@fitchmultz/pi-mcp-adapter 8.0.5 → 8.0.7

package/dist/mcp-oauth-provider.js

@@ -8,23 +8,29 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { UnauthorizedError, OAuthError, OAuthErrorCode, createPrivateKeyJwtAuth, discoverAndRequestJwtAuthGrant, validateClientMetadataUrl, } from "@modelcontextprotocol/client";
 import { getAuthForUrl, updateTokens, updateClientInfo, clearAllCredentials, clearClientInfo, clearCodeVerifier, clearTokens, } from "./mcp-auth.js";
 import { resolveCommandSecret } from "./utils.js";
-import { isNonInteractiveOAuth } from "./types.js";
+import { isNonInteractiveOAuth, } from "./types.js";
 import { combineAbortSignals } from "./runtime-owner.js";
 import { getOAuthCallbackPath, getOAuthCallbackPort } from "./mcp-oauth-callback-config.js";
 import sharedClientMetadata from "./docs/client-metadata.json" with { type: "json" };
 /** Validate explicit document URLs without echoing possible credentials in errors. */
 export function validateOAuthClientMetadataUrl(value) {
-    if (value === undefined || value === false)
+    if (value === undefined || value === false) {
         return;
+    }
     try {
-        if (typeof value !== "string" || !value)
+        if (typeof value !== "string" || !value) {
             throw new Error();
+        }
         validateClientMetadataUrl(value);
         const url = new URL(value);
         const raw = value.match(/^[^:]+:[/\\]*([^/\\?#]*)([^?#]*)/);
-        if (url.username || url.password || raw?.[1]?.includes("@") || value.includes("#")
-            || /[/\\](?:\.|%2e){1,2}(?=[/\\]|$)/i.test(raw?.[2] ?? ""))
+        if (url.username ||
+            url.password ||
+            raw?.[1]?.includes("@") ||
+            value.includes("#") ||
+            /[/\\](?:\.|%2e){1,2}(?=[/\\]|$)/i.test(raw?.[2] ?? "")) {
             throw new Error();
+        }
     }
     catch {
         throw new Error("OAuth clientMetadataUrl must be an HTTPS URL with a non-root path and no userinfo, fragment or dot segments");
@@ -32,24 +38,26 @@ export function validateOAuthClientMetadataUrl(value) {
 }
 /** Only the port may differ; keep raw host, path and query spelling exact. */
 export function loopbackRedirectsMatch(first, second) {
-    if (typeof second !== "string")
+    if (typeof second !== "string") {
         return false;
+    }
     const port = /^([^:/?#]+:\/\/[^/\\?#@]+):\d+(?=[/\\?#]|$)/;
-    if (!port.test(first) || !port.test(second) || first.includes("#") || second.includes("#"))
+    if (!port.test(first) || !port.test(second) || first.includes("#") || second.includes("#")) {
         return false;
+    }
     try {
-        return [new URL(first), new URL(second)].every(url => url.protocol === "http:"
-            && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) && Number(url.port) > 0)
-            && first.replace(port, "$1") === second.replace(port, "$1");
+        return ([new URL(first), new URL(second)].every((url) => url.protocol === "http:" &&
+            ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) &&
+            Number(url.port) > 0) && first.replace(port, "$1") === second.replace(port, "$1"));
     }
     catch {
         return false;
     }
 }
 export function issuersMatch(first, second) {
-    return first === second
-        || (first.endsWith("/") && first.slice(0, -1) === second)
-        || (second.endsWith("/") && second.slice(0, -1) === first);
+    return (first === second ||
+        (first.endsWith("/") && first.slice(0, -1) === second) ||
+        (second.endsWith("/") && second.slice(0, -1) === first));
 }
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -57,47 +65,61 @@ function isRecord(value) {
 /** Validate shapes and method conflicts without resolving or disclosing key sources. */
 export function validateOAuthPrivateKeyJwt(config) {
     const jwt = config.privateKeyJwt;
-    if (jwt === undefined)
+    if (jwt === undefined) {
         return;
-    if (!isRecord(jwt))
+    }
+    if (!isRecord(jwt)) {
