@adcp/sdk 14.3.0 → 15.0.0

package/dist/lib/auth/oauth/index.js

@@ -20,6 +20,7 @@ var oauth_exports = {};
 __export(oauth_exports, {
   AUTH_DIAGNOSIS_SCHEMA_VERSION: () => import_diagnose.AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AgentChangedDuringFlowError: () => import_web_flow.AgentChangedDuringFlowError,
+  AgentOAuthClientCredentialsSchema: () => import_client_credentials_schema.AgentOAuthClientCredentialsSchema,
   AgentVanishedDuringFlowError: () => import_web_flow.AgentVanishedDuringFlowError,
   BrowserBindingRequiredError: () => import_web_flow.BrowserBindingRequiredError,
   CLIFlowHandler: () => import_CLIFlowHandler.CLIFlowHandler,
@@ -92,6 +93,7 @@ var import_authorization_required = require('./authorization-required.js');
 var import_file_storage = require('./file-storage.js');
 var import_ClientCredentialsFlow = require('./ClientCredentialsFlow.js');
 var import_secret_resolver = require('./secret-resolver.js');
+var import_client_credentials_schema = require('./client-credentials-schema.js');
 var import_storage_registry = require('./storage-registry.js');
 var import_errors = require("@modelcontextprotocol/sdk/server/auth/errors.js");
 function createCLIOAuthProvider(agent, options) {
@@ -107,6 +109,7 @@ function createCLIOAuthProvider(agent, options) {
     ...options?.clientMetadata
   };
   return new import_MCPOAuthProvider2.MCPOAuthProvider({
+    allowInteractiveAuthorization: true,
     agent,
     flowHandler,
     storage: options?.storage,
@@ -123,6 +126,7 @@ function createNonInteractiveOAuthProvider(agent, options) {
     ...options?.clientMetadata
   };
   return new import_MCPOAuthProvider2.MCPOAuthProvider({
+    allowInteractiveAuthorization: false,
     agent,
     flowHandler,
     storage: options?.storage,
@@ -153,9 +157,10 @@ function hasValidOAuthTokens(agent) {
   return true;
 }
 function clearOAuthTokens(agent) {
-  delete agent.oauth_tokens;
-  delete agent.oauth_client;
-  delete agent.oauth_code_verifier;
+  agent.oauth_tokens = void 0;
+  agent.oauth_client = void 0;
+  agent.oauth_code_verifier = void 0;
+  agent.oauth_discovery_state = void 0;
 }
 function getEffectiveAuthToken(agent) {
   if (hasValidOAuthTokens(agent)) {
@@ -167,6 +172,7 @@ function getEffectiveAuthToken(agent) {
 0 && (module.exports = {
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AgentChangedDuringFlowError,
+  AgentOAuthClientCredentialsSchema,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   CLIFlowHandler,

package/dist/lib/auth/oauth/index.mjs

@@ -43,6 +43,7 @@ function createCLIOAuthProvider(agent, options) {
     ...options?.clientMetadata
   };
   return new MCPOAuthProvider2({
+    allowInteractiveAuthorization: true,
     agent,
     flowHandler,
     storage: options?.storage,
@@ -59,6 +60,7 @@ function createNonInteractiveOAuthProvider(agent, options) {
     ...options?.clientMetadata
   };
   return new MCPOAuthProvider2({
+    allowInteractiveAuthorization: false,
     agent,
     flowHandler,
     storage: options?.storage,
@@ -89,9 +91,10 @@ function hasValidOAuthTokens(agent) {
   return true;
 }
 function clearOAuthTokens(agent) {
-  delete agent.oauth_tokens;
-  delete agent.oauth_client;
-  delete agent.oauth_code_verifier;
+  agent.oauth_tokens = void 0;
+  agent.oauth_client = void 0;
+  agent.oauth_code_verifier = void 0;
+  agent.oauth_discovery_state = void 0;
 }
 function getEffectiveAuthToken(agent) {
   if (hasValidOAuthTokens(agent)) {
@@ -132,11 +135,13 @@ import {
   extractEnvSecretName,
   MissingEnvSecretError
 } from "./secret-resolver.mjs";
+import { AgentOAuthClientCredentialsSchema } from "./client-credentials-schema.mjs";
 import { bindAgentStorage, getAgentStorage, unbindAgentStorage } from "./storage-registry.mjs";
 import { InvalidTokenError, InsufficientScopeError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 export {
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AgentChangedDuringFlowError,
+  AgentOAuthClientCredentialsSchema,
   AgentVanishedDuringFlowError,
   BrowserBindingRequiredError,
   CLIFlowHandler,

