@fragno-dev/mcp-fragment 0.0.0-stage → 0.0.3

package/dist/cli/diagnostics.js

@@ -0,0 +1,93 @@
+import { parseSecretPayload } from "./mcp-api.js";
+import { mcpToolSchema } from "./mcp-types.js";
+import { z } from "zod";
+//#region src/diagnostics.ts
+const serverConnectionCacheOutputSchema = z.object({
+	protocolVersion: z.string().nullable().optional(),
+	serverInfo: z.unknown().nullable().optional(),
+	capabilities: z.unknown().nullable().optional(),
+	tools: z.array(mcpToolSchema).nullable().optional(),
+	updatedAt: z.union([z.string(), z.date()]).optional()
+});
+const serverOutputSchema = z.object({
+	slug: z.string(),
+	name: z.string().nullable().optional(),
+	endpointUrl: z.string(),
+	authMode: z.string(),
+	cache: serverConnectionCacheOutputSchema.nullable().optional()
+});
+const refreshOutputSchema = z.object({
+	ok: z.boolean(),
+	tools: z.array(mcpToolSchema),
+	stage: z.enum(["auth", "list_tools"]).nullable(),
+	checkedAt: z.string(),
+	server: serverOutputSchema.omit({ cache: true }),
+	auth: z.object({
+		authenticated: z.boolean(),
+		mode: z.string(),
+		tokenPresent: z.boolean(),
+		expiresAt: z.union([z.string(), z.date()]).nullable(),
+		expired: z.boolean().nullable(),
+		scopes: z.object({
+			requested: z.array(z.string()).nullable(),
+			granted: z.array(z.string()).nullable(),
+			missing: z.array(z.string()).nullable(),
+			raw: z.string().nullable()
+		})
+	}),
+	live: z.object({
+		reachable: z.boolean(),
+		listToolsOk: z.boolean(),
+		toolCount: z.number().nullable(),
+		protocolVersion: z.string().nullable(),
+		serverInfo: z.unknown().nullable(),
+		capabilities: z.unknown().nullable()
+	}),
+	cache: z.object({
+		presentBeforeCheck: z.boolean(),
+		previousToolCount: z.number().nullable(),
+		updatedToolCount: z.number().nullable()
+	}),
+	error: z.object({
+		code: z.string(),
+		message: z.string()
+	}).nullable()
+});
+const splitScope = (scope) => {
+	const scopes = scope?.split(/\s+/).filter(Boolean) ?? [];
+	return scopes.length > 0 ? scopes : null;
+};
+const newestOAuthScope = (states) => {
+	const [state] = states.toSorted((left, right) => new Date(right.expiresAt).getTime() - new Date(left.expiresAt).getTime());
+	return splitScope(state?.scope);
+};
+const buildAuthDiagnostics = ({ mode, secrets, oauthStates, authChanges }) => {
+	const authSecret = secrets.find((secret) => secret.kind === "auth");
+	const authPayload = authChanges?.authPayload ?? authSecret?.payload;
+	const authExpiresAt = authChanges?.authExpiresAt ?? authSecret?.expiresAt ?? null;
+	const parsedAuth = authPayload ? parseSecretPayload(authPayload) : void 0;
+	const granted = splitScope(parsedAuth?.type === "oauth" || parsedAuth?.type === "client_credentials" ? parsedAuth.tokens?.scope : void 0);
+	const requested = parsedAuth?.type === "client_credentials" ? parsedAuth.scopes ?? null : mode === "oauth" ? newestOAuthScope(oauthStates) : null;
+	const grantedScopes = granted ? new Set(granted) : null;
+	const missing = requested && grantedScopes ? requested.filter((scope) => !grantedScopes.has(scope)) : null;
+	const tokenPresent = parsedAuth?.type === "bearer" ? Boolean(parsedAuth.token) : Boolean(parsedAuth?.tokens?.access_token);
+	const expired = authExpiresAt ? new Date(authExpiresAt).getTime() <= Date.now() : null;
+	return {
+		authenticated: mode === "none" || tokenPresent,
+		mode,
+		tokenPresent,
+		expiresAt: authExpiresAt,
+		expired,
+		scopes: {
+			requested,
+			granted,
+			missing,
+			raw: parsedAuth?.type === "oauth" || parsedAuth?.type === "client_credentials" ? parsedAuth.tokens?.scope ?? null : null
+		}
+	};
+};
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+//#endregion
+export { buildAuthDiagnostics, errorMessage, refreshOutputSchema };
+
+//# sourceMappingURL=diagnostics.js.map

package/dist/cli/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","names":[],"sources":["../../src/diagnostics.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { parseSecretPayload } from \"./mcp-api\";\nimport { mcpToolSchema } from \"./mcp-types\";\nimport type { AuthPersistenceChanges } from \"./services\";\n\nconst serverConnectionCacheOutputSchema = z.object({\n  protocolVersion: z.string().nullable().optional(),\n  serverInfo: z.unknown().nullable().optional(),\n  capabilities: z.unknown().nullable().optional(),\n  tools: z.array(mcpToolSchema).nullable().optional(),\n  updatedAt: z.union([z.string(), z.date()]).optional(),\n});\n\nconst serverOutputSchema = z.object({\n  slug: z.string(),\n  name: z.string().nullable().optional(),\n  endpointUrl: z.string(),\n  authMode: z.string(),\n  cache: serverConnectionCacheOutputSchema.nullable().optional(),\n});\n\nexport const refreshOutputSchema = z.object({\n  ok: z.boolean(),\n  tools: z.array(mcpToolSchema),\n  stage: z.enum([\"auth\", \"list_tools\"]).nullable(),\n  checkedAt: z.string(),\n  server: serverOutputSchema.omit({ cache: true }),\n  auth: z.object({\n    authenticated: z.boolean(),\n    mode: z.string(),\n    tokenPresent: z.boolean(),\n    expiresAt: z.union([z.string(), z.date()]).nullable(),\n    expired: z.boolean().nullable(),\n    scopes: z.object({\n      requested: z.array(z.string()).nullable(),\n      granted: z.array(z.string()).nullable(),\n      missing: z.array(z.string()).nullable(),\n      raw: z.string().nullable(),\n    }),\n  }),\n  live: z.object({\n    reachable: z.boolean(),\n    listToolsOk: z.boolean(),\n    toolCount: z.number().nullable(),\n    protocolVersion: z.string().nullable(),\n    serverInfo: z.unknown().nullable(),\n    capabilities: z.unknown().nullable(),\n  }),\n  cache: z.object({\n    presentBeforeCheck: z.boolean(),\n    previousToolCount: z.number().nullable(),\n    updatedToolCount: z.number().nullable(),\n  }),\n  error: z.object({ code: z.string(), message: z.string() }).nullable(),\n});\n\nexport type SecretForDiagnostics = {\n  id: { toString(): string } | string;\n  kind: string;\n  payload: string;\n  expiresAt?: Date | string | null;\n};\n\nexport type OAuthStateForDiagnostics = {\n  scope?: string | null;\n  expiresAt: Date | string;\n};\n\ntype AuthPayloadForDiagnostics =\n  | { type: \"bearer\"; token?: string }\n  | { type: \"oauth\"; tokens?: { access_token?: string; scope?: string } }\n  | {\n      type: \"client_credentials\";\n      scopes?: string[];\n      tokens?: { access_token?: string; scope?: string };\n    };\n\nconst splitScope = (scope: string | null | undefined) => {\n  const