@inspectr/mcplab 1.6.0 → 1.7.0

package/dist/app-server/oauth-debugger-domain.d.ts

@@ -1,230 +1,210 @@
 import type { ServerResponse } from 'node:http';
 import type { EvalConfig } from '@inspectr/mcplab-core';
-type SessionStatus =
-  | 'configuring'
-  | 'running'
-  | 'waiting_for_user'
-  | 'waiting_for_browser_callback'
-  | 'completed'
-  | 'error'
-  | 'stopped';
+type SessionStatus = 'configuring' | 'running' | 'waiting_for_user' | 'waiting_for_browser_callback' | 'completed' | 'error' | 'stopped';
 type RegistrationMethod = 'pre_registered' | 'dcr' | 'cimd';
 export interface OAuthDebuggerSessionConfigInput {
-  profile: 'latest';
-  target: {
-    serverName: string;
-    overrides?: {
-      authorizationServerMetadataUrl?: string;
-      authorizationEndpoint?: string;
-      tokenEndpoint?: string;
-      registrationEndpoint?: string;
-      cimdUrl?: string;
-      resourceBaseUrl?: string;
+    profile: 'latest';
+    target: {
+        serverName: string;
+        overrides?: {
+            authorizationServerMetadataUrl?: string;
+            authorizationEndpoint?: string;
+            tokenEndpoint?: string;
+            registrationEndpoint?: string;
+            cimdUrl?: string;
+            resourceBaseUrl?: string;
+        };
     };
-  };
-  registrationMethod: RegistrationMethod;
-  clientConfig: {
-    preRegistered?: {
-      clientId: string;
-      clientSecret?: string;
-      tokenEndpointAuthMethod?: string;
+    registrationMethod: RegistrationMethod;
+    clientConfig: {
+        preRegistered?: {
+            clientId: string;
+            clientSecret?: string;
+            tokenEndpointAuthMethod?: string;
+        };
+        dcr?: {
+            metadata?: Record<string, unknown>;
+            tokenEndpointAuthMethod?: string;
+        };
+        cimd?: {
+            cimdUrl?: string;
+            expectedClientId?: string;
+        };
     };
-    dcr?: {
-      metadata?: Record<string, unknown>;
-      tokenEndpointAuthMethod?: string;
+    runtime: {
+        redirectMode: 'local_callback' | 'manual';
+        scopes?: string[];
+        resource?: string;
+        usePkce?: boolean;
+        codeChallengeMethod?: 'S256';
+        state?: string;
+        nonce?: string;
+        extraAuthParams?: Record<string, string>;
     };
-    cimd?: {
-      cimdUrl?: string;
-      expectedClientId?: string;
+    display?: {
+        showSensitiveValues?: boolean;
     };
-  };
-  runtime: {
-    redirectMode: 'local_callback' | 'manual';
-    scopes?: string[];
-    resource?: string;
-    usePkce?: boolean;
-    codeChallengeMethod?: 'S256';
-    state?: string;
-    nonce?: string;
-    extraAuthParams?: Record<string, string>;
-  };
-  display?: {
-    showSensitiveValues?: boolean;
-  };
 }
 export interface OAuthNetworkExchange {
-  id: string;
-  stepId: string;
-  kind: 'http';
-  phase: 'request' | 'response';
-  label: string;
-  method?: string;
-  url: string;
-  headers: Record<string, string>;
-  bodyText?: string;
-  status?: number;
-  durationMs?: number;
-  timestamp: string;
-  sensitiveFields?: Array<{
-    path: string;
-    type: 'token' | 'secret' | 'authorization_header';
-  }>;
+    id: string;
+    stepId: string;
+    kind: 'http';
+    phase: 'request' | 'response';
+    label: string;
+    method?: string;
+    url: string;
+    headers: Record<string, string>;
+    bodyText?: string;
+    status?: number;
+    durationMs?: number;
+    timestamp: string;
+    sensitiveFields?: Array<{
+        path: string;
+        type: 'token' | 'secret' | 'authorization_header';
+    }>;
 }
 export interface OAuthValidationFinding {
-  id: string;
-  stepId: string;
-  severity: 'error' | 'warning' | 'info';
-  code: string;
-  title: string;
-  detail: string;
-  specReference?: string;
-  recommendation?: string;
+    id: string;
+    stepId: string;