package/dist/lib/auth/oauth/types.d.mts

@@ -13,6 +13,10 @@ export type { AgentConfig, AgentOAuthTokens, AgentOAuthClient };
  * Agent config storage interface
  *
  * Implement this to persist OAuth tokens back to agent configuration.
+ * Round-trip pending `oauth_code_verifier` and `oauth_discovery_state` verbatim.
+ * For oauth_tokens, oauth_client, oauth_code_verifier and oauth_discovery_state,
+ * an own undefined property clears; omission preserves the saved field.
+ * Resource overrides and other fields retain the storage backend's semantics.
  * This allows different storage backends (file, database, memory)
  * while keeping tokens in the agent config structure.
  */
@@ -74,6 +78,11 @@ export interface OAuthProviderConfig {
     storage?: OAuthConfigStorage;
     /** Authorization flow handler */
     flowHandler: OAuthFlowHandler;
+    /**
+     * Explicitly allow fresh registration, PKCE work, redirects and automatic
+     * credential invalidation. Defaults to false; CLI factories opt in.
+     */
+    allowInteractiveAuthorization?: boolean;
     /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */
     clientMetadata: OAuthClientMetadata;
     /**
@@ -132,3 +141,11 @@ export declare function toMCPClientInfo(client: AgentOAuthClient): OAuthClientIn
  * Convert MCP SDK OAuthClientInformationFull to AgentOAuthClient format
  */
 export declare function fromMCPClientInfo(info: OAuthClientInformationFull): AgentOAuthClient;
+/** Internal credential-binding guard; old secrets must be migrated from trusted configuration. */
+export declare function assertOAuthCredentialIssuer(credential: {
+    issuer?: unknown;
+}, expectedIssuer?: string, requireIssuer?: boolean): void;
+/** Internal metadata guard, matching the modern MCP SDK's asymmetric issuer-echo rule. */
+export declare function assertOAuthServerIssuer(metadata: {
+    issuer?: unknown;
+} | undefined, authorizationServerUrl: string): void;

package/dist/lib/auth/oauth/types.d.ts

@@ -13,6 +13,10 @@ export type { AgentConfig, AgentOAuthTokens, AgentOAuthClient };
  * Agent config storage interface
  *
  * Implement this to persist OAuth tokens back to agent configuration.
+ * Round-trip pending `oauth_code_verifier` and `oauth_discovery_state` verbatim.
+ * For oauth_tokens, oauth_client, oauth_code_verifier and oauth_discovery_state,
+ * an own undefined property clears; omission preserves the saved field.
+ * Resource overrides and other fields retain the storage backend's semantics.
  * This allows different storage backends (file, database, memory)
  * while keeping tokens in the agent config structure.
  */
@@ -74,6 +78,11 @@ export interface OAuthProviderConfig {
     storage?: OAuthConfigStorage;
     /** Authorization flow handler */
     flowHandler: OAuthFlowHandler;
+    /**
+     * Explicitly allow fresh registration, PKCE work, redirects and automatic
+     * credential invalidation. Defaults to false; CLI factories opt in.
+     */
+    allowInteractiveAuthorization?: boolean;
     /** OAuth client metadata (required - use DEFAULT_CLIENT_METADATA as base) */
     clientMetadata: OAuthClientMetadata;
     /**
@@ -132,3 +141,11 @@ export declare function toMCPClientInfo(client: AgentOAuthClient): OAuthClientIn
  * Convert MCP SDK OAuthClientInformationFull to AgentOAuthClient format
  */
 export declare function fromMCPClientInfo(info: OAuthClientInformationFull): AgentOAuthClient;
+/** Internal credential-binding guard; old secrets must be migrated from trusted configuration. */
+export declare function assertOAuthCredentialIssuer(credential: {
+    issuer?: unknown;
+}, expectedIssuer?: string, requireIssuer?: boolean): void;
+/** Internal metadata guard, matching the modern MCP SDK's asymmetric issuer-echo rule. */
+export declare function assertOAuthServerIssuer(metadata: {
+    issuer?: unknown;
+} | undefined, authorizationServerUrl: string): void;

