@cursor/july 0.1.10 → 0.1.11

package/dist/internal/discovery.js

@@ -30,8 +30,9 @@ import { basename, extname, isAbsolute, join, relative, resolve, } from "node:pa
 import { pathToFileURL } from "node:url";
 import { resolveABMaxPlaygroundSessions } from "../ab.js";
 import { httpChannel } from "../channels.js";
-import { DEFAULT_MODEL, toPublicCloudInfo, } from "../types.js";
+import { DEFAULT_MODEL, MAX_RUNNING_TURNS_LIMIT, toPublicCloudInfo, } from "../types.js";
 import { registerAuthoredModuleLoaders } from "./authored-loaders.js";
+import { normalizePositiveInt } from "./bounded-int.js";
 import { getDefinitionKind } from "./brand.js";
 import { isValidCron } from "./cron.js";
 import { parseFrontmatter } from "./frontmatter.js";
@@ -272,6 +273,7 @@ function loadAgent(ctx, agentDir, options) {
                 cwd: localCwd,
             };
         const hosting = resolveHosting(ctx, agentDir, config === null || config === void 0 ? void 0 : config.hosting);
+        const concurrency = resolveConcurrency(ctx, agentDir, config === null || config === void 0 ? void 0 : config.concurrency);
         if (runtime === "cloud") {
             warnCloudRuntimeLimitations(ctx, agentDir, {
                 serverTools: tools.filter((tool) => tool.execution === "server").length,
@@ -291,6 +293,7 @@ function loadAgent(ctx, agentDir, options) {
             cloud,
             local,
             hosting,
+            concurrency,
             tools,
             skills,
             connections,
@@ -350,6 +353,33 @@ function resolveHosting(ctx, agentDir, hosting) {
         ? {}
         : { secretNames: [...hosting.secretNames] }));
 }
+/**
+ * Validate the authored `concurrency` block. Invalid values are **error**
+ * diagnostics (serve refuses to start): silently dropping a turn ceiling
+ * would fail open to unlimited parallelism, the opposite of what the
+ * author asked for.
+ */
+function resolveConcurrency(ctx, agentDir, concurrency) {
+    if (concurrency === undefined || concurrency.maxRunningTurns === undefined) {
+        return undefined;
+    }
+    try {
+        return {
+            maxRunningTurns: normalizePositiveInt(concurrency.maxRunningTurns, {
+                label: "concurrency.maxRunningTurns",
+                max: MAX_RUNNING_TURNS_LIMIT,
+            }),
+        };
+    }
+    catch (error) {
+        ctx.diagnostics.push({
+            severity: "error",
+            path: displayPath(ctx, join(agentDir, "agent.ts")),
+            message: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+}
 function loadAgentConfig(ctx, agentDir, isRoot) {
     return __awaiter(this, void 0, void 0, function* () {
         const configPath = yield findModuleFile(agentDir, "agent");
@@ -666,10 +696,18 @@ function connectionTransportLabel(transport) {
         return `agent:${transport.agent}`;
     }
     if ("url" in transport) {
-        return transport.url;
+        return transport.oauth === true
+            ? `${transport.url} (oauth)`
+            : transport.url;
     }
     return transport.command;
 }
+function hasAuthorizationHeader(headers) {
+    if (headers === undefined) {
+        return false;
+    }
+    return Object.keys(headers).some((key) => key.toLowerCase() === "authorization");
+}
 function connectionTransport(connection) {
     if ("cursorAccount" in connection && connection.cursorAccount === true) {
         return Object.assign({ cursorAccount: true }, (connection.servers === undefined
@@ -680,9 +718,12 @@ function connectionTransport(connection) {
         return { agent: connection.agent };
     }