+    severity: 'error' | 'warning' | 'info';
+    code: string;
+    title: string;
+    detail: string;
+    specReference?: string;
+    recommendation?: string;
 }
 export interface OAuthDebuggerStepState {
-  id: string;
-  title: string;
-  description: string;
-  status: 'pending' | 'active' | 'completed' | 'failed' | 'skipped';
-  startedAt?: string;
-  finishedAt?: string;
-  outcomeSummary?: string;
-  teachableMoment?: string;
-  networkExchangeIds: string[];
-  validationIds: string[];
+    id: string;
+    title: string;
+    description: string;
+    status: 'pending' | 'active' | 'completed' | 'failed' | 'skipped';
+    startedAt?: string;
+    finishedAt?: string;
+    outcomeSummary?: string;
+    teachableMoment?: string;
+    networkExchangeIds: string[];
+    validationIds: string[];
 }
 export interface OAuthSequenceEvent {
-  id: string;
-  ts: string;
-  from: 'User' | 'Debugger' | 'Auth Server' | 'Token Endpoint' | 'MCP/Resource';
-  to: 'User' | 'Debugger' | 'Auth Server' | 'Token Endpoint' | 'MCP/Resource';
-  label: string;
-  stepId?: string;
-  networkExchangeId?: string;
+    id: string;
+    ts: string;
+    from: 'User' | 'Debugger' | 'Auth Server' | 'Token Endpoint' | 'MCP/Resource';
+    to: 'User' | 'Debugger' | 'Auth Server' | 'Token Endpoint' | 'MCP/Resource';
+    label: string;
+    stepId?: string;
+    networkExchangeId?: string;
 }
 export interface OAuthDebuggerSession {
-  id: string;
-  createdAt: number;
-  updatedAt: number;
-  status: SessionStatus;
-  config: {
-    profile: 'latest';
-    target: OAuthDebuggerSessionConfigInput['target'];
-    registrationMethod: RegistrationMethod;
-    clientConfig: OAuthDebuggerSessionConfigInput['clientConfig'];
-    runtime: Required<
-      Pick<
-        OAuthDebuggerSessionConfigInput['runtime'],
-        'redirectMode' | 'usePkce' | 'codeChallengeMethod'
-      >
-    > &
-      Omit<
-        OAuthDebuggerSessionConfigInput['runtime'],
-        'redirectMode' | 'usePkce' | 'codeChallengeMethod'
-      >;
-    display: {
-      showSensitiveValues: boolean;
+    id: string;
+    createdAt: number;
+    updatedAt: number;
+    status: SessionStatus;
+    config: {
+        profile: 'latest';
+        target: OAuthDebuggerSessionConfigInput['target'];
+        registrationMethod: RegistrationMethod;
+        clientConfig: OAuthDebuggerSessionConfigInput['clientConfig'];
+        runtime: Required<Pick<OAuthDebuggerSessionConfigInput['runtime'], 'redirectMode' | 'usePkce' | 'codeChallengeMethod'>> & Omit<OAuthDebuggerSessionConfigInput['runtime'], 'redirectMode' | 'usePkce' | 'codeChallengeMethod'>;
+        display: {
+            showSensitiveValues: boolean;
+        };
     };
-  };
-  steps: OAuthDebuggerStepState[];
-  validations: OAuthValidationFinding[];
-  network: OAuthNetworkExchange[];
-  sequence: OAuthSequenceEvent[];
-  events: Array<{
-    type: string;
-    ts: string;
-    payload: Record<string, unknown>;
-  }>;
-  clients: Set<ServerResponse>;
-  abortController: AbortController;
-  serverConfig?: EvalConfig['servers'][string];
-  context: {
-    resourceMetadata?: any;
-    authServerMetadata?: any;
-    registration?: any;
-    resolvedClient?: {
-      clientId: string;
-      clientSecret?: string;
-      tokenEndpointAuthMethod?: string;
+    steps: OAuthDebuggerStepState[];
+    validations: OAuthValidationFinding[];
+    network: OAuthNetworkExchange[];
+    sequence: OAuthSequenceEvent[];
+    events: Array<{
+        type: string;
+        ts: string;
+        payload: Record<string, unknown>;
+    }>;
+    clients: Set<ServerResponse>;
+    abortController: AbortController;
+    serverConfig?: EvalConfig['servers'][string];
+    context: {
+        resourceMetadata?: any;
+        authServerMetadata?: any;
+        registration?: any;
+        resolvedClient?: {
+            clientId: string;
