@fitchmultz/pi-mcp-adapter 8.0.5 → 8.0.7

package/dist/mcp-auth-flow.js

@@ -5,11 +5,11 @@
  */
 import { auth as runSdkAuth, extractWWWAuthenticateParams, UnauthorizedError, Client, StreamableHTTPClientTransport, validateAuthorizationResponseIssuer, InsufficientScopeError, SdkHttpError, computeScopeUnion, isStrictScopeSuperset, } from "@modelcontextprotocol/client";
 import open from "open";
-import { McpOAuthProvider, issuersMatch, loopbackRedirectsMatch, validateOAuthClientMetadataUrl, validateOAuthPrivateKeyJwt, validateOAuthCrossAppAccess } from "./mcp-oauth-provider.js";
+import { McpOAuthProvider, issuersMatch, loopbackRedirectsMatch, validateOAuthClientMetadataUrl, validateOAuthPrivateKeyJwt, validateOAuthCrossAppAccess, } from "./mcp-oauth-provider.js";
 import { ensureCallbackServer, waitForCallback, cancelPendingCallback, releaseCallbackServer, takeCallbackResult, } from "./mcp-callback-server.js";
 import { getAuthForUrl, clearAllCredentials, clearClientInfo, clearTokens, clearCodeVerifier, getOAuthState, clearOAuthState, getAuthBaseDir, } from "./mcp-auth.js";
-import { isServerDisabled, isNonInteractiveOAuth, validateServerProtocolConfig } from "./types.js";
-import { ADAPTER_VERSION, formatTerminalError, interpolateEnvRecord, interpolateEnvVars, normalizeRequestTimeoutMs } from "./utils.js";
+import { isServerDisabled, isNonInteractiveOAuth, validateServerProtocolConfig, } from "./types.js";
+import { ADAPTER_VERSION, formatTerminalError, interpolateEnvRecord, interpolateEnvVars, normalizeRequestTimeoutMs, } from "./utils.js";
 import { abortable, throwIfAborted } from "./abort.js";
 import { combineAbortSignals, isAbortError } from "./runtime-owner.js";
 import { clearPendingAuth, getPendingAuthKey, getRuntime, getRuntimeState, legacyRuntime, } from "./mcp-oauth-runtime.js";
@@ -18,7 +18,9 @@ function applyConfiguredScope(discovery, config) {
     return {
         ...discovery,
         ...(config.scope !== undefined ? { scope: config.scope } : {}),
-        ...(config.skipIssuerMetadataValidation !== undefined ? { skipIssuerMetadataValidation: config.skipIssuerMetadataValidation } : {}),
+        ...(config.skipIssuerMetadataValidation !== undefined
+            ? { skipIssuerMetadataValidation: config.skipIssuerMetadataValidation }
+            : {}),
     };
 }
 function validateCallbackIssuer(serverName, context, response) {
@@ -26,7 +28,11 @@ function validateCallbackIssuer(serverName, context, response) {
         throw new Error("Cannot verify the OAuth error callback issuer");
     }
     try {
-        validateAuthorizationResponseIssuer({ expectedIssuer: context.expectedIssuer ?? context.fallbackIssuer, issParameterSupported: context.issParameterSupported === true, iss: response.iss });
+        validateAuthorizationResponseIssuer({
+            expectedIssuer: context.expectedIssuer ?? context.fallbackIssuer,
+            issParameterSupported: context.issParameterSupported === true,
+            iss: response.iss,
+        });
     }
     catch {
         if (response.iss === undefined && context.issParameterSupported) {
@@ -37,32 +43,39 @@ function validateCallbackIssuer(serverName, context, response) {
     }
 }
 export function isOAuthChallenge(error) {
-    return error instanceof InsufficientScopeError || error instanceof UnauthorizedError
-        || (error instanceof SdkHttpError && error.status === 401);
+    return (error instanceof InsufficientScopeError ||
+        error instanceof UnauthorizedError ||
+        (error instanceof SdkHttpError && error.status === 401));
 }
 export function getOAuthRequest(serverName, serverUrl, storageBase, runtime = legacyRuntime) {
-    if (runtime.signal.aborted)
+    if (runtime.signal.aborted) {
         return undefined;
+    }
     const request = getRuntimeState(runtime).requests.get(JSON.stringify([serverName, storageBase]));
