@assistant-ui/react-mcp 0.1.21 → 0.1.22

package/dist/resources/storage/McpLocalStorage.js.map

@@ -1 +1 @@
-{"version":3,"file":"McpLocalStorage.js","names":["resource","useMemo","OAuthMetadataSchema","OAuthClientInformationFullSchema","OAuthProtectedResourceMetadataSchema","OAuthTokensSchema","normalizeMcpServerUrl","MCPAuthConfig","MCPCustomServerRecord","MCPPersistedAuthState","assertValidServerId","MCPStorage","McpLocalStorageOptions","keyPrefix","storage","Storage","scopeId","resolveStorage","opts","globalThis","localStorage","isRecord","value","Record","Array","isArray","isOptionalString","undefined","isNonEmptyString","trim","length","isOptionalNonEmptyString","isOptionalStringArray","every","item","isOptionalConnectionTimeout","Number","isFinite","isValidServerId","id","isMCPAuthConfig","auth","type","token","scopes","authorizationEndpoint","tokenEndpoint","registrationEndpoint","clientId","clientSecret","isCustomServerRecord","name","url","createdAt","connectionTimeout","normalizeCustomServerRecord","record","normalizeCustomServerRecords","flatMap","normalizeOAuthTokens","result","safeParse","success","data","normalizeClientInformation","isSecureNetworkUrl","URL","isIpv4Loopback","test","hostname","protocol","endsWith","isMcpServerUrl","normalizeDiscoveryState","authorizationServerUrl","state","NonNullable","resourceMetadataUrl","metadata","authorizationServerMetadata","resourceMetadata","normalizePersistedAuthState","serverUrl","tokensClientId","codeVerifier","tokens","clientInformation","clientInformationSource","discoveryState","Object","keys","useMcpLocalStorage","t0","$","_c","t1","prefix","t2","customServersKey","t3","authKey","t4","key","fallback","raw","getItem","JSON","parse","T","read","t5","key_0","setItem","stringify","write","t6","key_1","removeItem","remove","t7","t8","t9","records","t10","id_0","t11","id_1","t12","id_2","t13","loadCustomServers","saveCustomServers","loadAuthState","saveAuthState","clearAuthState","McpLocalStorage","_c"],"sources":["../../../src/resources/storage/McpLocalStorage.ts"],"sourcesContent":["import { resource } from \"@assistant-ui/tap\";\nimport { useMemo } from \"react\";\nimport {\n  OAuthMetadataSchema,\n  OAuthClientInformationFullSchema,\n  OAuthProtectedResourceMetadataSchema,\n  OAuthTokensSchema,\n} from \"@modelcontextprotocol/core\";\nimport { normalizeMcpServerUrl } from \"../../utils/serverUrl\";\nimport type { MCPAuthConfig, MCPCustomServerRecord } from \"../../mcp-scope\";\nimport type { MCPPersistedAuthState } from \"../../auth/types\";\nimport { assertValidServerId } from \"../../utils/serverId\";\nimport type { MCPStorage } from \"./types\";\n\nexport type McpLocalStorageOptions = {\n  /** Namespace prefix for keys. Default \"aui-mcp\". */\n  keyPrefix?: string;\n  /** Override the underlying Storage. Defaults to globalThis.localStorage. */\n  storage?: Storage;\n  /**\n   * Stable identity for the backing data, used to key server reconnects.\n   * Required to get reconnect-on-swap behavior when `storage` is overridden;\n   * without it a custom backing store declares no scope, since a prefix\n   * alone cannot distinguish two different stores.\n   */\n  scopeId?: string;\n};\n\nfunction resolveStorage(opts: McpLocalStorageOptions): Storage | null {\n  if (opts.storage) return opts.storage;\n  if (typeof globalThis !== \"undefined\" && \"localStorage\" in globalThis) {\n    try {\n      return (globalThis as { localStorage: Storage }).localStorage;\n    } catch {\n      return null;\n    }\n  }\n  return null;\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst isOptionalString = (value: unknown): value is string | undefined =>\n  value === undefined || typeof value === \"string\";\n\nconst isNonEmptyString = (value: unknown): value is string =>\n  typeof value === \"string\" && value.trim().length > 0;\n\nconst isOptionalNonEmptyString = (\n  value: unknown,\n): value is string | undefined =>\n  value === undefined || isNonEmptyString(value);\n\nconst isOptionalStringArray = (value: unknown): value is string[] | undefined =>\n  value === undefined ||\n  (Array.isArray(value) && value.every((item) => typeof item === \"string\"));\n\nconst isOptionalConnectionTimeout = (\n  value: unknown,\n): value is number | undefined =>\n  value === undefined ||\n  (typeof value === \"number\" && Number.isFinite(value) && value >= 0);\n\nconst isValidServerId = (id: string): boolean => {\n  try {\n    assertValidServerId(id);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\nconst isMCPAuthConfig = (auth: unknown): auth is MCPAuthConfig => {\n  if (!isRecord(auth)) return false;\n\n  switch (auth.type) {\n    case \"none\":\n      return true;\n    case \"bearer\":\n      return isOptionalNonEmptyString(auth.token);\n    case \"oauth\":\n      return (\n        isOptionalStringArray(auth.scopes) &&\n        isOptionalString(auth.authorizationEndpoint) &&\n        isOptionalString(auth.tokenEndpoint) &&\n        isOptionalString(auth.registrationEndpoint) &&\n        isOptionalString(auth.clientId) &&\n        isOptionalString(auth.clientSecret)\n      );\n    default:\n      return false;\n  }\n};\n\nconst isCustomServerRecord = (\n  value: unknown,\n): value is MCPCustomServerRecord => {\n  if (!isRecord(value)) return false;\n  if (typeof value.id !== \"string\" || !isValidServerId(value.id)) {\n    return false;\n  }\n  return (\n    isNonEmptyString(value.name) &&\n    isNonEmptyString(value.url) &&\n    Number.isFinite(value.createdAt) &&\n    isMCPAuthConfig(value.auth) &&\n    isOptionalConnectionTimeout(value.connectionTimeout)\n  );\n};\n\nconst normalizeCustomServerRecord = (\n  value: unknown,\n): MCPCustomServerRecord | null => {\n  if (isCustomServerRecord(value)) return value;\n  if (!isRecord(value)) return null;\n\n  const record = { ...value };\n  delete record.connectionTimeout;\n  return isCustomServerRecord(record) ? record : null;\n};\n\nexport const normalizeCustomServerRecords = (\n  value: unknown,\n): MCPCustomServerRecord[] => {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((item) => {\n    const record = normalizeCustomServerRecord(item);\n    return record === null ? [] : [record];\n  });\n};\n\nconst normalizeOAuthTokens = (\n  value: unknown,\n): MCPPersistedAuthState[\"tokens\"] | undefined => {\n  const result = OAuthTokensSchema.safeParse(value);\n  return result.success ? result.data : undefined;\n};\n\nconst normalizeClientInformation = (\n  value: unknown,\n): MCPPersistedAuthState[\"clientInformation\"] | undefined => {\n  const result = OAuthClientInformationFullSchema.safeParse(value);\n  return result.success ? result.data : undefined;\n};\n\nconst isSecureNetworkUrl = (value: unknown): value is string => {\n  if (!isNonEmptyString(value)) return false;\n  try {\n    const url = new URL(value);\n    const isIpv4Loopback = /^127(?:\\.