package/dist/lib/auth/oauth/types.js

@@ -22,6 +22,8 @@ __export(types_exports, {
   OAuthCancelledError: () => OAuthCancelledError,
   OAuthError: () => OAuthError,
   OAuthTimeoutError: () => OAuthTimeoutError,
+  assertOAuthCredentialIssuer: () => assertOAuthCredentialIssuer,
+  assertOAuthServerIssuer: () => assertOAuthServerIssuer,
   fromMCPClientInfo: () => fromMCPClientInfo,
   fromMCPTokens: () => fromMCPTokens,
   toMCPClientInfo: () => toMCPClientInfo,
@@ -60,6 +62,7 @@ class OAuthTimeoutError extends OAuthError {
 }
 function toMCPTokens(tokens) {
   return {
+    ...tokens.issuer !== void 0 && tokens.issuer !== null && { issuer: tokens.issuer },
     access_token: tokens.access_token,
     refresh_token: tokens.refresh_token,
     token_type: tokens.token_type || "Bearer",
@@ -69,6 +72,7 @@ function toMCPTokens(tokens) {
 }
 function fromMCPTokens(tokens) {
   const result = {
+    ...tokens.issuer !== void 0 && tokens.issuer !== null && { issuer: tokens.issuer },
     access_token: tokens.access_token,
     token_type: tokens.token_type,
     scope: tokens.scope
@@ -84,6 +88,7 @@ function fromMCPTokens(tokens) {
 }
 function toMCPClientInfo(client) {
   return {
+    ...client.issuer !== void 0 && client.issuer !== null && { issuer: client.issuer },
     client_id: client.client_id,
     client_secret: client.client_secret,
     client_secret_expires_at: client.client_secret_expires_at
@@ -91,17 +96,52 @@ function toMCPClientInfo(client) {
 }
 function fromMCPClientInfo(info) {
   return {
+    ...info.issuer !== void 0 && info.issuer !== null && { issuer: info.issuer },
     client_id: info.client_id,
     client_secret: info.client_secret,
     client_secret_expires_at: info.client_secret_expires_at
   };
 }
+function isOAuthIssuer(value) {
+  if (typeof value !== "string" || !value || /[\u0000-\u0020\u007f\\]/.test(value)) return false;
+  try {
+    const url = new URL(value);
+    const rawAuthority = value.match(/^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i)?.[1];
+    return (url.protocol === "https:" || url.protocol === "http:") && !rawAuthority?.includes("@") && !url.username && !url.password && !url.search && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function assertOAuthCredentialIssuer(credential, expectedIssuer, requireIssuer = false) {
+  const issuer = credential.issuer;
+  if ((issuer === void 0 || issuer === null) && !requireIssuer) return;
+  if (!isOAuthIssuer(issuer)) {
+    throw new OAuthError(
+      "Saved OAuth credentials need a valid issuer. Clear them and sign in again, or set their issuer from trusted configuration.",
+      "oauth_issuer_required"
+    );
+  }
+  if (expectedIssuer !== void 0 && issuer !== expectedIssuer && !(issuer.endsWith("/") && issuer.slice(0, -1) === expectedIssuer) && !(expectedIssuer.endsWith("/") && expectedIssuer.slice(0, -1) === issuer)) {
+    throw new OAuthError("OAuth credentials belong to a different authorization server.", "oauth_issuer_mismatch");
+  }
+}
+function assertOAuthServerIssuer(metadata, authorizationServerUrl) {
+  const issuer = metadata?.issuer;
+  if (!isOAuthIssuer(issuer) || issuer !== authorizationServerUrl && !(authorizationServerUrl.endsWith("/") && issuer === authorizationServerUrl.slice(0, -1))) {
+    throw new OAuthError(
+      "Authorization-server metadata does not match the discovered issuer.",
+      "oauth_issuer_mismatch"
+    );
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_CLIENT_METADATA,
   OAuthCancelledError,
   OAuthError,
   OAuthTimeoutError,
+  assertOAuthCredentialIssuer,
+  assertOAuthServerIssuer,
   fromMCPClientInfo,
   fromMCPTokens,
   toMCPClientInfo,

