@didim365/agent-cli-core 0.1.0

package/dist/src/mcp/oauth-token-storage.test.js

@@ -0,0 +1,305 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { coreEvents } from '../utils/events.js';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { MCPOAuthTokenStorage } from './oauth-token-storage.js';
+import { FORCE_ENCRYPTED_FILE_ENV_VAR } from './token-storage/index.js';
+import { GEMINI_DIR } from '../utils/paths.js';
+// Mock dependencies
+vi.mock('node:fs', () => ({
+    promises: {
+        readFile: vi.fn(),
+        writeFile: vi.fn(),
+        mkdir: vi.fn(),
+        unlink: vi.fn(),
+    },
+}));
+vi.mock('node:path', () => ({
+    dirname: vi.fn(),
+    join: vi.fn(),
+}));
+vi.mock('../config/storage.js', () => ({
+    Storage: {
+        getMcpOAuthTokensPath: vi.fn(),
+    },
+}));
+vi.mock('../utils/events.js', () => ({
+    coreEvents: {
+        emitFeedback: vi.fn(),
+    },
+}));
+const mockHybridTokenStorage = {
+    listServers: vi.fn(),
+    setCredentials: vi.fn(),
+    getCredentials: vi.fn(),
+    deleteCredentials: vi.fn(),
+    clearAll: vi.fn(),
+    getAllCredentials: vi.fn(),
+};
+vi.mock('./token-storage/hybrid-token-storage.js', () => ({
+    HybridTokenStorage: vi.fn(() => mockHybridTokenStorage),
+}));
+const ONE_HR_MS = 3600000;
+describe('MCPOAuthTokenStorage', () => {
+    let tokenStorage;
+    const mockToken = {
+        accessToken: 'access_token_123',
+        refreshToken: 'refresh_token_456',
+        tokenType: 'Bearer',
+        scope: 'read write',
+        expiresAt: Date.now() + ONE_HR_MS,
+    };
+    const mockCredentials = {
+        serverName: 'test-server',
+        token: mockToken,
+        clientId: 'test-client-id',
+        tokenUrl: 'https://auth.example.com/token',
+        updatedAt: Date.now(),
+    };
+    describe('with encrypted flag false', () => {
+        beforeEach(() => {
+            vi.stubEnv(FORCE_ENCRYPTED_FILE_ENV_VAR, 'false');
+            tokenStorage = new MCPOAuthTokenStorage();
+            vi.clearAllMocks();
+        });
+        afterEach(() => {
+            vi.unstubAllEnvs();
+            vi.restoreAllMocks();
+        });
+        describe('getAllCredentials', () => {
+            it('should return empty map when token file does not exist', async () => {
+                vi.mocked(fs.readFile).mockRejectedValue({ code: 'ENOENT' });
+                const tokens = await tokenStorage.getAllCredentials();
+                expect(tokens.size).toBe(0);
+                expect(coreEvents.emitFeedback).not.toHaveBeenCalled();
+            });
+            it('should load tokens from file successfully', async () => {
+                const tokensArray = [mockCredentials];
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify(tokensArray));
+                const tokens = await tokenStorage.getAllCredentials();
+                expect(tokens.size).toBe(1);
+                expect(tokens.get('test-server')).toEqual(mockCredentials);
+                expect(fs.readFile).toHaveBeenCalledWith(path.join('/mock/home', GEMINI_DIR, 'mcp-oauth-tokens.json'), 'utf-8');
+            });
+            it('should handle corrupted token file gracefully', async () => {
+                vi.mocked(fs.readFile).mockResolvedValue('invalid json');
+                const tokens = await tokenStorage.getAllCredentials();
+                expect(tokens.size).toBe(0);
+                expect(coreEvents.emitFeedback).toHaveBeenCalledWith('error', expect.stringContaining('Failed to load MCP OAuth tokens'), expect.any(Error));
+            });
+            it('should handle file read errors other than ENOENT', async () => {
+                const error = new Error('Permission denied');
+                vi.mocked(fs.readFile).mockRejectedValue(error);
+                const tokens = await tokenStorage.getAllCredentials();
+                expect(tokens.size).toBe(0);
+                expect(coreEvents.emitFeedback).toHaveBeenCalledWith('error', 'Failed to load MCP OAuth tokens: Permission denied', error);
+            });
+        });
+        describe('saveToken', () => {
+            it('should save token with restricted permissions', async () => {
+                vi.mocked(fs.readFile).mockRejectedValue({ code: 'ENOENT' });
+                vi.mocked(fs.mkdir).mockResolvedValue(undefined);
+                vi.mocked(fs.writeFile).mockResolvedValue(undefined);
+                await tokenStorage.saveToken('test-server', mockToken, 'client-id', 'https://token.url');
+                expect(fs.mkdir).toHaveBeenCalledWith(path.join('/mock/home', GEMINI_DIR), { recursive: true });
+                expect(fs.writeFile).toHaveBeenCalledWith(path.join('/mock/home', GEMINI_DIR, 'mcp-oauth-tokens.json'), expect.stringContaining('test-server'), { mode: 0o600 });
+            });
+            it('should update existing token for same server', async () => {
+                const existingCredentials = {
+                    ...mockCredentials,
+                    serverName: 'existing-server',
+                };
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify([existingCredentials]));
+                vi.mocked(fs.writeFile).mockResolvedValue(undefined);
+                const newToken = {
+                    ...mockToken,
+                    accessToken: 'new_access_token',