\\d{1,3}){3}$/.test(url.hostname);\n    return (\n      url.protocol === \"https:\" ||\n      (url.protocol === \"http:\" &&\n        (url.hostname === \"localhost\" ||\n          url.hostname.endsWith(\".localhost\") ||\n          isIpv4Loopback ||\n          url.hostname === \"[::1]\"))\n    );\n  } catch {\n    return false;\n  }\n};\n\nconst isMcpServerUrl = (value: unknown): value is string => {\n  if (typeof value !== \"string\") return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === \"https:\" || url.protocol === \"http:\";\n  } catch {\n    return false;\n  }\n};\n\nconst normalizeDiscoveryState = (\n  value: unknown,\n): MCPPersistedAuthState[\"discoveryState\"] | undefined => {\n  if (!isRecord(value) || !isSecureNetworkUrl(value.authorizationServerUrl)) {\n    return undefined;\n  }\n\n  // A malformed optional field is dropped alone: keeping the validated\n  // authorization server URL preserves the redirect-time binding, and the SDK\n  // re-discovers whatever metadata is missing.\n  const state: NonNullable<MCPPersistedAuthState[\"discoveryState\"]> = {\n    authorizationServerUrl: value.authorizationServerUrl,\n  };\n\n  if (isSecureNetworkUrl(value.resourceMetadataUrl)) {\n    state.resourceMetadataUrl = value.resourceMetadataUrl;\n  }\n\n  const metadata = OAuthMetadataSchema.safeParse(\n    value.authorizationServerMetadata,\n  );\n  if (metadata.success) state.authorizationServerMetadata = metadata.data;\n\n  const resourceMetadata = OAuthProtectedResourceMetadataSchema.safeParse(\n    value.resourceMetadata,\n  );\n  if (resourceMetadata.success) state.resourceMetadata = resourceMetadata.data;\n\n  return state;\n};\n\nexport const normalizePersistedAuthState = (\n  value: unknown,\n): MCPPersistedAuthState | null => {\n  if (!isRecord(value)) return null;\n  if (\"serverUrl\" in value && !isMcpServerUrl(value.serverUrl)) return null;\n\n  const state: MCPPersistedAuthState = {};\n  if (isMcpServerUrl(value.serverUrl)) {\n    state.serverUrl = normalizeMcpServerUrl(value.serverUrl);\n  }\n  if (isNonEmptyString(value.token)) state.token = value.token;\n  if (isNonEmptyString(value.tokensClientId)) {\n    state.tokensClientId = value.tokensClientId;\n  }\n  if (isNonEmptyString(value.codeVerifier)) {\n    state.codeVerifier = value.codeVerifier;\n  }\n  if (isNonEmptyString(value.state)) state.state = value.state;\n\n  const tokens = normalizeOAuthTokens(value.tokens);\n  if (tokens) state.tokens = tokens;\n\n  const clientInformation = normalizeClientInformation(value.clientInformation);\n  if (clientInformation) state.clientInformation = clientInformation;\n  if (value.clientInformationSource === \"registered\") {\n    state.clientInformationSource = value.clientInformationSource;\n  }\n\n  const discoveryState = normalizeDiscoveryState(value.discoveryState);\n  if (discoveryState) state.discoveryState = discoveryState;\n\n  return Object.keys(state).length > 0 ? state : null;\n};\n\nconst useMcpLocalStorage = (opts: McpLocalStorageOptions = {}): MCPStorage => {\n  const prefix = opts.keyPrefix ?? \"aui-mcp\";\n  const storage = resolveStorage(opts);\n  // Deriving a scope from the prefix is only honest for the shared\n  // globalThis.localStorage; two custom backing stores under one prefix hold\n  // different data, so an overridden backing declares no scope unless the\n  // caller names one.\n  const scopeId =\n    opts.scopeId ??\n    (opts.storage === undefined ? `local-storage:${prefix}` : undefined);\n\n  // Callers key per-server coordination state on this instance, so it has to\n  // stay referentially stable for as long as the underlying store does.\n  return useMemo(() => {\n    const customServersKey = `${prefix}:custom-servers`;\n    const authKey = (id: string) => `${prefix}:auth:${id}`;\n\n    const read = <T>(key: string, fallback: T): T => {\n      if (!storage) return fallback;\n      try {\n        const raw = storage.getItem(key);\n        if (raw == null) return fallback;\n        return JSON.parse(raw) as T;\n      } catch {\n        return fallback;\n      }\n    };\n\n    const write = (key: string, value: unknown): void => {\n      if (!storage) return;\n      try {\n        storage.setItem(key, JSON.stringify(value));\n      } catch {\n        // quota or serialization failure — silently drop\n      }\n    };\n\n    const remove = (key: string): void => {\n      if (!storage) return;\n      try {\n        storage.removeItem(key);\n      } catch {\n        // ignore\n      }\n    };\n\n    return {\n      ...(scopeId !== undefined ? { scopeId } : {}),\n      loadCustomServers: async () =>\n        normalizeCustomServerRecords(read<unknown>(customServersKey, [])),\n      saveCustomServers: async (records) => {\n        write(customServersKey, records);\n      },\n      loadAuthState: async (id) =>\n        normalizePersistedAuthState(read<unknown>(authKey(id), null)),\n      saveAuthState: async (id, state) => {\n        write(authKey(id), state);\n      },\n      clearAuthState: async (id) => {\n        remove(authKey(id));\n      },\n    };\n  }, [prefix, storage, scopeId]);\n};\n\nexport const McpLocalStorage = resource(useMcpLocalStorage);\n"],"mappings":";;;;;;;AA4BA,SAASiB,eAAeC,MAA8C;CACpE,IAAIA,KAAKJ,SAAS,OAAOI,KAAKJ;CAC9B,IAAI,OAAOK,eAAe,eAAe,kBAAkBA,YACzD,IAAI;EACF,OAAQA,WAAyCC;CACnD,QAAQ;EACN,OAAO;CACT;CAEF,OAAO;AACT;AAEA,MAAMC,YAAYC,UAChB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACE,MAAMC,QAAQH,KAAK;AAErE,MAAMI,oBAAoBJ,UACxBA,UAAUK,KAAAA,KAAa,OAAOL,UAAU;AAE1C,MAAMM,oBAAoBN,UACxB,OAAOA,UAAU,YAAYA,MAAMO,KAAK,CAAC,CAACC,SAAS;AAErD,MAAMC,4BACJT,UAEAA,UAAUK,KAAAA,KAAaC,iBAAiBN,KAAK;AAE/C,MAAMU,yBAAyBV,UAC7BA,UAAUK,KAAAA,KACTH,MAAMC,QAAQH,KAAK,KAAKA,MAAMW,OAAOC,SAAS,OAAOA,SAAS,QAAQ;AAEzE,MAAMC,+BACJb,UAEAA,UAAUK,KAAAA,KACT,OAAOL,UAAU,YAAYc,OAAOC,SAASf,KAAK,KAAKA,SAAS;AAEnE,MAAMgB,mBAAmBC,OAAwB;CAC/C,IAAI;EACF7B,oBAAoB6B,EAAE;EACtB,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAMC,mBAAmBC,SAAyC;CAChE,IAAI,CAACpB,SAASoB,IAAI,GAAG,OAAO;CAE5B,QAAQA,KAAKC,MAAb;EACE,KAAK,QACH,OAAO;EACT,KAAK,UACH,OAAOX,yBAAyBU,KAAKE,KAAK;EAC5C,KAAK,SACH,OACEX,sBAAsBS,KAAKG,MAAM,KACjClB,iBAAiBe,KAAKI,qBAAqB,KAC3CnB,iBAAiBe,KAAKK,aAAa,KACnCpB,iBAAiBe,KAAKM,oBAAoB,KAC1CrB,iBAAiBe,KAAKO,QAAQ,KAC9BtB,