+            clientSecret?: string;
+            tokenEndpointAuthMethod?: string;
+        };
+        pkce?: {
+            verifier: string;
+            challenge: string;
+            method: 'S256';
+        };
+        authorizationRequestUrl?: string;
+        callbackResult?: {
+            rawUrl?: string;
+            code?: string;
+            state?: string;
+            error?: string;
+            errorDescription?: string;
+        };
+        tokenResponse?: any;
+        probeResponse?: {
+            status: number;
+            bodyText: string;
+            url: string;
+        };
+        callbackUrl?: string;
     };
-    pkce?: {
-      verifier: string;
-      challenge: string;
-      method: 'S256';
+}
+export interface OAuthDebuggerSessionView {
+    id: string;
+    status: SessionStatus;
+    createdAt: string;
+    updatedAt: string;
+    profile: 'latest';
+    registrationMethod: RegistrationMethod;
+    stepStates: OAuthDebuggerStepState[];
+    validations: OAuthValidationFinding[];
+    network: OAuthNetworkExchange[];
+    networkSummary: {
+        requestCount: number;
+        errorCount: number;
     };
-    authorizationRequestUrl?: string;
-    callbackResult?: {
-      rawUrl?: string;
-      code?: string;
-      state?: string;
-      error?: string;
-      errorDescription?: string;
+    sequence: OAuthSequenceEvent[];
+    uiHints: {
+        nextAction?: 'start' | 'open_authorize_url' | 'paste_callback_url' | 'none';
+        authorizationUrl?: string;
+        callbackMode?: 'local_callback' | 'manual';
+        callbackUrl?: string;
     };
-    tokenResponse?: any;
-    probeResponse?: {
-      status: number;
-      bodyText: string;
-      url: string;
+    summary?: {
+        issuer?: string;
+        clientId?: string;
+        redirectUri?: string;
+        tokenEndpointStatus?: number;
+        tokenType?: string;
+        grantedScopes?: string[];
+        accessToken?: string;
     };
-    callbackUrl?: string;
-  };
 }
-export interface OAuthDebuggerSessionView {
-  id: string;
-  status: SessionStatus;
-  createdAt: string;
-  updatedAt: string;
-  profile: 'latest';
-  registrationMethod: RegistrationMethod;
-  stepStates: OAuthDebuggerStepState[];
-  validations: OAuthValidationFinding[];
-  network: OAuthNetworkExchange[];
-  networkSummary: {
-    requestCount: number;
-    errorCount: number;
-  };
-  sequence: OAuthSequenceEvent[];
-  uiHints: {
-    nextAction?: 'start' | 'open_authorize_url' | 'paste_callback_url' | 'none';
-    authorizationUrl?: string;
-    callbackMode?: 'local_callback' | 'manual';
-    callbackUrl?: string;
-  };
-  summary?: {
-    issuer?: string;
-    clientId?: string;
-    redirectUri?: string;
-    tokenEndpointStatus?: number;
-    tokenType?: string;
-    grantedScopes?: string[];
-  };
-}
-export declare function cleanupOAuthDebuggerSessions(
-  sessions: Map<string, OAuthDebuggerSession>,
-  now?: number
-): void;
+export declare function cleanupOAuthDebuggerSessions(sessions: Map<string, OAuthDebuggerSession>, now?: number): void;
 export declare function createOAuthDebuggerSession(params: {
-  config: OAuthDebuggerSessionConfigInput;
-  serverConfig?: EvalConfig['servers'][string];
+    config: OAuthDebuggerSessionConfigInput;
+    serverConfig?: EvalConfig['servers'][string];
 }): OAuthDebuggerSession;
-export declare function oauthDebuggerSessionView(
-  session: OAuthDebuggerSession
-): OAuthDebuggerSessionView;
+export declare function oauthDebuggerSessionView(session: OAuthDebuggerSession): OAuthDebuggerSessionView;
 export declare function startOrResumeOAuthDebuggerSession(params: {
-  session: OAuthDebuggerSession;
-  appBaseUrl: string;
+    session: OAuthDebuggerSession;
+    appBaseUrl: string;
 }): Promise<void>;
 export declare function submitManualCallbackToSession(params: {
-  session: OAuthDebuggerSession;
