\n// Web (server-side) OAuth flow — companion to CLIFlowHandler for environments\n// where /oauth/start and /oauth/callback may be served by different processes.\n// Note: standalone functions, NOT a class implementing OAuthFlowHandler — see\n// docs/guides/WEB-OAUTH.md for the rationale (the contract spans two requests).\nexport {\n  startWebOAuthFlow,\n  completeWebOAuthFlow,\n  safeReturnTo,\n  InMemoryPendingFlowStore,\n  InvalidOrExpiredFlowError,\n  StateMismatchError,\n  BrowserBindingRequiredError,\n  TokenExchangeError,\n  ProtectedResourceMetadataError,\n  AgentVanishedDuringFlowError,\n  AgentChangedDuringFlowError,\n  ConfidentialClientNotAllowedError,\n  DEFAULT_WEB_FLOW_TTL_MS,\n  type PendingWebFlow,\n  type PendingWebFlowStore,\n  type PendingFlowStore,\n  type StartWebFlowOptions,\n  type StartWebFlowResult,\n  type CompleteWebFlowOptions,\n  type CompleteWebFlowResult,\n} from './web-flow';\n\n// Main provider\nexport { MCPOAuthProvider } from './MCPOAuthProvider';\n\n// ========================================\n// Convenience factory functions\n// ========================================\n\nimport { MCPOAuthProvider } from './MCPOAuthProvider';\nimport { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';\nimport { NonInteractiveFlowHandler } from './NonInteractiveFlowHandler';\nimport type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';\nimport { DEFAULT_CLIENT_METADATA } from './types';\n\n/**\n * Create an OAuth provider for CLI usage\n *\n * @param agent Agent configuration (tokens stored here)\n * @param options Optional configuration\n * @returns Configured OAuth provider\n *\n * @example\n * ```typescript\n * const agent: AgentConfig = {\n *   id: 'my-agent',\n *   name: 'My Agent',\n *   agent_uri: 'https://agent.example.com/mcp',\n *   protocol: 'mcp'\n * };\n *\n * const provider = createCLIOAuthProvider(agent);\n *\n * const transport = new StreamableHTTPClientTransport(url, {\n *   authProvider: provider\n * });\n *\n * try {\n *   await client.connect(transport);\n * } catch (error) {\n *   if (error instanceof UnauthorizedError) {\n *     const code = await provider.waitForCallback();\n *     await transport.finishAuth(code);\n *     await client.connect(transport);\n *   }\n * }\n *\n * // After successful auth, agent.oauth_tokens is populated\n * console.log(agent.oauth_tokens);\n * ```\n */\nexport function createCLIOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Callback port (default: 8766) */\n    callbackPort?: number;\n    /** Auth timeout in ms (default: 300000 = 5 min) */\n    timeout?: number;\n    /** Custom client metadata overrides */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Suppress console output */\n    quiet?: boolean;\n    /** Storage for persisting agent config */\n    storage?: OAuthConfigStorage;\n    /** Operator RFC 8707 override; `null` returns to metadata discovery. */\n    resourceOverride?: string | null;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowConfig: CLIFlowHandlerConfig = {\n    callbackPort: options?.callbackPort,\n    timeout: options?.timeout,\n    quiet: options?.quiet,\n  };\n  const flowHandler = new CLIFlowHandler(flowConfig);\n\n  // Build complete client metadata\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    resourceOverride: options?.resourceOverride,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Create an OAuth provider that uses and auto-refreshes saved tokens but\n * refuses to start a new interactive browser flow. Use this for storyboard\n * runs, scheduled jobs, and other non-interactive contexts where you've\n * already saved tokens via `createCLIOAuthProvider`.\n *\n * If refresh fails (e.g., the refresh_token is revoked or expired), the\n * MCP SDK will throw `UnauthorizedError` at call time — the caller should\n * treat that as a signal to run `adcp --save-auth <alias> --oauth` and retry.