iBAAiBe,KAAKQ,YAAY;EAEtC,SACE,OAAO;CACX;AACF;AAEA,MAAMC,wBACJ5B,UACmC;CACnC,IAAI,CAACD,SAASC,KAAK,GAAG,OAAO;CAC7B,IAAI,OAAOA,MAAMiB,OAAO,YAAY,CAACD,gBAAgBhB,MAAMiB,EAAE,GAC3D,OAAO;CAET,OACEX,iBAAiBN,MAAM6B,IAAI,KAC3BvB,iBAAiBN,MAAM8B,GAAG,KAC1BhB,OAAOC,SAASf,MAAM+B,SAAS,KAC/Bb,gBAAgBlB,MAAMmB,IAAI,KAC1BN,4BAA4Bb,MAAMgC,iBAAiB;AAEvD;AAEA,MAAMC,+BACJjC,UACiC;CACjC,IAAI4B,qBAAqB5B,KAAK,GAAG,OAAOA;CACxC,IAAI,CAACD,SAASC,KAAK,GAAG,OAAO;CAE7B,MAAMkC,SAAS,EAAE,GAAGlC,MAAM;CAC1B,OAAOkC,OAAOF;CACd,OAAOJ,qBAAqBM,MAAM,IAAIA,SAAS;AACjD;AAEA,MAAaC,gCACXnC,UAC4B;CAC5B,IAAI,CAACE,MAAMC,QAAQH,KAAK,GAAG,OAAO,CAAA;CAClC,OAAOA,MAAMoC,SAASxB,SAAS;EAC7B,MAAMsB,SAASD,4BAA4BrB,IAAI;EAC/C,OAAOsB,WAAW,OAAO,CAAA,IAAK,CAACA,MAAM;CACvC,CAAC;AACH;AAEA,MAAMG,wBACJrC,UACgD;CAChD,MAAMsC,SAASvD,kBAAkBwD,UAAUvC,KAAK;CAChD,OAAOsC,OAAOE,UAAUF,OAAOG,OAAOpC,KAAAA;AACxC;AAEA,MAAMqC,8BACJ1C,UAC2D;CAC3D,MAAMsC,SAASzD,iCAAiC0D,UAAUvC,KAAK;CAC/D,OAAOsC,OAAOE,UAAUF,OAAOG,OAAOpC,KAAAA;AACxC;AAEA,MAAMsC,sBAAsB3C,UAAoC;CAC9D,IAAI,CAACM,iBAAiBN,KAAK,GAAG,OAAO;CACrC,IAAI;EACF,MAAM8B,MAAM,IAAIc,IAAI5C,KAAK;EACzB,MAAM6C,iBAAiB,wBAAwBC,KAAKhB,IAAIiB,QAAQ;EAChE,OACEjB,IAAIkB,aAAa,YAChBlB,IAAIkB,aAAa,YACflB,IAAIiB,aAAa,eAChBjB,IAAIiB,SAASE,SAAS,YAAY,KAClCJ,kBACAf,IAAIiB,aAAa;CAEzB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAMG,kBAAkBlD,UAAoC;CAC1D,IAAI,OAAOA,UAAU,UAAU,OAAO;CACtC,IAAI;EACF,MAAM8B,MAAM,IAAIc,IAAI5C,KAAK;EACzB,OAAO8B,IAAIkB,aAAa,YAAYlB,IAAIkB,aAAa;CACvD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAMG,2BACJnD,UACwD;CACxD,IAAI,CAACD,SAASC,KAAK,KAAK,CAAC2C,mBAAmB3C,MAAMoD,sBAAsB,GACtE;CAMF,MAAMC,QAA8D,EAClED,wBAAwBpD,MAAMoD,uBAChC;CAEA,IAAIT,mBAAmB3C,MAAMuD,mBAAmB,GAC9CF,MAAME,sBAAsBvD,MAAMuD;CAGpC,MAAMC,WAAW5E,oBAAoB2D,UACnCvC,MAAMyD,2BACR;CACA,IAAID,SAAShB,SAASa,MAAMI,8BAA8BD,SAASf;CAEnE,MAAMiB,mBAAmB5E,qCAAqCyD,UAC5DvC,MAAM0D,gBACR;CACA,IAAIA,iBAAiBlB,SAASa,MAAMK,mBAAmBA,iBAAiBjB;CAExE,OAAOY;AACT;AAEA,MAAaM,+BACX3D,UACiC;CACjC,IAAI,CAACD,SAASC,KAAK,GAAG,OAAO;CAC7B,IAAI,eAAeA,SAAS,CAACkD,eAAelD,MAAM4D,SAAS,GAAG,OAAO;CAErE,MAAMP,QAA+B,CAAC;CACtC,IAAIH,eAAelD,MAAM4D,SAAS,GAChCP,MAAMO,YAAY5E,sBAAsBgB,MAAM4D,SAAS;CAEzD,IAAItD,iBAAiBN,MAAMqB,KAAK,GAAGgC,MAAMhC,QAAQrB,MAAMqB;CACvD,IAAIf,iBAAiBN,MAAM6D,cAAc,GACvCR,MAAMQ,iBAAiB7D,MAAM6D;CAE/B,IAAIvD,iBAAiBN,MAAM8D,YAAY,GACrCT,MAAMS,eAAe9D,MAAM8D;CAE7B,IAAIxD,iBAAiBN,MAAMqD,KAAK,GAAGA,MAAMA,QAAQrD,MAAMqD;CAEvD,MAAMU,SAAS1B,qBAAqBrC,MAAM+D,MAAM;CAChD,IAAIA,QAAQV,MAAMU,SAASA;CAE3B,MAAMC,oBAAoBtB,2BAA2B1C,MAAMgE,iBAAiB;CAC5E,IAAIA,mBAAmBX,MAAMW,oBAAoBA;CACjD,IAAIhE,MAAMiE,4BAA4B,cACpCZ,MAAMY,0BAA0BjE,MAAMiE;CAGxC,MAAMC,iBAAiBf,wBAAwBnD,MAAMkE,cAAc;CACnE,IAAIA,gBAAgBb,MAAMa,iBAAiBA;CAE3C,OAAOC,OAAOC,KAAKf,KAAK,CAAC,CAAC7C,SAAS,IAAI6C,QAAQ;AACjD;AAEA,MAAMgB,sBAAqBC,OAAA;CAAA,MAAAC,IAAAC,EAAA,EAAA;CAAA,IAAAC;CAAA,IAAAF,EAAA,OAAAD,IAAA;EAACG,KAAAH,OAAAjE,KAAAA,IAAA,CAAgC,IAAhCiE;EAAiCC,EAAA,KAAAD;EAAAC,EAAA,KAAAE;CAAA,OAAAA,KAAAF,EAAA;CAAjC,MAAA3E,OAAA6E;CAC1B,MAAAC,SAAe9E,KAAIL,aAAJ;CAA4B,IAAAoF;CAAA,IAAAJ,EAAA,OAAA3E,MAAA;EAC3B+E,KAAAhF,eAAeC,IAAI;EAAC2E,EAAA,KAAA3E;EAAA2E,EAAA,KAAAI;CAAA,OAAAA,KAAAJ,EAAA;CAApC,MAAA/E,UAAgBmF;CAKhB,MAAAjF,UACEE,KAAIF,YACHE,KAAIJ,YAAaa,KAAAA,IAAjB,iBAA8CqE,WAA9CrE,KAAAA;CAKD,MAAAuE,mBAAyB,GAAGF,OAAM;CAAkB,IAAAG;CAAA,IAAAN,EAAA,OAAAG,QAAA;EACpCG,MAAA5D,OAAgB,GAAGyD,OAAM,QAASzD;EAAIsD,EAAA,KAAAG;EAAAH,EAAA,KAAAM;CAAA,OAAAA,KAAAN,EAAA;CAAtD,MAAAO,UAAgBD;CAAuC,IAAAE;CAAA,IAAAR,EAAA,OAAA/E,SAAA;EAE1CuF,MAAAC,KAAAC,aAAA;GACX,IAAI,CAACzF,SAAO,OAASyF;GACrB,IAAA;IACE,MAAAC,MAAY1F,QAAO2F,QAASH,GAAG;IAC/B,IAAIE,OAAO,MAAI,OAASD;IAAS,OAC1BG,KAAIC,MAAOH,GAAG;GAAM,QAAA;IAAA,OAEpBD;GAAQ;EAChB;EACFV,EAAA,KAAA/E;EAAA+E,EAAA,KAAAQ;CAAA,OAAAA,KAAAR,EAAA;CATD,MAAAgB,OAAaR;CASX,IAAAS;CAAA,IAAAjB,EAAA,OAAA/E,SAAA;EAEYgG,MAAAC,OAAAzF,UAAA;GACZ,IAAI,CAACR,SAAO;GACZ,IAAA;IACEA,QAAOkG,QAASV,OAAKI,KAAIO,UAAW3F,KAAK,CAAC;GAAC,QAAA,CAAA;EAG5C;EACFuE,EAAA,KAAA/E;EAAA+E,EAAA,KAAAiB;CAAA,OAAAA,KAAAjB,EAAA;CAPD,MAAAqB,QAAcJ;CAOZ,IAAAK;CAAA,IAAAtB,EAAA,QAAA/E,SAAA;EAEaqG,MAAAC,UAAA;GACb,IAAI,CAACtG,SAAO;GACZ,IAAA;IACEA,QAAOuG,WAAYf,KAAG;GAAC,QAAA,CAAA;EAGxB;EACFT,EAAA,MAAA/E;EAAA+E,EAAA,MAAAsB;CAAA,OAAAA,KAAAtB,EAAA;CAPD,MAAAyB,SAAeH;CAOb,IAAAI;CAAA,IAAA1B,EAAA,QAAA7E,SAAA;EAGIuG,KAAAvG,YAAYW,KAAAA,IAAZ,EAAAX,QAAuC,IAAvC,CAAuC;EAAC6E,EAAA,MAAA7E;EAAA6E,EAAA,MAAA0B;CAAA,OAAAA,KAAA1B,EAAA;CAAA,IAAA2B;CAAA,IAAA3B,EAAA,QAAAK,oBAAAL,EAAA,QAAAgB,MAAA;EACzBW,KAAA,YACjB/D,6BAA6BoD,KAAcX,kBAAkB,CAAA,CAAE,CAAC;EAACL,EAAA,MAAAK;EAAAL,EAAA,MAAAgB;EAAAhB,EAAA,MAAA2B;CAAA,OAAAA,KAAA3B,EAAA;CAAA,IAAA4B;CAAA,IAAA5B,EAAA,QAAAK,oBAAAL,EAAA,QAAAqB,OAAA;EAChDO,KAAA,OAAAC,YAAA;GACjBR,MAAMhB,kBAAkBwB,OAAO;EAAC;EACjC7B,EAAA,MAAAK;EAAAL,EAAA,MAAAqB;EAAArB,EAAA,MAAA4B;CAAA,OAAAA,KAAA5B,EAAA;CAAA,IAAA8B;CAAA,IAAA9B,EAAA,QAAAO,WAAAP,EAAA,QAAAgB,MAAA;EACcc,MAAA,OAAAC,SACb3C,4BAA4B4B,KAAcT,QAAQ7D,IAAE,GAAG,IAAI,CAAC;EAACsD,EAAA,MAAAO;EAAAP,EAAA,MAAAgB;EAAAhB,EAAA,MAAA8B;CAAA,OAAAA,MAAA9B,EAAA;CAAA,IAAAgC;CAAA,IAAAhC,EAAA,QAAAO,WAAAP,EAAA,QAAAqB,OAAA;EAChDW,MAAA,OAAAC,MAAAnD,UAAA;GACbuC,MAAMd,QAAQ7D,IAAE,GAAGoC,KAAK;EAAC;EAC1BkB,EAAA,MAAAO;EAAAP,EAAA,MAAAqB;EAAArB,EAAA,MAAAgC;CAAA,OAAAA,MAAAhC,EAAA;CAAA,IAAAkC;CAAA,IAAAlC,EAAA,QAAAO,WAAAP,EAAA,QAAAyB,QAAA;EACeS,MAAA,OAAAC,SAAA;GACdV,OAAOlB,QAAQ7D,IAAE,CAAC;EAAC;EACpBsD,EAAA,MAAAO;EAAAP,EAAA,MAAAyB;EAAAzB,EAAA,MAAAkC;CAAA,OAAAA,MAAAlC,EAAA;CAAA,IAAAoC;CAAA,IAAApC,EAAA,QAAA8B,OAAA9B,EAAA,QAAAgC,OAAAhC,EAAA,QAAAkC,OAAAlC,EAAA,QAAA0B,MAAA1B,EAAA,QAAA2B,MAAA3B,EAAA,QAAA4B,IAAA;EAdIQ,MAAA;GAAA,GACDV;GAAwCW,mBACzBV;GACgDW,mBAChDV;GAElBW,eACcT;GACgDU,eAChDR;GAEdS,gBACeP;EAGlB;EAAClC,EAAA,MAAA8B;EAAA9B,EAAA,MAAAgC;EAAAhC,EAAA,MAAAkC;EAAAlC,EAAA,MAAA0B;EAAA1B,EAAA,MAAA2B;EAAA3B,EAAA,MAAA4B;EAAA5B,EAAA,MAAAoC;CAAA,OAAAA,MAAApC,EAAA;CAAA,OAfDoC;AAeE;AAIN,MAAaM,kBAAkBvI,SAAS2F,kBAAkB"}
