@agent-native/core 0.163.4 → 0.164.1

package/dist/mcp-client/oauth-client.js

@@ -23,6 +23,44 @@ function checkedRemoteUrl(value, label) {
 function canonicalServerUrl(value) {
     return checkedRemoteUrl(value, "server").toString();
 }
+/**
+ * RFC 8707 resource identifiers are exact strings. WHATWG `URL` origin-only
+ * values stringify with a trailing slash (`https://api.builder.io/` vs
+ * `https://api.builder.io`), and the MCP SDK puts `resource.href` on authorize
+ * and token requests. Servers that registered the unsuffixed identifier reject
+ * the canonical form as unregistered.
+ */
+class Rfc8707ResourceUrl extends URL {
+    identifier;
+    constructor(identifier) {
+        super(identifier);
+        this.identifier = identifier;
+    }
+    get href() {
+        return this.identifier;
+    }
+    toString() {
+        return this.identifier;
+    }
+}
+function rfc8707ResourceUrl(identifier) {
+    checkedRemoteUrl(identifier, "resource");
+    return new Rfc8707ResourceUrl(identifier);
+}
+function resourceIsAllowed(requested, configured) {
+    const configuredUrl = new URL(configured);
+    if (requested.origin !== configuredUrl.origin)
+        return false;
+    if (requested.pathname.length < configuredUrl.pathname.length)
+        return false;
+    const requestedPath = requested.pathname.endsWith("/")
+        ? requested.pathname
+        : `${requested.pathname}/`;
+    const configuredPath = configuredUrl.pathname.endsWith("/")
+        ? configuredUrl.pathname
+        : `${configuredUrl.pathname}/`;
+    return requestedPath.startsWith(configuredPath);
+}
 function serverUrlsMatch(stored, canonical) {
     try {
         return canonicalServerUrl(stored) === canonical;
@@ -256,6 +294,17 @@ export class McpOAuthClientProvider {
     get savedClientInformation() {
         return this.clientInfo;
     }
+    async validateResourceURL(defaultResource, advertised) {
+        if (!advertised)
+            return undefined;
+        const requested = typeof defaultResource === "string"
+            ? new URL(defaultResource)
+            : defaultResource;
+        if (!resourceIsAllowed(requested, advertised)) {
+            throw new Error(`Protected resource ${advertised} does not match expected ${requested} (or origin)`);
+        }
+        return rfc8707ResourceUrl(advertised);
+    }
 }
 export async function startMcpOAuthAuthorization(options) {
     checkedRemoteUrl(options.serverUrl, "server");
@@ -435,7 +484,7 @@ export async function getMcpOAuthAccessToken(options) {
                 throw new Error("MCP OAuth refresh issuer binding is invalid.");
             }
             const resource = discovery.resourceMetadata?.resource
-                ? checkedRemoteUrl(discovery.resourceMetadata.resource, "resource")
+                ? rfc8707ResourceUrl(discovery.resourceMetadata.resource)
                 : undefined;
             const authorizationServerUrl = checkedRemoteUrl(discovery.authorizationServerUrl, "authorization server");
             const refreshed = await refreshAuthorization(authorizationServerUrl, {

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,8 +311,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        id?: undefined;
         deleted?: undefined;
+        id?: undefined;
         providers: {
             id: string;
             label: string;
@@ -329,8 +329,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        id?: undefined;
         deleted?: undefined;
+        id?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/auth-marketing-locales.d.ts

@@ -0,0 +1,7 @@
+import type { LocaleCode } from "../localization/shared.js";
+export interface AuthMarketingLocaleCopy {
+    tagline?: string;
+    description?: string;
+    features?: string[];
+}
+export declare const AUTH_MARKETING_LOCALE_COPY: Partial<Record<LocaleCode, Record<string, AuthMarketingLocaleCopy>>>;