package/dist/lib/auth/oauth/types.mjs

@@ -30,6 +30,7 @@ class OAuthTimeoutError extends OAuthError {
 }
 function toMCPTokens(tokens) {
   return {
+    ...tokens.issuer !== void 0 && tokens.issuer !== null && { issuer: tokens.issuer },
     access_token: tokens.access_token,
     refresh_token: tokens.refresh_token,
     token_type: tokens.token_type || "Bearer",
@@ -39,6 +40,7 @@ function toMCPTokens(tokens) {
 }
 function fromMCPTokens(tokens) {
   const result = {
+    ...tokens.issuer !== void 0 && tokens.issuer !== null && { issuer: tokens.issuer },
     access_token: tokens.access_token,
     token_type: tokens.token_type,
     scope: tokens.scope
@@ -54,6 +56,7 @@ function fromMCPTokens(tokens) {
 }
 function toMCPClientInfo(client) {
   return {
+    ...client.issuer !== void 0 && client.issuer !== null && { issuer: client.issuer },
     client_id: client.client_id,
     client_secret: client.client_secret,
     client_secret_expires_at: client.client_secret_expires_at
@@ -61,16 +64,51 @@ function toMCPClientInfo(client) {
 }
 function fromMCPClientInfo(info) {
   return {
+    ...info.issuer !== void 0 && info.issuer !== null && { issuer: info.issuer },
     client_id: info.client_id,
     client_secret: info.client_secret,
     client_secret_expires_at: info.client_secret_expires_at
   };
 }
+function isOAuthIssuer(value) {
+  if (typeof value !== "string" || !value || /[\u0000-\u0020\u007f\\]/.test(value)) return false;
+  try {
+    const url = new URL(value);
+    const rawAuthority = value.match(/^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i)?.[1];
+    return (url.protocol === "https:" || url.protocol === "http:") && !rawAuthority?.includes("@") && !url.username && !url.password && !url.search && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function assertOAuthCredentialIssuer(credential, expectedIssuer, requireIssuer = false) {
+  const issuer = credential.issuer;
+  if ((issuer === void 0 || issuer === null) && !requireIssuer) return;
+  if (!isOAuthIssuer(issuer)) {
+    throw new OAuthError(
+      "Saved OAuth credentials need a valid issuer. Clear them and sign in again, or set their issuer from trusted configuration.",
+      "oauth_issuer_required"
+    );
+  }
+  if (expectedIssuer !== void 0 && issuer !== expectedIssuer && !(issuer.endsWith("/") && issuer.slice(0, -1) === expectedIssuer) && !(expectedIssuer.endsWith("/") && expectedIssuer.slice(0, -1) === issuer)) {
+    throw new OAuthError("OAuth credentials belong to a different authorization server.", "oauth_issuer_mismatch");
+  }
+}
+function assertOAuthServerIssuer(metadata, authorizationServerUrl) {
+  const issuer = metadata?.issuer;
+  if (!isOAuthIssuer(issuer) || issuer !== authorizationServerUrl && !(authorizationServerUrl.endsWith("/") && issuer === authorizationServerUrl.slice(0, -1))) {
+    throw new OAuthError(
+      "Authorization-server metadata does not match the discovered issuer.",
+      "oauth_issuer_mismatch"
+    );
+  }
+}
 export {
   DEFAULT_CLIENT_METADATA,
   OAuthCancelledError,
   OAuthError,
   OAuthTimeoutError,
+  assertOAuthCredentialIssuer,
+  assertOAuthServerIssuer,
   fromMCPClientInfo,
   fromMCPTokens,
   toMCPClientInfo,

package/dist/lib/auth/oauth/web-flow.d.mts

@@ -66,6 +66,8 @@ export interface PendingWebFlow {
     resourceOverrideSnapshot?: string | null;
     scope?: string;
     authorizationServerUrl: string;
+    /** Validated AS issuer frozen at start. Legacy rows without it cannot spend credentials. */
+    authorizationServerIssuer?: string;
     /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */
     clientInformation: OAuthClientInformation;
     createdAt: Date;

package/dist/lib/auth/oauth/web-flow.d.ts

@@ -66,6 +66,8 @@ export interface PendingWebFlow {
     resourceOverrideSnapshot?: string | null;
     scope?: string;
     authorizationServerUrl: string;
+    /** Validated AS issuer frozen at start. Legacy rows without it cannot spend credentials. */
+    authorizationServerIssuer?: string;
     /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */
     clientInformation: OAuthClientInformation;
     createdAt: Date;