+                };
+                await tokenStorage.saveToken('existing-server', newToken);
+                const writeCall = vi.mocked(fs.writeFile).mock.calls[0];
+                const savedData = JSON.parse(writeCall[1]);
+                expect(savedData).toHaveLength(1);
+                expect(savedData[0].token.accessToken).toBe('new_access_token');
+                expect(savedData[0].serverName).toBe('existing-server');
+            });
+            it('should handle write errors gracefully', async () => {
+                vi.mocked(fs.readFile).mockRejectedValue({ code: 'ENOENT' });
+                vi.mocked(fs.mkdir).mockResolvedValue(undefined);
+                const writeError = new Error('Disk full');
+                vi.mocked(fs.writeFile).mockRejectedValue(writeError);
+                await expect(tokenStorage.saveToken('test-server', mockToken)).rejects.toThrow('Disk full');
+                expect(coreEvents.emitFeedback).toHaveBeenCalledWith('error', 'Failed to save MCP OAuth token: Disk full', writeError);
+            });
+        });
+        describe('getCredentials', () => {
+            it('should return token for existing server', async () => {
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify([mockCredentials]));
+                const result = await tokenStorage.getCredentials('test-server');
+                expect(result).toEqual(mockCredentials);
+            });
+            it('should return null for non-existent server', async () => {
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify([mockCredentials]));
+                const result = await tokenStorage.getCredentials('non-existent');
+                expect(result).toBeNull();
+            });
+            it('should return null when no tokens file exists', async () => {
+                vi.mocked(fs.readFile).mockRejectedValue({ code: 'ENOENT' });
+                const result = await tokenStorage.getCredentials('test-server');
+                expect(result).toBeNull();
+            });
+        });
+        describe('deleteCredentials', () => {
+            it('should remove token for specific server', async () => {
+                const credentials1 = {
+                    ...mockCredentials,
+                    serverName: 'server1',
+                };
+                const credentials2 = {
+                    ...mockCredentials,
+                    serverName: 'server2',
+                };
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify([credentials1, credentials2]));
+                vi.mocked(fs.writeFile).mockResolvedValue(undefined);
+                await tokenStorage.deleteCredentials('server1');
+                const writeCall = vi.mocked(fs.writeFile).mock.calls[0];
+                const savedData = JSON.parse(writeCall[1]);
+                expect(savedData).toHaveLength(1);
+                expect(savedData[0].serverName).toBe('server2');
+            });
+            it('should remove token file when no tokens remain', async () => {
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify([mockCredentials]));
+                vi.mocked(fs.unlink).mockResolvedValue(undefined);
+                await tokenStorage.deleteCredentials('test-server');
+                expect(fs.unlink).toHaveBeenCalledWith(path.join('/mock/home', GEMINI_DIR, 'mcp-oauth-tokens.json'));
+                expect(fs.writeFile).not.toHaveBeenCalled();
+            });
+            it('should handle removal of non-existent token gracefully', async () => {
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify([mockCredentials]));
+                await tokenStorage.deleteCredentials('non-existent');
+                expect(fs.writeFile).not.toHaveBeenCalled();
+                expect(fs.unlink).not.toHaveBeenCalled();
+            });
+            it('should handle file operation errors gracefully', async () => {
+                vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify([mockCredentials]));
+                const unlinkError = new Error('Permission denied');
+                vi.mocked(fs.unlink).mockRejectedValue(unlinkError);
+                await tokenStorage.deleteCredentials('test-server');
+                expect(coreEvents.emitFeedback).toHaveBeenCalledWith('error', 'Failed to remove MCP OAuth token: Permission denied', unlinkError);
+            });
+        });
+        describe('isTokenExpired', () => {
+            it('should return false for token without expiry', () => {
+                const tokenWithoutExpiry = { ...mockToken };
+                delete tokenWithoutExpiry.expiresAt;
+                const result = tokenStorage.isTokenExpired(tokenWithoutExpiry);
+                expect(result).toBe(false);
+            });
+            it('should return false for valid token', () => {
+                const futureToken = {
+                    ...mockToken,
+                    expiresAt: Date.now() + ONE_HR_MS,
+                };
+                const result = tokenStorage.isTokenExpired(futureToken);
+                expect(result).toBe(false);
+            });
+            it('should return true for expired token', () => {
+                const expiredToken = {
+                    ...mockToken,
+                    expiresAt: Date.now() - ONE_HR_MS,
+                };
