@axtary/mcp 0.1.0 → 0.2.0

package/dist/http-client.js

@@ -0,0 +1,280 @@
+import { MCP_PROTOCOL_VERSION } from "./server.js";
+/**
+ * Validate an upstream MCP URL before we send anything to it. `https://` is
+ * always allowed; `http://` is allowed only for loopback hosts. We never POST
+ * headers (which may carry credentials) in cleartext to a remote host — the
+ * same honesty rule that caught the Slack HTTP-loopback bug.
+ */
+export function assertSafeMcpUrl(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error("mcp_http_invalid_url");
+    }
+    if (url.protocol === "https:") {
+        return url;
+    }
+    if (url.protocol === "http:") {
+        const host = url.hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]") {
+            return url;
+        }
+        throw new Error("mcp_http_insecure_url:http_allowed_only_for_localhost");
+    }
+    throw new Error(`mcp_http_unsupported_scheme:${url.protocol}`);
+}
+/**
+ * MCP client over the Streamable HTTP transport (spec 2025-06-18). Mirrors the
+ * surface of `McpStdioClient` so the governance path is transport-agnostic:
+ * every JSON-RPC message is a POST to the single MCP endpoint, the server may
+ * answer with one JSON object or an SSE stream, the session id from the
+ * InitializeResult is echoed on later requests, and the negotiated protocol
+ * version rides every post-init request.
+ */
+export class McpHttpClient {
+    url;
+    headers;
+    fetchImpl;
+    timeoutMs;
+    sessionId = null;
+    negotiatedVersion = null;
+    closed = false;
+    serverInfo = null;
+    constructor(config) {
+        this.url = assertSafeMcpUrl(config.url);
+        this.headers = config.headers ?? {};
+        const fetchImpl = config.fetch ?? globalThis.fetch;
+        if (!fetchImpl) {
+            throw new Error("mcp_http_fetch_required");
+        }
+        this.fetchImpl = fetchImpl;
+        this.timeoutMs = config.timeoutMs ?? 15_000;
+    }
+    static async start(config) {
+        const client = new McpHttpClient(config);
+        const initialized = (await client.request("initialize", {
+            protocolVersion: MCP_PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: {
+                name: config.clientName ?? "axtary-mcp-wrapper",
+                version: config.clientVersion ?? "0.0.1",
+            },
+        }));
+        const serverInfo = initialized.serverInfo &&
+            typeof initialized.serverInfo === "object" &&
+            !Array.isArray(initialized.serverInfo)
+            ? initialized.serverInfo
+            : {};
+        client.negotiatedVersion =
+            typeof initialized.protocolVersion === "string"
+                ? initialized.protocolVersion
+                : MCP_PROTOCOL_VERSION;
+        client.serverInfo = {
+            name: typeof serverInfo.name === "string" ? serverInfo.name : "upstream",
+            version: typeof serverInfo.version === "string" ? serverInfo.version : "unknown",
+            protocolVersion: client.negotiatedVersion,
+        };
+        await client.notify("notifications/initialized", {});
+        return client;
+    }
+    async listTools() {
+        const result = (await this.request("tools/list", {}));
+        const tools = Array.isArray(result.tools) ? result.tools : [];
+        return tools.flatMap((tool) => {
+            if (!tool || typeof tool !== "object" || Array.isArray(tool)) {
+                return [];
+            }
+            const record = tool;
+            if (typeof record.name !== "string" || record.name.length === 0) {
+                return [];
+            }
+            return [
+                {
+                    name: record.name,
+                    description: typeof record.description === "string" ? record.description : undefined,
+                    inputSchema: record.inputSchema &&
+                        typeof record.inputSchema === "object" &&
+                        !Array.isArray(record.inputSchema)
+                        ? record.inputSchema
+                        : {},
+                },
+            ];
+        });
+    }
+    callTool(name, callArguments) {
+        return this.request("tools/call", { name, arguments: callArguments });
+    }
+    close() {
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        // Best-effort session termination; the server may answer 405 (no support)
+        // and we never want close() to throw.
