@ashx-j/lunr 0.2.26 → 0.2.27

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.d.ts

@@ -15,35 +15,23 @@ export interface AuthenticateOptions {
  * Extract OAuth configuration from a ServerEntry.
  */
 export declare function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig;
-/**
- * Start OAuth authentication flow for a server.
- * Returns the authorization URL when browser authorization is required.
- */
-export declare function startAuth(serverName: string, serverUrl: string, definition?: ServerEntry): Promise<{
-    authorizationUrl: string;
-}>;
 /**
  * Extract an OAuth authorization code from either a raw code, a query string,
  * or the full localhost redirect URL copied from the browser address bar.
  */
 export declare function parseAuthorizationCodeInput(input: string, expectedState?: string): string;
-/**
- * Complete OAuth authentication from manual user input.
- */
-export declare function completeAuthFromInput(serverName: string, input: string): Promise<AuthStatus>;
-/**
- * Complete OAuth authentication with the authorization code.
- */
-export declare function completeAuth(serverName: string, authorizationCode: string): Promise<AuthStatus>;
-/**
- * Perform the complete OAuth authentication flow for a server.
- *
- * @param serverName - The name of the MCP server
- * @param serverUrl - The URL of the MCP server
- * @param definition - The server definition (optional)
- * @returns The final auth status
- */
-export declare function authenticate(serverName: string, serverUrl: string, definition?: ServerEntry, options?: AuthenticateOptions): Promise<AuthStatus>;
+/** Each session owns its flows; only the callback listener is shared. */
+export declare function createMcpAuthFlow(): {
+    startAuth: (serverName: string, serverUrl: string, definition?: ServerEntry | undefined) => Promise<{
+        authorizationUrl: string;
+    }>;
+    completeAuth: (serverName: string, code: string) => Promise<AuthStatus>;
+    completeAuthFromInput: (serverName: string, input: string) => Promise<AuthStatus>;
+    authenticate: (serverName: string, serverUrl: string, definition?: ServerEntry | undefined, options?: AuthenticateOptions) => Promise<AuthStatus>;
+    removeAuth: (serverName: string) => Promise<void>;
+    shutdown: () => Promise<void>;
+};
+export type McpAuthFlow = ReturnType<typeof createMcpAuthFlow>;
 /**
  * Get a valid access token for a server, refreshing if necessary.
  *
@@ -59,12 +47,6 @@ export declare function getValidToken(serverName: string, serverUrl: string): Pr
  * @returns The current auth status
  */
 export declare function getAuthStatus(serverName: string): Promise<AuthStatus>;
-/**
- * Remove all OAuth credentials for a server.
- *
- * @param serverName - The name of the MCP server
- */
-export declare function removeAuth(serverName: string): Promise<void>;
 /**
  * Check if OAuth is supported for a server configuration.
  * OAuth is supported for HTTP servers unless explicitly disabled.
@@ -73,14 +55,4 @@ export declare function removeAuth(serverName: string): Promise<void>;
  * @returns True if OAuth is supported
  */
 export declare function supportsOAuth(definition: ServerEntry): boolean;
-/**
- * Initialize the OAuth system on startup.
- * OAuth callback binding is lazy and starts from startAuth() only.
- */
-export declare function initializeOAuth(): Promise<void>;
-/**
- * Shutdown the OAuth system.
- * Stops the callback server and cancels pending auths.
- */
-export declare function shutdownOAuth(): Promise<void>;
 //# sourceMappingURL=mcp-auth-flow.d.ts.map

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth-flow.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAQH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAQ/E,OAAO,EAWL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAE1E,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxE;AAsBD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,WAAW,GAAG,cAAc,CAyC1E;AAqCD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAiFvC;AA8DD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CA+BzF;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,UAAU,CAAC,CAerB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,WAAW,EACxB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,UAAU,CAAC,CAmErB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASlE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAc9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;AAEzD;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Flow\n * \n * High-level OAuth flow management using the MCP SDK's built-in auth functions.\n */\n\nimport {\n  auth as runSdkAuth,\n  UnauthorizedError,\n} from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\"\nimport open from \"open\"\nimport { McpOAuthProvider, type McpOAuthConfig } from \"./mcp-oauth-provider.ts\"\nimport {\n  ensureCallbackServer,\n  waitForCallback,\n  cancelPendingCallback,\n  stopCallbackServer,\n  releaseCallbackServer,\n} from \"./mcp-callback-server.ts\"\nimport {\n  getAuthForUrl,\n  isTokenExpired,\n  hasStoredTokens,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  clearCodeVerifier,\n  updateOAuthState,\n  getOAuthState,\n  clearOAuthState,\n  type StoredTokens,\n} from \"./mcp-auth.ts\"\nimport type { ServerEntry } from \"./types.ts\"\n\n/** Auth status for a server */\nexport type AuthStatus = \"authenticated\" | \"expired\" | \"not_authenticated\"\n\nexport interface AuthenticateOptions {\n  onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>\n}\n\n// Track pending transports for auth completion\nconst pendingTransports = new Map<string, StreamableHTTPClientTransport>()\nconst pendingAuthStates = new Map<string, string>()\nconst pendingAuthCleanupTimers = new Map<string, ReturnType<typeof setTimeout>>()\n\n// Deduplicate concurrent authenticate() calls per server.\nconst pendingAuthentications = new Map<string, Promise<AuthStatus>>()\n\n/** Timeout for manual auth completion (5 minutes) */\nconst MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000\n\n/**\n * Generate a cryptographically secure random state parameter.\n */\nfunction generateState(): string {\n  return Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n}\n\n/**\n * Extract OAuth configuration from a ServerEntry.\n */\nexport function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {\n  if (definition.oauth === false) {\n    return {}\n  }\n\n  const config: McpOAuthConfig = {}\n  if (definition.oauth?.grantType !== undefined) config.grantType = definition.oauth.grantType\n  if (definition.oauth?.clientId !== undefined) config.clientId = definition.oauth.clientId\n  if (definition.oauth?.clientSecret !== undefined) config.clientSecret = definition.oauth.clientSecret\n  if (definition.oauth?.scope !== undefined) config.scope = definition.oauth.scope\n  if (definition.oauth?.redirectUri !== undefined) {\n    if (typeof definition.oauth.redirectUri !