package/dist/lib/auth/oauth/web-flow.js

@@ -144,6 +144,9 @@ async function startWebOAuthFlow(opts) {
   if (!asMetadata) {
     throw new import_types.OAuthError(`No OAuth metadata at ${asUrl.toString()}`, "no_authorization_server_metadata", agent.id);
   }
+  (0, import_types.assertOAuthServerIssuer)(asMetadata, asUrl.toString());
+  const authorizationServerIssuer = asUrl.toString();
+  assertSavedCredentialIssuers(agent, authorizationServerIssuer);
   const resource = resourceOverride ? new URL(resourceOverride) : prm?.resource ? new URL(prm.resource) : (0, import_auth_utils.resourceUrlFromServerUrl)(new URL(agent.agent_uri));
   const baseClientMetadata = {
     ...import_types.DEFAULT_CLIENT_METADATA,
@@ -158,7 +161,8 @@ async function startWebOAuthFlow(opts) {
     asMetadata,
     clientMetadata: baseClientMetadata,
     fetchFn: guardedFetch,
-    allowConfidentialClient
+    allowConfidentialClient,
+    issuer: authorizationServerIssuer
   });
   const state = (generateState ?? defaultGenerateState)();
   const { authorizationUrl, codeVerifier } = await (0, import_auth.startAuthorization)(asUrl.toString(), {
@@ -186,6 +190,7 @@ async function startWebOAuthFlow(opts) {
     resourceOverrideSnapshot: agent.oauth_resource ?? null,
     scope,
     authorizationServerUrl: asUrl.toString(),
+    authorizationServerIssuer,
     clientInformation,
     createdAt: now,
     expiresAt,
@@ -230,6 +235,17 @@ async function completeWebOAuthFlow(opts) {
   const asMetadata = await (0, import_auth.discoverAuthorizationServerMetadata)(flow.authorizationServerUrl, {
     fetchFn: guardedFetch
   });
+  (0, import_types.assertOAuthServerIssuer)(asMetadata, flow.authorizationServerUrl);
+  assertFrozenIssuer(flow);
+  (0, import_types.assertOAuthCredentialIssuer)(
+    flow.clientInformation,
+    flow.authorizationServerIssuer,
+    !!flow.clientInformation.client_secret
+  );
+  if (agentStorage) {
+    agentForPersistence = await agentStorage.loadAgent(flow.agentId);
+    assertAgentUnchangedForFlow(agentForPersistence, flow);
+  }
   let tokens;
   try {
     tokens = await (0, import_auth.exchangeAuthorization)(flow.authorizationServerUrl, {
@@ -241,6 +257,7 @@ async function completeWebOAuthFlow(opts) {
       resource: flow.resource ? new URL(flow.resource) : void 0,
       fetchFn: guardedFetch
     });
+    tokens = { ...tokens, issuer: flow.authorizationServerIssuer };
   } catch (err) {
     throw wrapTokenExchangeError(err);
   }
@@ -254,7 +271,8 @@ async function completeWebOAuthFlow(opts) {
     } else if (flow.resourceOverrideAction === "clear") {
       delete agentForPersistence.oauth_resource;
     }
-    delete agentForPersistence.oauth_code_verifier;
+    agentForPersistence.oauth_code_verifier = void 0;
+    agentForPersistence.oauth_discovery_state = void 0;
     await agentStorage.saveAgent(agentForPersistence);
     persisted = true;
   }
@@ -266,6 +284,20 @@ async function completeWebOAuthFlow(opts) {
     persisted
   };
 }
+function assertSavedCredentialIssuers(agent, issuer) {
+  if (agent.oauth_tokens) (0, import_types.assertOAuthCredentialIssuer)(agent.oauth_tokens, issuer, !!agent.oauth_tokens.refresh_token);
+  if (agent.oauth_client) (0, import_types.assertOAuthCredentialIssuer)(agent.oauth_client, issuer, !!agent.oauth_client.client_secret);
+}
+function assertFrozenIssuer(flow) {
+  if (!flow.authorizationServerIssuer) {
+    throw new import_types.OAuthError(
+      "Pending OAuth flow lacks a validated authorization-server issuer. Start a new owner sign-in.",
+      "oauth_issuer_required",
+      flow.agentId
+    );
+  }
+  (0, import_types.assertOAuthServerIssuer)({ issuer: flow.authorizationServerIssuer }, flow.authorizationServerUrl);
+}
 function assertAgentUnchangedForFlow(agent, flow) {
   if (!agent) {
     throw new AgentVanishedDuringFlowError(flow.agentId);
@@ -273,6 +305,13 @@ function assertAgentUnchangedForFlow(agent, flow) {
   if (agent.agent_uri !== flow.agentUrl) {
     throw new AgentChangedDuringFlowError(flow.agentId);
   }
+  if (!agent.oauth_client) throw new AgentChangedDuringFlowError(flow.agentId);
+  const currentClient = (0, import_types.toMCPClientInfo)(agent.oauth_client);
+  for (const key of ["client_id", "client_secret", "client_secret_expires_at", "issuer"]) {
+    if (currentClient[key] !== flow.clientInformation[key]) throw new AgentChangedDuringFlowError(flow.agentId);
+  }
+  assertFrozenIssuer(flow);
+  assertSavedCredentialIssuers(agent, flow.authorizationServerIssuer);
   if (Object.prototype.hasOwnProperty.call(flow, "resourceOverrideSnapshot") && (agent.oauth_resource ?? null) !== flow.resourceOverrideSnapshot) {
     throw new AgentChangedDuringFlowError(flow.agentId);
   }
@@ -408,7 +447,7 @@ function createSsrfSafeOAuthFetch(trustedFetchFn, allowHttp) {
   });
 }
 async function resolveClientInformation(args) {
-  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;
+  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient, issuer } = args;
   if (agent.oauth_client) {
     return (0, import_types.toMCPClientInfo)(agent.oauth_client);
   }
@@ -419,16 +458,20 @@ async function resolveClientInformation(args) {
       agent.id
     );
   }
-  const registered = await (0, import_auth.registerClient)(asUrl.toString(), {
+  const response = await (0, import_auth.registerClient)(asUrl.toString(), {
     metadata: asMetadata,
     clientMetadata,
     fetchFn
   });
+  const registered = { ...response, issuer };
   if (registered.client_secret && !allowConfidentialClient) {
     throw new ConfidentialClientNotAllowedError(agent.id);
   }
   if (agentStorage) {
-    const fresh = await agentStorage.loadAgent(agent.id) ?? agent;
+    const fresh = await agentStorage.loadAgent(agent.id);
+    if (!fresh) throw new AgentVanishedDuringFlowError(agent.id);
+    if (fresh.agent_uri !== agent.agent_uri || fresh.oauth_client) throw new AgentChangedDuringFlowError(agent.id);
+    assertSavedCredentialIssuers(fresh, issuer);
     fresh.oauth_client = (0, import_types.fromMCPClientInfo)(registered);
     await agentStorage.saveAgent(fresh);
   }