+        if (this.sessionId) {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+            void this.fetchImpl(this.url, {
+                method: "DELETE",
+                headers: this.buildHeaders(false),
+                signal: controller.signal,
+            })
+                .catch(() => undefined)
+                .finally(() => clearTimeout(timeout));
+        }
+    }
+    async request(method, params) {
+        const id = `axtary_mcp_${method}`;
+        const message = await this.post(id, method, params, false);
+        if (!message) {
+            throw new Error(`mcp_http_missing_response:${method}`);
+        }
+        if (message.error) {
+            throw new Error(`mcp_http_error:${message.error.code ?? "unknown"}:${message.error.message ?? "unknown"}`);
+        }
+        return message.result ?? null;
+    }
+    async notify(method, params) {
+        await this.post(null, method, params, true);
+    }
+    async post(id, method, params, isNotification) {
+        if (this.closed) {
+            throw new Error("mcp_http_closed");
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        const body = isNotification
+            ? { jsonrpc: "2.0", method, params }
+            : { jsonrpc: "2.0", id, method, params };
+        let response;
+        try {
+            response = await this.fetchImpl(this.url, {
+                method: "POST",
+                headers: this.buildHeaders(true),
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+        // The session id is assigned on the InitializeResult response.
+        const assignedSession = response.headers.get("mcp-session-id");
+        if (assignedSession) {
+            this.sessionId = assignedSession;
+        }
+        if (response.status === 404 && this.sessionId) {
+            throw new Error("mcp_http_session_expired");
+        }
+        if (isNotification) {
+            // 202 Accepted (no body) is the expected outcome for notifications.
+            if (!response.ok) {
+                throw new Error(`mcp_http_status:${response.status}`);
+            }
+            void response.body?.cancel();
+            return null;
+        }
+        if (!response.ok) {
+            throw new Error(`mcp_http_status:${response.status}`);
+        }
+        const contentType = response.headers.get("content-type") ?? "";
+        if (contentType.includes("text/event-stream")) {
+            return this.readSseResponse(response, id);
+        }
+        const parsed = (await response.json());
+        return toResponseMessage(parsed);
+    }
+    async readSseResponse(response, id) {
+        if (!response.body) {
+            throw new Error("mcp_http_sse_no_body");
+        }
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        try {
+            for (;;) {
+                const { value, done } = await reader.read();
+                if (done) {
+                    break;
+                }
+                buffer += decoder.decode(value, { stream: true });
+                let separator = nextEventBoundary(buffer);
+                while (separator) {
+                    const rawEvent = buffer.slice(0, separator.index);
+                    buffer = buffer.slice(separator.index + separator.length);
+                    const data = parseSseData(rawEvent);
+                    if (data !== null) {
+                        const message = toResponseMessage(JSON.parse(data));
+                        if (message && message.id === id) {
+                            await reader.cancel();
+                            return message;
+                        }
+                    }
+                    separator = nextEventBoundary(buffer);
+                }
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        throw new Error("mcp_http_sse_no_matching_response");
+    }
+    buildHeaders(withBody) {
+        const headers = {
+            ...this.headers,
+            accept: "application/json, text/event-stream",
+        };
+        if (withBody) {
+            headers["content-type"] = "application/json";
+        }
+        if (this.sessionId) {