     if ("url" in connection && !isBlank(connection.url)) {
-        return Object.assign(Object.assign(Object.assign({}, (connection.type === undefined ? {} : { type: connection.type })), { url: connection.url }), (connection.headers === undefined
-            ? {}
-            : { headers: connection.headers }));
+        return {
+            type: connection.type,
+            url: connection.url,
+            headers: connection.headers,
+            oauth: connection.oauth === true ? true : undefined,
+        };
     }
     if ("command" in connection && !isBlank(connection.command)) {
         return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (connection.type === undefined ? {} : { type: connection.type })), { command: connection.command }), (connection.args === undefined ? {} : { args: connection.args })), (connection.env === undefined ? {} : { env: connection.env })), (connection.cwd === undefined ? {} : { cwd: connection.cwd }));
@@ -779,6 +820,16 @@ function loadConnections(ctx, connectionsDir) {
                 continue;
             }
             const connection = definition;
+            if ("url" in connection &&
+                connection.oauth === true &&
+                hasAuthorizationHeader(connection.headers)) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, entryPath),
+                    message: "MCP connection `oauth: true` cannot set an Authorization header. Drop the header or remove `oauth`.",
+                });
+                continue;
+            }
             const transport = connectionTransport(connection);
             if (transport === undefined) {
                 ctx.diagnostics.push({
@@ -807,10 +858,12 @@ function loadConnections(ctx, connectionsDir) {
                 });
                 continue;
             }
-            connections.push(Object.assign({ name,
-                transport }, (connection.description === undefined
-                ? {}
-                : { description: connection.description })));
+            connections.push({
+                name,
+                transport,
+                description: connection.description,
+                hostOnly: connection.hostOnly,
+            });
         }
         return connections;
     });
@@ -1256,7 +1309,7 @@ export function projectInfo(project) {
             url: "/v1/session/:sessionId/approvals/:callId",
         },
     ];
-    return Object.assign(Object.assign({ name: project.name, model: agent.model, runtime: agent.runtime, cloud: agent.cloud === undefined ? undefined : toPublicCloudInfo(agent.cloud), local: agent.local, hosting: agent.hosting, mcp: { path: MCP_ENDPOINT_PATH, tools: mcpEndpointToolNames(project) }, instructions: agent.instructions === undefined
+    return Object.assign(Object.assign({ name: project.name, model: agent.model, runtime: agent.runtime, cloud: agent.cloud === undefined ? undefined : toPublicCloudInfo(agent.cloud), local: agent.local, hosting: agent.hosting, concurrency: agent.concurrency, mcp: { path: MCP_ENDPOINT_PATH, tools: mcpEndpointToolNames(project) }, instructions: agent.instructions === undefined
             ? undefined
             : {
                 chars: agent.instructions.length,
@@ -1275,6 +1328,7 @@ export function projectInfo(project) {
         })), connections: agent.connections.map((connection) => ({
             name: connection.name,
             transport: connectionTransportLabel(connection.transport),
+            hostOnly: connection.hostOnly,
         })), subagents: agent.subagents.map((subagent) => ({
             name: subagent.name,
             description: subagent.description,