\n */\nexport function createNonInteractiveOAuthProvider(\n  agent: AgentConfig,\n  options?: {\n    /** Hint shown in error messages if an interactive flow is attempted. */\n    agentHint?: string;\n    /** Custom client metadata overrides (inherited from saved registration in practice). */\n    clientMetadata?: Partial<OAuthClientMetadata>;\n    /** Storage for persisting refreshed tokens back to disk. */\n    storage?: OAuthConfigStorage;\n    /** Operator RFC 8707 override reused during refresh; `null` disables it. */\n    resourceOverride?: string | null;\n    /**\n     * Allow non-HTTPS resource URLs advertised in RFC 9728 protected-resource\n     * metadata. Mirrors the CLI's `--allow-http` flag. Defaults to `false`.\n     */\n    allowHttp?: boolean;\n  }\n): MCPOAuthProvider {\n  const flowHandler = new NonInteractiveFlowHandler({ agentHint: options?.agentHint });\n\n  const clientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    redirect_uris: [flowHandler.getRedirectUrl().toString()],\n    ...options?.clientMetadata,\n  };\n\n  return new MCPOAuthProvider({\n    agent,\n    flowHandler,\n    storage: options?.storage,\n    resourceOverride: options?.resourceOverride,\n    clientMetadata,\n    allowHttp: options?.allowHttp,\n  });\n}\n\n/**\n * Check if an error indicates OAuth is required\n */\nexport function isOAuthRequired(error: unknown): boolean {\n  if (error instanceof Error) {\n    if (error.name === 'UnauthorizedError') return true;\n    const msg = error.message.toLowerCase();\n    if (msg.includes('unauthorized') || msg.includes('authentication required') || msg.includes('oauth')) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Check if an agent has valid OAuth tokens\n */\nexport function hasValidOAuthTokens(agent: AgentConfig): boolean {\n  const tokens = agent.oauth_tokens;\n  if (!tokens?.access_token) return false;\n\n  if (tokens.expires_at) {\n    const expiresAt = new Date(tokens.expires_at);\n    // Expired if within 5 minutes of expiration\n    if (expiresAt.getTime() - Date.now() < 5 * 60 * 1000) {\n      return false;\n    }\n  }\n\n  return true;\n}\n\n/**\n * Clear OAuth tokens from an agent config\n */\nexport function clearOAuthTokens(agent: AgentConfig): void {\n  delete agent.oauth_tokens;\n  delete agent.oauth_client;\n  delete agent.oauth_code_verifier;\n}\n\n/**\n * Get the effective auth token for an agent\n * Returns OAuth access_token if available, otherwise static auth_token\n */\nexport function getEffectiveAuthToken(agent: AgentConfig): string | undefined {\n  // Prefer OAuth if available and valid\n  if (hasValidOAuthTokens(agent)) {\n    return agent.oauth_tokens!.access_token;\n  }\n  // Fall back to static token\n  return agent.auth_token;\n}\n\n// OAuth discovery\nexport {\n  discoverOAuthMetadata,\n  supportsOAuth,\n  supportsDynamicRegistration,\n  type OAuthMetadata,\n  type DiscoveryOptions,\n} from './discovery';\n\n// Diagnostics utilities — for `adcp diagnose-auth` and consumer introspection\nexport {\n  parseWWWAuthenticate,\n  decodeAccessTokenClaims,\n  validateTokenAudience,\n  type WWWAuthenticateChallenge,\n  type DecodedJWTHeader,\n  type DecodedJWTClaims,\n  type DecodedAccessToken,\n  type TokenAudienceResult,\n} from './diagnostics';\n\n// End-to-end OAuth handshake diagnosis (powers `adcp diagnose-auth`)\nexport {\n  runAuthDiagnosis,\n  AUTH_DIAGNOSIS_SCHEMA_VERSION,\n  type DiagnoseOptions,\n  type HttpCapture,\n  type DiagnosisStep,\n  type Hypothesis,\n  type HypothesisVerdict,\n  type AuthDiagnosisReport,\n} from './diagnose';\n\n// Zero-config authorization discovery + actionable error type.\n// Raised automatically by `ProtocolClient.callTool` when an MCP agent returns\n// a 401 Bearer challenge and the caller has no saved tokens.\nexport {\n  NeedsAuthorizationError,\n  discoverAuthorizationRequirements,\n  probeAuthChallenge,\n  type AuthorizationRequirements,\n  type DiscoverAuthorizationOptions,\n} from './authorization-required';\n\n// File-backed `OAuthConfigStorage` implementation (agents.json format).\nexport { createFileOAuthStorage, type FileOAuthStorageOptions } from './file-storage';\n\n// OAuth 2.0 client credentials grant (RFC 6749 §4.4) for machine-to-machine\n// token exchange. Used by the CLI for automated compliance runs where there\n// is no user to walk through an authorization-code flow.