@adcp/sdk 14.3.0 → 15.0.0

package/bin/adcp.js

@@ -1386,9 +1386,7 @@ async function ensureOAuthTokensForAlias(alias, url, { quiet = false, allowHttp
     return existing;
   }
 
-  // Spread the in-flight PKCE verifier too: if a prior attempt crashed mid-
-  // flow the verifier lives on the saved record, and without it the MCP SDK
-  // throws "No PKCE code verifier found" when the AS redirects back.
+  // A fresh login starts a new PKCE leg and rediscovers the authorization server.
   const tempAgent = {
     id: alias,
     name: alias,
@@ -1396,7 +1394,6 @@ async function ensureOAuthTokensForAlias(alias, url, { quiet = false, allowHttp
     protocol: 'mcp',
     ...(existing?.oauth_client && { oauth_client: existing.oauth_client }),
     ...(existing?.oauth_tokens && { oauth_tokens: existing.oauth_tokens }),
-    ...(existing?.oauth_code_verifier && { oauth_code_verifier: existing.oauth_code_verifier }),
   };
 
   const { Client: MCPClient } = require('@modelcontextprotocol/sdk/client/index.js');
@@ -6662,7 +6659,12 @@ credential material — never sync or commit.
     }
 
     const agentConfig = getAgent(alias);
-    if (!agentConfig.oauth_tokens) {
+    if (
+      !agentConfig.oauth_tokens &&
+      !agentConfig.oauth_client &&
+      !agentConfig.oauth_code_verifier &&
+      !agentConfig.oauth_discovery_state
+    ) {
       console.log(`\nAgent '${alias}' has no OAuth tokens to clear.\n`);
       process.exit(0);
     }
@@ -6671,6 +6673,7 @@ credential material — never sync or commit.
     delete agentConfig.oauth_tokens;
     delete agentConfig.oauth_client;
     delete agentConfig.oauth_code_verifier;
+    delete agentConfig.oauth_discovery_state;
     saveAgent(alias, agentConfig);
 
     console.log(`\n✅ Cleared OAuth tokens for '${alias}'`);

package/dist/lib/auth/oauth/ClientCredentialsFlow.js

@@ -247,7 +247,10 @@ async function ensureClientCredentialsTokens(agent, options = {}) {
       });
       agent.oauth_tokens = tokens;
       if (options.storage) {
-        await options.storage.saveAgent(agent);
+        const refreshedAgent = { ...agent };
+        delete refreshedAgent.oauth_code_verifier;
+        delete refreshedAgent.oauth_discovery_state;
+        await options.storage.saveAgent(refreshedAgent);
       }
       return tokens;
     } finally {

package/dist/lib/auth/oauth/ClientCredentialsFlow.mjs

@@ -222,7 +222,10 @@ async function ensureClientCredentialsTokens(agent, options = {}) {
       });
       agent.oauth_tokens = tokens;
       if (options.storage) {
-        await options.storage.saveAgent(agent);
+        const refreshedAgent = { ...agent };
+        delete refreshedAgent.oauth_code_verifier;
+        delete refreshedAgent.oauth_discovery_state;
+        await options.storage.saveAgent(refreshedAgent);
       }
       return tokens;
     } finally {