-  redirectUrl?: string;
-  code?: string;
-  state?: string;
+    session: OAuthDebuggerSession;
+    redirectUrl?: string;
+    code?: string;
+    state?: string;
 }): void;
 export declare function submitBrowserCallbackToSession(params: {
-  session: OAuthDebuggerSession;
-  rawUrl: string;
+    session: OAuthDebuggerSession;
+    rawUrl: string;
 }): void;
 export declare function stopOAuthDebuggerSession(session: OAuthDebuggerSession): void;
 export declare function oauthDebuggerExportMarkdown(session: OAuthDebuggerSession): string;
 export declare function oauthDebuggerExportRawTrace(session: OAuthDebuggerSession): string;
 export {};
-//# sourceMappingURL=oauth-debugger-domain.d.ts.map
+//# sourceMappingURL=oauth-debugger-domain.d.ts.map

package/dist/app-server/oauth-debugger-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-debugger-domain.d.ts","sourceRoot":"","sources":["../../src/app-server/oauth-debugger-domain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGxD,KAAK,aAAa,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,8BAA8B,GAC9B,WAAW,GACX,OAAO,GACP,SAAS,CAAC;AAEd,KAAK,kBAAkB,GAAG,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE;YACV,8BAA8B,CAAC,EAAE,MAAM,CAAC;YACxC,qBAAqB,CAAC,EAAE,MAAM,CAAC;YAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;YAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,eAAe,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;KACH,CAAC;IACF,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,EAAE;QACZ,aAAa,CAAC,EAAE;YACd,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;SAClC,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnC,uBAAuB,CAAC,EAAE,MAAM,CAAC;SAClC,CAAC;QACF,IAAI,CAAC,EAAE;YACL,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH,CAAC;IACF,OAAO,EAAE;QACP,YAAY,EAAE,gBAAgB,GAAG,QAAQ,CAAC;QAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,sBAAsB,CAAA;KAAE,CAAC,CAAC;CAC9F;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IAC9E,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE;QACN,OAAO,EAAE,QAAQ,CAAC;QAClB,MAAM,EAAE,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAClD,kBAAkB,EAAE,kBAAkB,CAAC;QACvC,YAAY,EAAE,+BAA+B,CAAC,cAAc,CAAC,CAAC;QAC9D,OAAO,EAAE,QAAQ,CACf,IAAI,CACF,+BAA+B,CAAC,SAAS,CAAC,EAC1C,cAAc,GAAG,SAAS,GAAG,qBAAqB,CACnD,CACF,GACC,IAAI,CACF,+BAA+B,CAAC,SAAS,CAAC,EAC1C,cAAc,GAAG,SAAS,GAAG,qBAAqB,CACnD,CAAC;QACJ,OAAO,EAAE;YACP,mBAAmB,EAAE,OAAO,CAAC;SAC9B,CAAC;KACH,CAAC;IACF,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,EAAE;QACP,gBAAgB,CAAC,EAAE,GAAG,CAAC;QACvB,kBAAkB,CAAC,EAAE,GAAG,CAAC;QACzB,YAAY,CAAC,EAAE,GAAG,CAAC;QACnB,cAAc,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,MAAM,CAAC;YAAC,uBAAuB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/F,IAAI,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/D,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,cAAc,CAAC,EAAE;YACf,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;QACF,aAAa,CAAC,EAAE,GAAG,CAAC;QACpB,aAAa,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAClE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,QAAQ,CAAC;IAClB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,MAAM,CAAC;QAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,gBAAgB,GAAG,QAAQ,CAAC;QAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC;CACH;AA23BD,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC3C,GAAG,SAAa,QAOjB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,+BAA+B,CAAC;IACxC,YAAY,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;CAC9C,GAAG,oBAAoB,CAsDvB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,GAAG,wBAAwB,CAmDhG;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB,iBAsFA;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,QAWA;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,QAIA;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,QAWrE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CA+BjF;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAiBjF"}