scopes = scope?.split(/\\s+/).filter(Boolean) ?? [];\n  return scopes.length > 0 ? scopes : null;\n};\n\nconst newestOAuthScope = (states: OAuthStateForDiagnostics[]) => {\n  const [state] = states.toSorted(\n    (left, right) => new Date(right.expiresAt).getTime() - new Date(left.expiresAt).getTime(),\n  );\n  return splitScope(state?.scope);\n};\n\nexport const buildAuthDiagnostics = ({\n  mode,\n  secrets,\n  oauthStates,\n  authChanges,\n}: {\n  mode: string;\n  secrets: SecretForDiagnostics[];\n  oauthStates: OAuthStateForDiagnostics[];\n  authChanges?: AuthPersistenceChanges;\n}) => {\n  const authSecret = secrets.find((secret) => secret.kind === \"auth\");\n  const authPayload = authChanges?.authPayload ?? authSecret?.payload;\n  const authExpiresAt = authChanges?.authExpiresAt ?? authSecret?.expiresAt ?? null;\n  const parsedAuth = authPayload\n    ? parseSecretPayload<AuthPayloadForDiagnostics>(authPayload)\n    : undefined;\n  const granted = splitScope(\n    parsedAuth?.type === \"oauth\" || parsedAuth?.type === \"client_credentials\"\n      ? parsedAuth.tokens?.scope\n      : undefined,\n  );\n  const requested =\n    parsedAuth?.type === \"client_credentials\"\n      ? (parsedAuth.scopes ?? null)\n      : mode === \"oauth\"\n        ? newestOAuthScope(oauthStates)\n        : null;\n  const grantedScopes = granted ? new Set(granted) : null;\n  const missing =\n    requested && grantedScopes ? requested.filter((scope) => !grantedScopes.has(scope)) : null;\n  const tokenPresent =\n    parsedAuth?.type === \"bearer\"\n      ? Boolean(parsedAuth.token)\n      : Boolean(parsedAuth?.tokens?.access_token);\n  const expired = authExpiresAt ? new Date(authExpiresAt).getTime() <= Date.now() : null;\n\n  return {\n    authenticated: mode === \"none\" || tokenPresent,\n    mode,\n    tokenPresent,\n    expiresAt: authExpiresAt,\n    expired,\n    scopes: {\n      requested,\n      granted,\n      missing,\n      raw:\n        parsedAuth?.type === \"oauth\" || parsedAuth?.type === \"client_credentials\"\n          ? (parsedAuth.tokens?.scope ?? null)\n          : null,\n    },\n  };\n};\n\nexport const errorMessage = (error: unknown) =>\n  error instanceof Error ? error.message : String(error);\n"],"mappings":";;;;AAMA,MAAM,oCAAoC,EAAE,OAAO;CACjD,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAChD,YAAY,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC5C,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC9C,OAAO,EAAE,MAAM,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAClD,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;AACtD,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;CAClC,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACrC,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,OAAO,kCAAkC,SAAS,CAAC,CAAC,SAAS;AAC/D,CAAC;AAED,MAAa,sBAAsB,EAAE,OAAO;CAC1C,IAAI,EAAE,QAAQ;CACd,OAAO,EAAE,MAAM,aAAa;CAC5B,OAAO,EAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC,CAAC,SAAS;CAC/C,WAAW,EAAE,OAAO;CACpB,QAAQ,mBAAmB,KAAK,EAAE,OAAO,KAAK,CAAC;CAC/C,MAAM,EAAE,OAAO;EACb,eAAe,EAAE,QAAQ;EACzB,MAAM,EAAE,OAAO;EACf,cAAc,EAAE,QAAQ;EACxB,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;EACpD,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC9B,QAAQ,EAAE,OAAO;GACf,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;GACxC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;GACtC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;GACtC,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS;EAC3B,CAAC;CACH,CAAC;CACD,MAAM,EAAE,OAAO;EACb,WAAW,EAAE,QAAQ;EACrB,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;EAC/B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;EACrC,YAAY,EAAE,QAAQ,CAAC,CAAC,SAAS;EACjC,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,CAAC;CACD,OAAO,EAAE,OAAO;EACd,oBAAoB,EAAE,QAAQ;EAC9B,mBAAmB,EAAE,OAAO,CAAC,CAAC,SAAS;EACvC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACxC,CAAC;CACD,OAAO,EAAE,OAAO;EAAE,MAAM,EAAE,OAAO;EAAG,SAAS,EAAE,OAAO;CAAE,CAAC,CAAC,CAAC,SAAS;AACtE,CAAC;AAuBD,MAAM,cAAc,UAAqC;CACvD,MAAM,SAAS,OAAO,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,KAAK,CAAC;CACvD,OAAO,OAAO,SAAS,IAAI,SAAS;AACtC;AAEA,MAAM,oBAAoB,WAAuC;CAC/D,MAAM,CAAC,SAAS,OAAO,UACpB,MAAM,UAAU,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,QAAQ,CAC1F;CACA,OAAO,WAAW,OAAO,KAAK;AAChC;AAEA,MAAa,wBAAwB,EACnC,MACA,SACA,aACA,kBAMI;CACJ,MAAM,aAAa,QAAQ,MAAM,WAAW,OAAO,SAAS,MAAM;CAClE,MAAM,cAAc,aAAa,eAAe,YAAY;CAC5D,MAAM,gBAAgB,aAAa,iBAAiB,YAAY,aAAa;CAC7E,MAAM,aAAa,cACf,mBAA8C,WAAW,IACzD,KAAA;CACJ,MAAM,UAAU,WACd,YAAY,SAAS,WAAW,YAAY,SAAS,uBACjD,WAAW,QAAQ,QACnB,KAAA,CACN;CACA,MAAM,YACJ,YAAY,SAAS,uBAChB,WAAW,UAAU,OACtB,SAAS,UACP,iBAAiB,WAAW,IAC5B;CACR,MAAM,gBAAgB,UAAU,IAAI,IAAI,OAAO,IAAI;CACnD,MAAM,UACJ,aAAa,gBAAgB,UAAU,QAAQ,UAAU,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI;CACxF,MAAM,eACJ,YAAY,SAAS,WACjB,QAAQ,WAAW,KAAK,IACxB,QAAQ,YAAY,QAAQ,YAAY;CAC9C,MAAM,UAAU,gBAAgB,IAAI,KAAK,aAAa,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI;CAElF,OAAO;EACL,eAAe,SAAS,UAAU;EAClC;EACA;EACA,WAAW;EACX;EACA,QAAQ;GACN;GACA;GACA;GACA,KACE,YAAY,SAAS,WAAW,YAAY,SAAS,uBAChD,WAAW,QAAQ,SAAS,OAC7B;EACR;CACF;AACF;AAEA,MAAa,gBAAgB,UAC3B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK"}

package/dist/cli/index.js

@@ -0,0 +1,13 @@
+import { mcpFragmentDefinition } from "./definition.js";
+import { mcpRoutesFactory } from "./routes.js";
+import "@fragno-dev/core/client";
+import { instantiate } from "@fragno-dev/core";
+//#region src/index.ts
+const routes = [mcpRoutesFactory];
+function createMcpFragment(config, fragnoConfig) {
+	return instantiate(mcpFragmentDefinition).withConfig(config).withRoutes(routes).withOptions(fragnoConfig).build();
+}
+//#endregion
+export { createMcpFragment };
+