package/dist/lib/auth/oauth/web-flow.mjs

@@ -7,7 +7,15 @@ import {
   startAuthorization
 } from "@modelcontextprotocol/sdk/client/auth.js";
 import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
-import { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from "./types.mjs";
+import {
+  DEFAULT_CLIENT_METADATA,
+  fromMCPClientInfo,
+  fromMCPTokens,
+  OAuthError,
+  toMCPClientInfo,
+  assertOAuthCredentialIssuer,
+  assertOAuthServerIssuer
+} from "./types.mjs";
 import { validateOAuthResourceUrl } from "./resource-url.mjs";
 import { ssrfSafeFetch } from "../../net/ssrf-fetch.mjs";
 const DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1e3;
@@ -115,6 +123,9 @@ async function startWebOAuthFlow(opts) {
   if (!asMetadata) {
     throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, "no_authorization_server_metadata", agent.id);
   }
+  assertOAuthServerIssuer(asMetadata, asUrl.toString());
+  const authorizationServerIssuer = asUrl.toString();
+  assertSavedCredentialIssuers(agent, authorizationServerIssuer);
   const resource = resourceOverride ? new URL(resourceOverride) : prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));
   const baseClientMetadata = {
     ...DEFAULT_CLIENT_METADATA,
@@ -129,7 +140,8 @@ async function startWebOAuthFlow(opts) {
     asMetadata,
     clientMetadata: baseClientMetadata,
     fetchFn: guardedFetch,
-    allowConfidentialClient
+    allowConfidentialClient,
+    issuer: authorizationServerIssuer
   });
   const state = (generateState ?? defaultGenerateState)();
   const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {
@@ -157,6 +169,7 @@ async function startWebOAuthFlow(opts) {
     resourceOverrideSnapshot: agent.oauth_resource ?? null,
     scope,
     authorizationServerUrl: asUrl.toString(),
+    authorizationServerIssuer,
     clientInformation,
     createdAt: now,
     expiresAt,
@@ -201,6 +214,17 @@ async function completeWebOAuthFlow(opts) {
   const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {
     fetchFn: guardedFetch
   });
+  assertOAuthServerIssuer(asMetadata, flow.authorizationServerUrl);
+  assertFrozenIssuer(flow);
+  assertOAuthCredentialIssuer(
+    flow.clientInformation,
+    flow.authorizationServerIssuer,
+    !!flow.clientInformation.client_secret
+  );
+  if (agentStorage) {
+    agentForPersistence = await agentStorage.loadAgent(flow.agentId);
+    assertAgentUnchangedForFlow(agentForPersistence, flow);
+  }
   let tokens;
   try {
     tokens = await exchangeAuthorization(flow.authorizationServerUrl, {
@@ -212,6 +236,7 @@ async function completeWebOAuthFlow(opts) {
       resource: flow.resource ? new URL(flow.resource) : void 0,
       fetchFn: guardedFetch
     });
+    tokens = { ...tokens, issuer: flow.authorizationServerIssuer };
   } catch (err) {
     throw wrapTokenExchangeError(err);
   }
@@ -225,7 +250,8 @@ async function completeWebOAuthFlow(opts) {
     } else if (flow.resourceOverrideAction === "clear") {
       delete agentForPersistence.oauth_resource;
     }
-    delete agentForPersistence.oauth_code_verifier;
+    agentForPersistence.oauth_code_verifier = void 0;
+    agentForPersistence.oauth_discovery_state = void 0;
     await agentStorage.saveAgent(agentForPersistence);
     persisted = true;
   }
@@ -237,6 +263,20 @@ async function completeWebOAuthFlow(opts) {
     persisted
   };
 }
+function assertSavedCredentialIssuers(agent, issuer) {
+  if (agent.oauth_tokens) assertOAuthCredentialIssuer(agent.oauth_tokens, issuer, !!agent.oauth_tokens.refresh_token);
+  if (agent.oauth_client) assertOAuthCredentialIssuer(agent.oauth_client, issuer, !!agent.oauth_client.client_secret);
+}
+function assertFrozenIssuer(flow) {
+  if (!flow.authorizationServerIssuer) {
+    throw new OAuthError(
+      "Pending OAuth flow lacks a validated authorization-server issuer. Start a new owner sign-in.",
+      "oauth_issuer_required",
+      flow.agentId
+    );
+  }
+  assertOAuthServerIssuer({ issuer: flow.authorizationServerIssuer }, flow.authorizationServerUrl);
+}
 function assertAgentUnchangedForFlow(agent, flow) {
   if (!agent) {
     throw new AgentVanishedDuringFlowError(flow.agentId);
@@ -244,6 +284,13 @@ function assertAgentUnchangedForFlow(agent, flow) {
   if (agent.agent_uri !== flow.agentUrl) {
     throw new AgentChangedDuringFlowError(flow.agentId);
   }
+  if (!agent.oauth_client) throw new AgentChangedDuringFlowError(flow.agentId);
+  const currentClient = toMCPClientInfo(agent.oauth_client);
+  for (const key of ["client_id", "client_secret", "client_secret_expires_at", "issuer"]) {
+    if (currentClient[key] !== flow.clientInformation[key]) throw new AgentChangedDuringFlowError(flow.agentId);
+  }
+  assertFrozenIssuer(flow);
+  assertSavedCredentialIssuers(agent, flow.authorizationServerIssuer);
   if (Object.prototype.hasOwnProperty.call(flow, "resourceOverrideSnapshot") && (agent.oauth_resource ?? null) !== flow.resourceOverrideSnapshot) {
     throw new AgentChangedDuringFlowError(flow.agentId);
   }
@@ -379,7 +426,7 @@ function createSsrfSafeOAuthFetch(trustedFetchFn, allowHttp) {
   });
 }
 async function resolveClientInformation(args) {
-  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;
+  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient, issuer } = args;
   if (agent.oauth_client) {
     return toMCPClientInfo(agent.oauth_client);
   }
@@ -390,16 +437,20 @@ async function resolveClientInformation(args) {
       agent.id
     );
   }
-  const registered = await registerClient(asUrl.toString(), {
+  const response = await registerClient(asUrl.toString(), {
     metadata: asMetadata,
     clientMetadata,
     fetchFn
   });
+  const registered = { ...response, issuer };
   if (registered.client_secret && !allowConfidentialClient) {
     throw new ConfidentialClientNotAllowedError(agent.id);
   }
   if (agentStorage) {
-    const fresh = await agentStorage.loadAgent(agent.id) ?? agent;
+    const fresh = await agentStorage.loadAgent(agent.id);
+    if (!fresh) throw new AgentVanishedDuringFlowError(agent.id);
+    if (fresh.agent_uri !== agent.agent_uri || fresh.oauth_client) throw new AgentChangedDuringFlowError(agent.id);
+    assertSavedCredentialIssuers(fresh, issuer);
     fresh.oauth_client = fromMCPClientInfo(registered);
     await agentStorage.saveAgent(fresh);
   }