+{"version":3,"file":"oauth-debugger-domain.d.ts","sourceRoot":"","sources":["../../src/app-server/oauth-debugger-domain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGxD,KAAK,aAAa,GACd,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,8BAA8B,GAC9B,WAAW,GACX,OAAO,GACP,SAAS,CAAC;AAEd,KAAK,kBAAkB,GAAG,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE;YACV,8BAA8B,CAAC,EAAE,MAAM,CAAC;YACxC,qBAAqB,CAAC,EAAE,MAAM,CAAC;YAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;YAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,eAAe,CAAC,EAAE,MAAM,CAAC;SAC1B,CAAC;KACH,CAAC;IACF,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,EAAE;QACZ,aAAa,CAAC,EAAE;YACd,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,uBAAuB,CAAC,EAAE,MAAM,CAAC;SAClC,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnC,uBAAuB,CAAC,EAAE,MAAM,CAAC;SAClC,CAAC;QACF,IAAI,CAAC,EAAE;YACL,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH,CAAC;IACF,OAAO,EAAE;QACP,YAAY,EAAE,gBAAgB,GAAG,QAAQ,CAAC;QAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,sBAAsB,CAAA;KAAE,CAAC,CAAC;CAC9F;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IAC9E,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE;QACN,OAAO,EAAE,QAAQ,CAAC;QAClB,MAAM,EAAE,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAClD,kBAAkB,EAAE,kBAAkB,CAAC;QACvC,YAAY,EAAE,+BAA+B,CAAC,cAAc,CAAC,CAAC;QAC9D,OAAO,EAAE,QAAQ,CACf,IAAI,CACF,+BAA+B,CAAC,SAAS,CAAC,EAC1C,cAAc,GAAG,SAAS,GAAG,qBAAqB,CACnD,CACF,GACC,IAAI,CACF,+BAA+B,CAAC,SAAS,CAAC,EAC1C,cAAc,GAAG,SAAS,GAAG,qBAAqB,CACnD,CAAC;QACJ,OAAO,EAAE;YACP,mBAAmB,EAAE,OAAO,CAAC;SAC9B,CAAC;KACH,CAAC;IACF,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7B,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,EAAE;QACP,gBAAgB,CAAC,EAAE,GAAG,CAAC;QACvB,kBAAkB,CAAC,EAAE,GAAG,CAAC;QACzB,YAAY,CAAC,EAAE,GAAG,CAAC;QACnB,cAAc,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,MAAM,CAAC;YAAC,uBAAuB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/F,IAAI,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/D,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,cAAc,CAAC,EAAE;YACf,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;QACF,aAAa,CAAC,EAAE,GAAG,CAAC;QACpB,aAAa,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAClE,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,QAAQ,CAAC;IAClB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACrC,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,cAAc,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,MAAM,CAAC;QAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,gBAAgB,GAAG,QAAQ,CAAC;QAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAk8BD,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC3C,GAAG,SAAa,QAOjB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,+BAA+B,CAAC;IACxC,YAAY,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;CAC9C,GAAG,oBAAoB,CAsDvB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,GAAG,wBAAwB,CAsDhG;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB,iBAsFA;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,QAWA;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,QAIA;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,QAWrE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CA+BjF;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAiBjF"}

package/dist/app-server/oauth-debugger-domain.js

@@ -266,11 +266,24 @@ function inferResourceMetadataUrl(baseUrl) {
     u.search = '';
     return u.toString();
 }
-function inferAuthServerMetadataUrl(issuerOrBase) {
-    const u = new URL(issuerOrBase);
-    u.pathname = '/.well-known/oauth-authorization-server';
-    u.search = '';
-    return u.toString();
+// Returns candidate URLs to try for auth server metadata, in priority order:
+//   1. OIDC relative to issuer path  — covers Keycloak, Auth0, and any path-based issuer