package/dist/internal/distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../src/internal/distribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,qEAAqE;AACrE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,WAAW,aAAa,CAAC;AACtC,eAAO,MAAM,UAAU,EAAE,MAA2B,CAAC;AACrD,eAAO,MAAM,gBAAgB,EAAE,MAAiC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAA+B,CAAC;AAc/D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAC/C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAkBzC,CAAC"}
+{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../src/internal/distribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,qEAAqE;AACrE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,WAAW,aAAa,CAAC;AACtC,eAAO,MAAM,UAAU,EAAE,MAA2B,CAAC;AACrD,eAAO,MAAM,gBAAgB,EAAE,MAAiC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAA+B,CAAC;AAc/D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAC/C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAmBzC,CAAC"}

package/dist/internal/distribution.js

@@ -84,6 +84,7 @@ export const AUTHORING_ENTRY_FILES = [
     ["reminders", "reminders.js"],
     ["connections", "connections.js"],
     ["hooks", "hooks.js"],
+    ["prompt", "prompt.js"],
     ["evals", "evals.js"],
     ["ab", "ab.js"],
     ["storage", "storage.js"],

package/dist/internal/json-dir-store.js

@@ -0,0 +1,100 @@
+/**
+ * Small filesystem helpers for one-JSON-file-per-id persistence under a
+ * project-relative directory (eval run snapshots, A/B aggregate snapshots).
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { randomBytes } from "node:crypto";
+import { mkdir, readdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+export function assertNonEmptyDir(dir, fnName) {
+    if (typeof dir !== "string" || dir.trim() === "") {
+        throw new Error(`${fnName}: dir must be a non-empty string`);
+    }
+    return dir;
+}
+/** Resolve `dir` against `projectRoot` when relative. */
+export function resolveProjectRelativeDir(args) {
+    return isAbsolute(args.dir) ? args.dir : join(args.projectRoot, args.dir);
+}
+function isEnoent(error) {
+    return (error !== null &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+/** List `*.json` basenames in `root` (any order). Missing dir → []. */
+export function listJsonBasenames(root) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let names;
+        try {
+            names = yield readdir(root);
+        }
+        catch (error) {
+            if (isEnoent(error)) {
+                return [];
+            }
+            throw error;
+        }
+        return names.filter((name) => name.endsWith(".json"));
+    });
+}
+/**
+ * Read and JSON.parse every `*.json` file under `root`. Missing dir → [].
+ * Unreadable or corrupt files are skipped so one bad snapshot cannot wipe
+ * the rest of the history.
+ */
+export function readJsonDir(root, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let names = yield listJsonBasenames(root);
+        if ((options === null || options === void 0 ? void 0 : options.sortBasenames) === "asc") {
+            names = [...names].sort();
+        }
+        else if ((options === null || options === void 0 ? void 0 : options.sortBasenames) === "desc") {
+            names = [...names].sort().reverse();
+        }
+        const out = [];
+        for (const name of names) {
+            try {
+                const raw = yield readFile(join(root, name), "utf8");
+                out.push(JSON.parse(raw));
+            }
+            catch (_a) {
+                // skip corrupt / unreadable files
+            }
+        }
+        return out;
+    });
+}
+/** Atomically write JSON under `root`/`fileName` (temp file + rename). */
+export function writeJsonFile(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { root, fileName, value } = args;
+        // Serialize before any await so callers get a stable snapshot even if they
+        // mutate `value` afterward.
+        const body = `${JSON.stringify(value, null, 2)}\n`;
+        yield mkdir(root, { recursive: true });
+        const finalPath = join(root, fileName);
+        const tmpPath = `${finalPath}.${randomBytes(4).toString("hex")}.tmp`;
+        yield writeFile(tmpPath, body, "utf8");
+        yield rename(tmpPath, finalPath);
+    });
+}
+/** Best-effort delete; ignores missing files. */
+export function deleteFileInDir(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield rm(join(args.root, args.fileName), { force: true });
+        }
+        catch (_a) {
+            // ignore
+        }
+    });
+}

package/dist/internal/logs-client.js

@@ -25,7 +25,7 @@ const PROGRESS_MESSAGES = {
     queued: "Waiting to start…",
     preparing: "Preparing runtime…",
     creating: "Creating runtime…",
-    building: "Checking out source and installing dependencies…",
+    building: "Checking out source…",
     starting: "Starting agent and waiting for health…",
     finalizing: "Finishing deployment…",
     running: "Deployment running",

package/dist/internal/mcp-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEhB,MAAM,aAAa,CAAC;AAOrB,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IAExE,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAYlE;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAO5B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED,OAAO,CAAC,SAAS;YAYH,OAAO;CAUtB"}
+{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEhB,MAAM,aAAa,CAAC;AASrB,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IAExE,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAYlE;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAO5B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED,OAAO,CAAC,SAAS;YAYH,OAAO;CAUtB"}