+                const result = tokenStorage.isTokenExpired(expiredToken);
+                expect(result).toBe(true);
+            });
+            it('should return true for token expiring within buffer time', () => {
+                const soonToExpireToken = {
+                    ...mockToken,
+                    expiresAt: Date.now() + 60000, // 1 minute from now (within 5-minute buffer)
+                };
+                const result = tokenStorage.isTokenExpired(soonToExpireToken);
+                expect(result).toBe(true);
+            });
+        });
+        describe('clearAll', () => {
+            it('should remove token file successfully', async () => {
+                vi.mocked(fs.unlink).mockResolvedValue(undefined);
+                await tokenStorage.clearAll();
+                expect(fs.unlink).toHaveBeenCalledWith(path.join('/mock/home', GEMINI_DIR, 'mcp-oauth-tokens.json'));
+            });
+            it('should handle non-existent file gracefully', async () => {
+                vi.mocked(fs.unlink).mockRejectedValue({ code: 'ENOENT' });
+                await tokenStorage.clearAll();
+                expect(coreEvents.emitFeedback).not.toHaveBeenCalled();
+            });
+            it('should handle other file errors gracefully', async () => {
+                const unlinkError = new Error('Permission denied');
+                vi.mocked(fs.unlink).mockRejectedValue(unlinkError);
+                await tokenStorage.clearAll();
+                expect(coreEvents.emitFeedback).toHaveBeenCalledWith('error', 'Failed to clear MCP OAuth tokens: Permission denied', unlinkError);
+            });
+        });
+    });
+    describe('with encrypted flag true', () => {
+        beforeEach(() => {
+            vi.stubEnv(FORCE_ENCRYPTED_FILE_ENV_VAR, 'true');
+            tokenStorage = new MCPOAuthTokenStorage();
+            vi.clearAllMocks();
+        });
+        afterEach(() => {
+            vi.unstubAllEnvs();
+            vi.restoreAllMocks();
+        });
+        it('should use HybridTokenStorage to list all credentials', async () => {
+            mockHybridTokenStorage.getAllCredentials.mockResolvedValue(new Map());
+            const servers = await tokenStorage.getAllCredentials();
+            expect(mockHybridTokenStorage.getAllCredentials).toHaveBeenCalled();
+            expect(servers).toEqual(new Map());
+        });
+        it('should use HybridTokenStorage to list servers', async () => {
+            mockHybridTokenStorage.listServers.mockResolvedValue(['server1']);
+            const servers = await tokenStorage.listServers();
+            expect(mockHybridTokenStorage.listServers).toHaveBeenCalled();
+            expect(servers).toEqual(['server1']);
+        });
+        it('should use HybridTokenStorage to set credentials', async () => {
+            await tokenStorage.setCredentials(mockCredentials);
+            expect(mockHybridTokenStorage.setCredentials).toHaveBeenCalledWith(mockCredentials);
+        });
+        it('should use HybridTokenStorage to save a token', async () => {
+            const serverName = 'server1';
+            const now = Date.now();
+            vi.spyOn(Date, 'now').mockReturnValue(now);
+            await tokenStorage.saveToken(serverName, mockToken, 'clientId', 'tokenUrl', 'mcpUrl');
+            const expectedCredential = {
+                serverName,
+                token: mockToken,
+                clientId: 'clientId',
+                tokenUrl: 'tokenUrl',
+                mcpServerUrl: 'mcpUrl',
+                updatedAt: now,
+            };
+            expect(mockHybridTokenStorage.setCredentials).toHaveBeenCalledWith(expectedCredential);
+            expect(path.dirname).toHaveBeenCalled();
+            expect(fs.mkdir).toHaveBeenCalled();
+        });
+        it('should use HybridTokenStorage to get credentials', async () => {
+            mockHybridTokenStorage.getCredentials.mockResolvedValue(mockCredentials);
+            const result = await tokenStorage.getCredentials('server1');
+            expect(mockHybridTokenStorage.getCredentials).toHaveBeenCalledWith('server1');
+            expect(result).toBe(mockCredentials);
+        });
+        it('should use HybridTokenStorage to delete credentials', async () => {
+            await tokenStorage.deleteCredentials('server1');
+            expect(mockHybridTokenStorage.deleteCredentials).toHaveBeenCalledWith('server1');
+        });
+        it('should use HybridTokenStorage to clear all tokens', async () => {
+            await tokenStorage.clearAll();
+            expect(mockHybridTokenStorage.clearAll).toHaveBeenCalled();
+        });
+    });
+});
+//# sourceMappingURL=oauth-token-storage.test.js.map