+//   2. RFC 8414 path-based           — /.well-known/oauth-authorization-server/{path}
+//   3. RFC 8414 root                 — /.well-known/oauth-authorization-server
+//   4. OIDC at origin                — final fallback for root-only OIDC providers
+function authServerMetadataCandidates(issuerUrl) {
+    const u = new URL(issuerUrl);
+    const base = issuerUrl.replace(/\/$/, '');
+    const hasPath = u.pathname && u.pathname !== '/';
+    const candidates = [
+        `${base}/.well-known/openid-configuration`,
+        ...(hasPath
+            ? [`${u.origin}/.well-known/oauth-authorization-server${u.pathname.replace(/\/$/, '')}`]
+            : []),
+        `${u.origin}/.well-known/oauth-authorization-server`,
+        ...(hasPath ? [`${u.origin}/.well-known/openid-configuration`] : [])
+    ];
+    return [...new Set(candidates)];
 }
 function localCallbackUrl(session, appBaseUrl) {
     return `${appBaseUrl.replace(/\/$/, '')}/api/oauth-debugger/sessions/${session.id}/callback`;
@@ -361,9 +374,34 @@ async function stepResolveTargetMetadata(session) {
     const server = session.serverConfig;
     if (!server)
         throw new Error(`MCP server '${session.config.target.serverName}' not found`);
+    // RFC 9728: probe the MCP server first. A 401/403 response may carry a
+    // WWW-Authenticate header with an explicit resource_metadata URL, which is
+    // more reliable than the inferred /.well-known path.
+    let probedResourceMetadataUrl;
+    if (!session.config.target.overrides?.authorizationServerMetadataUrl) {
+        const probeUrl = session.config.target.overrides?.resourceBaseUrl || server.url;
+        try {
+            const probeResponse = await fetchWithTrace({
+                session,
+                stepId,
+                label: 'MCP Server Probe',
+                url: probeUrl,
+                timeoutMs: 10_000
+            });
+            const wwwAuth = probeResponse.response.headers.get('www-authenticate') ?? '';
+            if (wwwAuth) {
+                const match = /resource_metadata=(?:"([^"]+)"|(\S+))/i.exec(wwwAuth);
+                if (match)
+                    probedResourceMetadataUrl = match[1] ?? match[2];
+            }
+        }
+        catch {
+            // probe is best-effort — network errors are fine here
+        }
+    }
     const resourceMetadataUrl = session.config.target.overrides?.authorizationServerMetadataUrl
         ? undefined
-        : inferResourceMetadataUrl(session.config.target.overrides?.resourceBaseUrl || server.url);
+        : probedResourceMetadataUrl ?? inferResourceMetadataUrl(session.config.target.overrides?.resourceBaseUrl || server.url);
     if (resourceMetadataUrl) {
         try {
             const { response, responseJson, responseText } = await fetchWithTrace({
@@ -397,34 +435,50 @@ async function stepResolveTargetMetadata(session) {
             });
         }
     }
-    const authMetadataUrl = session.config.target.overrides?.authorizationServerMetadataUrl ||
-        (session.context.resourceMetadata?.authorization_servers?.[0]
-            ? inferAuthServerMetadataUrl(String(session.context.resourceMetadata.authorization_servers[0]))
-            : session.context.resourceMetadata?.authorization_server
-                ? inferAuthServerMetadataUrl(String(session.context.resourceMetadata.authorization_server))
-                : undefined);
-    if (authMetadataUrl) {
-        const { response, responseJson, responseText } = await fetchWithTrace({
-            session,
-            stepId,
-            label: 'Authorization Server Metadata',
-            url: authMetadataUrl
-        });
-        if (!response.ok) {
-            throw new Error(`Authorization server metadata request failed (${response.status})`);
+    // Build the ordered candidate list for auth server metadata.