package/dist/lib/auth/oauth/MCPOAuthProvider.d.mts

@@ -4,8 +4,9 @@
  * Implements the MCP SDK's OAuthClientProvider interface
  * using AgentConfig for token storage.
  */
-import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
 import type { OAuthClientMetadata, OAuthClientInformation, OAuthClientInformationFull, OAuthTokens, OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, AgentConfig } from './types.mjs';
+export declare function assertLegacyOAuthSdk(): void;
 /**
  * MCP OAuth Client Provider
  *
@@ -19,13 +20,15 @@ import type { OAuthClientMetadata, OAuthClientInformation, OAuthClientInformatio
  *   name: 'My Agent',
  *   agent_uri: 'https://agent.example.com/mcp',
  *   protocol: 'mcp',
- *   // OAuth tokens stored here after auth flow
- *   oauth_tokens: { access_token: '...', refresh_token: '...' }
+ *   // A fresh interactive flow saves issuer-bound credentials afterward.
  * };
  *
+ * const flowHandler = new CLIFlowHandler();
  * const provider = new MCPOAuthProvider({
  *   agent,
- *   flowHandler: new CLIFlowHandler(),
+ *   flowHandler,
+ *   clientMetadata: { ...DEFAULT_CLIENT_METADATA, redirect_uris: [flowHandler.getRedirectUrl().toString()] },
+ *   allowInteractiveAuthorization: true,
  *   storage: myConfigStorage  // Optional: persists tokens
  * });
  *
@@ -41,6 +44,8 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     private readonly _clientMetadata;
     private readonly allowHttp;
     private readonly configuredResourceOverride?;
+    private readonly allowInteractiveAuthorization;
+    private pendingDiscoveryState?;
     constructor(config: OAuthProviderConfig);
     /**
      * Create a provider for CLI usage
@@ -72,7 +77,9 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     /**
      * Load client information from agent config
      */
-    clientInformation(): Promise<OAuthClientInformation | undefined>;
+    clientInformation(ctx?: {
+        issuer: string;
+    }): Promise<OAuthClientInformation | undefined>;
     /**
      * Save client information after dynamic registration
      */
@@ -80,7 +87,9 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     /**
      * Load existing tokens from agent config
      */
-    tokens(): Promise<OAuthTokens | undefined>;
+    tokens(ctx?: {
+        issuer: string;
+    }): Promise<OAuthTokens | undefined>;
     /**
      * Save tokens after authorization
      * Also cleans up the temporary code verifier
@@ -90,6 +99,12 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
      * Redirect user to authorization URL
      */
     redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    /** Persist the authorization-server identity across the callback leg. */
+    saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>;
+    discoveryState(): Promise<OAuthDiscoveryState | undefined>;
+    private validateDiscoveryState;
+    private checkIssuerContext;
+    private ownerReauthorizationRequired;
     /**
      * Save PKCE code verifier
      */
@@ -103,10 +118,12 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     /**
      * Invalidate credentials when server indicates they're invalid
      */
-    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): Promise<void>;
+    invalidateCredentials(scope: Parameters<NonNullable<OAuthClientProvider['invalidateCredentials']>>[0]): Promise<void>;
+    private clearCredentials;
     /**
-     * Persist agent config to storage if configured
+     * Persist a credential update without modifying independent browser state.
      */
+    private persistCredentials;
     private persistAgent;
     /**
      * Wait for the OAuth callback

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts

@@ -4,8 +4,9 @@
  * Implements the MCP SDK's OAuthClientProvider interface
  * using AgentConfig for token storage.
  */
-import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
 import type { OAuthClientMetadata, OAuthClientInformation, OAuthClientInformationFull, OAuthTokens, OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, AgentConfig } from './types';
+export declare function assertLegacyOAuthSdk(): void;
 /**
  * MCP OAuth Client Provider
  *
@@ -19,13 +20,15 @@ import type { OAuthClientMetadata, OAuthClientInformation, OAuthClientInformatio
  *   name: 'My Agent',
  *   agent_uri: 'https://agent.example.com/mcp',
  *   protocol: 'mcp',
- *   // OAuth tokens stored here after auth flow
- *   oauth_tokens: { access_token: '...', refresh_token: '...' }
+ *   // A fresh interactive flow saves issuer-bound credentials afterward.
  * };
  *
+ * const flowHandler = new CLIFlowHandler();
  * const provider = new MCPOAuthProvider({
  *   agent,
- *   flowHandler: new CLIFlowHandler(),
+ *   flowHandler,
+ *   clientMetadata: { ...DEFAULT_CLIENT_METADATA, redirect_uris: [flowHandler.getRedirectUrl().toString()] },
+ *   allowInteractiveAuthorization: true,
  *   storage: myConfigStorage  // Optional: persists tokens
  * });
  *
@@ -41,6 +44,8 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     private readonly _clientMetadata;
     private readonly allowHttp;
     private readonly configuredResourceOverride?;
+    private readonly allowInteractiveAuthorization;
+    private pendingDiscoveryState?;
     constructor(config: OAuthProviderConfig);
     /**
      * Create a provider for CLI usage
@@ -72,7 +77,9 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     /**
      * Load client information from agent config
      */
-    clientInformation(): Promise<OAuthClientInformation | undefined>;
+    clientInformation(ctx?: {
+        issuer: string;
+    }): Promise<OAuthClientInformation | undefined>;
     /**
      * Save client information after dynamic registration
      */
@@ -80,7 +87,9 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     /**
      * Load existing tokens from agent config
      */
-    tokens(): Promise<OAuthTokens | undefined>;
+    tokens(ctx?: {
+        issuer: string;
+    }): Promise<OAuthTokens | undefined>;
     /**
      * Save tokens after authorization
      * Also cleans up the temporary code verifier
@@ -90,6 +99,12 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
      * Redirect user to authorization URL
      */
     redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    /** Persist the authorization-server identity across the callback leg. */
+    saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>;
+    discoveryState(): Promise<OAuthDiscoveryState | undefined>;
+    private validateDiscoveryState;
+    private checkIssuerContext;
+    private ownerReauthorizationRequired;
     /**
      * Save PKCE code verifier
      */
@@ -103,10 +118,12 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     /**
      * Invalidate credentials when server indicates they're invalid
      */
-    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): Promise<void>;
+    invalidateCredentials(scope: Parameters<NonNullable<OAuthClientProvider['invalidateCredentials']>>[0]): Promise<void>;
+    private clearCredentials;
     /**
-     * Persist agent config to storage if configured
+     * Persist a credential update without modifying independent browser state.
      */
+    private persistCredentials;
     private persistAgent;
     /**
      * Wait for the OAuth callback