package/dist/src/mcp/oauth-token-storage.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-storage.test.js","sourceRoot":"","sources":["../../../src/mcp/oauth-token-storage.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,oBAAoB;AACpB,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACxB,QAAQ,EAAE;QACR,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;QACjB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;QAClB,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;KAChB;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1B,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;IAChB,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;CACd,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,EAAE;QACP,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;KAC/B;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;KACtB;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,sBAAsB,GAAG;IAC7B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC1B,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;IACjB,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC3B,CAAC;AACF,EAAE,CAAC,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC;CACxD,CAAC,CAAC,CAAC;AAEJ,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,YAAkC,CAAC;IAEvC,MAAM,SAAS,GAAe;QAC5B,WAAW,EAAE,kBAAkB;QAC/B,YAAY,EAAE,mBAAmB;QACjC,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KAClC,CAAC;IAEF,MAAM,eAAe,GAAqB;QACxC,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,gCAAgC;QAC1C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,UAAU,CAAC,GAAG,EAAE;YACd,EAAE,CAAC,OAAO,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;YAClD,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;YAE1C,EAAE,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACb,EAAE,CAAC,aAAa,EAAE,CAAC;YACnB,EAAE,CAAC,eAAe,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YACjC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;gBACtE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;gBAEtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;gBACzD,MAAM,WAAW,GAAG,CAAC,eAAe,CAAC,CAAC;gBACtC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;gBAEtE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;gBAEtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC3D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACtC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,uBAAuB,CAAC,EAC5D,OAAO,CACR,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;gBAC7D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;gBAEzD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;gBAEtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAClD,OAAO,EACP,MAAM,CAAC,gBAAgB,CAAC,iCAAiC,CAAC,EAC1D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAClB,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;gBAChE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC7C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAEhD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;gBAEtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAClD,OAAO,EACP,oDAAoD,EACpD,KAAK,CACN,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;YACzB,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;gBAC7D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBACjD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAErD,MAAM,YAAY,CAAC,SAAS,CAC1B,aAAa,EACb,SAAS,EACT,WAAW,EACX,mBAAmB,CACpB,CAAC;gBAEF,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,oBAAoB,CACnC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EACnC,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;gBACF,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACvC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,uBAAuB,CAAC,EAC5D,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,EACtC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;gBAC5D,MAAM,mBAAmB,GAAqB;oBAC5C,GAAG,eAAe;oBAClB,UAAU,EAAE,iBAAiB;iBAC9B,CAAC;gBACF,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CACtC,IAAI,CAAC,SAAS,CAAC,CAAC,mBAAmB,CAAC,CAAC,CACtC,CAAC;gBACF,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAErD,MAAM,QAAQ,GAAe;oBAC3B,GAAG,SAAS;oBACZ,WAAW,EAAE,kBAAkB;iBAChC,CAAC;gBACF,MAAM,YAAY,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;gBAE1D,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC1B,SAAS,CAAC,CAAC,CAAW,CACD,CAAC;gBAExB,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAClC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAChE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;gBACrD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBACjD,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC1C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBAEtD,MAAM,MAAM,CACV,YAAY,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CACjD,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAE/B,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAClD,OAAO,EACP,2CAA2C,EAC3C,UAAU,CACX,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;gBACvD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CACtC,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAClC,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;gBAEhE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;gBAC1D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CACtC,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAClC,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;gBAEjE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;gBAC7D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE7D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;gBAEhE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YACjC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;gBACvD,MAAM,YAAY,GAAqB;oBACrC,GAAG,eAAe;oBAClB,UAAU,EAAE,SAAS;iBACtB,CAAC;gBACF,MAAM,YAAY,GAAqB;oBACrC,GAAG,eAAe;oBAClB,UAAU,EAAE,SAAS;iBACtB,CAAC;gBACF,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CACtC,IAAI,CAAC,SAAS,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAC7C,CAAC;gBACF,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAErD,MAAM,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAEhD,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAW,CAAC,CAAC;gBAErD,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAClC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;gBAC9D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CACtC,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAClC,CAAC;gBACF,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAElD,MAAM,YAAY,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBAEpD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAC7D,CAAC;gBACF,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;gBACtE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CACtC,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAClC,CAAC;gBAEF,MAAM,YAAY,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;gBAErD,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;gBAC9D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CACtC,IAAI,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAClC,CAAC;gBACF,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAEpD,MAAM,YAAY,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBAEpD,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAClD,OAAO,EACP,qDAAqD,EACrD,WAAW,CACZ,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,kBAAkB,GAAe,EAAE,GAAG,SAAS,EAAE,CAAC;gBACxD,OAAO,kBAAkB,CAAC,SAAS,CAAC;gBAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;gBAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;gBAC7C,MAAM,WAAW,GAAe;oBAC9B,GAAG,SAAS;oBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAClC,CAAC;gBAEF,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;gBAExD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;gBAC9C,MAAM,YAAY,GAAe;oBAC/B,GAAG,SAAS;oBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAClC,CAAC;gBAEF,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;gBAEzD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;gBAClE,MAAM,iBAAiB,GAAe;oBACpC,GAAG,SAAS;oBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,6CAA6C;iBAC7E,CAAC;gBAEF,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;gBAE9D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;YACxB,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;gBACrD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAElD,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAE9B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAC7D,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;gBAC1D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE3D,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAE9B,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;gBAC1D,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACnD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAEpD,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAE9B,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAClD,OAAO,EACP,qDAAqD,EACrD,WAAW,CACZ,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,UAAU,CAAC,GAAG,EAAE;YACd,EAAE,CAAC,OAAO,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;YACjD,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;YAE1C,EAAE,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACb,EAAE,CAAC,aAAa,EAAE,CAAC;YACnB,EAAE,CAAC,eAAe,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,sBAAsB,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;YACvD,MAAM,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACpE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,sBAAsB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC9D,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,YAAY,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACnD,MAAM,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAChE,eAAe,CAChB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,UAAU,GAAG,SAAS,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAE3C,MAAM,YAAY,CAAC,SAAS,CAC1B,UAAU,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,QAAQ,CACT,CAAC;YAEF,MAAM,kBAAkB,GAAqB;gBAC3C,UAAU;gBACV,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,GAAG;aACf,CAAC;YAEF,MAAM,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAChE,kBAAkB,CACnB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,sBAAsB,CAAC,cAAc,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAChE,SAAS,CACV,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CACnE,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/oauth-utils.d.ts

@@ -0,0 +1,142 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MCPOAuthConfig } from './oauth-provider.js';
+/**
+ * Error thrown when the discovered resource metadata does not match the expected resource.
+ */
+export declare class ResourceMismatchError extends Error {
+    constructor(message: string);
+}
+/**
+ * OAuth authorization server metadata as per RFC 8414.
+ */
+export interface OAuthAuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    token_endpoint_auth_methods_supported?: string[];
+    revocation_endpoint?: string;
+    revocation_endpoint_auth_methods_supported?: string[];
+    registration_endpoint?: string;
+    response_types_supported?: string[];
+    grant_types_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    scopes_supported?: string[];
+}
+/**
+ * OAuth protected resource metadata as per RFC 9728.