+{"version":3,"file":"McpLocalStorage.js","names":["resource","useMemo","MCPStorage","normalizeCustomServerRecords","normalizePersistedAuthState","McpLocalStorageOptions","keyPrefix","storage","Storage","scopeId","resolveStorage","opts","globalThis","localStorage","useMcpLocalStorage","t0","$","_c","t1","undefined","prefix","t2","customServersKey","t3","id","authKey","t4","key","fallback","raw","getItem","JSON","parse","T","read","t5","key_0","value","setItem","stringify","write","t6","key_1","removeItem","remove","t7","t8","t9","records","t10","id_0","t11","id_1","state","t12","id_2","t13","loadCustomServers","saveCustomServers","loadAuthState","saveAuthState","clearAuthState","McpLocalStorage","_c"],"sources":["../../../src/resources/storage/McpLocalStorage.ts"],"sourcesContent":["import { resource } from \"@assistant-ui/tap\";\nimport { useMemo } from \"react\";\nimport type { MCPStorage } from \"./types\";\nimport {\n  normalizeCustomServerRecords,\n  normalizePersistedAuthState,\n} from \"./McpStoredDataNormalization\";\n\nexport {\n  normalizeCustomServerRecords,\n  normalizePersistedAuthState,\n} from \"./McpStoredDataNormalization\";\n\nexport type McpLocalStorageOptions = {\n  /** Namespace prefix for keys. Default \"aui-mcp\". */\n  keyPrefix?: string;\n  /** Override the underlying Storage. Defaults to globalThis.localStorage. */\n  storage?: Storage;\n  /**\n   * Stable identity for the backing data, used to key server reconnects.\n   * Required to get reconnect-on-swap behavior when `storage` is overridden;\n   * without it a custom backing store declares no scope, since a prefix\n   * alone cannot distinguish two different stores.\n   */\n  scopeId?: string;\n};\n\nfunction resolveStorage(opts: McpLocalStorageOptions): Storage | null {\n  if (opts.storage) return opts.storage;\n  if (typeof globalThis !== \"undefined\" && \"localStorage\" in globalThis) {\n    try {\n      return (globalThis as { localStorage: Storage }).localStorage;\n    } catch {\n      return null;\n    }\n  }\n  return null;\n}\n\nconst useMcpLocalStorage = (opts: McpLocalStorageOptions = {}): MCPStorage => {\n  const prefix = opts.keyPrefix ?? \"aui-mcp\";\n  const storage = resolveStorage(opts);\n  // Deriving a scope from the prefix is only honest for the shared\n  // globalThis.localStorage; two custom backing stores under one prefix hold\n  // different data, so an overridden backing declares no scope unless the\n  // caller names one.\n  const scopeId =\n    opts.scopeId ??\n    (opts.storage === undefined ? `local-storage:${prefix}` : undefined);\n\n  // Callers key per-server coordination state on this instance, so it has to\n  // stay referentially stable for as long as the underlying store does.\n  return useMemo(() => {\n    const customServersKey = `${prefix}:custom-servers`;\n    const authKey = (id: string) => `${prefix}:auth:${id}`;\n\n    const read = <T>(key: string, fallback: T): T => {\n      if (!storage) return fallback;\n      try {\n        const raw = storage.getItem(key);\n        if (raw == null) return fallback;\n        return JSON.parse(raw) as T;\n      } catch {\n        return fallback;\n      }\n    };\n\n    const write = (key: string, value: unknown): void => {\n      if (!storage) return;\n      try {\n        storage.setItem(key, JSON.stringify(value));\n      } catch {\n        // quota or serialization failure — silently drop\n      }\n    };\n\n    const remove = (key: string): void => {\n      if (!storage) return;\n      try {\n        storage.removeItem(key);\n      } catch {\n        // ignore\n      }\n    };\n\n    return {\n      ...(scopeId !== undefined ? { scopeId } : {}),\n      loadCustomServers: async () =>\n        normalizeCustomServerRecords(read<unknown>(customServersKey, [])),\n      saveCustomServers: async (records) => {\n        write(customServersKey, records);\n      },\n      loadAuthState: async (id) =>\n        normalizePersistedAuthState(read<unknown>(authKey(id), null)),\n      saveAuthState: async (id, state) => {\n        write(authKey(id), state);\n      },\n      clearAuthState: async (id) => {\n        remove(authKey(id));\n      },\n    };\n  }, [prefix, storage, scopeId]);\n};\n\nexport const McpLocalStorage = resource(useMcpLocalStorage);\n"],"mappings":";;;;;AA2BA,SAASU,eAAeC,MAA8C;CACpE,IAAIA,KAAKJ,SAAS,OAAOI,KAAKJ;CAC9B,IAAI,OAAOK,eAAe,eAAe,kBAAkBA,YACzD,IAAI;EACF,OAAQA,WAAyCC;CACnD,QAAQ;EACN,OAAO;CACT;CAEF,OAAO;AACT;AAEA,MAAMC,sBAAqBC,OAAA;CAAA,MAAAC,IAAAC,EAAA,EAAA;CAAA,IAAAC;CAAA,IAAAF,EAAA,OAAAD,IAAA;EAACG,KAAAH,OAAAI,KAAAA,IAAA,CAAgC,IAAhCJ;EAAiCC,EAAA,KAAAD;EAAAC,EAAA,KAAAE;CAAA,OAAAA,KAAAF,EAAA;CAAjC,MAAAL,OAAAO;CAC1B,MAAAE,SAAeT,KAAIL,aAAJ;CAA4B,IAAAe;CAAA,IAAAL,EAAA,OAAAL,MAAA;EAC3BU,KAAAX,eAAeC,IAAI;EAACK,EAAA,KAAAL;EAAAK,EAAA,KAAAK;CAAA,OAAAA,KAAAL,EAAA;CAApC,MAAAT,UAAgBc;CAKhB,MAAAZ,UACEE,KAAIF,YACHE,KAAIJ,YAAaY,KAAAA,IAAjB,iBAA8CC,WAA9CD,KAAAA;CAKD,MAAAG,mBAAyB,GAAGF,OAAM;CAAkB,IAAAG;CAAA,IAAAP,EAAA,OAAAI,QAAA;EACpCG,MAAAC,OAAgB,GAAGJ,OAAM,QAASI;EAAIR,EAAA,KAAAI;EAAAJ,EAAA,KAAAO;CAAA,OAAAA,KAAAP,EAAA;CAAtD,MAAAS,UAAgBF;CAAuC,IAAAG;CAAA,IAAAV,EAAA,OAAAT,SAAA;EAE1CmB,MAAAC,KAAAC,aAAA;GACX,IAAI,CAACrB,SAAO,OAASqB;GACrB,IAAA;IACE,MAAAC,MAAYtB,QAAOuB,QAASH,GAAG;IAC/B,IAAIE,OAAO,MAAI,OAASD;IAAS,OAC1BG,KAAIC,MAAOH,GAAG;GAAM,QAAA;IAAA,OAEpBD;GAAQ;EAChB;EACFZ,EAAA,KAAAT;EAAAS,EAAA,KAAAU;CAAA,OAAAA,KAAAV,EAAA;CATD,MAAAkB,OAAaR;CASX,IAAAS;CAAA,IAAAnB,EAAA,OAAAT,SAAA;EAEY4B,MAAAC,OAAAC,UAAA;GACZ,IAAI,CAAC9B,SAAO;GACZ,IAAA;IACEA,QAAO+B,QAASX,OAAKI,KAAIQ,UAAWF,KAAK,CAAC;GAAC,QAAA,CAAA;EAG5C;EACFrB,EAAA,KAAAT;EAAAS,EAAA,KAAAmB;CAAA,OAAAA,KAAAnB,EAAA;CAPD,MAAAwB,QAAcL;CAOZ,IAAAM;CAAA,IAAAzB,EAAA,QAAAT,SAAA;EAEakC,MAAAC,UAAA;GACb,IAAI,CAACnC,SAAO;GACZ,IAAA;IACEA,QAAOoC,WAAYhB,KAAG;GAAC,QAAA,CAAA;EAGxB;EACFX,EAAA,MAAAT;EAAAS,EAAA,MAAAyB;CAAA,OAAAA,KAAAzB,EAAA;CAPD,MAAA4B,SAAeH;CAOb,IAAAI;CAAA,IAAA7B,EAAA,QAAAP,SAAA;EAGIoC,KAAApC,YAAYU,KAAAA,IAAZ,EAAAV,QAAuC,IAAvC,CAAuC;EAACO,EAAA,MAAAP;EAAAO,EAAA,MAAA6B;CAAA,OAAAA,KAAA7B,EAAA;CAAA,IAAA8B;CAAA,IAAA9B,EAAA,QAAAM,oBAAAN,EAAA,QAAAkB,MAAA;EACzBY,KAAA,YACjB3C,6BAA6B+B,KAAcZ,kBAAkB,CAAA,CAAE,CAAC;EAACN,EAAA,MAAAM;EAAAN,EAAA,MAAAkB;EAAAlB,EAAA,MAAA8B;CAAA,OAAAA,KAAA9B,EAAA;CAAA,IAAA+B;CAAA,IAAA/B,EAAA,QAAAM,oBAAAN,EAAA,QAAAwB,OAAA;EAChDO,KAAA,OAAAC,YAAA;GACjBR,MAAMlB,kBAAkB0B,OAAO;EAAC;EACjChC,EAAA,MAAAM;EAAAN,EAAA,MAAAwB;EAAAxB,EAAA,MAAA+B;CAAA,OAAAA,KAAA/B,EAAA;CAAA,IAAAiC;CAAA,IAAAjC,EAAA,QAAAS,WAAAT,EAAA,QAAAkB,MAAA;EACce,MAAA,OAAAC,SACb9C,4BAA4B8B,KAAcT,QAAQD,IAAE,GAAG,IAAI,CAAC;EAACR,EAAA,MAAAS;EAAAT,EAAA,MAAAkB;EAAAlB,EAAA,MAAAiC;CAAA,OAAAA,MAAAjC,EAAA;CAAA,IAAAmC;CAAA,IAAAnC,EAAA,QAAAS,WAAAT,EAAA,QAAAwB,OAAA;EAChDW,MAAA,OAAAC,MAAAC,UAAA;GACbb,MAAMf,QAAQD,IAAE,GAAG6B,KAAK;EAAC;EAC1BrC,EAAA,MAAAS;EAAAT,EAAA,MAAAwB;EAAAxB,EAAA,MAAAmC;CAAA,OAAAA,MAAAnC,EAAA;CAAA,IAAAsC;CAAA,IAAAtC,EAAA,QAAAS,WAAAT,EAAA,QAAA4B,QAAA;EACeU,MAAA,OAAAC,SAAA;GACdX,OAAOnB,QAAQD,IAAE,CAAC;EAAC;EACpBR,EAAA,MAAAS;EAAAT,EAAA,MAAA4B;EAAA5B,EAAA,MAAAsC;CAAA,OAAAA,MAAAtC,EAAA;CAAA,IAAAwC;CAAA,IAAAxC,EAAA,QAAAiC,OAAAjC,EAAA,QAAAmC,OAAAnC,EAAA,QAAAsC,OAAAtC,EAAA,QAAA6B,MAAA7B,EAAA,QAAA8B,MAAA9B,EAAA,QAAA+B,IAAA;EAdIS,MAAA;GAAA,GACDX;GAAwCY,mBACzBX;GACgDY,mBAChDX;GAElBY,eACcV;GACgDW,eAChDT;GAEdU,gBACeP;EAGlB;EAACtC,EAAA,MAAAiC;EAAAjC,EAAA,MAAAmC;EAAAnC,EAAA,MAAAsC;EAAAtC,EAAA,MAAA6B;EAAA7B,EAAA,MAAA8B;EAAA9B,EAAA,MAAA+B;EAAA/B,EAAA,MAAAwC;CAAA,OAAAA,MAAAxC,EAAA;CAAA,OAfDwC;AAeE;AAIN,MAAaM,kBAAkB9D,SAASc,kBAAkB"}