package/dist/lib/auth/oauth/MCPOAuthProvider.js

@@ -18,12 +18,40 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var MCPOAuthProvider_exports = {};
 __export(MCPOAuthProvider_exports, {
-  MCPOAuthProvider: () => MCPOAuthProvider
+  MCPOAuthProvider: () => MCPOAuthProvider,
+  assertLegacyOAuthSdk: () => assertLegacyOAuthSdk
 });
 module.exports = __toCommonJS(MCPOAuthProvider_exports);
 var import_types = require('./types.js');
 var import_crypto = require("crypto");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+var import_node_module = require("node:module");
 var import_resource_url = require('./resource-url.js');
+let legacyOAuthSdkChecked = false;
+function assertLegacyOAuthSdk() {
+  if (legacyOAuthSdkChecked) return;
+  try {
+    const clientPath = (0, import_node_module.createRequire)((0, import_node_path.resolve)(__dirname, "MCPOAuthProvider.js")).resolve(
+      "@modelcontextprotocol/sdk/client/index.js"
+    );
+    const { version } = JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path.resolve)((0, import_node_path.dirname)(clientPath), "../../../package.json"), "utf8"));
+    const match = typeof version === "string" && /^1\.(\d+)\.\d+$/.exec(version);
+    if (!match || Number(match[1]) < 31) {
+      throw new import_types.OAuthError(
+        "Legacy MCP OAuth requires @modelcontextprotocol/sdk >=1.31.0 within major 1. Upgrade the installed peer dependency.",
+        "mcp_oauth_sdk_upgrade_required"
+      );
+    }
+  } catch (error) {
+    if (error instanceof import_types.OAuthError) throw error;
+    throw new import_types.OAuthError(
+      "Cannot verify a patched legacy MCP SDK. Install @modelcontextprotocol/sdk ^1.31.0 and keep it external when bundling.",
+      "mcp_oauth_sdk_upgrade_required"
+    );
+  }
+  legacyOAuthSdkChecked = true;
+}
 class MCPOAuthProvider {
   agent;
   storage;
@@ -31,6 +59,8 @@ class MCPOAuthProvider {
   _clientMetadata;
   allowHttp;
   configuredResourceOverride;
+  allowInteractiveAuthorization;
+  pendingDiscoveryState;
   constructor(config) {
     this.agent = config.agent;
     this.storage = config.storage;
@@ -38,6 +68,7 @@ class MCPOAuthProvider {
     this._clientMetadata = config.clientMetadata;
     this.allowHttp = config.allowHttp === true;
     this.configuredResourceOverride = config.resourceOverride;
+    this.allowInteractiveAuthorization = config.allowInteractiveAuthorization === true;
   }
   /**
    * Create a provider for CLI usage
@@ -54,7 +85,8 @@ class MCPOAuthProvider {
       storage,
       clientMetadata,
       allowHttp: options?.allowHttp,
-      resourceOverride: options?.resourceOverride
+      resourceOverride: options?.resourceOverride,
+      allowInteractiveAuthorization: true
     });
   }
   // ========================================
@@ -95,8 +127,14 @@ class MCPOAuthProvider {
   /**
    * Load client information from agent config
    */
-  async clientInformation() {
+  async clientInformation(ctx) {
+    const issuer = this.checkIssuerContext(ctx);
+    if (issuer && !this.agent.oauth_client && !this.allowInteractiveAuthorization) {
+      throw this.ownerReauthorizationRequired();
+    }
     if (this.agent.oauth_client) {
+      if (this.agent.oauth_client.client_secret) assertLegacyOAuthSdk();
+      (0, import_types.assertOAuthCredentialIssuer)(this.agent.oauth_client, void 0, !!this.agent.oauth_client.client_secret);
       return (0, import_types.toMCPClientInfo)(this.agent.oauth_client);
     }
     return void 0;
@@ -106,13 +144,16 @@ class MCPOAuthProvider {
    */
   async saveClientInformation(clientInfo) {