         throw new Error("OAuth privateKeyJwt must be an object");
+    }
     if (!(typeof jwt.privateKey === "string" ? jwt.privateKey.trim() : isRecord(jwt.privateKey))) {
         throw new Error("OAuth privateKeyJwt.privateKey must be a nonempty string or JWK object");
     }
-    if (typeof jwt.algorithm !== "string" || !jwt.algorithm.trim() || /^(?:HS|none$)/i.test(jwt.algorithm)) {
+    if (typeof jwt.algorithm !== "string" ||
+        !jwt.algorithm.trim() ||
+        /^(?:HS|none$)/i.test(jwt.algorithm)) {
         throw new Error("OAuth privateKeyJwt.algorithm must be an asymmetric JOSE algorithm");
     }
     if (jwt.audience !== undefined && (typeof jwt.audience !== "string" || !jwt.audience.trim())) {
         throw new Error("OAuth privateKeyJwt.audience must be a nonempty string");
     }
-    if (jwt.lifetimeSeconds !== undefined && (!Number.isSafeInteger(jwt.lifetimeSeconds) || jwt.lifetimeSeconds <= 0)) {
+    if (jwt.lifetimeSeconds !== undefined &&
+        (!Number.isSafeInteger(jwt.lifetimeSeconds) || jwt.lifetimeSeconds <= 0)) {
         throw new Error("OAuth privateKeyJwt.lifetimeSeconds must be a positive integer");
     }
-    if (jwt.claims !== undefined && !isRecord(jwt.claims))
+    if (jwt.claims !== undefined && !isRecord(jwt.claims)) {
         throw new Error("OAuth privateKeyJwt.claims must be an object");
-    if (config.clientSecret !== undefined)
+    }
+    if (config.clientSecret !== undefined) {
         throw new Error("OAuth privateKeyJwt cannot be combined with clientSecret");
-    if (!config.clientId && (typeof config.clientMetadataUrl !== "string" || config.clientMetadataUrl === sharedClientMetadata.client_id)) {
+    }
+    if (!config.clientId &&
+        (typeof config.clientMetadataUrl !== "string" ||
+            config.clientMetadataUrl === sharedClientMetadata.client_id)) {
         throw new Error("OAuth privateKeyJwt requires a configured clientId or custom clientMetadataUrl, not the shared browser identity");
     }
 }
 export function validateOAuthCrossAppAccess(config) {
     const crossApp = config.crossAppAccess;
-    if (crossApp === undefined)
+    if (crossApp === undefined) {
         return;
-    if (!isRecord(crossApp))
+    }
+    if (!isRecord(crossApp)) {
         throw new Error("OAuth crossAppAccess must be an object");
+    }
     for (const field of ["idpUrl", "clientId", "idToken", "clientSecret"]) {
-        if (field === "clientSecret" && crossApp[field] === undefined)
+        if (field === "clientSecret" && crossApp[field] === undefined) {
             continue;
+        }
         if (typeof crossApp[field] !== "string" || !crossApp[field].trim()) {
             throw new Error(`OAuth crossAppAccess.${field} must be a nonempty string`);
         }
     }
-    if (config.grantType !== undefined)
+    if (config.grantType !== undefined) {
         throw new Error("OAuth crossAppAccess selects the JWT-bearer grant; omit grantType");
-    if ("audience" in crossApp || "resource" in crossApp)
+    }
+    if ("audience" in crossApp || "resource" in crossApp) {
         throw new Error("OAuth crossAppAccess uses the discovered MCP issuer and resource; overrides are not supported");
+    }
 }
 const reservedAuthorizationParams = new Set([
     "client_id",
@@ -110,8 +132,9 @@ const reservedAuthorizationParams = new Set([
     "state",
 ]);
 function addAuthorizationParams(authorizationUrl, params) {
-    if (!params)
+    if (!params) {
         return authorizationUrl;
+    }
     const nextUrl = new URL(authorizationUrl.toString());
     for (const [key, value] of Object.entries(params)) {
         if (reservedAuthorizationParams.has(key) || nextUrl.searchParams.has(key)) {
@@ -156,15 +179,18 @@ export class McpOAuthProvider {
         this.flowState = initialState;
         this.redirectUrlSnapshot = isNonInteractiveOAuth(config)
             ? undefined
-            : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+            : (config.redirectUri ??