     return request?.serverUrl === serverUrl ? request : undefined;
 }
 /** Observe native challenges only; no credential reads or auth work here. */
 export function recordOAuthChallenge(serverName, serverUrl, storageBase, error, runtime = legacyRuntime) {
-    if (runtime.signal.aborted || !isOAuthChallenge(error))
+    if (runtime.signal.aborted || !isOAuthChallenge(error)) {
         return;
+    }
     const previous = getOAuthRequest(serverName, serverUrl, storageBase, runtime);
     const request = { ...previous, serverName, serverUrl };
     if (error instanceof InsufficientScopeError) {
         const requiredScope = computeScopeUnion(previous?.challenge?.requiredScope, error.requiredScope);
         const resourceMetadataUrl = error.resourceMetadataUrl ?? previous?.challenge?.resourceMetadataUrl;
-        request.challenge = { ...(requiredScope ? { requiredScope } : {}), ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}) };
+        request.challenge = {
+            ...(requiredScope ? { requiredScope } : {}),
+            ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}),
+        };
     }
     getRuntimeState(runtime).requests.set(JSON.stringify([serverName, storageBase]), request);
 }
 export function bindOAuthRequestIssuer(serverName, serverUrl, storageBase, issuer, runtime = legacyRuntime) {
     const request = getOAuthRequest(serverName, serverUrl, storageBase, runtime);
-    if (!request)
+    if (!request) {
         return;
+    }
     if (request.issuer && !issuersMatch(request.issuer, issuer)) {
         throw new Error(`OAuth authorization server issuer changed for ${serverName}; clear credentials before authenticating again`);
     }
@@ -87,18 +100,22 @@ export function extractOAuthConfig(definition) {
         return {};
     }
     const config = {};
-    if (definition.oauth?.skipIssuerMetadataValidation !== undefined)
+    if (definition.oauth?.skipIssuerMetadataValidation !== undefined) {
         config.skipIssuerMetadataValidation = definition.oauth.skipIssuerMetadataValidation;
-    if (definition.oauth?.grantType !== undefined)
+    }
+    if (definition.oauth?.grantType !== undefined) {
         config.grantType = definition.oauth.grantType;
+    }
     if (definition.oauth?.clientId !== undefined) {
-        if (typeof definition.oauth.clientId !== "string")
+        if (typeof definition.oauth.clientId !== "string") {
             throw new Error("OAuth clientId must be a string");
+        }
         config.clientId = interpolateEnvVars(definition.oauth.clientId);
     }
     if (definition.oauth?.clientSecret !== undefined) {
-        if (typeof definition.oauth.clientSecret !== "string")
+        if (typeof definition.oauth.clientSecret !== "string") {
             throw new Error("OAuth clientSecret must be a string");
+        }
         // Preserve command expressions for the provider; interpolation remains eager for ordinary values.
         config.clientSecret = definition.oauth.clientSecret.startsWith("!")
             ? definition.oauth.clientSecret
@@ -106,8 +123,9 @@ export function extractOAuthConfig(definition) {
     }
     if (definition.oauth?.clientMetadataUrl !== undefined) {
         const value = definition.oauth.clientMetadataUrl;
-        if (value !== false && typeof value !== "string")
+        if (value !== false && typeof value !== "string") {
             throw new Error("OAuth clientMetadataUrl must be a string or false");
+        }
         config.clientMetadataUrl = value === false ? false : interpolateEnvVars(value);
         validateOAuthClientMetadataUrl(config.clientMetadataUrl);
     }
@@ -115,13 +133,15 @@ export function extractOAuthConfig(definition) {
         // Keep environment and command sources lazy; each authentication resolves its own key.