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import { createClientBuilder, type FragnoPublicClientConfig } from \"@fragno-dev/core/client\";\n\nimport { instantiate } from \"@fragno-dev/core\";\nimport type { FragnoPublicConfigWithDatabase } from \"@fragno-dev/db\";\n\nimport { mcpFragmentDefinition, type McpFragmentConfig } from \"./definition\";\nimport { mcpRoutesFactory } from \"./routes\";\n\nconst routes = [mcpRoutesFactory] as const;\n\nexport function createMcpFragment(\n  config: McpFragmentConfig,\n  fragnoConfig: FragnoPublicConfigWithDatabase,\n) {\n  return instantiate(mcpFragmentDefinition)\n    .withConfig(config)\n    .withRoutes(routes)\n    .withOptions(fragnoConfig)\n    .build();\n}\n\nexport function createMcpFragmentClients(fragnoConfig: FragnoPublicClientConfig = {}) {\n  const builder = createClientBuilder(mcpFragmentDefinition, fragnoConfig, routes);\n\n  return {\n    useServers: builder.createHook(\"/servers\"),\n    useServer: builder.createHook(\"/servers/:slug\"),\n    createServer: builder.createMutator(\"POST\", \"/servers\"),\n    refreshServer: builder.createMutator(\"POST\", \"/servers/:slug/refresh\"),\n    callTool: builder.createMutator(\"POST\", \"/servers/:slug/tools/execute\"),\n    setToken: builder.createMutator(\"POST\", \"/servers/:slug/auth/token\"),\n    startOAuth: builder.createMutator(\"POST\", \"/servers/:slug/auth/start\"),\n    deleteAuth: builder.createMutator(\"DELETE\", \"/servers/:slug/auth\"),\n  };\n}\n"],"mappings":";;;;;AAQA,MAAM,SAAS,CAAC,gBAAgB;AAEhC,SAAgB,kBACd,QACA,cACA;CACA,OAAO,YAAY,qBAAqB,CAAC,CACtC,WAAW,MAAM,CAAC,CAClB,WAAW,MAAM,CAAC,CAClB,YAAY,YAAY,CAAC,CACzB,MAAM;AACX"}

package/dist/cli/mcp-api.js

@@ -0,0 +1,87 @@
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+//#region src/mcp-api.ts
+function assertAllowedEndpoint(endpointUrl, config) {
+	const url = new URL(endpointUrl);
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error("MCP endpoint must be an HTTP(S) URL");
+	if (config.allowedEndpointUrls && !config.allowedEndpointUrls(url)) throw new Error("MCP endpoint is not allowed");
+	return url;
+}
+function stringifySecretPayload(value) {
+	return JSON.stringify(value);
+}
+function parseSecretPayload(value) {
+	return JSON.parse(value);
+}
+function bearerRequestInit(token) {
+	if (!token) return;
+	return { headers: { Authorization: `Bearer ${token}` } };
+}
+const authProvider = (auth) => auth?.type === "provider" ? auth.provider : void 0;
+const authRequestInit = (auth) => auth?.type === "bearer" ? bearerRequestInit(auth.token) : void 0;
+async function readAuthChanges(auth) {
+	return auth?.type === "provider" ? await auth.readAuthChanges() : void 0;
+}
+async function withMcpClient(args) {
+	const client = new Client({
+		name: "fragno-mcp-fragment",
+		version: "0.1.0"
+	}, {
+		capabilities: {},
+		versionNegotiation: { mode: "auto" }
+	});
+	const transport = new StreamableHTTPClientTransport(new URL(args.endpointUrl), {
+		fetch: args.fetchImplementation,
+		requestInit: authRequestInit(args.auth),
+		authProvider: authProvider(args.auth)
+	});
+	try {
+		await client.connect(transport, { timeout: args.timeoutMs });
+		const capabilities = client.getServerCapabilities();
+		const metadata = {
+			protocolVersion: client.getNegotiatedProtocolVersion(),
+			serverInfo: client.getServerVersion(),
+			capabilities
+		};
+		return {
+			ok: true,
+			result: await args.operation(client),
+			metadata,
+			authChanges: await readAuthChanges(args.auth)
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error,
+			authChanges: await readAuthChanges(args.auth)
+		};
+	} finally {
+		await transport.close().catch(() => void 0);
+		await client.close().catch(() => void 0);
+	}
+}
+async function listMcpTools(args) {
+	return await withMcpClient({
+		...args,
+		operation: (client) => client.listTools(void 0, { timeout: args.timeoutMs })
+	});
+}
+async function callMcpTool(args) {
+	return await withMcpClient({
+		...args,
+		operation: async (client) => {
+			const result = await client.callTool({
+				name: args.name,
+				arguments: args.toolArguments ?? {}
+			}, { timeout: args.timeoutMs });
+			return {
+				isError: result.isError === true,
+				content: Array.isArray(result.content) ? result.content : [],
+				structuredContent: result.structuredContent ?? null
+			};
+		}
+	});
+}
+//#endregion
+export { assertAllowedEndpoint, callMcpTool, listMcpTools, parseSecretPayload, stringifySecretPayload };
+
+//# sourceMappingURL=mcp-api.js.map

package/dist/cli/mcp-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-api.js","names":[],"sources":["../../src/mcp-api.ts"],"sourcesContent":["import {\n  Client,\n  StreamableHTTPClientTransport,\n  type OAuthClientProvider,\n} from \"@modelcontextprotocol/client\";\n\nimport type { McpFragmentConfig, McpToolCallResult } from \"./mcp-types\";\n\nexport interface StoredServerAuth {\n  mode: string;\n  payload?: unknown;\n}\n\nexport interface McpConnectionMetadata {\n  protocolVersion?: string;\n  serverInfo?: unknown;\n  capabilities?: unknown;\n}\n\nexport type McpClientAuth<TAuthChanges = unknown> =\n  | { type: \"bearer\"; token?: string }\n  | {\n      type: \"provider\";\n      provider: OAuthClientProvider;\n      readAuthChanges: () => Promise<TAuthChanges | undefined>;\n    };\n\nexport type McpOperationResult<T, TAuthChanges = unknown> =\n  | {\n      ok: true;\n      result: T;\n      metadata: McpConnectionMetadata;\n      authChanges?: TAuthChanges;\n    }\n  | { ok: false; error: unknown; authChanges?: TAuthChanges };\n\nexport function assertAllowedEndpoint(endpointUrl: string, config: McpFragmentConfig) {\n  const url = new URL(endpointUrl);\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"MCP endpoint must be an HTTP(S) URL\");\n  }\n  if (config.allowedEndpointUrls && !config.allowedEndpointUrls(url)) {\n    throw new Error(\"MCP endpoint is not allowed\");\n  }\n  return url;\n}\n\nexport function stringifySecretPayload(value: unknown) {\n  return JSON.stringify(value);\n}\n\n// oxlint-disable-next-line typescript/no-unnecessary-type-parameters -- Secret consumers select the stored payload shape at this trusted serialization boundary.\nexport function parseSecretPayload<T>(value: string) {\n  return JSON.parse(value) as T;\n}\n\nfunction bearerRequestInit(token: string | undefined): RequestInit | undefined {\n  if (!token) {\n    return undefined;\n  }\n  return { headers: { Authorization: `Bearer ${token}` } };\n}\n\nconst authProvider = (auth: McpClientAuth | undefined) =>\n  auth?.type === \"provider\" ? auth.provider : undefined;\n\nconst authRequestInit = (auth: McpClientAuth | undefined) =>\n  auth?.type === \"bearer\" ? bearerRequestInit(auth.token) : undefined;\n\nasync function readAuthChanges<TAuthChanges>(auth: McpClientAuth<TAuthChanges> | undefined) {\n  return auth?.type === \"provider\" ? await auth.readAuthChanges() : undefined;\n}\n\nasync function withMcpClient<T, TAuthChanges = unknown>(args: {\n  endpointUrl: string;\n  auth?: McpClientAuth<TAuthChanges>;\n  timeoutMs?: number;\n  fetchImplementation?: typeof fetch;\n  operation: (client: Client) => Promise<T>;\n}): Promise<McpOperationResult<T, TAuthChanges>> {\n  const client = new Client(\n    { name: \"fragno-mcp-fragment\", version: \"0.1.0\" },\n    { capabilities: {}, versionNegotiation: { mode: \"auto\" } },\n  );\n  const transport = new StreamableHTTPClientTransport(new URL(args.endpointUrl), {\n    fetch: args.fetchImplementation,\n    requestInit: authRequestInit(args.auth),\n    authProvider: authProvider(args.auth),\n  });\n\n  try {\n    await client.connect(transport, { timeout: args.timeoutMs });\n    const capabilities = client.getServerCapabilities();\n\n    const metadata: McpConnectionMetadata = {\n      protocolVersion: client.getNegotiatedProtocolVersion(),\n      serverInfo: client.getServerVersion(),\n      capabilities,\n    };\n    const result = await args.operation(client);\n    return { ok: true, result, metadata, authChanges: await readAuthChanges(args.auth) };\n  } catch (error) {\n    return { ok: false, error, authChanges: await readAuthChanges(args.auth) };\n  } finally {\n    await transport.close().catch(() => undefined);\n    await client.close().catch(() => undefined);\n  }\n}\n\nexport async function listMcpTools<TAuthChanges = unknown>(args: {\n  endpointUrl: string;\n  auth?: McpClientAuth<TAuthChanges>;\n  timeoutMs?: number;\n  fetchImplementation?: typeof fetch;\n}) {\n  return await withMcpClient({\n    ...args,\n    operation: (client) => client.listTools(undefined, { timeout: args.timeoutMs }),\n  });\n}\n\nexport async function callMcpTool<TAuthChanges = unknown>(args: {\n  endpointUrl: string;\n  auth?: McpClientAuth<TAuthChanges>;\n  name: string;\n  toolArguments?: Record<string, unknown>;\n  timeoutMs?: number;\n  fetchImplementation?: typeof fetch;\n}) {\n  return await withMcpClient({\n    ...args,\n    operation: async (client) => {\n      const result = await client.callTool(\n        { name: args.name, arguments: args.toolArguments ?? {} },\n        { timeout: args.timeoutMs },\n      );\n      // Tool errors are results for the caller, not protocol failures (MCP spec, tools/call).\n      return {\n        isError: result.isError === true,\n        content: Array.isArray(result.content) ? result.content : [],\n        structuredContent: result.structuredContent ?? null,\n      } satisfies McpToolCallResult;\n    },\n  });\n}\n"],"mappings":";;AAoCA,SAAgB,sBAAsB,aAAqB,QAA2B;CACpF,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAChD,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,OAAO,uBAAuB,CAAC,OAAO,oBAAoB,GAAG,GAC/D,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAgB,uBAAuB,OAAgB;CACrD,OAAO,KAAK,UAAU,KAAK;AAC7B;AAGA,SAAgB,mBAAsB,OAAe;CACnD,OAAO,KAAK,MAAM,KAAK;AACzB;AAEA,SAAS,kBAAkB,OAAoD;CAC7E,IAAI,CAAC,OACH;CAEF,OAAO,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAAE;AACzD;AAEA,MAAM,gBAAgB,SACpB,MAAM,SAAS,aAAa,KAAK,WAAW,KAAA;AAE9C,MAAM,mBAAmB,SACvB,MAAM,SAAS,WAAW,kBAAkB,KAAK,KAAK,IAAI,KAAA;AAE5D,eAAe,gBAA8B,MAA+C;CAC1F,OAAO,MAAM,SAAS,aAAa,MAAM,KAAK,gBAAgB,IAAI,KAAA;AACpE;AAEA,eAAe,cAAyC,MAMP;CAC/C,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM;EAAuB,SAAS;CAAQ,GAChD;EAAE,cAAc,CAAC;EAAG,oBAAoB,EAAE,MAAM,OAAO;CAAE,CAC3D;CACA,MAAM,YAAY,IAAI,8BAA8B,IAAI,IAAI,KAAK,WAAW,GAAG;EAC7E,OAAO,KAAK;EACZ,aAAa,gBAAgB,KAAK,IAAI;EACtC,cAAc,aAAa,KAAK,IAAI;CACtC,CAAC;CAED,IAAI;EACF,MAAM,OAAO,QAAQ,WAAW,EAAE,SAAS,KAAK,UAAU,CAAC;EAC3D,MAAM,eAAe,OAAO,sBAAsB;EAElD,MAAM,WAAkC;GACtC,iBAAiB,OAAO,6BAA6B;GACrD,YAAY,OAAO,iBAAiB;GACpC;EACF;EAEA,OAAO;GAAE,IAAI;GAAM,QAAA,MADE,KAAK,UAAU,MAAM;GACf;GAAU,aAAa,MAAM,gBAAgB,KAAK,IAAI;EAAE;CACrF,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO;GAAO,aAAa,MAAM,gBAAgB,KAAK,IAAI;EAAE;CAC3E,UAAU;EACR,MAAM,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC7C,MAAM,OAAO,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;AACF;AAEA,eAAsB,aAAqC,MAKxD;CACD,OAAO,MAAM,cAAc;EACzB,GAAG;EACH,YAAY,WAAW,OAAO,UAAU,KAAA,GAAW,EAAE,SAAS,KAAK,UAAU,CAAC;CAChF,CAAC;AACH;AAEA,eAAsB,YAAoC,MAOvD;CACD,OAAO,MAAM,cAAc;EACzB,GAAG;EACH,WAAW,OAAO,WAAW;GAC3B,MAAM,SAAS,MAAM,OAAO,SAC1B;IAAE,MAAM,KAAK;IAAM,WAAW,KAAK,iBAAiB,CAAC;GAAE,GACvD,EAAE,SAAS,KAAK,UAAU,CAC5B;GAEA,OAAO;IACL,SAAS,OAAO,YAAY;IAC5B,SAAS,MAAM,QAAQ,OAAO,OAAO,IAAI,OAAO,UAAU,CAAC;IAC3D,mBAAmB,OAAO,qBAAqB;GACjD;EACF;CACF,CAAC;AACH"}

package/dist/cli/mcp-types.js

@@ -0,0 +1,100 @@
+import { z } from "zod";
+//#region src/mcp-types.ts
+const authConfigSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("none") }),
+	z.object({
+		type: z.literal("bearer"),
+		token: z.string().min(1)
+	}),
+	z.object({
+		type: z.literal("client_credentials"),
+		clientId: z.string().min(1),
+		clientSecret: z.string().min(1),
+		scopes: z.array(z.string()).optional()
+	}),
+	z.object({
+		type: z.literal("oauth"),
+		clientId: z.string().optional(),
+		clientSecret: z.string().optional(),
+		scopes: z.array(z.string()).optional()
+	})
+]);
+/** Slugs are URL path segments and OAuth state prefixes, so they exclude ':' and dot segments. */
+const mcpServerSlugSchema = z.string().regex(/^[a-z0-9][a-z0-9-]*$/);
+const createServerInputSchema = z.object({
+	slug: mcpServerSlugSchema,
+	name: z.string().optional(),
+	endpointUrl: z.url(),
+	auth: authConfigSchema.default({ type: "none" })
+});
+/** Replacement keeps the slug and creation time; everything else is supplied again. */
+const replaceServerConfigurationInputSchema = createServerInputSchema.omit({ slug: true });
+const toolCallInputSchema = z.object({
+	name: z.string().min(1),
+	arguments: z.record(z.string(), z.unknown()).optional(),
+	timeoutMs: z.number().int().positive().max(12e4).optional()
+});
+const tokenAuthInputSchema = z.object({ token: z.string().min(1) });
+const mcpCredentialsPresenceSchema = z.enum(["present", "missing"]).describe("Whether credentials are stored, not whether the server accepts them.");
+/** Sanitized auth state derived from stored configuration; it never proves live server access. */
+const mcpAuthStatusSchema = z.discriminatedUnion("mode", [
+	z.object({ mode: z.literal("none") }),
+	z.object({
+		mode: z.literal("bearer"),
+		credentials: mcpCredentialsPresenceSchema
+	}),
+	z.object({
+		mode: z.literal("client_credentials"),
+		credentials: mcpCredentialsPresenceSchema
+	}),
+	z.object({
+		mode: z.literal("oauth"),
+		state: z.enum([
+			"consent-required",
+			"consent-pending",
+			"authorized",
+			"expired"
+		]).describe("Expired means the access token expired and no refresh token is stored; pending means an unexpired authorization link exists.")