== \"string\") {\n      throw new Error(\"OAuth redirectUri must be a string\")\n    }\n    const redirectUri = definition.oauth.redirectUri.trim()\n    if (!redirectUri) {\n      throw new Error(\"OAuth redirectUri must not be empty\")\n    }\n    config.redirectUri = redirectUri\n  }\n  if (definition.oauth?.clientName !== undefined) {\n    if (typeof definition.oauth.clientName !== \"string\") {\n      throw new Error(\"OAuth clientName must be a string\")\n    }\n    const clientName = definition.oauth.clientName.trim()\n    if (!clientName) {\n      throw new Error(\"OAuth clientName must not be empty\")\n    }\n    config.clientName = clientName\n  }\n  if (definition.oauth?.clientUri !== undefined) {\n    if (typeof definition.oauth.clientUri !== \"string\") {\n      throw new Error(\"OAuth clientUri must be a string\")\n    }\n    const clientUri = definition.oauth.clientUri.trim()\n    if (!clientUri) {\n      throw new Error(\"OAuth clientUri must not be empty\")\n    }\n    config.clientUri = clientUri\n  }\n  return config\n}\n\nfunction parseOAuthRedirectUri(redirectUri: string): { port: number; callbackHost: string; callbackPath: string } {\n  let url: URL\n  try {\n    url = new URL(redirectUri)\n  } catch (error) {\n    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error })\n  }\n\n  const hostname = url.hostname.toLowerCase()\n  const isLocalhost = hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\"\n  if (url.protocol !== \"http:\" || !isLocalhost) {\n    throw new Error(\"OAuth redirectUri must be an http:// localhost or loopback URI\")\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"OAuth redirectUri must not include username or password\")\n  }\n\n  if (url.hash) {\n    throw new Error(\"OAuth redirectUri must not include a fragment\")\n  }\n\n  if (!url.port) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const port = Number.parseInt(url.port, 10)\n  if (!Number.isInteger(port) || port <= 0 || port > 65535) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const callbackHost = hostname === \"[::1]\" ? \"::1\" : hostname\n  return { port, callbackHost, callbackPath: url.pathname }\n}\n\n/**\n * Start OAuth authentication flow for a server.\n * Returns the authorization URL when browser authorization is required.\n */\nexport async function startAuth(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry\n): Promise<{ authorizationUrl: string }> {\n  const config = definition ? extractOAuthConfig(definition) : {}\n\n  if (config.grantType === \"client_credentials\") {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {\n      clearClientInfo(serverName)\n      clearCodeVerifier(serverName)\n      await clearOAuthState(serverName)\n    }\n\n    const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n      onRedirect: async () => {\n        throw new Error(\"Browser redirect is not used for client_credentials flow\")\n      },\n    })\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result !== \"AUTHORIZED\") {\n      throw new UnauthorizedError(\"Failed to authorize\")\n    }\n    return { authorizationUrl: \"\" }\n  }\n\n  const redirectCallback = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined\n  const oauthState = generateState()\n\n  try {\n    await ensureCallbackServer({\n      strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,\n      oauthState,\n      reserveState: true,\n      ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),\n    })\n  } catch (error) {\n    await clearOAuthState(serverName)\n    throw error\n  }\n\n  let capturedUrl: URL | undefined\n  const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n    onRedirect: async (url) => {\n      capturedUrl = url\n    },\n  })\n\n  try {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !config.clientId) {\n      if (!storedAuth.tokens) {\n        clearClientInfo(serverName)\n        clearCodeVerifier(serverName)\n        await clearOAuthState(serverName)\n      } else {\n        const redirectUris = storedAuth.clientInfo.redirectUris\n        if (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? \"\")) {\n          clearClientInfo(serverName)\n          clearTokens(serverName)\n          clearCodeVerifier(serverName)\n          await clearOAuthState(serverName)\n        }\n      }\n    }\n\n    await updateOAuthState(serverName, oauthState, serverUrl)\n\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result === \"AUTHORIZED\") {\n      releaseCallbackServer(oauthState)\n      await clearOAuthState(serverName)\n      return { authorizationUrl: \"\" }\n    }\n    if (!capturedUrl) {\n      throw new UnauthorizedError(\"OAuth authorization URL was not provided\")\n    }\n    const pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider })\n    await setPendingTransport(serverName, pendingTransport, oauthState)\n    return { authorizationUrl: capturedUrl.toString() }\n  } catch (error) {\n    await clearPendingAuth(serverName, oauthState)\n    throw error\n  }\n}\n\nasync function setPendingTransport(\n  serverName: string,\n  transport: StreamableHTTPClientTransport,\n  oauthState: string,\n): Promise<void> {\n  await clearPendingAuth(serverName)\n  pendingTransports.set(serverName, transport)\n  pendingAuthStates.set(serverName, oauthState)\n  const cleanupTimer = setTimeout(() => {\n    void clearPendingAuth(serverName, oauthState)\n  }, MANUAL_AUTH_TIMEOUT_MS)\n  cleanupTimer.unref?.()\n  pendingAuthCleanupTimers.set(serverName, cleanupTimer)\n}\n\nasync function clearPendingAuth(serverName: string, oauthState?: string): Promise<void> {\n  const pendingState = pendingAuthStates.get(serverName)\n  if (oauthState && pendingState && pendingState !== oauthState) return\n\n  const timer = pendingAuthCleanupTimers.get(serverName)\n  if (timer) {\n    clearTimeout(timer)\n    pendingAuthCleanupTimers.delete(serverName)\n  }\n\n  const transport = pendingTransports.get(serverName)\n  pendingTransports.delete(serverName)\n  pendingAuthStates.delete(serverName)\n  const stateToRelease = pendingState ?? oauthState\n  if (stateToRelease) {\n    releaseCallbackServer(stateToRelease)\n    const storedState = await getOAuthState(serverName)\n    if (storedState === stateToRelease) {\n      await clearOAuthState(serverName)\n    }\n  }\n  if (transport) {\n    await transport.close().catch(() => {})\n  }\n}\n\nfunction getSearchParamsFromInput(input: string): URLSearchParams | undefined {\n  try {\n    const url = new URL(input)\n    const params = new URLSearchParams(url.search)\n    if (url.hash) {\n      const hash = url.hash.startsWith(\"#\") ? url.hash.slice(1) : url.hash\n      const hashParams = new URLSearchParams(hash)\n      for (const [key, value] of hashParams) {\n        if (!params.has(key)) params.set(key, value)\n      }\n    }\n    return params\n  } catch {\n    const query = input.includes(\"?\") ? input.slice(input.indexOf(\"?