         config.privateKeyJwt = definition.oauth.privateKeyJwt;
     }
-    if (definition.oauth?.crossAppAccess !== undefined)
+    if (definition.oauth?.crossAppAccess !== undefined) {
         config.crossAppAccess = definition.oauth.crossAppAccess;
+    }
     validateOAuthPrivateKeyJwt(config);
     validateOAuthCrossAppAccess(config);
     if (definition.oauth?.scope !== undefined) {
-        if (typeof definition.oauth.scope !== "string")
+        if (typeof definition.oauth.scope !== "string") {
             throw new Error("OAuth scope must be a string");
+        }
         config.scope = interpolateEnvVars(definition.oauth.scope);
     }
     if (definition.oauth?.authorizationParams !== undefined) {
@@ -131,10 +151,12 @@ export function extractOAuthConfig(definition) {
         }
         config.authorizationParams = {};
         for (const [key, value] of Object.entries(params)) {
-            if (!key)
+            if (!key) {
                 throw new Error("OAuth authorizationParams keys must not be empty");
-            if (typeof value !== "string")
+            }
+            if (typeof value !== "string") {
                 throw new Error(`OAuth authorizationParams.${key} must be a string`);
+            }
             config.authorizationParams[key] = interpolateEnvVars(value);
         }
     }
@@ -182,15 +204,26 @@ async function probeAuthDiscovery(serverUrl, definition, signal) {
     const client = new Client({ name: "pi-mcp-auth-discovery", version: ADAPTER_VERSION }, {
         versionNegotiation: { mode: definition?.protocolVersion ?? "auto" },
         ...(isNonInteractiveOAuth(definition?.oauth)
-            ? { capabilities: { extensions: { [definition?.oauth && definition.oauth.crossAppAccess
-                            ? "io.modelcontextprotocol/enterprise-managed-authorization" : "io.modelcontextprotocol/oauth-client-credentials"]: {} } } } : {}),
+            ? {
+                capabilities: {
+                    extensions: {
+                        [definition?.oauth && definition.oauth.crossAppAccess
+                            ? "io.modelcontextprotocol/enterprise-managed-authorization"
+                            : "io.modelcontextprotocol/oauth-client-credentials"]: {},
+                    },
+                },
+            }
+            : {}),
     });
     const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
         requestInit: { headers },
         fetch: async (input, init) => {
             const response = await fetch(input, init);
             const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
-            discovery = { ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}), ...(scope ? { scope } : {}) };
+            discovery = {
+                ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}),
+                ...(scope ? { scope } : {}),
+            };
             return response;
         },
     });
@@ -198,8 +231,9 @@ async function probeAuthDiscovery(serverUrl, definition, signal) {
         await abortable(client.connect(transport, { timeout }), discoverySignal);
     }
     catch (error) {
-        if (signal?.aborted)
+        if (signal?.aborted) {
             throwIfAborted(signal);
+        }
     }
     finally {
         await (client.transport ? client.close() : transport.close());
@@ -215,7 +249,10 @@ function parseOAuthRedirectUri(redirectUri) {
         throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error });
     }
     const hostname = url.hostname.toLowerCase();
-    const isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+    const isLocalhost = hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "[::1]" ||
+        hostname === "::1";
     if (url.protocol !== "http:" || !isLocalhost) {
         throw new Error("OAuth redirectUri must be an http:// localhost or loopback URI");
     }
@@ -240,8 +277,9 @@ function parseOAuthRedirectUri(redirectUri) {
  * Returns the authorization URL when browser authorization is required.
  */
 export async function startAuth(serverName, serverUrl, definition, options = {}) {
-    if (isServerDisabled(definition))
+    if (isServerDisabled(definition)) {
         throw new Error(`MCP server "${serverName}" is disabled`);
+    }
     const runtime = getRuntime(options);
     const runtimeState = getRuntimeState(runtime);
     const config = definition ? extractOAuthConfig(definition) : {};
@@ -251,7 +289,10 @@ export async function startAuth(serverName, serverUrl, definition, options = {})
     throwIfAborted(signal);
     if (isNonInteractiveOAuth(config)) {
         const storedAuth = await getAuthForUrl(serverName, serverUrl, authStorageOptions);
-        if (!config.crossAppAccess && storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {
+        if (!config.crossAppAccess &&
+            storedAuth?.clientInfo &&
+            !storedAuth.tokens &&
+            !config.clientId) {
             clearClientInfo(serverName, authStorageOptions);
             clearCodeVerifier(serverName, authStorageOptions);