package/dist/resources/storage/McpStoredDataNormalization.d.ts

@@ -0,0 +1,5 @@
+import type { MCPCustomServerRecord } from "../../mcp-scope.js";
+import type { MCPPersistedAuthState } from "../../auth/types.js";
+export declare const normalizeCustomServerRecords: (value: unknown) => MCPCustomServerRecord[];
+export declare const normalizePersistedAuthState: (value: unknown) => MCPPersistedAuthState | null;
+//# sourceMappingURL=McpStoredDataNormalization.d.ts.map

package/dist/resources/storage/McpStoredDataNormalization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpStoredDataNormalization.d.ts","sourceRoot":"","sources":["../../../src/resources/storage/McpStoredDataNormalization.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAiB,qBAAqB,EAAE,2BAAwB;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,4BAAyB;AAqF9D,eAAO,MAAM,4BAA4B,GACvC,OAAO,OAAO,KACb,qBAAqB,EAMvB,CAAC;AAgEF,eAAO,MAAM,2BAA2B,GACtC,OAAO,OAAO,KACb,qBAAqB,GAAG,IA8B1B,CAAC"}

package/dist/resources/storage/McpStoredDataNormalization.js

@@ -0,0 +1,95 @@
+import { isSecureNetworkUrl, normalizeMcpServerUrl } from "../../utils/serverUrl.js";
+import { assertValidServerId } from "../../utils/serverId.js";
+import { OAuthClientInformationFullSchema, OAuthMetadataSchema, OAuthProtectedResourceMetadataSchema, OAuthTokensSchema } from "@modelcontextprotocol/core";
+//#region src/resources/storage/McpStoredDataNormalization.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isOptionalString = (value) => value === void 0 || typeof value === "string";
+const isNonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
+const isOptionalNonEmptyString = (value) => value === void 0 || isNonEmptyString(value);
+const isOptionalStringArray = (value) => value === void 0 || Array.isArray(value) && value.every((item) => typeof item === "string");
+const isOptionalConnectionTimeout = (value) => value === void 0 || typeof value === "number" && Number.isFinite(value) && value >= 0;
+const isValidServerId = (id) => {
+	try {
+		assertValidServerId(id);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const isMCPAuthConfig = (auth) => {
+	if (!isRecord(auth)) return false;
+	switch (auth.type) {
+		case "none": return true;
+		case "bearer": return isOptionalNonEmptyString(auth.token);
+		case "oauth": return isOptionalStringArray(auth.scopes) && isOptionalString(auth.authorizationEndpoint) && isOptionalString(auth.tokenEndpoint) && isOptionalString(auth.registrationEndpoint) && isOptionalString(auth.clientId) && isOptionalString(auth.clientSecret);
+		default: return false;
+	}
+};
+const isCustomServerRecord = (value) => {
+	if (!isRecord(value)) return false;
+	if (typeof value.id !== "string" || !isValidServerId(value.id)) return false;
+	return isNonEmptyString(value.name) && isNonEmptyString(value.url) && Number.isFinite(value.createdAt) && isMCPAuthConfig(value.auth) && isOptionalConnectionTimeout(value.connectionTimeout);
+};
+const normalizeCustomServerRecord = (value) => {
+	if (isCustomServerRecord(value)) return value;
+	if (!isRecord(value)) return null;
+	const record = { ...value };
+	delete record.connectionTimeout;
+	return isCustomServerRecord(record) ? record : null;
+};
+const normalizeCustomServerRecords = (value) => {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => {
+		const record = normalizeCustomServerRecord(item);
+		return record === null ? [] : [record];
+	});
+};
+const normalizeOAuthTokens = (value) => {
+	const result = OAuthTokensSchema.safeParse(value);
+	return result.success ? result.data : void 0;
+};
+const normalizeClientInformation = (value) => {
+	const result = OAuthClientInformationFullSchema.safeParse(value);
+	return result.success ? result.data : void 0;
+};
+const isMcpServerUrl = (value) => {
+	if (typeof value !== "string") return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" || url.protocol === "http:";
+	} catch {
+		return false;
+	}
+};
+const normalizeDiscoveryState = (value) => {
+	if (!isRecord(value) || typeof value.authorizationServerUrl !== "string" || !isSecureNetworkUrl(value.authorizationServerUrl)) return;
+	const state = { authorizationServerUrl: value.authorizationServerUrl };
+	if (typeof value.resourceMetadataUrl === "string" && isSecureNetworkUrl(value.resourceMetadataUrl)) state.resourceMetadataUrl = value.resourceMetadataUrl;
+	const metadata = OAuthMetadataSchema.safeParse(value.authorizationServerMetadata);
+	if (metadata.success) state.authorizationServerMetadata = metadata.data;
+	const resourceMetadata = OAuthProtectedResourceMetadataSchema.safeParse(value.resourceMetadata);
+	if (resourceMetadata.success) state.resourceMetadata = resourceMetadata.data;
+	return state;
+};
+const normalizePersistedAuthState = (value) => {
+	if (!isRecord(value)) return null;
+	if ("serverUrl" in value && !isMcpServerUrl(value.serverUrl)) return null;
+	const state = {};
+	if (isMcpServerUrl(value.serverUrl)) state.serverUrl = normalizeMcpServerUrl(value.serverUrl);
+	if (isNonEmptyString(value.token)) state.token = value.token;
+	if (isNonEmptyString(value.tokensClientId)) state.tokensClientId = value.tokensClientId;
+	if (isNonEmptyString(value.codeVerifier)) state.codeVerifier = value.codeVerifier;
+	if (isNonEmptyString(value.state)) state.state = value.state;
+	const tokens = normalizeOAuthTokens(value.tokens);
+	if (tokens) state.tokens = tokens;
+	const clientInformation = normalizeClientInformation(value.clientInformation);
+	if (clientInformation) state.clientInformation = clientInformation;
+	if (value.clientInformationSource === "registered") state.clientInformationSource = value.clientInformationSource;
+	const discoveryState = normalizeDiscoveryState(value.discoveryState);
+	if (discoveryState) state.discoveryState = discoveryState;
+	return Object.keys(state).length > 0 ? state : null;
+};
+//#endregion
+export { normalizeCustomServerRecords, normalizePersistedAuthState };
+
+//# sourceMappingURL=McpStoredDataNormalization.js.map