\") + 1) : input\n    const params = new URLSearchParams(query.startsWith(\"#\") ? query.slice(1) : query)\n    return params.has(\"code\") || params.has(\"state\") || params.has(\"error\") ? params : undefined\n  }\n}\n\n/**\n * Extract an OAuth authorization code from either a raw code, a query string,\n * or the full localhost redirect URL copied from the browser address bar.\n */\nexport function parseAuthorizationCodeInput(input: string, expectedState?: string): string {\n  const trimmed = input.trim()\n  if (!trimmed) {\n    throw new Error(\"Authorization code or redirect URL is required\")\n  }\n\n  const params = getSearchParamsFromInput(trimmed)\n  if (params) {\n    const error = params.get(\"error\")\n    if (error) {\n      const description = params.get(\"error_description\")\n      throw new Error(description ? `${error}: ${description}` : error)\n    }\n\n    const state = params.get(\"state\")\n    if (expectedState && !state) {\n      throw new Error(\"OAuth state missing from redirect URL\")\n    }\n    if (expectedState && state !== expectedState) {\n      throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n    }\n\n    const code = params.get(\"code\")\n    if (code) return code\n  }\n\n  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {\n    return trimmed\n  }\n\n  throw new Error(\"Could not find an OAuth authorization code in the provided input\")\n}\n\n/**\n * Complete OAuth authentication from manual user input.\n */\nexport async function completeAuthFromInput(\n  serverName: string,\n  input: string,\n): Promise<AuthStatus> {\n  const oauthState = await getOAuthState(serverName)\n  const code = parseAuthorizationCodeInput(input, oauthState)\n  return completeAuth(serverName, code)\n}\n\n/**\n * Complete OAuth authentication with the authorization code.\n */\nexport async function completeAuth(\n  serverName: string,\n  authorizationCode: string\n): Promise<AuthStatus> {\n  const transport = pendingTransports.get(serverName)\n  if (!transport) {\n    throw new Error(`No pending OAuth flow for server: ${serverName}`)\n  }\n\n  const oauthState = await getOAuthState(serverName)\n\n  try {\n    // Complete the auth using the transport's finishAuth method\n    await transport.finishAuth(authorizationCode)\n    return \"authenticated\"\n  } finally {\n    await clearPendingAuth(serverName, oauthState)\n  }\n}\n\n/**\n * Perform the complete OAuth authentication flow for a server.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server  \n * @param definition - The server definition (optional)\n * @returns The final auth status\n */\nexport async function authenticate(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry,\n  options: AuthenticateOptions = {},\n): Promise<AuthStatus> {\n  const inFlight = pendingAuthentications.get(serverName)\n  if (inFlight) {\n    return inFlight\n  }\n\n  const operation = (async (): Promise<AuthStatus> => {\n    // Start auth flow\n    const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)\n\n    // If no auth URL needed, already authenticated\n    if (!authorizationUrl) {\n      return \"authenticated\"\n    }\n\n    // Get the state that was already generated and stored in startAuth()\n    const oauthState = await getOAuthState(serverName)\n    if (!oauthState) {\n      throw new Error(\"OAuth state not found - this should not happen\")\n    }\n\n    // Register the callback BEFORE opening the browser\n    const callbackPromise = waitForCallback(oauthState)\n\n    try {\n      // Open browser. Always surface the URL first so remote/headless users can copy it\n      // even when the OS browser handoff is unavailable or invisible.\n      if (options.onAuthorizationUrl) {\n        await options.onAuthorizationUrl(authorizationUrl)\n      } else {\n        console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\\n${authorizationUrl}`)\n      }\n      try {\n        await open(authorizationUrl)\n      } catch (error) {\n        console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })\n      }\n\n      // Wait for callback\n      const code = await callbackPromise\n\n      // Validate state\n      const storedState = await getOAuthState(serverName)\n      if (storedState !== oauthState) {\n        await clearOAuthState(serverName)\n        throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n      }\n      await clearOAuthState(serverName)\n\n      // Complete the auth\n      return await completeAuth(serverName, code)\n    } catch (error) {\n      cancelPendingCallback(oauthState)\n      await clearPendingAuth(serverName, oauthState)\n      throw error\n    }\n  })()\n\n  pendingAuthentications.set(serverName, operation)\n\n  try {\n    return await operation\n  } finally {\n    if (pendingAuthentications.get(serverName) === operation) {\n      pendingAuthentications.delete(serverName)\n    }\n  }\n}\n\n/**\n * Get a valid access token for a server, refreshing if necessary.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server\n * @returns The valid tokens or null if not authenticated\n */\nexport async function getValidToken(\n  serverName: string,\n  serverUrl: string,\n): Promise<StoredTokens | null> {\n  // Check if we have valid tokens\n  const entry = await getAuthForUrl(serverName, serverUrl)\n  if (!entry?.tokens) {\n    return null\n  }\n\n  // Check expiration\n  const expired = await isTokenExpired(serverName)\n  if (expired === false) {\n    return entry.tokens\n  }\n\n  if (expired === true && entry.tokens.refreshToken) {\n    // Token is expired, try to refresh\n    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`)\n\n    try {\n      // Create auth provider for token refresh\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {\n        onRedirect: async () => {},\n      })\n\n      const clientInfo = await authProvider.clientInformation()\n      if (!clientInfo) {\n        console.log(`MCP Auth: No client info for refresh for ${serverName}`)\n        return null\n      }\n\n      const result = await runSdkAuth(authProvider, { serverUrl })\n      if (result !== \"AUTHORIZED\") {\n        return null\n      }\n      const refreshed = await getAuthForUrl(serverName, serverUrl)\n      return refreshed?.tokens ?? null\n    } catch (error) {\n      console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error })\n      return null\n    }\n  }\n\n  // No expiration info or no refresh token, assume valid\n  return entry.tokens\n}\n\n/**\n * Check the authentication status for a server.\n * \n * @param serverName - The name of the MCP server\n * @returns The current auth status\n */\nexport async function getAuthStatus(serverName: string): Promise<AuthStatus> {\n  const hasTokens = await hasStoredTokens(serverName)\n  if (!hasTokens) return \"not_authenticated\"\n\n  const expired = await isTokenExpired(serverName)\n  return expired ? \"expired\" : \"authenticated\"\n}\n\n/**\n * Remove all OAuth credentials for a server.