package/dist/internal/mcp-host.js

@@ -17,10 +17,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
+import { createHostMcpOAuthProvider } from "./mcp-oauth.js";
 export class McpHost {
     constructor(connections) {
         this.byName = new Map();
@@ -99,8 +102,17 @@ function openConnection(connection) {
             name: "agent-serve",
             version: "0.1.0",
         });
-        const transport = createTransport(connection);
-        yield client.connect(transport);
+        const transport = yield createTransport(connection);
+        try {
+            yield client.connect(transport);
+        }
+        catch (error) {
+            if (error instanceof UnauthorizedError &&
+                isOauthHttpTransport(connection.transport)) {
+                throw new Error(`MCP connection "${connection.name}" needs authorization. Run \`${CLI} mcp oauth ${connection.name}\`.`, { cause: error });
+            }
+            throw error;
+        }
         return {
             client,
             close: () => __awaiter(this, void 0, void 0, function* () {
@@ -122,30 +134,41 @@ function openConnection(connection) {
     });
 }
 function createTransport(connection) {
-    var _a;
-    const transport = connection.transport;
-    if ("agent" in transport) {
-        // Peers are resolved to concrete URLs by the serve host before any call
-        // (SessionEngine.setResolvedConnections); reaching here means the
-        // connection is being used outside a running server.
-        throw new Error(`MCP connection "${connection.name}" targets peer agent "${transport.agent}" and has not been resolved; peer MCP connections are only callable on a running serve host.`);
-    }
-    if ("cursorAccount" in transport) {
-        // Same contract as peers: the serve host resolves the account bridge URL
-        // before any call (SessionEngine.setResolvedConnections).
-        throw new Error(`MCP connection "${connection.name}" exposes the Cursor account's connectors and has not been resolved; Cursor account MCP connections are only callable on a running serve host.`);
-    }
-    if ("command" in transport) {
-        return new StdioClientTransport(Object.assign(Object.assign(Object.assign({ command: transport.command }, (transport.args === undefined ? {} : { args: transport.args })), { env: Object.assign(Object.assign({}, Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined))), ((_a = transport.env) !== null && _a !== void 0 ? _a : {})) }), (transport.cwd === undefined ? {} : { cwd: transport.cwd })));
-    }
-    const url = new URL(transport.url);
-    const requestInit = transport.headers === undefined
-        ? undefined
-        : { headers: transport.headers };
-    if (transport.type === "sse") {
-        return new SSEClientTransport(url, Object.assign({}, (requestInit === undefined ? {} : { requestInit })));
-    }
-    return new StreamableHTTPClientTransport(url, Object.assign({}, (requestInit === undefined ? {} : { requestInit })));
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const transport = connection.transport;
+        if ("agent" in transport) {
+            // Peers are resolved to concrete URLs by the serve host before any call
+            // (SessionEngine.setResolvedConnections); reaching here means the
+            // connection is being used outside a running server.
+            throw new Error(`MCP connection "${connection.name}" targets peer agent "${transport.agent}" and has not been resolved; peer MCP connections are only callable on a running serve host.`);
+        }
+        if ("cursorAccount" in transport) {
+            // Same contract as peers: the serve host resolves the account bridge URL
+            // before any call (SessionEngine.setResolvedConnections).
+            throw new Error(`MCP connection "${connection.name}" exposes the Cursor account's connectors and has not been resolved; Cursor account MCP connections are only callable on a running serve host.`);
+        }
+        if ("command" in transport) {
+            return new StdioClientTransport(Object.assign(Object.assign(Object.assign({ command: transport.command }, (transport.args === undefined ? {} : { args: transport.args })), { env: Object.assign(Object.assign({}, Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined))), ((_a = transport.env) !== null && _a !== void 0 ? _a : {})) }), (transport.cwd === undefined ? {} : { cwd: transport.cwd })));
+        }
+        const url = new URL(transport.url);
+        const requestInit = transport.headers === undefined
+            ? undefined
+            : { headers: transport.headers };
+        const authProvider = transport.oauth === true
+            ? yield createHostMcpOAuthProvider({
+                identifier: connection.name,
+                resourceUrl: transport.url,
+            })
+            : undefined;
+        if (transport.type === "sse") {
+            return new SSEClientTransport(url, { requestInit, authProvider });
+        }
+        return new StreamableHTTPClientTransport(url, { requestInit, authProvider });
+    });
+}
+function isOauthHttpTransport(transport) {
+    return "url" in transport && transport.oauth === true;
 }
 function normalizeCallResult(result) {
     if (typeof result !== "object" || result === null) {