             await clearOAuthState(serverName, authStorageOptions);
@@ -289,8 +330,14 @@ export async function startAuth(serverName, serverUrl, definition, options = {})
             strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,
             oauthState,
             reserveState: true,
-            validate: response => validateCallbackIssuer(serverName, callbackIssuer, response),
-            ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),
+            validate: (response) => validateCallbackIssuer(serverName, callbackIssuer, response),
+            ...(redirectCallback
+                ? {
+                    port: redirectCallback.port,
+                    callbackHost: redirectCallback.callbackHost,
+                    callbackPath: redirectCallback.callbackPath,
+                }
+                : {}),
         });
         throwIfAborted(signal);
     }
@@ -311,28 +358,41 @@ export async function startAuth(serverName, serverUrl, definition, options = {})
         let discovery = applyConfiguredScope(await probeAuthDiscovery(serverUrl, definition, signal), config);
         if (request?.challenge) {
             const scope = computeScopeUnion(discovery.scope, request.requestedScope, storedAuth?.tokens?.scope, request.challenge.requiredScope);
-            discovery = { ...discovery, ...(scope ? { scope } : {}), ...(request.challenge.resourceMetadataUrl ? { resourceMetadataUrl: request.challenge.resourceMetadataUrl } : {}) };
+            discovery = {
+                ...discovery,
+                ...(scope ? { scope } : {}),
+                ...(request.challenge.resourceMetadataUrl
+                    ? { resourceMetadataUrl: request.challenge.resourceMetadataUrl }
+                    : {}),
+            };
         }
         throwIfAborted(signal);
-        const flowConfig = { ...config, ...(request?.challenge && discovery.scope ? { scope: discovery.scope } : {}) };
+        const flowConfig = {
+            ...config,
+            ...(request?.challenge && discovery.scope ? { scope: discovery.scope } : {}),
+        };
         authProvider = new McpOAuthProvider(serverName, serverUrl, flowConfig, {
-            onRedirect: url => {
+            onRedirect: (url) => {
                 capturedUrl = url;
                 const requestedScope = url.searchParams.get("scope") ?? undefined;
                 if (requestedScope) {
                     discovery = { ...discovery, scope: requestedScope };
-                    if (request?.challenge)
+                    if (request?.challenge) {
                         flowConfig.scope = requestedScope;
+                    }
                 }
                 const current = getOAuthRequest(serverName, serverUrl, storageBase, runtime);
                 const scope = computeScopeUnion(current?.requestedScope, requestedScope);
-                if (current && scope)
+                if (current && scope) {
                     current.requestedScope = scope;
+                }
             },
-            onDiscoveryState: state => {
+            onDiscoveryState: (state) => {
                 callbackIssuer.expectedIssuer = state.authorizationServerMetadata?.issuer;
                 callbackIssuer.fallbackIssuer = state.authorizationServerUrl;
-                callbackIssuer.issParameterSupported = state.authorizationServerMetadata?.authorization_response_iss_parameter_supported === true;
+                callbackIssuer.issParameterSupported =
+                    state.authorizationServerMetadata?.authorization_response_iss_parameter_supported ===
+                        true;
                 bindOAuthRequestIssuer(serverName, serverUrl, storageBase, callbackIssuer.expectedIssuer ?? state.authorizationServerUrl, runtime);
             },
         }, authStorageOptions, runtime.signal, oauthState);
@@ -345,9 +405,10 @@ export async function startAuth(serverName, serverUrl, definition, options = {})
             else {
                 const redirectUris = storedAuth.clientInfo.redirectUris;
                 const redirectUrl = authProvider.redirectUrl ?? "";
-                const matchesRedirect = Array.isArray(redirectUris) && (redirectUris.includes(redirectUrl)
-                    || (storedAuth.clientInfo.registrationType === "cimd"
-                        && redirectUris.some(uri => loopbackRedirectsMatch(redirectUrl, uri))));
+                const matchesRedirect = Array.isArray(redirectUris) &&
+                    (redirectUris.includes(redirectUrl) ||
+                        (storedAuth.clientInfo.registrationType === "cimd" &&
+                            redirectUris.some((uri) => loopbackRedirectsMatch(redirectUrl, uri))));
                 if (!matchesRedirect) {
                     clearClientInfo(serverName, authStorageOptions);
                     clearTokens(serverName, authStorageOptions);
@@ -358,8 +419,13 @@ export async function startAuth(serverName, serverUrl, definition, options = {})
         }
         throwIfAborted(signal);
         const result = await abortable(runSdkAuth(authProvider, {