\n * \n * @param serverName - The name of the MCP server\n */\nexport async function removeAuth(serverName: string): Promise<void> {\n  const oauthState = await getOAuthState(serverName)\n  if (oauthState) {\n    cancelPendingCallback(oauthState)\n  }\n  await clearPendingAuth(serverName, oauthState)\n  clearAllCredentials(serverName)\n  await clearOAuthState(serverName)\n  console.log(`MCP Auth: Removed credentials for ${serverName}`)\n}\n\n/**\n * Check if OAuth is supported for a server configuration.\n * OAuth is supported for HTTP servers unless explicitly disabled.\n * \n * @param definition - The server definition\n * @returns True if OAuth is supported\n */\nexport function supportsOAuth(definition: ServerEntry): boolean {\n  // OAuth requires a URL\n  if (!definition.url) return false\n  \n  // Explicitly disabled via auth: false or oauth: false\n  if (definition.auth === false) return false\n  if (definition.oauth === false) return false\n  if (definition.auth === \"oauth\") return true\n  \n  // Configured custom headers take precedence over implicit OAuth auto-detection.\n  if (definition.headers && Object.keys(definition.headers).length > 0) return false\n\n  // OAuth is enabled when auth is not specified (auto-detect)\n  return definition.auth === undefined\n}\n\n/**\n * Initialize the OAuth system on startup.\n * OAuth callback binding is lazy and starts from startAuth() only.\n */\nexport async function initializeOAuth(): Promise<void> {}\n\n/**\n * Shutdown the OAuth system.\n * Stops the callback server and cancels pending auths.\n */\nexport async function shutdownOAuth(): Promise<void> {\n  for (const serverName of Array.from(pendingTransports.keys())) {\n    await clearPendingAuth(serverName)\n  }\n  await stopCallbackServer()\n}\n"]}
+{"version":3,"file":"mcp-auth-flow.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAQH,OAAO,EAAoB,KAAK,cAAc,EAA0B,MAAM,yBAAyB,CAAA;AASvG,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAA;AAEtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,+BAA+B;AAC/B,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,CAAA;AAE1E,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxE;AAcD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,WAAW,GAAG,cAAc,CAyC1E;AAwDD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CA+BzF;AAUD,yEAAyE;AACzE,wBAAgB,iBAAiB;;;;;;;;;EA4KhC;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE9D;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA2C9B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAM3E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAc9D","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Flow\n * \n * High-level OAuth flow management using the MCP SDK's built-in auth functions.\n */\n\nimport {\n  auth as runSdkAuth,\n  UnauthorizedError,\n} from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\"\nimport open from \"open\"\nimport { McpOAuthProvider, type McpOAuthConfig, type McpOAuthFlowState } from \"./mcp-oauth-provider.ts\"\nimport {\n  ensureCallbackServer,\n  waitForCallback,\n  cancelPendingCallback,\n  acquireCallbackServerOwner,\n  releaseCallbackServerOwner,\n  releaseCallbackServer,\n} from \"./mcp-callback-server.ts\"\nimport {\n  getAuthForUrl,\n  isTokenExpired,\n  hasStoredTokens,\n  clearAllCredentials,\n  type StoredTokens,\n} from \"./mcp-auth.ts\"\nimport { abortable, throwIfAborted } from \"./abort.ts\"\nimport type { ServerEntry } from \"./types.ts\"\n\n/** Auth status for a server */\nexport type AuthStatus = \"authenticated\" | \"expired\" | \"not_authenticated\"\n\nexport interface AuthenticateOptions {\n  onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>\n}\n\n/** Timeout for manual auth completion (5 minutes) */\nconst MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000\n\n/**\n * Generate a cryptographically secure random state parameter.\n */\nfunction generateState(): string {\n  return Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n}\n\n/**\n * Extract OAuth configuration from a ServerEntry.\n */\nexport function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {\n  if (definition.oauth === false) {\n    return {}\n  }\n\n  const config: McpOAuthConfig = {}\n  if (definition.oauth?.grantType !== undefined) config.grantType = definition.oauth.grantType\n  if (definition.oauth?.clientId !== undefined) config.clientId = definition.oauth.clientId\n  if (definition.oauth?.clientSecret !== undefined) config.clientSecret = definition.oauth.clientSecret\n  if (definition.oauth?.scope !== undefined) config.scope = definition.oauth.scope\n  if (definition.oauth?.redirectUri !== undefined) {\n    if (typeof definition.oauth.redirectUri !== \"string\") {\n      throw new Error(\"OAuth redirectUri must be a string\")\n    }\n    const redirectUri = definition.oauth.redirectUri.trim()\n    if (!redirectUri) {\n      throw new Error(\"OAuth redirectUri must not be empty\")\n    }\n    config.redirectUri = redirectUri\n  }\n  if (definition.oauth?.clientName !== undefined) {\n    if (typeof definition.oauth.clientName !== \"string\") {\n      throw new Error(\"OAuth clientName must be a string\")\n    }\n    const clientName = definition.oauth.clientName.trim()\n    if (!clientName) {\n      throw new Error(\"OAuth clientName must not be empty\")\n    }\n    config.clientName = clientName\n  }\n  if (definition.oauth?.clientUri !== undefined) {\n    if (typeof definition.oauth.clientUri !== \"string\") {\n      throw new Error(\"OAuth clientUri must be a string\")\n    }\n    const clientUri = definition.oauth.clientUri.trim()\n    if (!clientUri) {\n      throw new Error(\"OAuth clientUri must not be empty\")\n    }\n    config.clientUri = clientUri\n  }\n  return config\n}\n\nfunction parseOAuthRedirectUri(redirectUri: string): { port: number; callbackHost: string; callbackPath: string } {\n  let url: URL\n  try {\n    url = new URL(redirectUri)\n  } catch (error) {\n    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error })\n  }\n\n  const hostname = url.hostname.toLowerCase()\n  const isLocalhost = hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\"\n  if (url.protocol !== \"http:\" || !isLocalhost) {\n    throw new Error(\"OAuth redirectUri must be an http:// localhost or loopback URI\")\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"OAuth redirectUri must not include username or password\")\n  }\n\n  if (url.hash) {\n    throw new Error(\"OAuth redirectUri must not include a fragment\")\n  }\n\n  if (!url.port) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const port = Number.parseInt(url.port, 10)\n  if (!Number.isInteger(port) || port <= 0 || port > 65535) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const callbackHost = hostname === \"[::1]\" ? \"::1\" : hostname\n  return { port, callbackHost, callbackPath: url.pathname }\n}\n\nfunction getSearchParamsFromInput(input: string): URLSearchParams | undefined {\n  try {\n    const url = new URL(input)\n    const params = new URLSearchParams(url.search)\n    if (url.hash) {\n      const hash = url.hash.startsWith(\"#\") ? url.hash.slice(1) : url.hash\n      const hashParams = new URLSearchParams(hash)\n      for (const [key, value] of hashParams) {\n        if (!params.has(key)) params.set(key, value)\n      }\n    }\n    return params\n  } catch {\n    const query = input.includes(\"?