+	})
+]);
+/** The pending link embeds the callback state, so reading it needs server-create authority. */
+const mcpOAuthPendingSchema = z.object({ pending: z.object({
+	authorizationUrl: z.url(),
+	expiresAt: z.union([z.string(), z.date()])
+}).nullable().describe("The newest unexpired, unconsumed authorization link; any pending link completes it.") });
+/**
+* Mirrors the MCP protocol's tool definition, whose optional members are defined by the spec.
+* Loose so newer spec members, such as icons, survive the cache and the API.
+*/
+const mcpToolSchema = z.looseObject({
+	name: z.string(),
+	title: z.string().optional(),
+	description: z.string().optional(),
+	inputSchema: z.record(z.string(), z.unknown()),
+	outputSchema: z.record(z.string(), z.unknown()).optional(),
+	annotations: z.record(z.string(), z.unknown()).optional(),
+	_meta: z.record(z.string(), z.unknown()).optional()
+});
+/** Tool errors are results the model should see; transport and auth failures are route errors. */
+const mcpToolCallResultSchema = z.object({
+	isError: z.boolean(),
+	content: z.array(z.record(z.string(), z.unknown())),
+	/** Since MCP 2026-07-28 any JSON value; null when the tool returned none. */
+	structuredContent: z.unknown()
+});
+/** Query parameter carrying the OAuth callback URI for an MCP OAuth start request. */
+const MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER = "redirectUri";
+const mcpOAuthRedirectUriSchema = z.url().refine((value) => {
+	const protocol = new URL(value).protocol;
+	return protocol === "https:" || protocol === "http:";
+}, "MCP OAuth redirect URI must use HTTP or HTTPS");
+const oauthStartInputSchema = z.object({
+	scope: z.string().optional(),
+	clientId: z.string().min(1).optional(),
+	clientSecret: z.string().min(1).optional(),
+	discardTokens: z.boolean().default(false).describe("Drop stored tokens so status reports pending consent until this new consent completes.")
+});
+//#endregion
+export { MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER, authConfigSchema, createServerInputSchema, mcpAuthStatusSchema, mcpOAuthPendingSchema, mcpOAuthRedirectUriSchema, mcpServerSlugSchema, mcpToolCallResultSchema, mcpToolSchema, oauthStartInputSchema, replaceServerConfigurationInputSchema, tokenAuthInputSchema, toolCallInputSchema };
+
+//# sourceMappingURL=mcp-types.js.map

package/dist/cli/mcp-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-types.js","names":[],"sources":["../../src/mcp-types.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport interface McpFragmentConfig {\n  /** Optional URL allow-list. If omitted, only http(s) URL syntax is checked. */\n  allowedEndpointUrls?: (url: URL) => boolean;\n  /** Allows OAuth callback URLs. OAuth start is rejected when this policy is omitted. */\n  allowedOAuthRedirectUris?: (url: URL) => boolean;\n  /** Optional fetch implementation for tests/custom runtimes. */\n  fetch?: typeof fetch;\n}\n\nexport const authConfigSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"none\") }),\n  z.object({ type: z.literal(\"bearer\"), token: z.string().min(1) }),\n  z.object({\n    type: z.literal(\"client_credentials\"),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1),\n    scopes: z.array(z.string()).optional(),\n  }),\n  z.object({\n    type: z.literal(\"oauth\"),\n    clientId: z.string().optional(),\n    clientSecret: z.string().optional(),\n    scopes: z.array(z.string()).optional(),\n  }),\n]);\n\n/** Slugs are URL path segments and OAuth state prefixes, so they exclude ':' and dot segments. */\nexport const mcpServerSlugSchema = z.string().regex(/^[a-z0-9][a-z0-9-]*$/);\n\nexport const createServerInputSchema = z.object({\n  slug: mcpServerSlugSchema,\n  name: z.string().optional(),\n  endpointUrl: z.url(),\n  auth: authConfigSchema.default({ type: \"none\" }),\n});\n\n/** Replacement keeps the slug and creation time; everything else is supplied again. */\nexport const replaceServerConfigurationInputSchema = createServerInputSchema.omit({ slug: true });\n\nexport const toolCallInputSchema = z.object({\n  name: z.string().min(1),\n  arguments: z.record(z.string(), z.unknown()).optional(),\n  timeoutMs: z.number().int().positive().max(120_000).optional(),\n});\n\nexport const tokenAuthInputSchema = z.object({\n  token: z.string().min(1),\n});\n\nconst mcpCredentialsPresenceSchema = z\n  .enum([\"present\", \"missing\"])\n  .describe(\"Whether credentials are stored, not whether the server accepts them.\");\n\n/** Sanitized auth state derived from stored configuration; it never proves live server access. */\nexport const mcpAuthStatusSchema = z.discriminatedUnion(\"mode\", [\n  z.object({ mode: z.literal(\"none\") }),\n  z.object({ mode: z.literal(\"bearer\"), credentials: mcpCredentialsPresenceSchema }),\n  z.object({ mode: z.literal(\"client_credentials\"), credentials: mcpCredentialsPresenceSchema }),\n  z.object({\n    mode: z.literal(\"oauth\"),\n    state: z\n      .enum([\"consent-required\", \"consent-pending\", \"authorized\", \"expired\"])\n      .describe(\n        \"Expired means the access token expired and no refresh token is stored; pending means an unexpired authorization link exists.\",\n      ),\n  }),\n]);\n\n/** The pending link embeds the callback state, so reading it needs server-create authority. */\nexport const mcpOAuthPendingSchema = z.object({\n  pending: z\n    .object({ authorizationUrl: z.url(), expiresAt: z.union([z.string(), z.date()]) })\n    .nullable()\n    .describe(\n      \"The newest unexpired, unconsumed authorization link; any pending link completes it.\",\n    ),\n});\n\n/**\n * Mirrors the MCP protocol's tool definition, whose optional members are defined by the spec.\n * Loose so newer spec members, such as icons, survive the cache and the API.\n */\nexport const mcpToolSchema = z.looseObject({\n  name: z.string(),\n  title: z.string().optional(),\n  description: z.string().optional(),\n  inputSchema: z.record(z.string(), z.unknown()),\n  outputSchema: z.record(z.string(), z.unknown()).optional(),\n  annotations: z.record(z.string(), z.unknown()).optional(),\n  _meta: z.record(z.string(), z.unknown()).optional(),\n});\n\n/** Tool errors are results the model should see; transport and auth failures are route errors. */\nexport const mcpToolCallResultSchema = z.object({\n  isError: z.boolean(),\n  content: z.array(z.record(z.string(), z.unknown())),\n  /** Since MCP 2026-07-28 any JSON value; null when the tool returned none. */\n  structuredContent: z.unknown(),\n});\n\n/** Query parameter carrying the OAuth callback URI for an MCP OAuth start request. */\nexport const MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER = \"redirectUri\";\n\nexport const mcpOAuthRedirectUriSchema = z.url().refine((value) => {\n  const protocol = new URL(value).protocol;\n  return protocol === \"https:\" || protocol === \"http:\";\n}, \"MCP OAuth redirect URI must use HTTP or HTTPS\");\n\nexport const oauthStartInputSchema = z.object({\n  scope: z.string().optional(),\n  clientId: z.string().min(1).optional(),\n  clientSecret: z.string().min(1).optional(),\n  discardTokens: z\n    .boolean()\n    .default(false)\n    .describe(\n      \"Drop stored tokens so status reports pending consent until this new consent completes.