+ */
+export interface OAuthProtectedResourceMetadata {
+    resource: string;
+    authorization_servers?: string[];
+    bearer_methods_supported?: string[];
+    resource_documentation?: string;
+    resource_signing_alg_values_supported?: string[];
+    resource_encryption_alg_values_supported?: string[];
+    resource_encryption_enc_values_supported?: string[];
+}
+export declare const FIVE_MIN_BUFFER_MS: number;
+/**
+ * Utility class for common OAuth operations.
+ */
+export declare class OAuthUtils {
+    /**
+     * Construct well-known OAuth endpoint URLs per RFC 9728 §3.1.
+     *
+     * The well-known URI is constructed by inserting /.well-known/oauth-protected-resource
+     * between the host and any existing path component. This preserves the resource's
+     * path structure in the metadata URL.
+     *
+     * Examples:
+     * - https://example.com -> https://example.com/.well-known/oauth-protected-resource
+     * - https://example.com/api/resource -> https://example.com/.well-known/oauth-protected-resource/api/resource
+     *
+     * @param baseUrl The resource URL
+     * @param useRootDiscovery If true, ignores path and uses root-based discovery (for fallback compatibility)
+     */
+    static buildWellKnownUrls(baseUrl: string, useRootDiscovery?: boolean): {
+        protectedResource: string;
+        authorizationServer: string;
+    };
+    /**
+     * Fetch OAuth protected resource metadata.
+     *
+     * @param resourceMetadataUrl The protected resource metadata URL
+     * @returns The protected resource metadata or null if not available
+     */
+    static fetchProtectedResourceMetadata(resourceMetadataUrl: string): Promise<OAuthProtectedResourceMetadata | null>;
+    /**
+     * Fetch OAuth authorization server metadata.
+     *
+     * @param authServerMetadataUrl The authorization server metadata URL
+     * @returns The authorization server metadata or null if not available
+     */
+    static fetchAuthorizationServerMetadata(authServerMetadataUrl: string): Promise<OAuthAuthorizationServerMetadata | null>;
+    /**
+     * Convert authorization server metadata to OAuth configuration.
+     *
+     * @param metadata The authorization server metadata
+     * @returns The OAuth configuration
+     */
+    static metadataToOAuthConfig(metadata: OAuthAuthorizationServerMetadata): MCPOAuthConfig;
+    /**
+     * Discover Oauth Authorization server metadata given an Auth server URL, by
+     * trying the standard well-known endpoints.
+     *
+     * @param authServerUrl The authorization server URL
+     * @returns The authorization server metadata or null if not found
+     */
+    static discoverAuthorizationServerMetadata(authServerUrl: string): Promise<OAuthAuthorizationServerMetadata | null>;
+    /**
+     * Discover OAuth configuration using the standard well-known endpoints.
+     *
+     * @param serverUrl The base URL of the server
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static discoverOAuthConfig(serverUrl: string): Promise<MCPOAuthConfig | null>;
+    /**
+     * Parse WWW-Authenticate header to extract OAuth information.
+     *
+     * @param header The WWW-Authenticate header value
+     * @returns The resource metadata URI if found
+     */
+    static parseWWWAuthenticateHeader(header: string): string | null;
+    /**
+     * Discover OAuth configuration from WWW-Authenticate header.
+     *
+     * @param wwwAuthenticate The WWW-Authenticate header value
+     * @param mcpServerUrl Optional MCP server URL to validate against the resource metadata
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static discoverOAuthFromWWWAuthenticate(wwwAuthenticate: string, mcpServerUrl?: string): Promise<MCPOAuthConfig | null>;
+    /**
+     * Extract base URL from an MCP server URL.
+     *
+     * @param mcpServerUrl The MCP server URL
+     * @returns The base URL
+     */
+    static extractBaseUrl(mcpServerUrl: string): string;
+    /**
+     * Check if a URL is an SSE endpoint.
+     *
+     * @param url The URL to check
+     * @returns True if the URL appears to be an SSE endpoint
+     */
+    static isSSEEndpoint(url: string): boolean;
+    /**
+     * Build a resource parameter for OAuth requests.
+     *
+     * @param endpointUrl The endpoint URL
+     * @returns The resource parameter value
+     */
+    static buildResourceParameter(endpointUrl: string): string;
+    /**
+     * Parses a JWT string to extract its expiry time.
+     * @param idToken The JWT ID token.
+     * @returns The expiry time in **milliseconds**, or undefined if parsing fails.
+     */
+    static parseTokenExpiry(idToken: string): number | undefined;
+}