\") ? input.slice(input.indexOf(\"?\") + 1) : input\n    const params = new URLSearchParams(query.startsWith(\"#\") ? query.slice(1) : query)\n    return params.has(\"code\") || params.has(\"state\") || params.has(\"error\") ? params : undefined\n  }\n}\n\n/**\n * Extract an OAuth authorization code from either a raw code, a query string,\n * or the full localhost redirect URL copied from the browser address bar.\n */\nexport function parseAuthorizationCodeInput(input: string, expectedState?: string): string {\n  const trimmed = input.trim()\n  if (!trimmed) {\n    throw new Error(\"Authorization code or redirect URL is required\")\n  }\n\n  const params = getSearchParamsFromInput(trimmed)\n  if (params) {\n    const error = params.get(\"error\")\n    if (error) {\n      const description = params.get(\"error_description\")\n      throw new Error(description ? `${error}: ${description}` : error)\n    }\n\n    const state = params.get(\"state\")\n    if (expectedState && !state) {\n      throw new Error(\"OAuth state missing from redirect URL\")\n    }\n    if (expectedState && state !== expectedState) {\n      throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n    }\n\n    const code = params.get(\"code\")\n    if (code) return code\n  }\n\n  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {\n    return trimmed\n  }\n\n  throw new Error(\"Could not find an OAuth authorization code in the provided input\")\n}\n\ninterface PendingAuthFlow {\n  state: McpOAuthFlowState\n  controller: AbortController\n  transport?: StreamableHTTPClientTransport\n  timer?: ReturnType<typeof setTimeout>\n  cleanup?: Promise<void>\n}\n\n/** Each session owns its flows; only the callback listener is shared. */\nexport function createMcpAuthFlow() {\n  const owner = acquireCallbackServerOwner()\n  const flows = new Map<string, PendingAuthFlow>()\n  const authenticating = new Map<string, Promise<AuthStatus>>()\n  let shutdownPromise: Promise<void> | undefined\n  let closed = false\n\n  function assertOpen(): void {\n    if (closed) throw new Error(\"MCP OAuth session closed\")\n  }\n\n  async function clearPendingAuth(serverName: string, flow = flows.get(serverName)): Promise<void> {\n    if (!flow) return\n    if (!flow.cleanup) {\n      flow.cleanup = (async () => {\n        if (flows.get(serverName) === flow) flows.delete(serverName)\n        if (flow.timer) clearTimeout(flow.timer)\n        flow.controller.abort(new Error(\"Authorization cancelled\"))\n        cancelPendingCallback(flow.state.oauthState)\n        releaseCallbackServer(flow.state.oauthState)\n        await flow.transport?.close().catch(() => {})\n      })()\n    }\n    await flow.cleanup\n  }\n\n  async function startAuth(\n    serverName: string,\n    serverUrl: string,\n    definition?: ServerEntry,\n  ): Promise<{ authorizationUrl: string }> {\n    assertOpen()\n    const previous = flows.get(serverName)\n    if (previous) await clearPendingAuth(serverName, previous)\n    assertOpen()\n    if (flows.has(serverName)) throw new Error(`OAuth flow already pending for server: ${serverName}`)\n    const controller = new AbortController()\n    const flow: PendingAuthFlow = { controller, state: { oauthState: generateState(), signal: controller.signal } }\n    flows.set(serverName, flow)\n    const signal = controller.signal\n    const fetchFn: typeof fetch = (input, init) => fetch(input, {\n      ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal,\n    })\n    try {\n      const config = definition ? extractOAuthConfig(definition) : {}\n      const storedAuth = await getAuthForUrl(serverName, serverUrl)\n      throwIfAborted(signal)\n      flow.state.clientInfo = storedAuth?.clientInfo\n      // Reuse the registered redirect endpoint and client ID, including clients\n      // without tokens. Display metadata changes never invalidate registrations.\n      if (config.grantType !== \"client_credentials\") {\n        if (!config.redirectUri && !config.clientId) {\n          const registeredRedirect = storedAuth?.clientInfo?.redirectUris?.[0]\n          if (registeredRedirect) config.redirectUri = registeredRedirect\n        }\n        const redirect = config.redirectUri ? parseOAuthRedirectUri(config.redirectUri) : undefined\n        await ensureCallbackServer({\n          owner,\n          signal,\n          strictPort: Boolean(config.clientId || storedAuth?.clientInfo) || config.redirectUri !== undefined,\n          oauthState: flow.state.oauthState,\n          reserveState: true,\n          ...(redirect ? { port: redirect.port, callbackHost: redirect.callbackHost, callbackPath: redirect.callbackPath } : {}),\n        })\n        throwIfAborted(signal)\n      }\n      let capturedUrl: URL | undefined\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n        onRedirect: (url) => { throwIfAborted(signal); capturedUrl = url },\n      }, flow.state)\n      const result = await abortable(runSdkAuth(authProvider, { serverUrl, fetchFn }), signal)\n      throwIfAborted(signal)\n      if (result === \"AUTHORIZED\") {\n        await clearPendingAuth(serverName, flow)\n        return { authorizationUrl: \"\" }\n      }\n      if (config.grantType === \"client_credentials\" || !capturedUrl) {\n        throw new UnauthorizedError(\"OAuth authorization URL was not provided\")\n      }\n      flow.transport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider, fetch: fetchFn })\n      flow.timer = setTimeout(() => { void clearPendingAuth(serverName, flow) }, MANUAL_AUTH_TIMEOUT_MS)\n      flow.timer.unref?.()\n      return { authorizationUrl: capturedUrl.toString() }\n    } catch (error) {\n      await clearPendingAuth(serverName, flow)\n      throw error\n    }\n  }\n\n  async function completeAuthFromInput(serverName: string, input: string): Promise<AuthStatus> {\n    assertOpen()\n    const flow = flows.get(serverName)\n    if (!flow) throw new Error(`No pending OAuth flow for server: ${serverName}`)\n    return completeAuth(serverName, parseAuthorizationCodeInput(input, flow.state.oauthState))\n  }\n\n  async function completeAuth(serverName: string, code: string): Promise<AuthStatus> {\n    assertOpen()\n    const flow = flows.get(serverName)\n    if (!flow?.transport) throw new Error(`No pending OAuth flow for server: ${serverName}`)\n    try {\n      await abortable(flow.transport.finishAuth(code), flow.state.signal)\n      throwIfAborted(flow.state.signal)\n      return \"authenticated\"\n    } finally {\n      await clearPendingAuth(serverName, flow)\n    }\n  }\n\n  async function authenticate(\n    serverName: string,\n    serverUrl: string,\n    definition?: ServerEntry,\n    options: AuthenticateOptions = {},\n  ): Promise<AuthStatus> {\n    assertOpen()\n    const pending = authenticating.get(serverName)\n    if (pending) return pending\n    const operation = (async (): Promise<AuthStatus> => {\n      const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)\n      if (!authorizationUrl) return \"authenticated\"\n      assertOpen()\n      const flow = flows.get(serverName)\n      if (!flow) throw new Error(`No pending OAuth flow for server: ${serverName}`)\n      const callback = waitForCallback(flow.state.oauthState)\n      // Attach a rejection handler before asynchronous UI/browser handoffs.