+                `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`);
         if (config.clientMetadataUrl !== false && config.clientSecret === undefined) {
             if (config.clientMetadataUrl && config.clientMetadataUrl !== sharedClientMetadata.client_id) {
                 this.clientMetadataUrl = config.clientMetadataUrl;
             }
-            else if (!this.isNonInteractive && !config.privateKeyJwt
-                && (config.clientName === undefined || config.clientName === sharedClientMetadata.client_name)
-                && (config.clientUri === undefined || config.clientUri === sharedClientMetadata.client_uri)
-                && sharedClientMetadata.redirect_uris.some(uri => loopbackRedirectsMatch(uri, this.redirectUrl))) {
+            else if (!this.isNonInteractive &&
+                !config.privateKeyJwt &&
+                (config.clientName === undefined ||
+                    config.clientName === sharedClientMetadata.client_name) &&
+                (config.clientUri === undefined || config.clientUri === sharedClientMetadata.client_uri) &&
+                sharedClientMetadata.redirect_uris.some((uri) => loopbackRedirectsMatch(uri, this.redirectUrl))) {
                 this.clientMetadataUrl = sharedClientMetadata.client_id;
             }
         }
@@ -173,8 +199,8 @@ export class McpOAuthProvider {
         return isNonInteractiveOAuth(this.config);
     }
     get discoveredIssuer() {
-        return this.flowDiscoveryState?.authorizationServerMetadata?.issuer
-            ?? this.flowDiscoveryState?.authorizationServerUrl;
+        return (this.flowDiscoveryState?.authorizationServerMetadata?.issuer ??
+            this.flowDiscoveryState?.authorizationServerUrl);
     }
     get signal() {
         return combineAbortSignals(this.lifetimeSignal, this.requestSignals.getStore());
@@ -191,11 +217,11 @@ export class McpOAuthProvider {
         if (this.flowIssuerMismatch) {
             throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
         }
-        if (!entry || !issuer)
+        if (!entry || !issuer) {
             return;
-        const storedIssuers = [entry.clientInfo?.issuer, entry.tokens?.issuer]
-            .filter((storedIssuer) => storedIssuer !== undefined);
-        if (storedIssuers.some(storedIssuer => !issuersMatch(storedIssuer, issuer))) {
+        }
+        const storedIssuers = [entry.clientInfo?.issuer, entry.tokens?.issuer].filter((storedIssuer) => storedIssuer !== undefined);
+        if (storedIssuers.some((storedIssuer) => !issuersMatch(storedIssuer, issuer))) {
             this.flowIssuerMismatch = true;
             throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
         }
@@ -220,8 +246,16 @@ export class McpOAuthProvider {
                 client_name: this.config.clientName ?? "Pi Coding Agent",
                 client_uri: this.config.clientUri ?? "https://github.com/fitchmultz/pi-mcp-adapter",
                 redirect_uris: [],
-                grant_types: [this.config.crossAppAccess ? "urn:ietf:params:oauth:grant-type:jwt-bearer" : "client_credentials"],
-                token_endpoint_auth_method: this.config.privateKeyJwt ? "private_key_jwt" : this.config.clientSecret ? "client_secret_post" : "none",
+                grant_types: [
+                    this.config.crossAppAccess
+                        ? "urn:ietf:params:oauth:grant-type:jwt-bearer"
+                        : "client_credentials",
+                ],
+                token_endpoint_auth_method: this.config.privateKeyJwt
+                    ? "private_key_jwt"
+                    : this.config.clientSecret
+                        ? "client_secret_post"
+                        : "none",
             };
         }
         const redirectUrl = this.redirectUrl;
@@ -234,7 +268,11 @@ export class McpOAuthProvider {
             client_uri: this.config.clientUri ?? "https://github.com/fitchmultz/pi-mcp-adapter",
             grant_types: ["authorization_code", "refresh_token"],
             response_types: ["code"],
-            token_endpoint_auth_method: this.config.privateKeyJwt ? "private_key_jwt" : this.config.clientSecret ? "client_secret_post" : "none",
+            token_endpoint_auth_method: this.config.privateKeyJwt
+                ? "private_key_jwt"
+                : this.config.clientSecret
+                    ? "client_secret_post"
+                    : "none",
             ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),
         };
     }
@@ -247,15 +285,15 @@ export class McpOAuthProvider {
         const stored = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
         this.assertStoredIssuerBindings(stored, issuer);
         // Rejected discovery must not become the runtime's issuer binding.