package/dist/resources/storage/McpStoredDataNormalization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpStoredDataNormalization.js","names":["OAuthMetadataSchema","OAuthClientInformationFullSchema","OAuthProtectedResourceMetadataSchema","OAuthTokensSchema","isSecureNetworkUrl","normalizeMcpServerUrl","MCPAuthConfig","MCPCustomServerRecord","MCPPersistedAuthState","assertValidServerId","isRecord","value","Record","Array","isArray","isOptionalString","undefined","isNonEmptyString","trim","length","isOptionalNonEmptyString","isOptionalStringArray","every","item","isOptionalConnectionTimeout","Number","isFinite","isValidServerId","id","isMCPAuthConfig","auth","type","token","scopes","authorizationEndpoint","tokenEndpoint","registrationEndpoint","clientId","clientSecret","isCustomServerRecord","name","url","createdAt","connectionTimeout","normalizeCustomServerRecord","record","normalizeCustomServerRecords","flatMap","normalizeOAuthTokens","result","safeParse","success","data","normalizeClientInformation","isMcpServerUrl","URL","protocol","normalizeDiscoveryState","authorizationServerUrl","state","NonNullable","resourceMetadataUrl","metadata","authorizationServerMetadata","resourceMetadata","normalizePersistedAuthState","serverUrl","tokensClientId","codeVerifier","tokens","clientInformation","clientInformationSource","discoveryState","Object","keys"],"sources":["../../../src/resources/storage/McpStoredDataNormalization.ts"],"sourcesContent":["import {\n  OAuthMetadataSchema,\n  OAuthClientInformationFullSchema,\n  OAuthProtectedResourceMetadataSchema,\n  OAuthTokensSchema,\n} from \"@modelcontextprotocol/core\";\nimport {\n  isSecureNetworkUrl,\n  normalizeMcpServerUrl,\n} from \"../../utils/serverUrl\";\nimport type { MCPAuthConfig, MCPCustomServerRecord } from \"../../mcp-scope\";\nimport type { MCPPersistedAuthState } from \"../../auth/types\";\nimport { assertValidServerId } from \"../../utils/serverId\";\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst isOptionalString = (value: unknown): value is string | undefined =>\n  value === undefined || typeof value === \"string\";\n\nconst isNonEmptyString = (value: unknown): value is string =>\n  typeof value === \"string\" && value.trim().length > 0;\n\nconst isOptionalNonEmptyString = (\n  value: unknown,\n): value is string | undefined =>\n  value === undefined || isNonEmptyString(value);\n\nconst isOptionalStringArray = (value: unknown): value is string[] | undefined =>\n  value === undefined ||\n  (Array.isArray(value) && value.every((item) => typeof item === \"string\"));\n\nconst isOptionalConnectionTimeout = (\n  value: unknown,\n): value is number | undefined =>\n  value === undefined ||\n  (typeof value === \"number\" && Number.isFinite(value) && value >= 0);\n\nconst isValidServerId = (id: string): boolean => {\n  try {\n    assertValidServerId(id);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\nconst isMCPAuthConfig = (auth: unknown): auth is MCPAuthConfig => {\n  if (!isRecord(auth)) return false;\n\n  switch (auth.type) {\n    case \"none\":\n      return true;\n    case \"bearer\":\n      return isOptionalNonEmptyString(auth.token);\n    case \"oauth\":\n      return (\n        isOptionalStringArray(auth.scopes) &&\n        isOptionalString(auth.authorizationEndpoint) &&\n        isOptionalString(auth.tokenEndpoint) &&\n        isOptionalString(auth.registrationEndpoint) &&\n        isOptionalString(auth.clientId) &&\n        isOptionalString(auth.clientSecret)\n      );\n    default:\n      return false;\n  }\n};\n\nconst isCustomServerRecord = (\n  value: unknown,\n): value is MCPCustomServerRecord => {\n  if (!isRecord(value)) return false;\n  if (typeof value.id !== \"string\" || !isValidServerId(value.id)) {\n    return false;\n  }\n  return (\n    isNonEmptyString(value.name) &&\n    isNonEmptyString(value.url) &&\n    Number.isFinite(value.createdAt) &&\n    isMCPAuthConfig(value.auth) &&\n    isOptionalConnectionTimeout(value.connectionTimeout)\n  );\n};\n\nconst normalizeCustomServerRecord = (\n  value: unknown,\n): MCPCustomServerRecord | null => {\n  if (isCustomServerRecord(value)) return value;\n  if (!isRecord(value)) return null;\n\n  const record = { ...value };\n  delete record.connectionTimeout;\n  return isCustomServerRecord(record) ? record : null;\n};\n\nexport const normalizeCustomServerRecords = (\n  value: unknown,\n): MCPCustomServerRecord[] => {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((item) => {\n    const record = normalizeCustomServerRecord(item);\n    return record === null ? [] : [record];\n  });\n};\n\nconst normalizeOAuthTokens = (\n  value: unknown,\n): MCPPersistedAuthState[\"tokens\"] | undefined => {\n  const result = OAuthTokensSchema.safeParse(value);\n  return result.success ? result.data : undefined;\n};\n\nconst normalizeClientInformation = (\n  value: unknown,\n): MCPPersistedAuthState[\"clientInformation\"] | undefined => {\n  const result = OAuthClientInformationFullSchema.safeParse(value);\n  return result.success ? result.data : undefined;\n};\n\nconst isMcpServerUrl = (value: unknown): value is string => {\n  if (typeof value !== \"string\") return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === \"https:\" || url.protocol === \"http:\";\n  } catch {\n    return false;\n  }\n};\n\nconst normalizeDiscoveryState = (\n  value: unknown,\n): MCPPersistedAuthState[\"discoveryState\"] | undefined => {\n  if (\n    !isRecord(value) ||\n    typeof value.authorizationServerUrl !== \"string\" ||\n    !isSecureNetworkUrl(value.authorizationServerUrl)\n  ) {\n    return undefined;\n  }\n\n  // A malformed optional field is dropped alone: keeping the validated\n  // authorization server URL preserves the redirect-time binding, and the SDK\n  // re-discovers whatever metadata is missing.\n  const state: NonNullable<MCPPersistedAuthState[\"discoveryState\"]> = {\n    authorizationServerUrl: value.authorizationServerUrl,\n  };\n\n  if (\n    typeof value.resourceMetadataUrl === \"string\" &&\n    isSecureNetworkUrl(value.resourceMetadataUrl)\n  ) {\n    state.resourceMetadataUrl = value.resourceMetadataUrl;\n  }\n\n  const metadata = OAuthMetadataSchema.safeParse(\n    value.authorizationServerMetadata,\n  );\n  if (metadata.success) state.authorizationServerMetadata = metadata.data;\n\n  const resourceMetadata = OAuthProtectedResourceMetadataSchema.safeParse(\n    value.resourceMetadata,\n  );\n  if (resourceMetadata.success) state.resourceMetadata = resourceMetadata.data;\n\n  return state;\n};\n\nexport const normalizePersistedAuthState = (\n  value: unknown,\n): MCPPersistedAuthState | null => {\n  if (!isRecord(value)) return null;\n  if (\"serverUrl\" in value && !isMcpServerUrl(value.serverUrl)) return null;\n\n  const state: MCPPersistedAuthState = {};\n  if (isMcpServerUrl(value.serverUrl)) {\n    state.serverUrl = normalizeMcpServerUrl(value.serverUrl);\n  }\n  if (isNonEmptyString(value.token)) state.token = value.token;\n  if (isNonEmptyString(value.tokensClientId)) {\n    state.tokensClientId = value.tokensClientId;\n  }\n  if (isNonEmptyString(value.codeVerifier)) {\n    state.codeVerifier = value.codeVerifier;\n  }\n  if (isNonEmptyString(value.state)) state.state = value.state;\n\n  const tokens = normalizeOAuthTokens(value.tokens);\n  if (tokens) state.tokens = tokens;\n\n  const clientInformation = normalizeClientInformation(value.clientInformation);\n  if (clientInformation) state.clientInformation = clientInformation;\n  if (value.clientInformationSource === \"registered\") {\n    state.clientInformationSource = value.clientInformationSource;\n  }\n\n  const discoveryState = normalizeDiscoveryState(value.discoveryState);\n  if (discoveryState) state.discoveryState = discoveryState;\n\n  return Object.keys(state).length > 0 ? state : null;\n};\n"],"mappings":";;;;AAcA,MAAMU,YAAYC,UAChB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACE,MAAMC,QAAQH,KAAK;AAErE,MAAMI,oBAAoBJ,UACxBA,UAAUK,KAAAA,KAAa,OAAOL,UAAU;AAE1C,MAAMM,oBAAoBN,UACxB,OAAOA,UAAU,YAAYA,MAAMO,KAAK,CAAC,CAACC,SAAS;AAErD,MAAMC,4BACJT,UAEAA,UAAUK,KAAAA,KAAaC,iBAAiBN,KAAK;AAE/C,MAAMU,yBAAyBV,UAC7BA,UAAUK,KAAAA,KACTH,MAAMC,QAAQH,KAAK,KAAKA,MAAMW,OAAOC,SAAS,OAAOA,SAAS,QAAQ;AAEzE,MAAMC,+BACJb,UAEAA,UAAUK,KAAAA,KACT,OAAOL,UAAU,YAAYc,OAAOC,SAASf,KAAK,KAAKA,SAAS;AAEnE,MAAMgB,mBAAmBC,OAAwB;CAC/C,IAAI;EACFnB,oBAAoBmB,EAAE;EACtB,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAMC,mBAAmBC,SAAyC;CAChE,IAAI,CAACpB,SAASoB,IAAI,GAAG,OAAO;CAE5B,QAAQA,KAAKC,MAAb;EACE,KAAK,QACH,OAAO;EACT,KAAK,UACH,OAAOX,yBAAyBU,KAAKE,KAAK;EAC5C,KAAK,SACH,OACEX,sBAAsBS,KAAKG,MAAM,KACjClB,iBAAiBe,KAAKI,qBAAqB,KAC3CnB,iBAAiBe,KAAKK,aAAa,KACnCpB,iBAAiBe,KAAKM,oBAAoB,KAC1CrB,iBAAiBe,KAAKO,QAAQ,KAC9BtB,iBAAiBe,KAAKQ,YAAY;EAEtC,SACE,OAAO;CACX;AACF;AAEA,MAAMC,wBACJ5B,UACmC;CACnC,IAAI,CAACD,SAASC,KAAK,GAAG,OAAO;CAC7B,IAAI,OAAOA,MAAMiB,OAAO,YAAY,CAACD,gBAAgBhB,MAAMiB,EAAE,GAC3D,OAAO;CAET,OACEX,iBAAiBN,MAAM6B,IAAI,KAC3BvB,iBAAiBN,MAAM8B,GAAG,KAC1BhB,OAAOC,SAASf,MAAM+B,SAAS,KAC/Bb,gBAAgBlB,MAAMmB,IAAI,KAC1BN,4BAA4Bb,MAAMgC,iBAAiB;AAEvD;AAEA,MAAMC,+BACJjC,UACiC;CACjC,IAAI4B,qBAAqB5B,KAAK,GAAG,OAAOA;CACxC,IAAI,CAACD,SAASC,KAAK,GAAG,OAAO;CAE7B,MAAMkC,SAAS,EAAE,GAAGlC,MAAM;CAC1B,OAAOkC,OAAOF;CACd,OAAOJ,qBAAqBM,MAAM,IAAIA,SAAS;AACjD;AAEA,MAAaC,gCACXnC,UAC4B;CAC5B,IAAI,CAACE,MAAMC,QAAQH,KAAK,GAAG,OAAO,CAAA;CAClC,OAAOA,MAAMoC,SAASxB,SAAS;EAC7B,MAAMsB,SAASD,4BAA4BrB,IAAI;EAC/C,OAAOsB,WAAW,OAAO,CAAA,IAAK,CAACA,MAAM;CACvC,CAAC;AACH;AAEA,MAAMG,wBACJrC,UACgD;CAChD,MAAMsC,SAAS9C,kBAAkB+C,UAAUvC,KAAK;CAChD,OAAOsC,OAAOE,UAAUF,OAAOG,OAAOpC,KAAAA;AACxC;AAEA,MAAMqC,8BACJ1C,UAC2D;CAC3D,MAAMsC,SAAShD,iCAAiCiD,UAAUvC,KAAK;CAC/D,OAAOsC,OAAOE,UAAUF,OAAOG,OAAOpC,KAAAA;AACxC;AAEA,MAAMsC,kBAAkB3C,UAAoC;CAC1D,IAAI,OAAOA,UAAU,UAAU,OAAO;CACtC,IAAI;EACF,MAAM8B,MAAM,IAAIc,IAAI5C,KAAK;EACzB,OAAO8B,IAAIe,aAAa,YAAYf,IAAIe,aAAa;CACvD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAMC,2BACJ9C,UACwD;CACxD,IACE,CAACD,SAASC,KAAK,KACf,OAAOA,MAAM+C,2BAA2B,YACxC,CAACtD,mBAAmBO,MAAM+C,sBAAsB,GAEhD;CAMF,MAAMC,QAA8D,EAClED,wBAAwB/C,MAAM+C,uBAChC;CAEA,IACE,OAAO/C,MAAMkD,wBAAwB,YACrCzD,mBAAmBO,MAAMkD,mBAAmB,GAE5CF,MAAME,sBAAsBlD,MAAMkD;CAGpC,MAAMC,WAAW9D,oBAAoBkD,UACnCvC,MAAMoD,2BACR;CACA,IAAID,SAASX,SAASQ,MAAMI,8BAA8BD,SAASV;CAEnE,MAAMY,mBAAmB9D,qCAAqCgD,UAC5DvC,MAAMqD,gBACR;CACA,IAAIA,iBAAiBb,SAASQ,MAAMK,mBAAmBA,iBAAiBZ;CAExE,OAAOO;AACT;AAEA,MAAaM,+BACXtD,UACiC;CACjC,IAAI,CAACD,SAASC,KAAK,GAAG,OAAO;CAC7B,IAAI,eAAeA,SAAS,CAAC2C,eAAe3C,MAAMuD,SAAS,GAAG,OAAO;CAErE,MAAMP,QAA+B,CAAC;CACtC,IAAIL,eAAe3C,MAAMuD,SAAS,GAChCP,MAAMO,YAAY7D,sBAAsBM,MAAMuD,SAAS;CAEzD,IAAIjD,iBAAiBN,MAAMqB,KAAK,GAAG2B,MAAM3B,QAAQrB,MAAMqB;CACvD,IAAIf,iBAAiBN,MAAMwD,cAAc,GACvCR,MAAMQ,iBAAiBxD,MAAMwD;CAE/B,IAAIlD,iBAAiBN,MAAMyD,YAAY,GACrCT,MAAMS,eAAezD,MAAMyD;CAE7B,IAAInD,iBAAiBN,MAAMgD,KAAK,GAAGA,MAAMA,QAAQhD,MAAMgD;CAEvD,MAAMU,SAASrB,qBAAqBrC,MAAM0D,MAAM;CAChD,IAAIA,QAAQV,MAAMU,SAASA;CAE3B,MAAMC,oBAAoBjB,2BAA2B1C,MAAM2D,iBAAiB;CAC5E,IAAIA,mBAAmBX,MAAMW,oBAAoBA;CACjD,IAAI3D,MAAM4D,4BAA4B,cACpCZ,MAAMY,0BAA0B5D,MAAM4D;CAGxC,MAAMC,iBAAiBf,wBAAwB9C,MAAM6D,cAAc;CACnE,IAAIA,gBAAgBb,MAAMa,iBAAiBA;CAE3C,OAAOC,OAAOC,KAAKf,KAAK,CAAC,CAACxC,SAAS,IAAIwC,QAAQ;AACjD"}