\n      void callback.catch(() => {})\n      try {\n        if (options.onAuthorizationUrl) {\n          await abortable(Promise.resolve(options.onAuthorizationUrl(authorizationUrl)), flow.state.signal)\n        } else {\n          console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\\n${authorizationUrl}`)\n        }\n        throwIfAborted(flow.state.signal)\n        try {\n          await abortable(open(authorizationUrl), flow.state.signal)\n        } catch (error) {\n          throwIfAborted(flow.state.signal)\n          console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })\n        }\n        const code = await callback\n        return await completeAuth(serverName, code)\n      } catch (error) {\n        await clearPendingAuth(serverName, flow)\n        throw error\n      }\n    })()\n    authenticating.set(serverName, operation)\n    try { return await operation } finally {\n      if (authenticating.get(serverName) === operation) authenticating.delete(serverName)\n    }\n  }\n\n  async function removeAuth(serverName: string): Promise<void> {\n    assertOpen()\n    await clearPendingAuth(serverName)\n    clearAllCredentials(serverName)\n  }\n\n  function shutdown(): Promise<void> {\n    if (!shutdownPromise) {\n      // Mark closed before cleanup can yield, so stale callers cannot start work.\n      closed = true\n      shutdownPromise = (async () => {\n        await Promise.all([...flows].map(([name, flow]) => clearPendingAuth(name, flow)))\n        await releaseCallbackServerOwner(owner)\n      })()\n    }\n    return shutdownPromise\n  }\n\n  return { startAuth, completeAuth, completeAuthFromInput, authenticate, removeAuth, shutdown }\n}\n\nexport type McpAuthFlow = ReturnType<typeof createMcpAuthFlow>\n\n/**\n * Get a valid access token for a server, refreshing if necessary.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server\n * @returns The valid tokens or null if not authenticated\n */\nexport async function getValidToken(\n  serverName: string,\n  serverUrl: string,\n): Promise<StoredTokens | null> {\n  // Check if we have valid tokens\n  const entry = await getAuthForUrl(serverName, serverUrl)\n  if (!entry?.tokens) {\n    return null\n  }\n\n  // Check expiration\n  const expired = await isTokenExpired(serverName)\n  if (expired === false) {\n    return entry.tokens\n  }\n\n  if (expired === true && entry.tokens.refreshToken) {\n    // Token is expired, try to refresh\n    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`)\n\n    try {\n      // Create auth provider for token refresh\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {\n        onRedirect: async () => {},\n      })\n\n      const clientInfo = await authProvider.clientInformation()\n      if (!clientInfo) {\n        console.log(`MCP Auth: No client info for refresh for ${serverName}`)\n        return null\n      }\n\n      const result = await runSdkAuth(authProvider, { serverUrl })\n      if (result !== \"AUTHORIZED\") {\n        return null\n      }\n      const refreshed = await getAuthForUrl(serverName, serverUrl)\n      return refreshed?.tokens ?? null\n    } catch (error) {\n      console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error })\n      return null\n    }\n  }\n\n  // No expiration info or no refresh token, assume valid\n  return entry.tokens\n}\n\n/**\n * Check the authentication status for a server.\n * \n * @param serverName - The name of the MCP server\n * @returns The current auth status\n */\nexport async function getAuthStatus(serverName: string): Promise<AuthStatus> {\n  const hasTokens = await hasStoredTokens(serverName)\n  if (!hasTokens) return \"not_authenticated\"\n\n  const expired = await isTokenExpired(serverName)\n  return expired ? \"expired\" : \"authenticated\"\n}\n\n/**\n * Check if OAuth is supported for a server configuration.\n * OAuth is supported for HTTP servers unless explicitly disabled.\n * \n * @param definition - The server definition\n * @returns True if OAuth is supported\n */\nexport function supportsOAuth(definition: ServerEntry): boolean {\n  // OAuth requires a URL\n  if (!definition.url) return false\n  \n  // Explicitly disabled via auth: false or oauth: false\n  if (definition.auth === false) return false\n  if (definition.oauth === false) return false\n  if (definition.auth === \"oauth\") return true\n  \n  // Configured custom headers take precedence over implicit OAuth auto-detection.\n  if (definition.headers && Object.keys(definition.headers).length > 0) return false\n\n  // OAuth is enabled when auth is not specified (auto-detect)\n  return definition.auth === undefined\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js

@@ -8,14 +8,9 @@ import { auth as runSdkAuth, UnauthorizedError, } from "@modelcontextprotocol/sd
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import open from "open";
 import { McpOAuthProvider } from "./mcp-oauth-provider.js";
-import { ensureCallbackServer, waitForCallback, cancelPendingCallback, stopCallbackServer, releaseCallbackServer, } from "./mcp-callback-server.js";
-import { getAuthForUrl, isTokenExpired, hasStoredTokens, clearAllCredentials, clearClientInfo, clearTokens, clearCodeVerifier, updateOAuthState, getOAuthState, clearOAuthState, } from "./mcp-auth.js";
-// Track pending transports for auth completion
-const pendingTransports = new Map();
-const pendingAuthStates = new Map();
-const pendingAuthCleanupTimers = new Map();
-// Deduplicate concurrent authenticate() calls per server.
-const pendingAuthentications = new Map();
+import { ensureCallbackServer, waitForCallback, cancelPendingCallback, acquireCallbackServerOwner, releaseCallbackServerOwner, releaseCallbackServer, } from "./mcp-callback-server.js";
+import { getAuthForUrl, isTokenExpired, hasStoredTokens, clearAllCredentials, } from "./mcp-auth.js";
+import { abortable, throwIfAborted } from "./abort.js";
 /** Timeout for manual auth completion (5 minutes) */
 const MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
 /**
@@ -103,121 +98,6 @@ function parseOAuthRedirectUri(redirectUri) {
     const callbackHost = hostname === "[::1]" ? "::1" : hostname;
     return { port, callbackHost, callbackPath: url.pathname };
 }
-/**
- * Start OAuth authentication flow for a server.
- * Returns the authorization URL when browser authorization is required.