     this.agent.oauth_client = (0, import_types.fromMCPClientInfo)(clientInfo);
-    await this.persistAgent();
+    await this.persistCredentials();
   }
   /**
    * Load existing tokens from agent config
    */
-  async tokens() {
+  async tokens(ctx) {
+    this.checkIssuerContext(ctx);
     if (this.agent.oauth_tokens) {
+      if (this.agent.oauth_tokens.refresh_token) assertLegacyOAuthSdk();
+      (0, import_types.assertOAuthCredentialIssuer)(this.agent.oauth_tokens, void 0, !!this.agent.oauth_tokens.refresh_token);
       return (0, import_types.toMCPTokens)(this.agent.oauth_tokens);
     }
     return void 0;
@@ -123,19 +164,72 @@ class MCPOAuthProvider {
    */
   async saveTokens(tokens) {
     this.agent.oauth_tokens = (0, import_types.fromMCPTokens)(tokens);
-    delete this.agent.oauth_code_verifier;
-    await this.persistAgent();
+    if (this.allowInteractiveAuthorization) {
+      this.agent.oauth_code_verifier = void 0;
+      this.agent.oauth_discovery_state = void 0;
+    }
+    this.pendingDiscoveryState = void 0;
+    await this.persistCredentials();
   }
   /**
    * Redirect user to authorization URL
    */
   async redirectToAuthorization(authorizationUrl) {
-    await this.flowHandler.redirectToAuthorization(authorizationUrl);
+    if (!this.allowInteractiveAuthorization) throw this.ownerReauthorizationRequired("interactive_required");
+    try {
+      await this.flowHandler.redirectToAuthorization(authorizationUrl);
+    } catch (error) {
+      await this.invalidateCredentials("verifier");
+      throw error;
+    }
+  }
+  /** Persist the authorization-server identity across the callback leg. */
+  async saveDiscoveryState(state) {
+    this.validateDiscoveryState(state);
+    if (!this.agent.oauth_client && !this.allowInteractiveAuthorization) throw this.ownerReauthorizationRequired();
+    this.pendingDiscoveryState = structuredClone(state);
+    if (this.allowInteractiveAuthorization) {
+      this.agent.oauth_discovery_state = structuredClone(state);
+      await this.persistAgent();
+    }
+  }
+  async discoveryState() {
+    if (!this.allowInteractiveAuthorization) return void 0;
+    if (!this.agent.oauth_code_verifier) return void 0;
+    const state = this.pendingDiscoveryState ?? this.agent.oauth_discovery_state;
+    if (!state) return void 0;
+    this.validateDiscoveryState(state);
+    this.pendingDiscoveryState = structuredClone(state);
+    return structuredClone(state);
+  }
+  validateDiscoveryState(state) {
+    (0, import_types.assertOAuthServerIssuer)(state.authorizationServerMetadata, String(state.authorizationServerUrl));
+    this.checkIssuerContext({ issuer: String(state.authorizationServerUrl) });
+  }
+  checkIssuerContext(ctx) {
+    const issuer = ctx?.issuer ?? this.pendingDiscoveryState?.authorizationServerUrl;
+    if (issuer !== void 0) {
+      if (this.agent.oauth_tokens) {
+        (0, import_types.assertOAuthCredentialIssuer)(this.agent.oauth_tokens, issuer, !!this.agent.oauth_tokens.refresh_token);
+      }
+      if (this.agent.oauth_client) {
+        (0, import_types.assertOAuthCredentialIssuer)(this.agent.oauth_client, issuer, !!this.agent.oauth_client.client_secret);
+      }
+    }
+    return issuer;
+  }
+  ownerReauthorizationRequired(code = "owner_reauthorization_required") {
+    return new import_types.OAuthError(
+      "OAuth owner reauthorization is required; this provider will not automatically clear credentials or register a new client. CLI: adcp <alias> --clear-oauth, then adcp <alias> --oauth.",
+      code,
+      this.agent.id
+    );
   }
   /**
    * Save PKCE code verifier