+            headers["mcp-session-id"] = this.sessionId;
+        }
+        if (this.negotiatedVersion) {
+            headers["mcp-protocol-version"] = this.negotiatedVersion;
+        }
+        return headers;
+    }
+}
+function toResponseMessage(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    const error = record.error && typeof record.error === "object" && !Array.isArray(record.error)
+        ? record.error
+        : undefined;
+    return {
+        id: record.id ?? null,
+        result: record.result,
+        error: error
+            ? {
+                code: typeof error.code === "number" ? error.code : undefined,
+                message: typeof error.message === "string" ? error.message : undefined,
+            }
+            : undefined,
+    };
+}
+/** Locate the next SSE event boundary (blank line), tolerating LF and CRLF. */
+function nextEventBoundary(buffer) {
+    const lf = buffer.indexOf("\n\n");
+    const crlf = buffer.indexOf("\r\n\r\n");
+    if (crlf !== -1 && (lf === -1 || crlf < lf)) {
+        return { index: crlf, length: 4 };
+    }
+    if (lf !== -1) {
+        return { index: lf, length: 2 };
+    }
+    return null;
+}
+/** Concatenate the `data:` lines of one SSE event, or null if there are none. */
+function parseSseData(rawEvent) {
+    const dataLines = rawEvent
+        .split(/\r?\n/)
+        .filter((line) => line.startsWith("data:"))
+        .map((line) => line.slice("data:".length).replace(/^ /, ""));
+    return dataLines.length > 0 ? dataLines.join("\n") : null;
+}
+//# sourceMappingURL=http-client.js.map

package/dist/http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../src/http-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAsBnD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE1B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACvF,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACP,GAAG,CAAM;IACT,OAAO,CAAyB;IAChC,SAAS,CAAe;IACxB,SAAS,CAAS;IAC3B,SAAS,GAAkB,IAAI,CAAC;IAChC,iBAAiB,GAAkB,IAAI,CAAC;IACxC,MAAM,GAAG,KAAK,CAAC;IACvB,UAAU,GAAiC,IAAI,CAAC;IAEhD,YAAoB,MAA2B;QAC7C,IAAI,CAAC,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAEnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAA2B;QAC5C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;YACtD,eAAe,EAAE,oBAAoB;YACrC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE;gBACV,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,oBAAoB;gBAC/C,OAAO,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO;aACzC;SACF,CAAC,CAA8B,CAAC;QAEjC,MAAM,UAAU,GACd,WAAW,CAAC,UAAU;YACtB,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ;YAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YACpC,CAAC,CAAE,WAAW,CAAC,UAAwC;YACvD,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,CAAC,iBAAiB;YACtB,OAAO,WAAW,CAAC,eAAe,KAAK,QAAQ;gBAC7C,CAAC,CAAC,WAAW,CAAC,eAAe;gBAC7B,CAAC,CAAC,oBAAoB,CAAC;QAC3B,MAAM,CAAC,UAAU,GAAG;YAClB,IAAI,EAAE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YACxE,OAAO,EAAE,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAChF,eAAe,EAAE,MAAM,CAAC,iBAAiB;SAC1C,CAAC;QAEF,MAAM,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QAErD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAA8B,CAAC;QACnF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,IAAiC,CAAC;YAEjD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO;gBACL;oBACE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,WAAW,EACT,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;oBACzE,WAAW,EACT,MAAM,CAAC,WAAW;wBAClB,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;wBACtC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;wBAChC,CAAC,CAAE,MAAM,CAAC,WAAyC;wBACnD,CAAC,CAAC,EAAE;iBACT;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,aAAwC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,0EAA0E;QAC1E,sCAAsC;QACtC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAErE,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;gBACjC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;iBACC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBACtB,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,MAAiC;QAEjC,MAAM,EAAE,GAAG,cAAc,MAAM,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAAiC;QACpE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,EAAiB,EACjB,MAAc,EACd,MAAiC,EACjC,cAAuB;QAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,cAAc;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;YACpC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAE3C,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAChC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAED,+DAA+D;QAC/D,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE/D,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC;QACnC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,oEAAoE;YACpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACxD,CAAC;YAED,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAE/D,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;QAEpD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,QAAkB,EAClB,EAAiB;QAEjB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAE5C,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM;gBACR,CAAC;gBAED,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAE1C,OAAO,SAAS,EAAE,CAAC;oBACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;oBAClD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;oBAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;oBAEpC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;wBAClB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAC;wBAEjE,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;4BACjC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;4BACtB,OAAO,OAAO,CAAC;wBACjB,CAAC;oBACH,CAAC;oBAED,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAEO,YAAY,CAAC,QAAiB;QACpC,MAAM,OAAO,GAA2B;YACtC,GAAG,IAAI,CAAC,OAAO;YACf,MAAM,EAAE,qCAAqC;SAC9C,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC3D,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,KAAgB;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAkC,CAAC;IAClD,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9E,CAAC,CAAE,MAAM,CAAC,KAAmC;QAC7C,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,IAAI;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,KAAK;YACV,CAAC,CAAC;gBACE,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC7D,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aACvE;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,SAAS,GAAG,QAAQ;SACvB,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAE/D,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,8 @@
 export * from "./core.js";
-export { MCP_PROTOCOL_VERSION, MCP_WRAPPER_SERVER_NAME, McpStdioClient, McpWrapperServer, createMcpToolRouter, createMcpWrapperServer, createMcpWrapperTool, type McpStdioClientConfig, type McpUpstreamServerInfo, type McpUpstreamToolListing, type McpWrapperRuntime, type McpWrapperServerConfig, type McpWrapperTool, } from "./server.js";
+export { MCP_CONFORMANCE_RECEIPT_VERSION, MCP_CONFORMANCE_REGISTRY_VERSION, McpConformanceReceiptSchema, McpConformanceRegistrySchema, emptyMcpConformanceRegistry, loadMcpConformanceRegistry, parseMcpConformanceRegistry, saveMcpConformanceRegistry, upsertMcpConformanceReceipt, type McpConformanceReceipt, type McpConformanceRegistry, } from "./conformance.js";
+export { MCP_PINS_SCHEMA_VERSION, MCP_PINS_SCHEMA_VERSION_V0, McpPinManifestSchema, McpServerPinsSchema, McpToolPinSchema, emptyMcpPinManifest, loadMcpPinManifest, parseMcpPinManifest, pinMcpDefinitions, reconcileMcpPins, saveMcpPinManifest, evaluateMcpVersionChain, findMcpToolPin, compareSemver, type McpChainEvaluation, type McpChainVerdict, type McpPinManifest, type McpPinProvenance, type McpPinReconcileEntry, type McpPinStatus, type McpServerPins, type McpToolPin, } from "./pins.js";
+export { MCP_PROTOCOL_VERSION, MCP_WRAPPER_SERVER_NAME, McpStdioClient, McpWrapperServer, createMcpToolRouter, createMcpWrapperServer, createMcpWrapperTool, type McpStdioClientConfig, type McpUpstreamClient, type McpUpstreamServerInfo, type McpUpstreamToolListing, type McpWrapperRuntime, type McpWrapperServerConfig, type McpWrapperTool, } from "./server.js";
+export { McpHttpClient, assertSafeMcpUrl, type McpHttpClientConfig, } from "./http-client.js";