package/dist/utils/serverUrl.d.ts

@@ -1,5 +1,6 @@
 import type { MCPPersistedAuthState } from "../auth/types.js";
 export declare const normalizeMcpServerUrl: (serverUrl: string) => string;
+export declare const isSecureNetworkUrl: (serverUrl: string) => boolean;
 export declare const isAuthStateForServerUrl: (state: MCPPersistedAuthState | null, serverUrl: string) => boolean;
 export declare const hasPersistedCredentials: (state: MCPPersistedAuthState | null) => boolean;
 //# sourceMappingURL=serverUrl.d.ts.map

package/dist/utils/serverUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serverUrl.d.ts","sourceRoot":"","sources":["../../src/utils/serverUrl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,yBAAsB;AAE3D,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,KAAG,MAC3B,CAAC;AAEhC,eAAO,MAAM,uBAAuB,GAClC,OAAO,qBAAqB,GAAG,IAAI,EACnC,WAAW,MAAM,KAChB,OAUF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAClC,OAAO,qBAAqB,GAAG,IAAI,KAClC,OAA0D,CAAC"}
+{"version":3,"file":"serverUrl.d.ts","sourceRoot":"","sources":["../../src/utils/serverUrl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,yBAAsB;AAE3D,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,KAAG,MAC3B,CAAC;AAgBhC,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,KAAG,OAUtD,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAClC,OAAO,qBAAqB,GAAG,IAAI,EACnC,WAAW,MAAM,KAChB,OAUF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAClC,OAAO,qBAAqB,GAAG,IAAI,KAClC,OAA0D,CAAC"}

package/dist/utils/serverUrl.js

@@ -1,5 +1,19 @@
 //#region src/utils/serverUrl.ts
 const normalizeMcpServerUrl = (serverUrl) => new URL(serverUrl).toString();
+const IPV4_LOOPBACK = /^127(?:\.\d{1,3}){3}$/;
+const IPV4_MAPPED_LOOPBACK = /^\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\]$/;
+const isLoopbackHostname = (hostname) => {
+	const host = hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+	return host === "localhost" || host.endsWith(".localhost") || IPV4_LOOPBACK.test(host) || host === "[::1]" || IPV4_MAPPED_LOOPBACK.test(host);
+};
+const isSecureNetworkUrl = (serverUrl) => {
+	try {
+		const url = new URL(serverUrl);
+		return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
+	} catch {
+		return false;
+	}
+};
 const isAuthStateForServerUrl = (state, serverUrl) => {
 	if (state?.serverUrl === void 0) return false;
 	try {
@@ -10,6 +24,6 @@ const isAuthStateForServerUrl = (state, serverUrl) => {
 };
 const hasPersistedCredentials = (state) => Boolean(state?.tokens) || Boolean(state?.token);
 //#endregion
-export { hasPersistedCredentials, isAuthStateForServerUrl, normalizeMcpServerUrl };
+export { hasPersistedCredentials, isAuthStateForServerUrl, isSecureNetworkUrl, normalizeMcpServerUrl };
 
 //# sourceMappingURL=serverUrl.js.map

package/dist/utils/serverUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverUrl.js","names":["MCPPersistedAuthState","normalizeMcpServerUrl","serverUrl","URL","toString","isAuthStateForServerUrl","state","undefined","hasPersistedCredentials","Boolean","tokens","token"],"sources":["../../src/utils/serverUrl.ts"],"sourcesContent":["import type { MCPPersistedAuthState } from \"../auth/types\";\n\nexport const normalizeMcpServerUrl = (serverUrl: string): string =>\n  new URL(serverUrl).toString();\n\nexport const isAuthStateForServerUrl = (\n  state: MCPPersistedAuthState | null,\n  serverUrl: string,\n): boolean => {\n  if (state?.serverUrl === undefined) return false;\n  try {\n    return (\n      normalizeMcpServerUrl(state.serverUrl) ===\n      normalizeMcpServerUrl(serverUrl)\n    );\n  } catch {\n    return false;\n  }\n};\n\nexport const hasPersistedCredentials = (\n  state: MCPPersistedAuthState | null,\n): boolean => Boolean(state?.tokens) || Boolean(state?.token);\n"],"mappings":";AAEA,MAAaC,yBAAyBC,cACpC,IAAIC,IAAID,SAAS,CAAC,CAACE,SAAS;AAE9B,MAAaC,2BACXC,OACAJ,cACY;CACZ,IAAII,OAAOJ,cAAcK,KAAAA,GAAW,OAAO;CAC3C,IAAI;EACF,OACEN,sBAAsBK,MAAMJ,SAAS,MACrCD,sBAAsBC,SAAS;CAEnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAaM,2BACXF,UACYG,QAAQH,OAAOI,MAAM,KAAKD,QAAQH,OAAOK,KAAK"}
+{"version":3,"file":"serverUrl.js","names":["MCPPersistedAuthState","normalizeMcpServerUrl","serverUrl","URL","toString","IPV4_LOOPBACK","IPV4_MAPPED_LOOPBACK","isLoopbackHostname","hostname","host","endsWith","slice","test","isSecureNetworkUrl","url","protocol","isAuthStateForServerUrl","state","undefined","hasPersistedCredentials","Boolean","tokens","token"],"sources":["../../src/utils/serverUrl.ts"],"sourcesContent":["import type { MCPPersistedAuthState } from \"../auth/types\";\n\nexport const normalizeMcpServerUrl = (serverUrl: string): string =>\n  new URL(serverUrl).toString();\n\nconst IPV4_LOOPBACK = /^127(?:\\.\\d{1,3}){3}$/;\nconst IPV4_MAPPED_LOOPBACK = /^\\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\\]$/;\n\nconst isLoopbackHostname = (hostname: string): boolean => {\n  const host = hostname.endsWith(\".\") ? hostname.slice(0, -1) : hostname;\n  return (\n    host === \"localhost\" ||\n    host.endsWith(\".localhost\") ||\n    IPV4_LOOPBACK.test(host) ||\n    host === \"[::1]\" ||\n    IPV4_MAPPED_LOOPBACK.test(host)\n  );\n};\n\nexport const isSecureNetworkUrl = (serverUrl: string): boolean => {\n  try {\n    const url = new URL(serverUrl);\n    return (\n      url.protocol === \"https:\" ||\n      (url.protocol === \"http:\" && isLoopbackHostname(url.hostname))\n    );\n  } catch {\n    return false;\n  }\n};\n\nexport const isAuthStateForServerUrl = (\n  state: MCPPersistedAuthState | null,\n  serverUrl: string,\n): boolean => {\n  if (state?.serverUrl === undefined) return false;\n  try {\n    return (\n      normalizeMcpServerUrl(state.serverUrl) ===\n      normalizeMcpServerUrl(serverUrl)\n    );\n  } catch {\n    return false;\n  }\n};\n\nexport const hasPersistedCredentials = (\n  state: MCPPersistedAuthState | null,\n): boolean => Boolean(state?.tokens) || Boolean(state?.token);\n"],"mappings":";AAEA,MAAaC,yBAAyBC,cACpC,IAAIC,IAAID,SAAS,CAAC,CAACE,SAAS;AAE9B,MAAMC,gBAAgB;AACtB,MAAMC,uBAAuB;AAE7B,MAAMC,sBAAsBC,aAA8B;CACxD,MAAMC,OAAOD,SAASE,SAAS,GAAG,IAAIF,SAASG,MAAM,GAAG,EAAE,IAAIH;CAC9D,OACEC,SAAS,eACTA,KAAKC,SAAS,YAAY,KAC1BL,cAAcO,KAAKH,IAAI,KACvBA,SAAS,WACTH,qBAAqBM,KAAKH,IAAI;AAElC;AAEA,MAAaI,sBAAsBX,cAA+B;CAChE,IAAI;EACF,MAAMY,MAAM,IAAIX,IAAID,SAAS;EAC7B,OACEY,IAAIC,aAAa,YAChBD,IAAIC,aAAa,WAAWR,mBAAmBO,IAAIN,QAAQ;CAEhE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAaQ,2BACXC,OACAf,cACY;CACZ,IAAIe,OAAOf,cAAcgB,KAAAA,GAAW,OAAO;CAC3C,IAAI;EACF,OACEjB,sBAAsBgB,MAAMf,SAAS,MACrCD,sBAAsBC,SAAS;CAEnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAaiB,2BACXF,UACYG,QAAQH,OAAOI,MAAM,KAAKD,QAAQH,OAAOK,KAAK"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assistant-ui/react-mcp",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "MCP server configuration and connection primitives for @assistant-ui",
   "keywords": [
     "mcp",
@@ -27,13 +27,13 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@assistant-ui/core": "^0.3.23",
-    "@assistant-ui/store": "^0.3.17",
-    "@assistant-ui/tap": "^0.9.21",
-    "@modelcontextprotocol/client": "^2.2.0",
-    "@modelcontextprotocol/core": "^2.2.0",
-    "@radix-ui/react-primitive": "^2.1.10",
-    "assistant-stream": "^0.3.47"
+    "@assistant-ui/core": "^0.3.25",
+    "@assistant-ui/store": "^0.3.18",
+    "@assistant-ui/tap": "^0.9.22",
+    "@modelcontextprotocol/client": "^2.3.1",
+    "@modelcontextprotocol/core": "^2.3.1",
+    "@radix-ui/react-primitive": "^2.1.11",
+    "assistant-stream": "^0.3.49"
   },
   "peerDependencies": {
     "@types/react": "*",
@@ -50,7 +50,7 @@
     "@testing-library/dom": "^10.4.2",
     "@testing-library/react": "^16.3.3",
     "@types/react": "^19.3.0",
-    "jsdom": "^30.0.1",
+    "jsdom": "^30.1.2",
     "react": "^19.3.0",
     "vitest": "^5.0.3"
   },
@@ -70,6 +70,7 @@
   "scripts": {
     "build": "aui-build",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage --coverage.reporter=text --coverage.reporter=html --coverage.reporter=json-summary",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
     "test:peer-react18": "vitest run --config vitest.peer-react18.config.ts",
     "test:types:peer-react18": "aui-react18-types",

package/src/auth/createOAuthProvider.test.ts

@@ -1,5 +1,5 @@
 import { auth, type OAuthDiscoveryState } from "@modelcontextprotocol/client";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import type { MCPStorage } from "../resources/storage/types";
 import type { MCPPersistedAuthState } from "./types";
 import {
@@ -113,6 +113,10 @@ const rejectFetch = async () => {
   throw new Error("Unexpected OAuth request");
 };
 