package/dist/lib/index.d.mts

@@ -186,7 +186,7 @@ export { getAuthToken, createAdCPHeaders, createMCPAuthHeaders, createAuthentica
 export { parseWWWAuthenticate, decodeAccessTokenClaims, validateTokenAudience, type WWWAuthenticateChallenge, type DecodedJWTHeader, type DecodedJWTClaims, type DecodedAccessToken, type TokenAudienceResult, InvalidTokenError, InsufficientScopeError, } from './auth/oauth/index.mjs';
 export { runAuthDiagnosis, AUTH_DIAGNOSIS_SCHEMA_VERSION, type DiagnoseOptions, type HttpCapture as DiagnosisHttpCapture, type DiagnosisStep, type Hypothesis as DiagnosisHypothesis, type HypothesisVerdict as DiagnosisHypothesisVerdict, type AuthDiagnosisReport, } from './auth/oauth/index.mjs';
 export { NeedsAuthorizationError, discoverAuthorizationRequirements, hasValidatedMcpAuthorizationRequirements, createFileOAuthStorage, bindAgentStorage, getAgentStorage, unbindAgentStorage, type AuthorizationRequirements, type DiscoverAuthorizationOptions, type FileOAuthStorageOptions, } from './auth/oauth/index.mjs';
-export { exchangeClientCredentials, ensureClientCredentialsTokens, ClientCredentialsExchangeError, MissingEnvSecretError, resolveSecret, isEnvSecretReference, toEnvSecretReference, extractEnvSecretName, type ExchangeClientCredentialsOptions, type EnsureClientCredentialsOptions, type AgentOAuthClientCredentials, } from './auth/oauth/index.mjs';
+export { exchangeClientCredentials, ensureClientCredentialsTokens, ClientCredentialsExchangeError, MissingEnvSecretError, resolveSecret, isEnvSecretReference, toEnvSecretReference, extractEnvSecretName, type ExchangeClientCredentialsOptions, type EnsureClientCredentialsOptions, type AgentOAuthClientCredentials, AgentOAuthClientCredentialsSchema, } from './auth/oauth/index.mjs';
 export { validateAgentUrl, validateAdCPResponse, getExpectedSchema, handleAdCPResponse } from './validation/index.mjs';
 export { ProtocolClient, callMCPTool, callA2ATool, createA2AClientFromCardUrl, createMCPClient, createA2AClient, closeMCPConnections, closeOAuthConnections, bundleSupportsAdcpVersionField, BODY_SNIPPET_TIMEOUT_MS, OBSERVER_FLUSH_TIMEOUT_MS, sanitizeTransportHeaders, sanitizeTransportUrl, } from './protocols/index.mjs';
 export { toReleasePrecisionWire, validateAdcpVersionWire } from './validation/schema-loader.mjs';