package/dist/internal/mcp-oauth.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Host-side MCP OAuth for `defineConnection({ url, oauth: true })`.
+ * Local: mcp-auth.json. Prod secrets: `mcp oauth <name> --store`.
+ */
+import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+export declare const MCP_OAUTH_CALLBACK_PORT = 8787;
+export declare const MCP_OAUTH_CALLBACK_PATH = "/callback";
+export declare const MCP_OAUTH_CALLBACK_URL: string;
+/** `anytool` → `MCP_OAUTH_ANYTOOL`. */
+export declare function mcpOauthEnvPrefix(connection: string): string;
+export type McpOauthSecretNames = {
+    accessToken: string;
+    refreshToken: string;
+    clientId: string;
+};
+export declare function mcpOauthSecretNames(connection: string): McpOauthSecretNames;
+export declare function tokensFromEnv(connection: string, env?: NodeJS.ProcessEnv): OAuthTokens | undefined;
+export declare function clientIdFromEnv(connection: string, env?: NodeJS.ProcessEnv): OAuthClientInformationFull | undefined;
+/** Sibling of `credentials.json` under `~/.config/agent-serve/`. */
+export declare function defaultMcpAuthPath(): string;
+/** Canonical MCP resource key for binding stored tokens to a server URL. */
+export declare function normalizeMcpResourceUrl(url: string): string;
+export declare class FileMcpOAuthStore {
+    readonly path: string;
+    private cache;
+    private loading;
+    constructor(path?: string);
+    loadTokens(id: string, resourceUrl: string): Promise<OAuthTokens | undefined>;
+    loadClientInformation(id: string, resourceUrl: string): Promise<OAuthClientInformationFull | undefined>;
+    saveTokens(id: string, resourceUrl: string, tokens: OAuthTokens): Promise<void>;
+    saveClientInformation(id: string, resourceUrl: string, clientInfo: OAuthClientInformationFull): Promise<void>;
+    deleteCredentials(id: string): Promise<void>;
+    private entryFor;
+    private update;
+    private read;
+    private readDisk;
+    private write;
+    private withLock;
+}
+type ProviderArgs = {
+    identifier: string;
+    resourceUrl: string;
+    store: FileMcpOAuthStore;
+    redirectUrl?: string;
+    onRedirect?: (url: URL) => void;
+    tokens?: OAuthTokens;
+    clientInformation?: OAuthClientInformationFull;
+};
+export declare class HostMcpOAuthProvider implements OAuthClientProvider {
+    private tokensValue;
+    private clientInfo;
+    private verifier;
+    private redirect;
+    private readonly meta;
+    private readonly args;
+    constructor(args: ProviderArgs);
+    get redirectUrl(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    get lastRedirectUrl(): URL | undefined;
+    state(): string;
+    clientInformation(): OAuthClientInformationFull | undefined;
+    saveClientInformation(info: OAuthClientInformationFull): Promise<void>;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): Promise<void>;
+    redirectToAuthorization(url: URL): void;
+    saveCodeVerifier(codeVerifier: string): Promise<void>;
+    codeVerifier(): string;
+    invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier"): Promise<void>;
+}
+export declare function createHostMcpOAuthProvider(args: {
+    identifier: string;
+    resourceUrl: string;
+    store?: FileMcpOAuthStore;
+    onRedirect?: (url: URL) => void;
+}): Promise<HostMcpOAuthProvider>;
+export type OAuthCallbackResult = {
+    code: string;
+    state?: string;
+};
+export declare function waitForMcpOAuthCallback(args?: {
+    port?: number;
+    path?: string;
+    timeoutMs?: number;
+}): Promise<OAuthCallbackResult>;
+export declare function openBrowser(url: string): void;
+export {};
+//# sourceMappingURL=mcp-oauth.d.ts.map

package/dist/internal/mcp-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AAEF,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IAEpC,YAAY,IAAI,EAAE,YAAY,EAW7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAchC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgF/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}