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
 describe("createOAuthProvider callback state", () => {
   it("persists the generated state with the PKCE verifier", async () => {
     const { storage, getState } = createStorage();
@@ -129,6 +133,31 @@ describe("createOAuthProvider callback state", () => {
     });
   });
 
+  it("uses secure random bytes when randomUUID is unavailable", async () => {
+    const getRandomValues = vi.fn((bytes: Uint8Array) => {
+      bytes.fill(0xab);
+      return bytes;
+    });
+    vi.stubGlobal("crypto", { getRandomValues });
+    const { storage } = createStorage();
+    const provider = createStaticProvider(storage);
+
+    expect(provider.state?.()).toBe(
+      "aui-mcp:ZG9jcw.q6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6s",
+    );
+    expect(getRandomValues).toHaveBeenCalledOnce();
+  });
+
+  it("fails closed when secure randomness is unavailable", () => {
+    vi.stubGlobal("crypto", undefined);
+    const { storage } = createStorage();
+    const provider = createStaticProvider(storage);
+
+    expect(() => provider.state?.()).toThrow(
+      "Web Crypto is required to start MCP OAuth",
+    );
+  });
+
   it("consumes callback state when tokens are saved", async () => {
     const { storage, getState } = createStorage({
       serverUrl,

package/src/auth/createOAuthProvider.ts

@@ -36,6 +36,17 @@ function encodeServerIdInState(serverId: string): string {
   return `${STATE_PREFIX}${bytesToBase64Url(bytes)}`;
 }
 
+function createStateNonce(): string {
+  if (typeof crypto === "undefined") {
+    throw new Error("Web Crypto is required to start MCP OAuth");
+  }
+  if (typeof crypto.randomUUID === "function") return crypto.randomUUID();
+  if (typeof crypto.getRandomValues !== "function") {
+    throw new Error("Web Crypto is required to start MCP OAuth");
+  }
+  return bytesToBase64Url(crypto.getRandomValues(new Uint8Array(32)));
+}
+
 export function decodeServerIdFromState(state: string): string | null {
   if (!state.startsWith(STATE_PREFIX)) return null;
   const dot = state.indexOf(".", STATE_PREFIX.length);
@@ -376,10 +387,7 @@ export function createOAuthProvider(
     state() {
       // Embed the server id so the callback handler can route it back to the
       // right MCPServerResource without app-level wiring.
-      const nonce =
-        typeof crypto !== "undefined" && "randomUUID" in crypto
-          ? crypto.randomUUID()
-          : `${Date.now()}.${Math.random()}`;
+      const nonce = createStateNonce();
       pendingState = `${encodeServerIdInState(serverId)}.${nonce}`;
       return pendingState;
     },

package/src/primitives/addForm/McpAddFormRoot.test.tsx

@@ -102,6 +102,72 @@ describe("McpAddFormPrimitiveRoot", () => {
     },
   );
 
+  const submitAuthenticatedServer = (
+    url: string,
+    authType: "bearer" | "oauth" = "bearer",
+  ) => {
+    render(
+      <McpAddFormPrimitiveRoot>
+        <McpAddFormPrimitiveNameField aria-label="Name" />
+        <McpAddFormPrimitiveUrlField aria-label="URL" />
+        <McpAddFormPrimitiveAuthSelect aria-label="Auth" />
+        <McpAddFormPrimitiveBearerTokenField aria-label="Token" />
+        <McpAddFormPrimitiveError />
+        <McpAddFormPrimitiveSubmit>Submit</McpAddFormPrimitiveSubmit>
+      </McpAddFormPrimitiveRoot>,
+    );
+    fireEvent.change(screen.getByLabelText("Name"), {
+      target: { value: "Docs" },
+    });
+    fireEvent.change(screen.getByLabelText("URL"), { target: { value: url } });
+    fireEvent.change(screen.getByLabelText("Auth"), {
+      target: { value: authType },
+    });
+    if (authType === "bearer") {
+      fireEvent.change(screen.getByLabelText("Token"), {
+        target: { value: "secret" },
+      });
+    }
+    fireEvent.click(screen.getByRole("button", { name: "Submit" }));
+  };
+
+  it.each(["bearer", "oauth"] as const)(
+    "rejects %s auth over plain HTTP to a remote host",
+    async (authType) => {
+      submitAuthenticatedServer("http://192.168.1.20:3000/mcp", authType);
+
+      expect(
+        await screen.findByText(
+          "Authenticated servers must use HTTPS or loopback HTTP",
+        ),
+      ).toBeTruthy();
+      expect(mocks.addCustomServer).not.toHaveBeenCalled();
+    },
+  );
+
+  it("clears the authenticated URL error when auth changes to none", async () => {
+    submitAuthenticatedServer("http://192.168.1.20:3000/mcp");
+    const message = "Authenticated servers must use HTTPS or loopback HTTP";
+    expect(await screen.findByText(message)).toBeTruthy();
+
+    fireEvent.change(screen.getByLabelText("Auth"), {
+      target: { value: "none" },
+    });
+
+    expect(screen.queryByText(message)).toBeNull();
+  });
+
+  it("accepts bearer auth over loopback HTTP", async () => {
+    submitAuthenticatedServer("http://localhost:3000/mcp");
+
+    await waitFor(() => expect(mocks.addCustomServer).toHaveBeenCalledOnce());
+    expect(mocks.addCustomServer).toHaveBeenCalledWith({
+      name: "Docs",
+      url: "http://localhost:3000/mcp",
+      auth: { type: "bearer", token: "secret" },
+    });
+  });
+
   it.each(["throws", "rejects"] as const)(
     "does not turn a successful add into an error when onSubmitted %s",
     async (mode) => {

package/src/primitives/addForm/McpAddFormRoot.tsx

@@ -17,6 +17,7 @@ import {
 } from "./context";
 import type { MCPAuthConfig } from "../../mcp-scope";
 import { invokeMcpCallback } from "../../utils/invokeMcpCallback";
+import { isSecureNetworkUrl } from "../../utils/serverUrl";
 
 const INITIAL: AddFormState = {
   name: "",
@@ -77,7 +78,8 @@ export const McpAddFormPrimitiveRoot = forwardRef<
         const clearsError =
           prev.errorField === "form" ||
           prev.errorField === key ||
-          (key === "authType" && prev.errorField === "bearerToken");
+          (key === "authType" &&
+            (prev.errorField === "bearerToken" || prev.errorField === "url"));
         return {
           ...prev,
           [key]: value,
@@ -136,6 +138,14 @@ export const McpAddFormPrimitiveRoot = forwardRef<
       }));
       return;
     }
+    if (state.authType !== "none" && !isSecureNetworkUrl(urlResult.url)) {
+      setState((p) => ({
+        ...p,
+        error: "Authenticated servers must use HTTPS or loopback HTTP",
+        errorField: "url",
+      }));
+      return;
+    }
     setState((p) => ({
       ...p,
       submitting: true,

package/src/resources/McpCustomServerPersistence.test.ts

@@ -0,0 +1,56 @@
+import { createTapRoot, useResource } from "@assistant-ui/tap";
+import { describe, expect, it, vi } from "vitest";
+import type { MCPCustomServerRecord } from "../mcp-scope";
+import type { MCPStorage } from "./storage/types";
+import { McpCustomServersResource } from "./McpCustomServerPersistence";
+
+describe("McpCustomServersResource", () => {
+  it("merges a local mutation made before hydration and persists the result", async () => {
+    let resolveLoad: (records: MCPCustomServerRecord[]) => void = () => {};
+    const loaded = new Promise<MCPCustomServerRecord[]>((resolve) => {
+      resolveLoad = resolve;
+    });
+    const saveCustomServers = vi.fn(async () => {});
+    const storage: MCPStorage = {
+      loadCustomServers: () => loaded,
+      saveCustomServers,
+      loadAuthState: async () => null,
+      saveAuthState: async () => {},
+      clearAuthState: async () => {},
+    };
+    const persisted: MCPCustomServerRecord = {
+      id: "persisted",
+      name: "Persisted",
+      url: "https://example.com/persisted",
+      auth: { type: "none" },
+      createdAt: 1,
+    };
+    const local: MCPCustomServerRecord = {
+      ...persisted,
+      id: "local",
+      name: "Local",
+    };
+    const persistenceQueues = new Map<string, Promise<void>>();
+    const root = createTapRoot(function Root() {
+      return useResource(
+        McpCustomServersResource({
+          storage,
+          scopeKey: "test",
+          persistenceQueues,
+        }),
+      );
+    });
+
+    try {
+      root.getValue().updateCustomServers((records) => [...records, local]);
+      resolveLoad([persisted]);
+      await vi.waitFor(() => expect(root.getValue().isHydrated).toBe(true));
+      expect(root.getValue().customServers).toEqual([persisted, local]);
+      await vi.waitFor(() =>
+        expect(saveCustomServers).toHaveBeenCalledWith([persisted, local]),
+      );
+    } finally {
+      root.unmount();
+    }
+  });
+});