    */
   async saveCodeVerifier(codeVerifier) {
+    if (!this.allowInteractiveAuthorization) throw this.ownerReauthorizationRequired();
     this.agent.oauth_code_verifier = codeVerifier;
     await this.persistAgent();
   }
@@ -145,6 +239,7 @@ class MCPOAuthProvider {
    * retrieves it here during token exchange.
    */
   async codeVerifier() {
+    if (!this.allowInteractiveAuthorization) throw this.ownerReauthorizationRequired();
     if (!this.agent.oauth_code_verifier) {
       throw new Error(
         "No PKCE code verifier found. The OAuth flow may have been interrupted or the agent config was modified. Please try authenticating again."
@@ -156,20 +251,40 @@ class MCPOAuthProvider {
    * Invalidate credentials when server indicates they're invalid
    */
   async invalidateCredentials(scope) {
+    if (!this.allowInteractiveAuthorization && (scope === "discovery" || scope === "verifier")) {
+      this.pendingDiscoveryState = void 0;
+      return;
+    }
+    if (!this.allowInteractiveAuthorization && (scope === "all" || scope === "client" || scope === "tokens")) {
+      throw this.ownerReauthorizationRequired();
+    }
+    await this.clearCredentials(scope);
+  }
+  async clearCredentials(scope) {
     switch (scope) {
       case "all":
-        delete this.agent.oauth_tokens;
-        delete this.agent.oauth_client;
-        delete this.agent.oauth_code_verifier;
+        this.pendingDiscoveryState = void 0;
+        this.agent.oauth_discovery_state = void 0;
+        this.agent.oauth_tokens = void 0;
+        this.agent.oauth_client = void 0;
+        this.agent.oauth_code_verifier = void 0;
         break;
       case "tokens":
-        delete this.agent.oauth_tokens;
+        this.agent.oauth_tokens = void 0;
         break;
       case "client":
-        delete this.agent.oauth_client;
+        this.pendingDiscoveryState = void 0;
+        this.agent.oauth_discovery_state = void 0;
+        this.agent.oauth_client = void 0;
+        break;
+      case "discovery":
+        this.pendingDiscoveryState = void 0;
+        this.agent.oauth_discovery_state = void 0;
         break;
       case "verifier":
-        delete this.agent.oauth_code_verifier;
+        this.pendingDiscoveryState = void 0;
+        this.agent.oauth_discovery_state = void 0;
+        this.agent.oauth_code_verifier = void 0;
         break;
     }
     await this.persistAgent();
@@ -178,11 +293,20 @@ class MCPOAuthProvider {
   // Additional methods
   // ========================================
   /**
-   * Persist agent config to storage if configured
+   * Persist a credential update without modifying independent browser state.
    */
-  async persistAgent() {
+  async persistCredentials() {
+    let savedAgent = this.agent;
+    if (!this.allowInteractiveAuthorization) {
+      savedAgent = { ...this.agent };
+      delete savedAgent.oauth_code_verifier;
+      delete savedAgent.oauth_discovery_state;
+    }
+    await this.persistAgent(savedAgent);
+  }
+  async persistAgent(agent = this.agent) {
     if (this.storage) {
-      await this.storage.saveAgent(this.agent);
+      await this.storage.saveAgent(agent);
     }
   }
   /**
@@ -224,7 +348,7 @@ class MCPOAuthProvider {
    * Clear all OAuth data for this agent
    */
   async clearAuth() {
-    await this.invalidateCredentials("all");
+    await this.clearCredentials("all");
   }
   /**
    * Get the agent config this provider manages
@@ -243,5 +367,6 @@ class MCPOAuthProvider {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  MCPOAuthProvider
+  MCPOAuthProvider,
+  assertLegacyOAuthSdk
 });