-            serverUrl, ...discovery,
-            ...(request?.challenge ? { forceReauthorization: isStrictScopeSuperset(discovery.scope, storedAuth?.tokens?.scope) } : {}),
+            serverUrl,
+            ...discovery,
+            ...(request?.challenge
+                ? {
+                    forceReauthorization: isStrictScopeSuperset(discovery.scope, storedAuth?.tokens?.scope),
+                }
+                : {}),
         }), signal);
         throwIfAborted(signal);
         if (result === "AUTHORIZED") {
@@ -371,7 +437,16 @@ export async function startAuth(serverName, serverUrl, definition, options = {})
         if (!capturedUrl) {
             throw new UnauthorizedError("OAuth authorization URL was not provided");
         }
-        await setPendingAuth(runtime, serverName, { serverName, authProvider, serverUrl, authorizationUrl: capturedUrl.toString(), discovery, callbackIssuer: { ...callbackIssuer }, authStorageOptions, ...(request ? { request } : {}) }, oauthState, signal, generation);
+        await setPendingAuth(runtime, serverName, {
+            serverName,
+            authProvider,
+            serverUrl,
+            authorizationUrl: capturedUrl.toString(),
+            discovery,
+            callbackIssuer: { ...callbackIssuer },
+            authStorageOptions,
+            ...(request ? { request } : {}),
+        }, oauthState, signal, generation);
         return { authorizationUrl: capturedUrl.toString() };
     }
     catch (error) {
@@ -390,12 +465,13 @@ async function setPendingAuth(runtime, serverName, pendingAuth, oauthState, sign
     const key = getPendingAuthKey(serverName, pendingAuth.authStorageOptions);
     await clearPendingAuth(runtime, serverName, undefined, pendingAuth.authStorageOptions);
     throwIfAborted(signal);
-    if (generation !== state.generation)
+    if (generation !== state.generation) {
         throw new Error("OAuth runtime stopped");
+    }
     state.pendingAuths.set(key, pendingAuth);
     state.pendingAuthStates.set(key, oauthState);
     const cleanupTimer = setTimeout(() => {
-        void clearPendingAuth(runtime, serverName, oauthState, pendingAuth.authStorageOptions).catch(error => {
+        void clearPendingAuth(runtime, serverName, oauthState, pendingAuth.authStorageOptions).catch((error) => {
             console.error(`MCP Auth: Timed-out flow cleanup failed: ${formatTerminalError(error)}`);
         });
     }, MANUAL_AUTH_TIMEOUT_MS);
@@ -410,8 +486,9 @@ function getSearchParamsFromInput(input) {
             const hash = url.hash.startsWith("#") ? url.hash.slice(1) : url.hash;
             const hashParams = new URLSearchParams(hash);
             for (const [key, value] of hashParams) {
-                if (!params.has(key))
+                if (!params.has(key)) {
                     params.set(key, value);
+                }
             }
         }
         return params;
@@ -440,7 +517,11 @@ export function parseAuthorizationRedirectInput(input, expectedState) {
         if (error) {
             const description = params.get("error_description");
             const iss = params.get("iss");
-            return { error, ...(description !== null ? { errorDescription: description } : {}), ...(iss !== null ? { iss } : {}) };
+            return {
+                error,
+                ...(description !== null ? { errorDescription: description } : {}),
+                ...(iss !== null ? { iss } : {}),
+            };
         }
         const code = params.get("code");
         if (code) {
@@ -485,21 +566,25 @@ export async function completeAuth(serverName, authorizationCode, options = {})
     }
     const oauthState = runtimeState.pendingAuthStates.get(key);
     throwIfAborted(signal);
-    const response = typeof authorizationCode === "string" ? { code: authorizationCode }
-        : authorizationCode ?? (oauthState ? takeCallbackResult(oauthState) : undefined);
+    const response = typeof authorizationCode === "string"
+        ? { code: authorizationCode }
+        : (authorizationCode ?? (oauthState ? takeCallbackResult(oauthState) : undefined));
     if (!response) {
         throw new Error(`No OAuth callback received yet for ${serverName}. Finish authorization in the browser, then retry auth-complete. ` +
-            "If the browser cannot reach this Pi session's callback, pass args: { redirectUrl: \"FULL_REDIRECT_URL\" } instead.");
+            'If the browser cannot reach this Pi session\'s callback, pass args: { redirectUrl: "FULL_REDIRECT_URL" } instead.');
     }
     const { iss } = response;
     let keepPendingForRetry = false;
     let caughtError;
     try {
-        keepPendingForRetry = iss === undefined && pendingAuth.callbackIssuer.issParameterSupported === true;
+        keepPendingForRetry =
+            iss === undefined && pendingAuth.callbackIssuer.issParameterSupported === true;
         validateCallbackIssuer(serverName, pendingAuth.callbackIssuer, response);
         if ("error" in response) {
             keepPendingForRetry = true;