\",\n    ),\n});\n\nexport type AuthConfig = z.infer<typeof authConfigSchema>;\nexport type CreateServerInput = z.infer<typeof createServerInputSchema>;\nexport type ToolCallInput = z.infer<typeof toolCallInputSchema>;\nexport type McpAuthStatus = z.infer<typeof mcpAuthStatusSchema>;\nexport type McpOAuthPending = z.infer<typeof mcpOAuthPendingSchema>;\nexport type McpTool = z.infer<typeof mcpToolSchema>;\nexport type McpToolCallResult = z.infer<typeof mcpToolCallResultSchema>;\n"],"mappings":";;AAWA,MAAa,mBAAmB,EAAE,mBAAmB,QAAQ;CAC3D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;CACpC,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CAChE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,oBAAoB;EACpC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC9B,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACvC,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;EAClC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACvC,CAAC;AACH,CAAC;;AAGD,MAAa,sBAAsB,EAAE,OAAO,CAAC,CAAC,MAAM,sBAAsB;AAE1E,MAAa,0BAA0B,EAAE,OAAO;CAC9C,MAAM;CACN,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,aAAa,EAAE,IAAI;CACnB,MAAM,iBAAiB,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjD,CAAC;;AAGD,MAAa,wCAAwC,wBAAwB,KAAK,EAAE,MAAM,KAAK,CAAC;AAEhG,MAAa,sBAAsB,EAAE,OAAO;CAC1C,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACtD,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,IAAO,CAAC,CAAC,SAAS;AAC/D,CAAC;AAED,MAAa,uBAAuB,EAAE,OAAO,EAC3C,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EACzB,CAAC;AAED,MAAM,+BAA+B,EAClC,KAAK,CAAC,WAAW,SAAS,CAAC,CAAC,CAC5B,SAAS,sEAAsE;;AAGlF,MAAa,sBAAsB,EAAE,mBAAmB,QAAQ;CAC9D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;CACpC,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,aAAa;CAA6B,CAAC;CACjF,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,oBAAoB;EAAG,aAAa;CAA6B,CAAC;CAC7F,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,OAAO,EACJ,KAAK;GAAC;GAAoB;GAAmB;GAAc;EAAS,CAAC,CAAC,CACtE,SACC,8HACF;CACJ,CAAC;AACH,CAAC;;AAGD,MAAa,wBAAwB,EAAE,OAAO,EAC5C,SAAS,EACN,OAAO;CAAE,kBAAkB,EAAE,IAAI;CAAG,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;AAAE,CAAC,CAAC,CACjF,SAAS,CAAC,CACV,SACC,qFACF,EACJ,CAAC;;;;;AAMD,MAAa,gBAAgB,EAAE,YAAY;CACzC,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;CAC7C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACzD,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACxD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;AACpD,CAAC;;AAGD,MAAa,0BAA0B,EAAE,OAAO;CAC9C,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;;CAElD,mBAAmB,EAAE,QAAQ;AAC/B,CAAC;;AAGD,MAAa,yCAAyC;AAEtD,MAAa,4BAA4B,EAAE,IAAI,CAAC,CAAC,QAAQ,UAAU;CACjE,MAAM,WAAW,IAAI,IAAI,KAAK,CAAC,CAAC;CAChC,OAAO,aAAa,YAAY,aAAa;AAC/C,GAAG,+CAA+C;AAElD,MAAa,wBAAwB,EAAE,OAAO;CAC5C,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACrC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACzC,eAAe,EACZ,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,wFACF;AACJ,CAAC"}

package/dist/cli/oauth-provider.js

@@ -0,0 +1,113 @@
+//#region src/oauth-provider.ts
+var BufferedOAuthClientProvider = class {
+	snapshot;
+	changes = {};
+	constructor(snapshot) {
+		this.snapshot = snapshot;
+	}
+	get redirectUrl() {
+		return this.snapshot.redirectUrl;
+	}
+	get clientMetadata() {
+		if (this.snapshot.flow === "client_credentials") return {
+			redirect_uris: [],
+			token_endpoint_auth_method: "client_secret_basic",
+			grant_types: ["client_credentials"],
+			client_name: this.snapshot.clientName ?? "Fragno MCP Fragment",
+			scope: this.snapshot.scope
+		};
+		return {
+			redirect_uris: this.snapshot.redirectUrl ? [this.snapshot.redirectUrl] : [],
+			token_endpoint_auth_method: this.snapshot.clientSecret ? "client_secret_basic" : "none",
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			client_name: this.snapshot.clientName ?? "Fragno MCP Fragment",
+			scope: this.snapshot.scope
+		};
+	}
+	state() {
+		if (!this.snapshot.stateId) throw new Error("OAuth state is required to start authorization");
+		return this.snapshot.stateId;
+	}
+	clientInformation() {
+		if (this.changes.clientInformation) return this.changes.clientInformation;
+		if (this.snapshot.clientId) {
+			const clientInformation = {
+				client_id: this.snapshot.clientId,
+				client_secret: this.snapshot.clientSecret
+			};
+			this.changes.clientInformation = clientInformation;
+			return clientInformation;
+		}
+		return this.changes.clientInvalidated ? void 0 : this.snapshot.clientInformation;
+	}
+	saveClientInformation(clientInformation) {
+		this.changes.clientInformation = clientInformation;
+	}
+	tokens() {
+		return this.changes.tokens ?? (this.changes.tokensInvalidated ? void 0 : this.snapshot.tokens);
+	}
+	saveTokens(tokens) {
+		this.changes.tokens = tokens;
+	}
+	redirectToAuthorization(authorizationUrl) {
+		this.changes.authorizationUrl = authorizationUrl;
+	}
+	saveCodeVerifier(codeVerifier) {
+		if (this.snapshot.flow === "client_credentials") return;
+		if (!this.snapshot.stateId || !this.snapshot.redirectUrl) throw new Error("OAuth state and redirect URL are required");
+		this.changes.oauthState = {
+			id: this.snapshot.stateId,
+			codeVerifier,
+			redirectUri: this.snapshot.redirectUrl,
+			scope: this.snapshot.scope,
+			expiresAt: new Date(Date.now() + 6e5)
+		};
+	}
+	codeVerifier() {
+		if (this.snapshot.flow === "client_credentials") throw new Error("codeVerifier is not used for client_credentials flow");
+		const state = this.snapshot.oauthState;
+		if (!state || state.consumedAt) throw new Error("Invalid OAuth state");
+		if (state.expiresAt.getTime() < Date.now()) throw new Error("OAuth state expired");
+		return state.codeVerifier;
+	}
+	saveDiscoveryState(state) {
+		this.changes.discoveryState = state;
+	}
+	discoveryState() {
+		return this.changes.discoveryState ?? (this.changes.discoveryInvalidated ? void 0 : this.snapshot.discoveryState);
+	}
+	/**
+	* The SDK retries authorization right after invalidating, so later reads skip what it dropped:
+	* retrying a rejected client or token fails the same way. A configured client is configuration,
+	* not a registration, so it is kept. The code verifier lives in the pending OAuth state, which
+	* the callback consumes either way.