-        if (this.flowDiscoveryState)
+        if (this.flowDiscoveryState) {
             this.callbacks.onDiscoveryState?.(this.flowDiscoveryState);
+        }
         // Check config first (pre-registered client). Store only its issuer binding.
         // The configured secret stays in config and never enters the credential store.
         if (this.config.clientId) {
-            const storedClient = stored?.clientInfo?.clientId === this.config.clientId
-                ? stored.clientInfo
-                : undefined;
-            if (issuer && (storedClient?.issuer !== issuer || storedClient.configPreRegistered !== true)) {
+            const storedClient = stored?.clientInfo?.clientId === this.config.clientId ? stored.clientInfo : undefined;
+            if (issuer &&
+                (storedClient?.issuer !== issuer || storedClient.configPreRegistered !== true)) {
                 updateClientInfo(this.serverName, { clientId: this.config.clientId, issuer, configPreRegistered: true }, this.serverUrl, this.storageOptions);
             }
             const clientSecret = this.config.clientSecret?.startsWith("!")
@@ -279,19 +317,22 @@ export class McpOAuthProvider {
             // would let a token refresh go out with a client_id but no secret,
             // causing invalid_client and credential invalidation. Return undefined
             // so callers treat this as "no client info".
-            const isConfigStub = clientInfo.configPreRegistered === true
-                || (clientInfo.clientSecret === undefined
-                    && clientInfo.clientIdIssuedAt === undefined
-                    && clientInfo.clientSecretExpiresAt === undefined
-                    && clientInfo.redirectUris === undefined);
+            const isConfigStub = clientInfo.configPreRegistered === true ||
+                (clientInfo.clientSecret === undefined &&
+                    clientInfo.clientIdIssuedAt === undefined &&
+                    clientInfo.clientSecretExpiresAt === undefined &&
+                    clientInfo.redirectUris === undefined);
             if (isConfigStub) {
                 return undefined;
             }
-            if ((this.config.privateKeyJwt || this.isNonInteractive) && clientInfo.registrationType === "cimd" && clientInfo.clientId === sharedClientMetadata.client_id) {
+            if ((this.config.privateKeyJwt || this.isNonInteractive) &&
+                clientInfo.registrationType === "cimd" &&
+                clientInfo.clientId === sharedClientMetadata.client_id) {
                 throw new OAuthError(OAuthErrorCode.InvalidRequest, `OAuth ${this.config.privateKeyJwt ? "privateKeyJwt" : this.config.crossAppAccess ? "crossAppAccess" : "client_credentials"} cannot use the saved shared browser registration; configure its own clientId or replace that login`);
             }
             // Check if client secret has expired
-            if (clientInfo.clientSecretExpiresAt && clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
+            if (clientInfo.clientSecretExpiresAt &&
+                clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
                 return undefined;
             }
             if (issuer && clientInfo.issuer && !issuersMatch(clientInfo.issuer, issuer)) {
@@ -336,18 +377,25 @@ export class McpOAuthProvider {
             }, this.serverUrl, this.storageOptions);
             return;
         }
-        const redirectUris = ("redirect_uris" in info ? info.redirect_uris : undefined)
-            ?? (this.redirectUrl ? [this.redirectUrl] : []);
+        const redirectUris = ("redirect_uris" in info ? info.redirect_uris : undefined) ??