- */
-export async function startAuth(serverName, serverUrl, definition) {
-    const config = definition ? extractOAuthConfig(definition) : {};
-    if (config.grantType === "client_credentials") {
-        const storedAuth = await getAuthForUrl(serverName, serverUrl);
-        if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {
-            clearClientInfo(serverName);
-            clearCodeVerifier(serverName);
-            await clearOAuthState(serverName);
-        }
-        const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
-            onRedirect: async () => {
-                throw new Error("Browser redirect is not used for client_credentials flow");
-            },
-        });
-        const result = await runSdkAuth(authProvider, { serverUrl });
-        if (result !== "AUTHORIZED") {
-            throw new UnauthorizedError("Failed to authorize");
-        }
-        return { authorizationUrl: "" };
-    }
-    const redirectCallback = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined;
-    const oauthState = generateState();
-    try {
-        await ensureCallbackServer({
-            strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,
-            oauthState,
-            reserveState: true,
-            ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),
-        });
-    }
-    catch (error) {
-        await clearOAuthState(serverName);
-        throw error;
-    }
-    let capturedUrl;
-    const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
-        onRedirect: async (url) => {
-            capturedUrl = url;
-        },
-    });
-    try {
-        const storedAuth = await getAuthForUrl(serverName, serverUrl);
-        if (storedAuth?.clientInfo && !config.clientId) {
-            if (!storedAuth.tokens) {
-                clearClientInfo(serverName);
-                clearCodeVerifier(serverName);
-                await clearOAuthState(serverName);
-            }
-            else {
-                const redirectUris = storedAuth.clientInfo.redirectUris;
-                if (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? "")) {
-                    clearClientInfo(serverName);
-                    clearTokens(serverName);
-                    clearCodeVerifier(serverName);
-                    await clearOAuthState(serverName);
-                }
-            }
-        }
-        await updateOAuthState(serverName, oauthState, serverUrl);
-        const result = await runSdkAuth(authProvider, { serverUrl });
-        if (result === "AUTHORIZED") {
-            releaseCallbackServer(oauthState);
-            await clearOAuthState(serverName);
-            return { authorizationUrl: "" };
-        }
-        if (!capturedUrl) {
-            throw new UnauthorizedError("OAuth authorization URL was not provided");
-        }
-        const pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider });
-        await setPendingTransport(serverName, pendingTransport, oauthState);
-        return { authorizationUrl: capturedUrl.toString() };
-    }
-    catch (error) {
-        await clearPendingAuth(serverName, oauthState);
-        throw error;
-    }
-}
-async function setPendingTransport(serverName, transport, oauthState) {
-    await clearPendingAuth(serverName);
-    pendingTransports.set(serverName, transport);
-    pendingAuthStates.set(serverName, oauthState);
-    const cleanupTimer = setTimeout(() => {
-        void clearPendingAuth(serverName, oauthState);
-    }, MANUAL_AUTH_TIMEOUT_MS);
-    cleanupTimer.unref?.();
-    pendingAuthCleanupTimers.set(serverName, cleanupTimer);
-}
-async function clearPendingAuth(serverName, oauthState) {
-    const pendingState = pendingAuthStates.get(serverName);
-    if (oauthState && pendingState && pendingState !== oauthState)
-        return;
-    const timer = pendingAuthCleanupTimers.get(serverName);
-    if (timer) {
-        clearTimeout(timer);
-        pendingAuthCleanupTimers.delete(serverName);
-    }
-    const transport = pendingTransports.get(serverName);
-    pendingTransports.delete(serverName);
-    pendingAuthStates.delete(serverName);
-    const stateToRelease = pendingState ?? oauthState;
-    if (stateToRelease) {
-        releaseCallbackServer(stateToRelease);
-        const storedState = await getOAuthState(serverName);
-        if (storedState === stateToRelease) {
-            await clearOAuthState(serverName);
-        }
-    }
-    if (transport) {
-        await transport.close().catch(() => { });
-    }
-}
 function getSearchParamsFromInput(input) {
     try {
         const url = new URL(input);
@@ -270,101 +150,182 @@ export function parseAuthorizationCodeInput(input, expectedState) {
     }
     throw new Error("Could not find an OAuth authorization code in the provided input");
 }
-/**
- * Complete OAuth authentication from manual user input.
- */
-export async function completeAuthFromInput(serverName, input) {
-    const oauthState = await getOAuthState(serverName);
-    const code = parseAuthorizationCodeInput(input, oauthState);
-    return completeAuth(serverName, code);
-}
-/**
- * Complete OAuth authentication with the authorization code.
- */
-export async function completeAuth(serverName, authorizationCode) {
-    const transport = pendingTransports.get(serverName);
-    if (!transport) {
-        throw new Error(`No pending OAuth flow for server: ${serverName}`);
-    }
-    const oauthState = await getOAuthState(serverName);
-    try {
-        // Complete the auth using the transport's finishAuth method
-        await transport.finishAuth(authorizationCode);
-        return "authenticated";
-    }
-    finally {
-        await clearPendingAuth(serverName, oauthState);
-    }
-}
-/**
- * Perform the complete OAuth authentication flow for a server.
- *
- * @param serverName - The name of the MCP server
- * @param serverUrl - The URL of the MCP server
- * @param definition - The server definition (optional)
- * @returns The final auth status
- */
-export async function authenticate(serverName, serverUrl, definition, options = {}) {
-    const inFlight = pendingAuthentications.get(serverName);
-    if (inFlight) {
-        return inFlight;
-    }
-    const operation = (async () => {
-        // Start auth flow
-        const { authorizationUrl } = await startAuth(serverName, serverUrl, definition);
-        // If no auth URL needed, already authenticated
-        if (!authorizationUrl) {
-            return "authenticated";
-        }
-        // Get the state that was already generated and stored in startAuth()
-        const oauthState = await getOAuthState(serverName);
-        if (!oauthState) {
-            throw new Error("OAuth state not found - this should not happen");
+/** Each session owns its flows; only the callback listener is shared. */
+export function createMcpAuthFlow() {
+    const owner = acquireCallbackServerOwner();
+    const flows = new Map();
+    const authenticating = new Map();
+    let shutdownPromise;
+    let closed = false;
+    function assertOpen() {
+        if (closed)
+            throw new Error("MCP OAuth session closed");
+    }
+    async function clearPendingAuth(serverName, flow = flows.get(serverName)) {
+        if (!flow)
+            return;
+        if (!flow.cleanup) {
+            flow.cleanup = (async () => {
+                if (flows.get(serverName) === flow)
+                    flows.delete(serverName);
+                if (flow.timer)
+                    clearTimeout(flow.timer);
+                flow.controller.abort(new Error("Authorization cancelled"));
+                cancelPendingCallback(flow.state.oauthState);
+                releaseCallbackServer(flow.state.oauthState);
+                await flow.transport?.close().catch(() => { });
+            })();
         }
-        // Register the callback BEFORE opening the browser
-        const callbackPromise = waitForCallback(oauthState);
+        await flow.cleanup;
+    }
+    async function startAuth(serverName, serverUrl, definition) {
+        assertOpen();
+        const previous = flows.get(serverName);
+        if (previous)
+            await clearPendingAuth(serverName, previous);
+        assertOpen();
+        if (flows.has(serverName))
+            throw new Error(`OAuth flow already pending for server: ${serverName}`);
+        const controller = new AbortController();
+        const flow = { controller, state: { oauthState: generateState(), signal: controller.signal } };
+        flows.set(serverName, flow);
+        const signal = controller.signal;
+        const fetchFn = (input, init) => fetch(input, {
+            ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal,
+        });
         try {
-            // Open browser. Always surface the URL first so remote/headless users can copy it
-            // even when the OS browser handoff is unavailable or invisible.
-            if (options.onAuthorizationUrl) {
-                await options.onAuthorizationUrl(authorizationUrl);
+            const config = definition ? extractOAuthConfig(definition) : {};
+            const storedAuth = await getAuthForUrl(serverName, serverUrl);
+            throwIfAborted(signal);
+            flow.state.clientInfo = storedAuth?.clientInfo;
+            // Reuse the registered redirect endpoint and client ID, including clients
+            // without tokens. Display metadata changes never invalidate registrations.