-            throw new Error(response.errorDescription ? `${response.error}: ${response.errorDescription}` : response.error);
+            throw new Error(response.errorDescription
+                ? `${response.error}: ${response.errorDescription}`
+                : response.error);
         }
         const result = await abortable(runSdkAuth(pendingAuth.authProvider, {
             serverUrl: pendingAuth.serverUrl,
@@ -512,11 +597,14 @@ export async function completeAuth(serverName, authorizationCode, options = {})
             throw new UnauthorizedError("Failed to authorize");
         }
         const request = pendingAuth.request;
-        if (request?.challenge?.requiredScope
-            && request === getOAuthRequest(serverName, pendingAuth.serverUrl, getAuthBaseDir(authStorageOptions), runtime)) {
+        if (request?.challenge?.requiredScope &&
+            request ===
+                getOAuthRequest(serverName, pendingAuth.serverUrl, getAuthBaseDir(authStorageOptions), runtime)) {
             const issuedScope = (await getAuthForUrl(serverName, pendingAuth.serverUrl, authStorageOptions))?.tokens?.scope;
-            if (issuedScope !== undefined && !isStrictScopeSuperset(request.challenge.requiredScope, issuedScope))
+            if (issuedScope !== undefined &&
+                !isStrictScopeSuperset(request.challenge.requiredScope, issuedScope)) {
                 delete request.challenge;
+            }
         }
         return "authenticated";
     }
@@ -547,8 +635,9 @@ export async function completeAuth(serverName, authorizationCode, options = {})
  * @returns The final auth status
  */
 export async function authenticate(serverName, serverUrl, definition, options = {}) {
-    if (isServerDisabled(definition))
+    if (isServerDisabled(definition)) {
         throw new Error(`MCP server "${serverName}" is disabled`);
+    }
     const runtime = getRuntime(options);
     const runtimeState = getRuntimeState(runtime);
     const authStorageOptions = options.authStorageOptions ?? {};
@@ -595,8 +684,9 @@ export async function authenticate(serverName, serverUrl, definition, options =
                 await abortable(open(authorizationUrl), signal);
             }
             catch (error) {
-                if (isAbortError(error, signal))
+                if (isAbortError(error, signal)) {
                     throw error;
+                }
                 console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
             }
             // Wait for callback
@@ -611,8 +701,9 @@ export async function authenticate(serverName, serverUrl, definition, options =
             });
         }
         catch (error) {
-            if (oauthState)
+            if (oauthState) {
                 cancelPendingCallback(oauthState);
+            }
             try {
                 await clearPendingAuth(runtime, serverName, oauthState, authStorageOptions);
             }
@@ -650,8 +741,9 @@ export async function removeAuth(serverName, options = {}) {
     await clearPendingAuth(runtime, serverName, oauthState, authStorageOptions);
     throwIfAborted(signal);
     for (const [key, request] of getRuntimeState(runtime).requests) {
-        if (request.serverName === serverName)
+        if (request.serverName === serverName) {
             getRuntimeState(runtime).requests.delete(key);
+        }
     }
     clearAllCredentials(serverName, authStorageOptions);
     await clearOAuthState(serverName, authStorageOptions);

package/dist/mcp-auth.d.ts

@@ -52,16 +52,16 @@ export interface AuthStorageOptions {
 }
 export declare class OAuthCredentialStoreError extends Error {
     readonly code = "OAUTH_CREDENTIAL_STORE_UNAVAILABLE";
-    readonly operation: 'read' | 'write' | 'remove';
-    constructor(message: string, operation: 'read' | 'write' | 'remove', cause: unknown);
+    readonly operation: "read" | "write" | "remove";
+    constructor(message: string, operation: "read" | "write" | "remove", cause: unknown);
 }
 export type OAuthCredentialStatus = {
-    status: 'present';
+    status: "present";
     entry: AuthEntry;
 } | {
-    status: 'absent';
+    status: "absent";
 } | {
-    status: 'unavailable';
+    status: "unavailable";
     message: string;
 };
 export declare function formatOAuthCredentialStoreUnavailable(error: OAuthCredentialStoreError): string;
@@ -70,9 +70,9 @@ export declare function getAuthBaseDir(options?: AuthStorageOptions): string;
 /**
  * Get the legacy plaintext tokens file path for a server.
  */
-export declare function getAuthEntryFilePath(serverName: string, options?: AuthStorageOptions): string;
+export declare function getAuthEntryFilePath(serverName: unknown, options?: AuthStorageOptions): string;
 /** Explicit copy-only upgrade. Normal reads and logout never access the old service. */
-export declare function migrateLegacyAuthEntry(serverName: string, legacyDirectory?: string): 'copied' | 'existing' | 'absent';
+export declare function migrateLegacyAuthEntry(serverName: string, legacyDirectory?: string): "copied" | "existing" | "absent";
 /**
  * Get auth entry for a server.
  */