+            (this.redirectUrl ? [this.redirectUrl] : []);
         const clientInfo = {
             clientId: info.client_id,
             ...(info.client_secret !== undefined ? { clientSecret: info.client_secret } : {}),
-            ...(info.client_id_issued_at !== undefined ? { clientIdIssuedAt: info.client_id_issued_at } : {}),
-            ...(info.client_secret_expires_at !== undefined ? { clientSecretExpiresAt: info.client_secret_expires_at } : {}),
+            ...(info.client_id_issued_at !== undefined
+                ? { clientIdIssuedAt: info.client_id_issued_at }
+                : {}),
+            ...(info.client_secret_expires_at !== undefined
+                ? { clientSecretExpiresAt: info.client_secret_expires_at }
+                : {}),
             redirectUris,
             // Native CIMD saves only client_id + issuer; DCR's full schema requires redirect_uris.
-            ...(info.client_id === this.clientMetadataUrl && !("redirect_uris" in info)
-                && this.flowDiscoveryState?.authorizationServerMetadata?.client_id_metadata_document_supported === true
-                ? { registrationType: "cimd" } : {}),
+            ...(info.client_id === this.clientMetadataUrl &&
+                !("redirect_uris" in info) &&
+                this.flowDiscoveryState?.authorizationServerMetadata
+                    ?.client_id_metadata_document_supported === true
+                ? { registrationType: "cimd" }
+                : {}),
             ...(issuer !== undefined ? { issuer } : {}),
         };
         this.flowClientInfo = clientInfo;
@@ -360,8 +408,9 @@ export class McpOAuthProvider {
     async tokens(context) {
         // Use getAuthForUrl to validate tokens are for the current server URL.
         const entry = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
-        if (!entry?.tokens)
+        if (!entry?.tokens) {
             return undefined;
+        }
         const issuer = context?.issuer ?? this.discoveredIssuer;
         this.assertStoredIssuerBindings(entry, issuer);
         if (issuer && entry.tokens.issuer === undefined) {
@@ -390,7 +439,9 @@ export class McpOAuthProvider {
             // Preserve expiry even when expires_in is 0 (e.g. the SDK re-saving an
             // already-expired token) so expired tokens stay expired instead of
             // being persisted as never-expiring.
-            ...(tokens.expires_in !== undefined ? { expiresAt: Date.now() / 1000 + tokens.expires_in } : {}),
+            ...(tokens.expires_in !== undefined
+                ? { expiresAt: Date.now() / 1000 + tokens.expires_in }
+                : {}),
             ...(tokens.scope !== undefined ? { scope: tokens.scope } : {}),
             ...(issuer !== undefined ? { issuer } : {}),
         };
@@ -465,7 +516,8 @@ export class McpOAuthProvider {
         this.flowResourceUrl = resource;
     }
     fetch = (input, init) => fetch(input, {
-        ...init, signal: combineAbortSignals(init?.signal ?? undefined, this.signal),
+        ...init,
+        signal: combineAbortSignals(init?.signal ?? undefined, this.signal),
     });
     async discoveryState() {
         this.throwIfInactive();
@@ -531,7 +583,9 @@ export class McpOAuthProvider {
      */
     addClientAuthentication = async (headers, params, url, metadata) => {
         this.throwIfInactive();
-        if (params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope) {
+        if (params.get("grant_type") === "authorization_code" &&
+            !params.has("scope") &&
+            this.config.scope) {
             params.set("scope", this.config.scope);
         }
         const clientInfo = await this.clientInformation(this.config.privateKeyJwt && metadata?.issuer ? { issuer: metadata.issuer } : undefined);
@@ -555,11 +609,16 @@ export class McpOAuthProvider {