+export { PROTECTED_RESOURCE_WELL_KNOWN, AUTHORIZATION_SERVER_WELL_KNOWN, OPENID_CONFIGURATION_WELL_KNOWN, canonicalResourceUri, assertSafeOAuthEndpoint, parseWwwAuthenticate, protectedResourceMetadataUrl, authorizationServerMetadataUrls, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, createPkcePair, createOAuthState, buildAuthorizationUrl, exchangeAuthorizationCode, refreshAccessToken, registerOAuthClient, type WwwAuthenticateChallenge, type ProtectedResourceMetadata, type AuthorizationServerMetadata, type DiscoverInput, type PkcePair, type OAuthTokens, type RegisteredClient, } from "./oauth.js";
+export { MCP_SIGNED_DEFINITION_PROFILE, MCP_SIGNED_DEFINITION_TYP, MCP_PUBLISHER_KEYRING_VERSION, MCP_PUBLISHER_TRUST_VERSION, MCP_SIGNED_DEFINITION_REGISTRY_VERSION, McpSignedDefinitionClaimsSchema, McpSignedDefinitionRegistryEntrySchema, McpSignedDefinitionRegistrySchema, McpPublisherKeySchema, McpPublisherKeyringSchema, McpPublisherTrustEntrySchema, McpPublisherTrustStoreSchema, signMcpToolDefinition, verifyMcpSignedDefinition, createSignedMcpToolHandler, mcpPublisherKeyResolver, emptyMcpPublisherTrustStore, parseMcpPublisherTrustStore, loadMcpPublisherTrustStore, saveMcpPublisherTrustStore, loadMcpSignedDefinitionRegistry, findMcpSignedDefinition, trustMcpPublisher, mcpPublisherJwks, mcpPublisherSigningKey, loadOrCreateMcpPublisherKeyring, type McpSignedDefinitionClaims, type McpSignedDefinitionRegistry, type McpSignedDefinitionRegistryEntry, type McpSignedDefinitionVerification, type McpPublisherKey, type McpPublisherKeyResolver, type McpPublisherKeyring, type McpPublisherTrustEntry, type McpPublisherTrustStore, type SignMcpToolDefinitionInput, } from "./signing.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,+BAA+B,EAC/B,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,+BAA+B,EAC/B,iCAAiC,EACjC,mCAAmC,EACnC,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,EAC3B,sCAAsC,EACtC,+BAA+B,EAC/B,sCAAsC,EACtC,iCAAiC,EACjC,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,+BAA+B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACpC,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,GAChC,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,3 +1,8 @@
 export * from "./core.js";
+export { MCP_CONFORMANCE_RECEIPT_VERSION, MCP_CONFORMANCE_REGISTRY_VERSION, McpConformanceReceiptSchema, McpConformanceRegistrySchema, emptyMcpConformanceRegistry, loadMcpConformanceRegistry, parseMcpConformanceRegistry, saveMcpConformanceRegistry, upsertMcpConformanceReceipt, } from "./conformance.js";
+export { MCP_PINS_SCHEMA_VERSION, MCP_PINS_SCHEMA_VERSION_V0, McpPinManifestSchema, McpServerPinsSchema, McpToolPinSchema, emptyMcpPinManifest, loadMcpPinManifest, parseMcpPinManifest, pinMcpDefinitions, reconcileMcpPins, saveMcpPinManifest, evaluateMcpVersionChain, findMcpToolPin, compareSemver, } from "./pins.js";
 export { MCP_PROTOCOL_VERSION, MCP_WRAPPER_SERVER_NAME, McpStdioClient, McpWrapperServer, createMcpToolRouter, createMcpWrapperServer, createMcpWrapperTool, } from "./server.js";
+export { McpHttpClient, assertSafeMcpUrl, } from "./http-client.js";
+export { PROTECTED_RESOURCE_WELL_KNOWN, AUTHORIZATION_SERVER_WELL_KNOWN, OPENID_CONFIGURATION_WELL_KNOWN, canonicalResourceUri, assertSafeOAuthEndpoint, parseWwwAuthenticate, protectedResourceMetadataUrl, authorizationServerMetadataUrls, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, createPkcePair, createOAuthState, buildAuthorizationUrl, exchangeAuthorizationCode, refreshAccessToken, registerOAuthClient, } from "./oauth.js";
+export { MCP_SIGNED_DEFINITION_PROFILE, MCP_SIGNED_DEFINITION_TYP, MCP_PUBLISHER_KEYRING_VERSION, MCP_PUBLISHER_TRUST_VERSION, MCP_SIGNED_DEFINITION_REGISTRY_VERSION, McpSignedDefinitionClaimsSchema, McpSignedDefinitionRegistryEntrySchema, McpSignedDefinitionRegistrySchema, McpPublisherKeySchema, McpPublisherKeyringSchema, McpPublisherTrustEntrySchema, McpPublisherTrustStoreSchema, signMcpToolDefinition, verifyMcpSignedDefinition, createSignedMcpToolHandler, mcpPublisherKeyResolver, emptyMcpPublisherTrustStore, parseMcpPublisherTrustStore, loadMcpPublisherTrustStore, saveMcpPublisherTrustStore, loadMcpSignedDefinitionRegistry, findMcpSignedDefinition, trustMcpPublisher, mcpPublisherJwks, mcpPublisherSigningKey, loadOrCreateMcpPublisherKeyring, } from "./signing.