package/dist/lib/index.d.ts

@@ -186,7 +186,7 @@ export { getAuthToken, createAdCPHeaders, createMCPAuthHeaders, createAuthentica
 export { parseWWWAuthenticate, decodeAccessTokenClaims, validateTokenAudience, type WWWAuthenticateChallenge, type DecodedJWTHeader, type DecodedJWTClaims, type DecodedAccessToken, type TokenAudienceResult, InvalidTokenError, InsufficientScopeError, } from './auth/oauth';
 export { runAuthDiagnosis, AUTH_DIAGNOSIS_SCHEMA_VERSION, type DiagnoseOptions, type HttpCapture as DiagnosisHttpCapture, type DiagnosisStep, type Hypothesis as DiagnosisHypothesis, type HypothesisVerdict as DiagnosisHypothesisVerdict, type AuthDiagnosisReport, } from './auth/oauth';
 export { NeedsAuthorizationError, discoverAuthorizationRequirements, hasValidatedMcpAuthorizationRequirements, createFileOAuthStorage, bindAgentStorage, getAgentStorage, unbindAgentStorage, type AuthorizationRequirements, type DiscoverAuthorizationOptions, type FileOAuthStorageOptions, } from './auth/oauth';
-export { exchangeClientCredentials, ensureClientCredentialsTokens, ClientCredentialsExchangeError, MissingEnvSecretError, resolveSecret, isEnvSecretReference, toEnvSecretReference, extractEnvSecretName, type ExchangeClientCredentialsOptions, type EnsureClientCredentialsOptions, type AgentOAuthClientCredentials, } from './auth/oauth';
+export { exchangeClientCredentials, ensureClientCredentialsTokens, ClientCredentialsExchangeError, MissingEnvSecretError, resolveSecret, isEnvSecretReference, toEnvSecretReference, extractEnvSecretName, type ExchangeClientCredentialsOptions, type EnsureClientCredentialsOptions, type AgentOAuthClientCredentials, AgentOAuthClientCredentialsSchema, } from './auth/oauth';
 export { validateAgentUrl, validateAdCPResponse, getExpectedSchema, handleAdCPResponse } from './validation';
 export { ProtocolClient, callMCPTool, callA2ATool, createA2AClientFromCardUrl, createMCPClient, createA2AClient, closeMCPConnections, closeOAuthConnections, bundleSupportsAdcpVersionField, BODY_SNIPPET_TIMEOUT_MS, OBSERVER_FLUSH_TIMEOUT_MS, sanitizeTransportHeaders, sanitizeTransportUrl, } from './protocols';
 export { toReleasePrecisionWire, validateAdcpVersionWire } from './validation/schema-loader';

package/dist/lib/index.js

@@ -48,6 +48,7 @@ __export(index_exports, {
   AdagentsJsonSchema: () => import_wellknown_schemas.AdagentsJsonSchema,
   AgentClient: () => import_AgentClient.AgentClient,
   AgentNotFoundError: () => import_errors.AgentNotFoundError,
+  AgentOAuthClientCredentialsSchema: () => import_oauth4.AgentOAuthClientCredentialsSchema,
   Asset: () => import_asset_builders.Asset,
   AsyncHandler: () => import_AsyncHandler.AsyncHandler,
   AuthenticationCredentialsRejectedError: () => import_errors.AuthenticationCredentialsRejectedError,
@@ -888,6 +889,7 @@ function createAdCPClientFromEnv() {
   AdagentsJsonSchema,
   AgentClient,
   AgentNotFoundError,
+  AgentOAuthClientCredentialsSchema,
   Asset,
   AsyncHandler,
   AuthenticationCredentialsRejectedError,