                 }
             }
             try {
-                if (typeof privateKey === "string" && privateKey.trimStart().startsWith("{"))
+                if (typeof privateKey === "string" && privateKey.trimStart().startsWith("{")) {
                     privateKey = JSON.parse(privateKey);
+                }
                 const { algorithm, ...options } = jwt;
                 await createPrivateKeyJwtAuth({
-                    ...options, privateKey, alg: algorithm, issuer: clientInfo.client_id, subject: clientInfo.client_id,
+                    ...options,
+                    privateKey,
+                    alg: algorithm,
+                    issuer: clientInfo.client_id,
+                    subject: clientInfo.client_id,
                 })(headers, params, url, metadata);
             }
             catch {
@@ -598,7 +657,9 @@ export class McpOAuthProvider {
         if (!params.has("client_id")) {
             params.set("client_id", clientInfo.client_id);
         }
-        if (authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret")) {
+        if (authMethod === "client_secret_post" &&
+            clientInfo.client_secret &&
+            !params.has("client_secret")) {
             params.set("client_secret", clientInfo.client_secret);
         }
     };
@@ -606,21 +667,33 @@ export class McpOAuthProvider {
         this.throwIfInactive();
         const audience = this.flowAuthorizationServerUrl;
         const resource = this.flowResourceUrl;
-        if (!audience || !resource)
+        if (!audience || !resource) {
             throw new OAuthError(OAuthErrorCode.InvalidRequest, "OAuth crossAppAccess requires discovered MCP authorization server and protected resource metadata");
+        }
         const config = this.config.crossAppAccess;
         try {
             const result = await discoverAndRequestJwtAuthGrant({
                 idpUrl: resolveCommandSecret(config.idpUrl, "OAuth crossAppAccess.idpUrl"),
                 clientId: resolveCommandSecret(config.clientId, "OAuth crossAppAccess.clientId"),
                 idToken: resolveCommandSecret(config.idToken, "OAuth crossAppAccess.idToken"),
-                ...(config.clientSecret !== undefined ? { clientSecret: resolveCommandSecret(config.clientSecret, "OAuth crossAppAccess.clientSecret") } : {}),
-                audience, resource, ...(scope ? { scope } : {}), fetchFn: this.fetch,
+                ...(config.clientSecret !== undefined
+                    ? {
+                        clientSecret: resolveCommandSecret(config.clientSecret, "OAuth crossAppAccess.clientSecret"),
+                    }
+                    : {}),
+                audience,
+                resource,
+                ...(scope ? { scope } : {}),
+                fetchFn: this.fetch,
             });
             this.throwIfInactive();
-            const params = new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: result.jwtAuthGrant });
-            if (scope)
+            const params = new URLSearchParams({
+                grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+                assertion: result.jwtAuthGrant,
+            });
+            if (scope) {
                 params.set("scope", scope);
+            }
             return params;
         }
         catch {
@@ -630,8 +703,9 @@ export class McpOAuthProvider {
         }
     }
     prepareTokenRequest(scope) {
-        if (this.config.crossAppAccess)
+        if (this.config.crossAppAccess) {
             return this.prepareCrossAppRequest(scope ?? this.config.scope);
+        }
         if (!this.isNonInteractive) {
             return undefined;
         }

package/dist/mcp-oauth-runtime.js

@@ -4,13 +4,15 @@
  * only by operations that need it; all callers share the state owned here.