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,GAOrB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,GAG5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,aAAa,GASd,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,GAQrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,+BAA+B,EAC/B,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,+BAA+B,EAC/B,iCAAiC,EACjC,mCAAmC,EACnC,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,GAQpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,EAC3B,sCAAsC,EACtC,+BAA+B,EAC/B,sCAAsC,EACtC,iCAAiC,EACjC,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,+BAA+B,GAWhC,MAAM,cAAc,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,168 @@
+export declare const PROTECTED_RESOURCE_WELL_KNOWN = "/.well-known/oauth-protected-resource";
+export declare const AUTHORIZATION_SERVER_WELL_KNOWN = "/.well-known/oauth-authorization-server";
+export declare const OPENID_CONFIGURATION_WELL_KNOWN = "/.well-known/openid-configuration";
+/**
+ * The canonical resource identifier for an MCP server, per RFC 8707 §2 and the
+ * MCP spec's "Canonical Server URI" rules: lowercase scheme + host, no fragment,
+ * no trailing slash (unless the path is just "/"). This exact string is the
+ * `resource` parameter and must match the `resource` field of the Protected
+ * Resource Metadata document.
+ */
+export declare function canonicalResourceUri(rawUrl: string): string;
+/**
+ * Allow `https://` always; allow `http://` only for loopback hosts. The MCP
+ * authorization spec requires all authorization-server endpoints to be served
+ * over HTTPS — we never send a bearer, code, or verifier in cleartext to a
+ * remote host. Loopback stays permitted for local conformance servers.
+ */
+export declare function assertSafeOAuthEndpoint(rawUrl: string): URL;
+export type WwwAuthenticateChallenge = {
+    scheme: string;
+    params: Record<string, string>;
+};
+/**
+ * Parse an RFC 7235 `WWW-Authenticate` header far enough to recover the RFC 9728
+ * `resource_metadata` and (optionally) `scope` from a Bearer challenge. We only
+ * need quoted/unquoted token68-free `key=value` auth params, which is what real
+ * MCP resource servers emit.
+ */
+export declare function parseWwwAuthenticate(header: string): WwwAuthenticateChallenge | null;
+export type ProtectedResourceMetadata = {
+    resource: string;
+    authorizationServers: string[];
+    scopesSupported: string[];
+    resourceName: string | null;
+    metadataUrl: string;
+};
+export type AuthorizationServerMetadata = {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint: string | null;
+    codeChallengeMethodsSupported: string[];
+    scopesSupported: string[];
+    grantTypesSupported: string[];
+    metadataUrl: string;
+};
+/**
+ * Build the RFC 9728 Protected Resource Metadata URL from an MCP server URL. The
+ * well-known segment is inserted between host and path (path-aware), matching
+ * RFC 9728 §3.1, so `https://h/mcp` → `https://h/.well-known/oauth-protected-resource/mcp`.
+ */
+export declare function protectedResourceMetadataUrl(mcpUrl: string): string;
+/**
+ * Candidate RFC 8414 Authorization Server Metadata URLs for an issuer, tried in
+ * order. RFC 8414 inserts the well-known segment between host and path; we also
+ * fall back to the OpenID Connect discovery document, which many real
+ * authorization servers (including ones fronting MCP) serve instead.
+ */
+export declare function authorizationServerMetadataUrls(issuer: string): string[];
+export type DiscoverInput = {
+    mcpUrl: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    /** A `WWW-Authenticate` header from a prior 401, if already observed. */
+    wwwAuthenticate?: string;
+};
+/**
+ * Discover Protected Resource Metadata for an MCP server. Prefers the
+ * `resource_metadata` URL advertised in a 401 `WWW-Authenticate` header (RFC
+ * 9728 §5.1); otherwise derives the well-known URL from the MCP endpoint. The
+ * returned `resource` must equal the canonical MCP URI or we fail closed rather
+ * than request a token for the wrong audience.