+	*/
+	invalidateCredentials(scope) {
+		if (scope === "all" || scope === "tokens") {
+			this.changes.tokens = void 0;
+			this.changes.tokensInvalidated = true;
+		}
+		if (scope === "all" || scope === "client") {
+			this.changes.clientInformation = void 0;
+			this.changes.clientInvalidated = true;
+		}
+		if (scope === "all" || scope === "discovery") {
+			this.changes.discoveryState = void 0;
+			this.changes.discoveryInvalidated = true;
+		}
+	}
+	prepareTokenRequest(scope) {
+		if (this.snapshot.flow !== "client_credentials") return;
+		const params = new URLSearchParams({ grant_type: "client_credentials" });
+		if (scope) params.set("scope", scope);
+		return params;
+	}
+	consumeState() {
+		if (this.snapshot.stateId) this.changes.consumeStateId = this.snapshot.stateId;
+	}
+};
+//#endregion
+export { BufferedOAuthClientProvider };
+
+//# sourceMappingURL=oauth-provider.js.map

package/dist/cli/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","names":[],"sources":["../../src/oauth-provider.ts"],"sourcesContent":["import type {\n  OAuthClientProvider,\n  OAuthDiscoveryState,\n  OAuthClientInformationMixed,\n  OAuthClientMetadata,\n  OAuthTokens,\n} from \"@modelcontextprotocol/client\";\n\nexport interface OAuthProviderSnapshot {\n  serverId: string;\n  endpointUrl: string;\n  redirectUrl?: string;\n  scope?: string;\n  stateId?: string;\n  clientId?: string;\n  clientSecret?: string;\n  clientName?: string;\n  clientInformation?: OAuthClientInformationMixed;\n  tokens?: OAuthTokens;\n  discoveryState?: OAuthDiscoveryState;\n  flow?: \"authorization_code\" | \"client_credentials\";\n  oauthState?: {\n    id: string;\n    codeVerifier: string;\n    redirectUri: string;\n    scope?: string;\n    expiresAt: Date;\n    consumedAt?: Date | null;\n  };\n}\n\nexport interface OAuthProviderChanges {\n  authorizationUrl?: URL;\n  clientInformation?: OAuthClientInformationMixed;\n  tokens?: OAuthTokens;\n  discoveryState?: OAuthDiscoveryState;\n  oauthState?: {\n    id: string;\n    codeVerifier: string;\n    redirectUri: string;\n    scope?: string;\n    expiresAt: Date;\n  };\n  consumeStateId?: string;\n  /** The server rejected the stored tokens, so they must be removed unless new ones were saved. */\n  tokensInvalidated?: boolean;\n  /** The server rejected the registered client, so it must be removed unless a new one was saved. */\n  clientInvalidated?: boolean;\n  /** The discovered metadata failed, so it must be removed unless it was discovered again. */\n  discoveryInvalidated?: boolean;\n}\n\nexport class BufferedOAuthClientProvider implements OAuthClientProvider {\n  readonly changes: OAuthProviderChanges = {};\n\n  constructor(private readonly snapshot: OAuthProviderSnapshot) {}\n\n  get redirectUrl() {\n    return this.snapshot.redirectUrl;\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    if (this.snapshot.flow === \"client_credentials\") {\n      return {\n        redirect_uris: [],\n        token_endpoint_auth_method: \"client_secret_basic\",\n        grant_types: [\"client_credentials\"],\n        client_name: this.snapshot.clientName ?? \"Fragno MCP Fragment\",\n        scope: this.snapshot.scope,\n      };\n    }\n    return {\n      redirect_uris: this.snapshot.redirectUrl ? [this.snapshot.redirectUrl] : [],\n      token_endpoint_auth_method: this.snapshot.clientSecret ? \"client_secret_basic\" : \"none\",\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      response_types: [\"code\"],\n      client_name: this.snapshot.clientName ?? \"Fragno MCP Fragment\",\n      scope: this.snapshot.scope,\n    };\n  }\n\n  state() {\n    if (!this.snapshot.stateId) {\n      throw new Error(\"OAuth state is required to start authorization\");\n    }\n    return this.snapshot.stateId;\n  }\n\n  clientInformation() {\n    // Preserve the SDK's issuer stamp instead of rebuilding static credentials after discovery.\n    if (this.changes.clientInformation) {\n      return this.changes.clientInformation;\n    }\n    if (this.snapshot.clientId) {\n      const clientInformation = {\n        client_id: this.snapshot.clientId,\n        client_secret: this.snapshot.clientSecret,\n      };\n      this.changes.clientInformation = clientInformation;\n      return clientInformation;\n    }\n    return this.changes.clientInvalidated ? undefined : this.snapshot.clientInformation;\n  }\n\n  saveClientInformation(clientInformation: OAuthClientInformationMixed) {\n    this.changes.clientInformation = clientInformation;\n  }\n\n  tokens() {\n    return (\n      this.changes.tokens ?? (this.changes.tokensInvalidated ? undefined : this.snapshot.tokens)\n    );\n  }\n\n  saveTokens(tokens: OAuthTokens) {\n    this.changes.tokens = tokens;\n  }\n\n  redirectToAuthorization(authorizationUrl: URL) {\n    this.changes.authorizationUrl = authorizationUrl;\n  }\n\n  saveCodeVerifier(codeVerifier: string) {\n    if (this.snapshot.flow === \"client_credentials\") {\n      return;\n    }\n    if (!this.snapshot.stateId || !this.snapshot.redirectUrl) {\n      throw new Error(\"OAuth state and redirect URL are required\");\n    }\n    this.changes.oauthState = {\n      id: this.snapshot.stateId,\n      codeVerifier,\n      redirectUri: this.snapshot.redirectUrl,\n      scope: this.snapshot.scope,\n      expiresAt: new Date(Date.now() + 10 * 60 * 1000),\n    };\n  }\n\n  codeVerifier() {\n    if (this.snapshot.flow === \"client_credentials\") {\n      throw new Error(\"codeVerifier is not used for client_credentials flow\");\n    }\n    const state = this.snapshot.oauthState;\n    if (!state || state.consumedAt) {\n      throw new Error(\"Invalid OAuth state\");\n    }\n    if (state.expiresAt.getTime() < Date.now()) {\n      throw new Error(\"OAuth state expired\");\n    }\n    return state.codeVerifier;\n  }\n\n  saveDiscoveryState(state: OAuthDiscoveryState) {\n    this.changes.discoveryState = state;\n  }\n\n  discoveryState() {\n    return (\n      this.changes.discoveryState ??\n      (this.changes.discoveryInvalidated ? undefined : this.snapshot.discoveryState)\n    );\n  }\n\n  /**\n   * The SDK retries authorization right after invalidating, so later reads skip what it dropped:\n   * retrying a rejected client or token fails the same way. A configured client is configuration,\n   * not a registration, so it is kept. The code verifier lives in the pending OAuth state, which\n   * the callback consumes either way.\n   */\n  invalidateCredentials(scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\") {\n    if (scope === \"all\" || scope === \"tokens\") {\n      this.changes.tokens = undefined;\n      this.changes.tokensInvalidated = true;\n    }\n    if (scope === \"all\" || scope === \"client\") {\n      this.changes.clientInformation = undefined;\n      this.changes.clientInvalidated = true;\n    }\n    if (scope === \"all\" || scope === \"discovery\") {\n      this.changes.discoveryState = undefined;\n      this.changes.discoveryInvalidated = true;\n    }\n  }\n\n  prepareTokenRequest(scope?: string) {\n    if (this.snapshot.flow !== \"client_credentials\") {\n      return undefined;\n    }\n    const params = new URLSearchParams({ grant_type: \"client_credentials\" });\n    if (scope) {\n      params.set(\"scope\", scope);\n    }\n    return params;\n  }\n\n  consumeState() {\n    if (this.snapshot.stateId) {\n      this.changes.consumeStateId = this.snapshot.stateId;\n    }\n  }\n}\n"],"mappings":";AAoDA,IAAa,8BAAb,MAAwE;CAGzC;CAF7B,UAAyC,CAAC;CAE1C,YAAY,UAAkD;EAAjC,KAAA,WAAA;CAAkC;CAE/D,IAAI,cAAc;EAChB,OAAO,KAAK,SAAS;CACvB;CAEA,IAAI,iBAAsC;EACxC,IAAI,KAAK,SAAS,SAAS,sBACzB,OAAO;GACL,eAAe,CAAC;GAChB,4BAA4B;GAC5B,aAAa,CAAC,oBAAoB;GAClC,aAAa,KAAK,SAAS,cAAc;GACzC,OAAO,KAAK,SAAS;EACvB;EAEF,OAAO;GACL,eAAe,KAAK,SAAS,cAAc,CAAC,KAAK,SAAS,WAAW,IAAI,CAAC;GAC1E,4BAA4B,KAAK,SAAS,eAAe,wBAAwB;GACjF,aAAa,CAAC,sBAAsB,eAAe;GACnD,gBAAgB,CAAC,MAAM;GACvB,aAAa,KAAK,SAAS,cAAc;GACzC,OAAO,KAAK,SAAS;EACvB;CACF;CAEA,QAAQ;EACN,IAAI,CAAC,KAAK,SAAS,SACjB,MAAM,IAAI,MAAM,gDAAgD;EAElE,OAAO,KAAK,SAAS;CACvB;CAEA,oBAAoB;EAElB,IAAI,KAAK,QAAQ,mBACf,OAAO,KAAK,QAAQ;EAEtB,IAAI,KAAK,SAAS,UAAU;GAC1B,MAAM,oBAAoB;IACxB,WAAW,KAAK,SAAS;IACzB,eAAe,KAAK,SAAS;GAC/B;GACA,KAAK,QAAQ,oBAAoB;GACjC,OAAO;EACT;EACA,OAAO,KAAK,QAAQ,oBAAoB,KAAA,IAAY,KAAK,SAAS;CACpE;CAEA,sBAAsB,mBAAgD;EACpE,KAAK,QAAQ,oBAAoB;CACnC;CAEA,SAAS;EACP,OACE,KAAK,QAAQ,WAAW,KAAK,QAAQ,oBAAoB,KAAA,IAAY,KAAK,SAAS;CAEvF;CAEA,WAAW,QAAqB;EAC9B,KAAK,QAAQ,SAAS;CACxB;CAEA,wBAAwB,kBAAuB;EAC7C,KAAK,QAAQ,mBAAmB;CAClC;CAEA,iBAAiB,cAAsB;EACrC,IAAI,KAAK,SAAS,SAAS,sBACzB;EAEF,IAAI,CAAC,KAAK,SAAS,WAAW,CAAC,KAAK,SAAS,aAC3C,MAAM,IAAI,MAAM,2CAA2C;EAE7D,KAAK,QAAQ,aAAa;GACxB,IAAI,KAAK,SAAS;GAClB;GACA,aAAa,KAAK,SAAS;GAC3B,OAAO,KAAK,SAAS;GACrB,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,GAAc;EACjD;CACF;CAEA,eAAe;EACb,IAAI,KAAK,SAAS,SAAS,sBACzB,MAAM,IAAI,MAAM,sDAAsD;EAExE,MAAM,QAAQ,KAAK,SAAS;EAC5B,IAAI,CAAC,SAAS,MAAM,YAClB,MAAM,IAAI,MAAM,qBAAqB;EAEvC,IAAI,MAAM,UAAU,QAAQ,IAAI,KAAK,IAAI,GACvC,MAAM,IAAI,MAAM,qBAAqB;EAEvC,OAAO,MAAM;CACf;CAEA,mBAAmB,OAA4B;EAC7C,KAAK,QAAQ,iBAAiB;CAChC;CAEA,iBAAiB;EACf,OACE,KAAK,QAAQ,mBACZ,KAAK,QAAQ,uBAAuB,KAAA,IAAY,KAAK,SAAS;CAEnE;;;;;;;CAQA,sBAAsB,OAA+D;EACnF,IAAI,UAAU,SAAS,UAAU,UAAU;GACzC,KAAK,QAAQ,SAAS,KAAA;GACtB,KAAK,QAAQ,oBAAoB;EACnC;EACA,IAAI,UAAU,SAAS,UAAU,UAAU;GACzC,KAAK,QAAQ,oBAAoB,KAAA;GACjC,KAAK,QAAQ,oBAAoB;EACnC;EACA,IAAI,UAAU,SAAS,UAAU,aAAa;GAC5C,KAAK,QAAQ,iBAAiB,KAAA;GAC9B,KAAK,QAAQ,uBAAuB;EACtC;CACF;CAEA,oBAAoB,OAAgB;EAClC,IAAI,KAAK,SAAS,SAAS,sBACzB;EAEF,MAAM,SAAS,IAAI,gBAAgB,EAAE,YAAY,qBAAqB,CAAC;EACvE,IAAI,OACF,OAAO,IAAI,SAAS,KAAK;EAE3B,OAAO;CACT;CAEA,eAAe;EACb,IAAI,KAAK,SAAS,SAChB,KAAK,QAAQ,iBAAiB,KAAK,SAAS;CAEhD;AACF"}