  */
 import { cancelPendingCallback, stopCallbackServer } from "./mcp-callback-server.js";
-import { getAuthBaseDir, getOAuthState, clearOAuthState } from "./mcp-auth.js";
+import { getAuthBaseDir, getOAuthState, clearOAuthState, } from "./mcp-auth.js";
 import { combineAbortSignals } from "./runtime-owner.js";
 const runtimeStates = new WeakMap();
 const activeRuntimes = new Set();
 export function createOAuthRuntime(signal) {
     const controller = new AbortController();
-    const runtime = { signal: combineAbortSignals(signal, controller.signal) };
+    const runtime = {
+        signal: combineAbortSignals(signal, controller.signal),
+    };
     runtimeStates.set(runtime, {
         controller,
         generation: 0,
@@ -31,15 +33,17 @@ export function getRuntime(options) {
         activeRuntimes.add(options.runtime);
         return options.runtime;
     }
-    if (legacyRuntime.signal.aborted)
+    if (legacyRuntime.signal.aborted) {
         legacyRuntime = createOAuthRuntime();
+    }
     activeRuntimes.add(legacyRuntime);
     return legacyRuntime;
 }
 export function getRuntimeState(runtime) {
     const state = runtimeStates.get(runtime);
-    if (!state)
+    if (!state) {
         throw new Error("Unknown OAuth runtime");
+    }
     return state;
 }
 export function getPendingAuthKey(serverName, options) {
@@ -50,7 +54,7 @@ export function hasPendingAuth(serverName, options, runtime) {
     if (options) {
         return state.pendingAuths.has(getPendingAuthKey(serverName, options));
     }
-    return Array.from(state.pendingAuths.values()).some(pendingAuth => pendingAuth.serverName === serverName);
+    return Array.from(state.pendingAuths.values()).some((pendingAuth) => pendingAuth.serverName === serverName);
 }
 export async function clearPendingAuth(runtime, serverName, oauthState, fallbackStorageOptions = {}) {
     const state = getRuntimeState(runtime);
@@ -58,8 +62,9 @@ export async function clearPendingAuth(runtime, serverName, oauthState, fallback
     const pendingAuth = state.pendingAuths.get(key);
     const authStorageOptions = pendingAuth?.authStorageOptions ?? fallbackStorageOptions;
     const pendingState = state.pendingAuthStates.get(key);
-    if (oauthState && pendingState && pendingState !== oauthState)
+    if (oauthState && pendingState && pendingState !== oauthState) {
         return;
+    }
     const timer = state.pendingAuthCleanupTimers.get(key);
     if (timer) {
         clearTimeout(timer);
@@ -86,18 +91,23 @@ export async function clearPendingAuth(runtime, serverName, oauthState, fallback
  */
 export function supportsOAuth(definition) {
     // OAuth requires a URL
-    if (!definition.url)
+    if (!definition.url) {
         return false;
+    }
     // Explicitly disabled via auth: false or oauth: false
-    if (definition.auth === false)
+    if (definition.auth === false) {
         return false;
-    if (definition.oauth === false)
+    }
+    if (definition.oauth === false) {
         return false;
-    if (definition.auth === "oauth")
+    }
+    if (definition.auth === "oauth") {
         return true;
+    }
     // Configured custom headers take precedence over implicit OAuth auto-detection.
-    if (definition.headers && Object.keys(definition.headers).length > 0)
+    if (definition.headers && Object.keys(definition.headers).length > 0) {
         return false;
+    }
     // OAuth is enabled when auth is not specified (auto-detect)
     return definition.auth === undefined;
 }
@@ -121,14 +131,16 @@ export async function initializeOAuth(runtimeOrSignal) {
  */
 export async function shutdownOAuth(runtime = legacyRuntime) {
     const state = getRuntimeState(runtime);
-    if (state.controller.signal.aborted)
+    if (state.controller.signal.aborted) {
         return;
+    }
     state.generation += 1;
     state.controller.abort(new Error("OAuth runtime stopped"));
-    for (const callbackState of Array.from(state.pendingAuthStates.values()))
+    for (const callbackState of Array.from(state.pendingAuthStates.values())) {
         cancelPendingCallback(callbackState);
-    const results = await Promise.allSettled(Array.from(state.pendingAuths.values(), pendingAuth => clearPendingAuth(runtime, pendingAuth.serverName, undefined, pendingAuth.authStorageOptions)));
-    const failures = results.flatMap(result => result.status === "rejected" ? [result.reason] : []);
+    }
+    const results = await Promise.allSettled(Array.from(state.pendingAuths.values(), (pendingAuth) => clearPendingAuth(runtime, pendingAuth.serverName, undefined, pendingAuth.authStorageOptions)));
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
     state.pendingAuthentications.clear();
     state.requests.clear();
     activeRuntimes.delete(runtime);
@@ -140,6 +152,7 @@ export async function shutdownOAuth(runtime = legacyRuntime) {
             failures.push(error);
         }
     }
-    if (failures.length)
+    if (failures.length) {
         throw new AggregateError(failures, "MCP OAuth cleanup failed");
+    }
 }