+ */
+export declare function discoverProtectedResourceMetadata(input: DiscoverInput): Promise<ProtectedResourceMetadata>;
+/**
+ * Discover RFC 8414 Authorization Server Metadata for an issuer, trying the
+ * path-aware well-known URLs and the OpenID fallback in order. The metadata's
+ * `issuer` must equal the requested issuer (RFC 8414 §3.3), and the
+ * authorization/token endpoints must be HTTPS (or loopback) or we fail closed.
+ */
+export declare function discoverAuthorizationServerMetadata(input: {
+    issuer: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<AuthorizationServerMetadata>;
+export type PkcePair = {
+    verifier: string;
+    challenge: string;
+    method: "S256";
+};
+/** Create an RFC 7636 PKCE verifier/challenge pair (S256). */
+export declare function createPkcePair(randomVerifier?: () => string): PkcePair;
+/** Create an anti-CSRF `state` value for the authorization request. */
+export declare function createOAuthState(randomState?: () => string): string;
+/**
+ * Build the OAuth 2.1 authorization-request URL. The RFC 8707 `resource`
+ * parameter is always included and set to the canonical MCP URI (MUST per the
+ * MCP spec, regardless of AS support), alongside PKCE `code_challenge` and the
+ * anti-CSRF `state`.
+ */
+export declare function buildAuthorizationUrl(input: {
+    authorizationEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    scopes: string[];
+    state: string;
+    codeChallenge: string;
+    extraParams?: Record<string, string>;
+}): string;
+export type OAuthTokens = {
+    accessToken: string;
+    refreshToken: string | null;
+    tokenType: string;
+    scope: string[];
+    expiresIn: number | null;
+};
+/**
+ * Exchange an authorization code for tokens at the token endpoint. Sends the
+ * RFC 7636 `code_verifier` and the RFC 8707 `resource` parameter so the issued
+ * token is audience-bound to this MCP server. Public-client form (no secret) is
+ * the default; a confidential client secret is included only when supplied.
+ */
+export declare function exchangeAuthorizationCode(input: {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+    resource: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<OAuthTokens>;
+/**
+ * Refresh an access token. Per OAuth 2.1 the `resource` parameter is repeated so
+ * the refreshed token keeps the same audience; the requested `scope` is narrowed
+ * to what was originally granted (never broadened).
+ */
+export declare function refreshAccessToken(input: {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    refreshToken: string;
+    resource: string;
+    scopes?: string[];
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<OAuthTokens>;
+export type RegisteredClient = {
+    clientId: string;
+    clientSecret: string | null;
+};
+/**
+ * Register a public OAuth client via RFC 7591 Dynamic Client Registration. We
+ * register as a public client using PKCE (`token_endpoint_auth_method: none`)
+ * with the loopback redirect and the authorization-code grant, so no client
+ * secret is needed or stored. Returns the issued client id.
+ */
+export declare function registerOAuthClient(input: {
+    registrationEndpoint: string;
+    redirectUris: string[];
+    clientName: string;
+    scopes?: string[];
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<RegisteredClient>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,6BAA6B,0CAA0C,CAAC;AACrF,eAAO,MAAM,+BAA+B,4CAA4C,CAAC;AACzF,eAAO,MAAM,+BAA+B,sCAAsC,CAAC;AAEnF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA8B3D;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAwB3D;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,GAAG,IAAI,CAqBpF;AASD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,6BAA6B,EAAE,MAAM,EAAE,CAAC;IACxC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKnE;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBxE;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,yBAAyB,CAAC,CA+CpC;AAED;;;;;GAKG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA4DvC;AAED,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,QAAQ,CAKtE;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,GAAG,MAAM,CAmBT;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAYF;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,WAAW,CAAC,CAoBvB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBvB;AASD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4C5B"}