\nexport {\n  exchangeClientCredentials,\n  ensureClientCredentialsTokens,\n  ClientCredentialsExchangeError,\n  type ExchangeClientCredentialsOptions,\n  type EnsureClientCredentialsOptions,\n} from './ClientCredentialsFlow';\n\n// `$ENV:VAR` indirection for client credentials so secrets can live in env\n// vars (CI) rather than on disk in the agent config.\nexport {\n  resolveSecret,\n  isEnvSecretReference,\n  toEnvSecretReference,\n  extractEnvSecretName,\n  MissingEnvSecretError,\n} from './secret-resolver';\n\n// Type re-export — the credentials struct itself lives in the ADCP core types\n// module alongside `AgentOAuthTokens` / `AgentOAuthClient`.\nexport type { AgentOAuthClientCredentials } from '../../types/adcp';\n\n// Per-agent storage binding — the bridge that lets `callTool` pick up the\n// caller's chosen `OAuthConfigStorage` without a signature change.\nexport { bindAgentStorage, getAgentStorage, unbindAgentStorage } from './storage-registry';\n\n// Re-exported MCP SDK OAuth error types so consumers can discriminate 401 causes\n// without string-matching on error messages. These originate from the MCP server\n// auth module but are the canonical OAuth error classes for client-side handling too.\nexport { InvalidTokenError, InsufficientScopeError } from '@modelcontextprotocol/sdk/server/auth/errors.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+CA,mBASO;AAGP,4BAA0D;AAC1D,uCAAgF;AAMhF,sBAqBO;AAGP,8BAAiC;AAMjC,IAAAA,2BAAiC;AACjC,IAAAC,yBAA0D;AAC1D,IAAAC,oCAA0C;AAE1C,IAAAC,gBAAwC;AAyLxC,uBAMO;AAGP,yBASO;AAGP,sBASO;AAKP,oCAMO;AAGP,0BAAqE;AAKrE,mCAMO;AAIP,6BAMO;AAQP,8BAAsE;AAKtE,oBAA0D;AAjOnD,SAAS,uBACd,OACA,SAmBkB;AAClB,QAAM,aAAmC;AAAA,IACvC,cAAc,SAAS;AAAA,IACvB,SAAS,SAAS;AAAA,IAClB,OAAO,SAAS;AAAA,EAClB;AACA,QAAM,cAAc,IAAI,sCAAe,UAAU;AAGjD,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAYO,SAAS,kCACd,OACA,SAekB;AAClB,QAAM,cAAc,IAAI,4DAA0B,EAAE,WAAW,SAAS,UAAU,CAAC;AAEnF,QAAM,iBAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,eAAe,CAAC,YAAY,eAAe,EAAE,SAAS,CAAC;AAAA,IACvD,GAAG,SAAS;AAAA,EACd;AAEA,SAAO,IAAI,0CAAiB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,SAAS,SAAS;AAAA,IAClB,kBAAkB,SAAS;AAAA,IAC3B;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,gBAAgB,OAAyB;AACvD,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,oBAAqB,QAAO;AAC/C,UAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,yBAAyB,KAAK,IAAI,SAAS,OAAO,GAAG;AACpG,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,oBAAoB,OAA6B;AAC/D,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,aAAc,QAAO;AAElC,MAAI,OAAO,YAAY;AACrB,UAAM,YAAY,IAAI,KAAK,OAAO,UAAU;AAE5C,QAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAM;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,iBAAiB,OAA0B;AACzD,SAAO,MAAM;AACb,SAAO,MAAM;AACb,SAAO,MAAM;AACf;AAMO,SAAS,sBAAsB,OAAwC;AAE5E,MAAI,oBAAoB,KAAK,GAAG;AAC9B,WAAO,MAAM,aAAc;AAAA,EAC7B;AAEA,SAAO,MAAM;AACf;","names":["import_MCPOAuthProvider","import_CLIFlowHandler","import_NonInteractiveFlowHandler","import_types"]}

package/dist/lib/auth/oauth/index.mjs

@@ -21,6 +21,7 @@ import {
   TokenExchangeError,
   ProtectedResourceMetadataError,
   AgentVanishedDuringFlowError,
+  AgentChangedDuringFlowError,
   ConfidentialClientNotAllowedError,
   DEFAULT_WEB_FLOW_TTL_MS
 } from "./web-flow.mjs";
@@ -45,6 +46,7 @@ function createCLIOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -60,6 +62,7 @@ function createNonInteractiveOAuthProvider(agent, options) {
     agent,
     flowHandler,
     storage: options?.storage,
+    resourceOverride: options?.resourceOverride,
     clientMetadata,
     allowHttp: options?.allowHttp
   });
@@ -132,6 +135,7 @@ import { bindAgentStorage, getAgentStorage, unbindAgentStorage } from "./storage
 import { InvalidTokenError, InsufficientScopeError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 export {
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
+  AgentChangedDuringFlowError,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   CLIFlowHandler,