+            if (config.grantType !== "client_credentials") {
+                if (!config.redirectUri && !config.clientId) {
+                    const registeredRedirect = storedAuth?.clientInfo?.redirectUris?.[0];
+                    if (registeredRedirect)
+                        config.redirectUri = registeredRedirect;
+                }
+                const redirect = config.redirectUri ? parseOAuthRedirectUri(config.redirectUri) : undefined;
+                await ensureCallbackServer({
+                    owner,
+                    signal,
+                    strictPort: Boolean(config.clientId || storedAuth?.clientInfo) || config.redirectUri !== undefined,
+                    oauthState: flow.state.oauthState,
+                    reserveState: true,
+                    ...(redirect ? { port: redirect.port, callbackHost: redirect.callbackHost, callbackPath: redirect.callbackPath } : {}),
+                });
+                throwIfAborted(signal);
+            }
+            let capturedUrl;
+            const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
+                onRedirect: (url) => { throwIfAborted(signal); capturedUrl = url; },
+            }, flow.state);
+            const result = await abortable(runSdkAuth(authProvider, { serverUrl, fetchFn }), signal);
+            throwIfAborted(signal);
+            if (result === "AUTHORIZED") {
+                await clearPendingAuth(serverName, flow);
+                return { authorizationUrl: "" };
             }
-            else {
-                console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\n${authorizationUrl}`);
+            if (config.grantType === "client_credentials" || !capturedUrl) {
+                throw new UnauthorizedError("OAuth authorization URL was not provided");
             }
+            flow.transport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider, fetch: fetchFn });
+            flow.timer = setTimeout(() => { void clearPendingAuth(serverName, flow); }, MANUAL_AUTH_TIMEOUT_MS);
+            flow.timer.unref?.();
+            return { authorizationUrl: capturedUrl.toString() };
+        }
+        catch (error) {
+            await clearPendingAuth(serverName, flow);
+            throw error;
+        }
+    }
+    async function completeAuthFromInput(serverName, input) {
+        assertOpen();
+        const flow = flows.get(serverName);
+        if (!flow)
+            throw new Error(`No pending OAuth flow for server: ${serverName}`);
+        return completeAuth(serverName, parseAuthorizationCodeInput(input, flow.state.oauthState));
+    }
+    async function completeAuth(serverName, code) {
+        assertOpen();
+        const flow = flows.get(serverName);
+        if (!flow?.transport)
+            throw new Error(`No pending OAuth flow for server: ${serverName}`);
+        try {
+            await abortable(flow.transport.finishAuth(code), flow.state.signal);
+            throwIfAborted(flow.state.signal);
+            return "authenticated";
+        }
+        finally {
+            await clearPendingAuth(serverName, flow);
+        }
+    }
+    async function authenticate(serverName, serverUrl, definition, options = {}) {
+        assertOpen();
+        const pending = authenticating.get(serverName);
+        if (pending)
+            return pending;
+        const operation = (async () => {
+            const { authorizationUrl } = await startAuth(serverName, serverUrl, definition);
+            if (!authorizationUrl)
+                return "authenticated";
+            assertOpen();
+            const flow = flows.get(serverName);
+            if (!flow)
+                throw new Error(`No pending OAuth flow for server: ${serverName}`);
+            const callback = waitForCallback(flow.state.oauthState);
+            // Attach a rejection handler before asynchronous UI/browser handoffs.
+            void callback.catch(() => { });
             try {
-                await open(authorizationUrl);
+                if (options.onAuthorizationUrl) {
+                    await abortable(Promise.resolve(options.onAuthorizationUrl(authorizationUrl)), flow.state.signal);
+                }
+                else {
+                    console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\n${authorizationUrl}`);
+                }
+                throwIfAborted(flow.state.signal);
+                try {
+                    await abortable(open(authorizationUrl), flow.state.signal);
+                }
+                catch (error) {
+                    throwIfAborted(flow.state.signal);
+                    console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
+                }
+                const code = await callback;
+                return await completeAuth(serverName, code);
             }
             catch (error) {
-                console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
-            }
-            // Wait for callback
-            const code = await callbackPromise;
-            // Validate state
-            const storedState = await getOAuthState(serverName);
-            if (storedState !== oauthState) {
-                await clearOAuthState(serverName);
-                throw new Error("OAuth state mismatch - potential CSRF attack");
+                await clearPendingAuth(serverName, flow);
+                throw error;
             }
-            await clearOAuthState(serverName);
-            // Complete the auth
-            return await completeAuth(serverName, code);
+        })();
+        authenticating.set(serverName, operation);
+        try {
+            return await operation;
         }
-        catch (error) {
-            cancelPendingCallback(oauthState);
-            await clearPendingAuth(serverName, oauthState);
-            throw error;
+        finally {
+            if (authenticating.get(serverName) === operation)
+                authenticating.delete(serverName);
         }
-    })();
-    pendingAuthentications.set(serverName, operation);
-    try {
-        return await operation;
     }
-    finally {
-        if (pendingAuthentications.get(serverName) === operation) {
-            pendingAuthentications.delete(serverName);
+    async function removeAuth(serverName) {
+        assertOpen();
+        await clearPendingAuth(serverName);
+        clearAllCredentials(serverName);
+    }
+    function shutdown() {
+        if (!shutdownPromise) {
+            // Mark closed before cleanup can yield, so stale callers cannot start work.
+            closed = true;
+            shutdownPromise = (async () => {
+                await Promise.all([...flows].map(([name, flow]) => clearPendingAuth(name, flow)));
+                await releaseCallbackServerOwner(owner);
+            })();
         }
+        return shutdownPromise;
     }
+    return { startAuth, completeAuth, completeAuthFromInput, authenticate, removeAuth, shutdown };
 }
 /**
  * Get a valid access token for a server, refreshing if necessary.
@@ -425,21 +386,6 @@ export async function getAuthStatus(serverName) {
     const expired = await isTokenExpired(serverName);
     return expired ? "expired" : "authenticated";
 }
-/**
- * Remove all OAuth credentials for a server.
- *
- * @param serverName - The name of the MCP server
- */
-export async function removeAuth(serverName) {
-    const oauthState = await getOAuthState(serverName);
-    if (oauthState) {
-        cancelPendingCallback(oauthState);
-    }
-    await clearPendingAuth(serverName, oauthState);
-    clearAllCredentials(serverName);
-    await clearOAuthState(serverName);
-    console.log(`MCP Auth: Removed credentials for ${serverName}`);
-}
 /**
  * Check if OAuth is supported for a server configuration.
  * OAuth is supported for HTTP servers unless explicitly disabled.
@@ -464,19 +410,4 @@ export function supportsOAuth(definition) {
     // OAuth is enabled when auth is not specified (auto-detect)
     return definition.auth === undefined;
 }
-/**
- * Initialize the OAuth system on startup.
- * OAuth callback binding is lazy and starts from startAuth() only.
- */
-export async function initializeOAuth() { }
-/**
- * Shutdown the OAuth system.
- * Stops the callback server and cancels pending auths.
- */
-export async function shutdownOAuth() {
-    for (const serverName of Array.from(pendingTransports.keys())) {
-        await clearPendingAuth(serverName);
-    }
-    await stopCallbackServer();
-}
 //# sourceMappingURL=mcp-auth-flow.js.map