+    // If the user supplied a direct metadata URL override, use it as-is.
+    // Otherwise derive candidates from the issuer URL found in resource metadata,
+    // or fall back to candidates based on the MCP server URL itself.
+    const overrideMetadataUrl = session.config.target.overrides?.authorizationServerMetadataUrl;
+    const issuerFromMetadata = session.context.resourceMetadata?.authorization_servers?.[0]
+        ? String(session.context.resourceMetadata.authorization_servers[0])
+        : session.context.resourceMetadata?.authorization_server
+            ? String(session.context.resourceMetadata.authorization_server)
+            : undefined;
+    const metadataCandidates = overrideMetadataUrl
+        ? [overrideMetadataUrl]
+        : authServerMetadataCandidates(issuerFromMetadata ?? session.config.target.overrides?.resourceBaseUrl ?? server.url);
+    let authMetadataFetched = false;
+    for (const candidateUrl of metadataCandidates) {
+        try {
+            const { response, responseJson } = await fetchWithTrace({
+                session,
+                stepId,
+                label: 'Authorization Server Metadata',
+                url: candidateUrl
+            });
+            if (response.ok && responseJson?.authorization_endpoint) {
+                session.context.authServerMetadata = responseJson;
+                authMetadataFetched = true;
+                break;
+            }
+        }
+        catch {
+            // try next candidate
         }
-        session.context.authServerMetadata = responseJson ?? { raw: responseText };
     }
-    else {
+    if (!authMetadataFetched) {
         session.context.authServerMetadata = {};
-        addValidation(session, {
-            stepId,
-            severity: 'warning',
-            code: 'auth_metadata_missing',
-            title: 'Authorization metadata URL not discovered',
-            detail: 'Could not derive authorization server metadata URL automatically from the selected MCP server.',
-            recommendation: 'Use Advanced overrides to set authorization/token/registration endpoints.'
-        });
+        if (!session.config.target.overrides?.authorizationEndpoint) {
+            addValidation(session, {
+                stepId,
+                severity: 'warning',
+                code: 'auth_metadata_missing',
+                title: 'Authorization metadata URL not discovered',
+                detail: 'Could not derive authorization server metadata URL automatically from the selected MCP server.',
+                recommendation: 'Use Advanced overrides to set authorization/token/registration endpoints.'
+            });
+        }
     }
     if (session.config.target.overrides?.authorizationEndpoint) {
         session.context.authServerMetadata = {
@@ -444,6 +498,20 @@ async function stepResolveTargetMetadata(session) {
             registration_endpoint: session.config.target.overrides.registrationEndpoint
         };
     }
+    // Scope auto-discovery: when no scopes are configured, derive them from
+    // discovered metadata so the authorization request isn't sent scope-less.
+    if ((session.config.runtime.scopes ?? []).length === 0) {
+        const fromResource = session.context.resourceMetadata?.scopes_supported;
+        const fromAuthServer = session.context.authServerMetadata?.scopes_supported;
+        const discovered = Array.isArray(fromResource)
+            ? fromResource
+            : Array.isArray(fromAuthServer)
+                ? fromAuthServer
+                : [];
+        if (discovered.length > 0) {
+            session.config.runtime.scopes = discovered;
+        }
+    }
     markStepCompleted(session, stepId, 'Metadata resolution finished');
 }
 async function stepResolveRegistrationSource(session) {
@@ -502,7 +570,9 @@ async function stepDcr(session) {
     const redirectUri = requiredString(session.context.callbackUrl, 'Callback URL not set');
     const bodyObj = {
         redirect_uris: [redirectUri],
-        token_endpoint_auth_method: session.config.clientConfig.dcr?.tokenEndpointAuthMethod ?? 'none',
+        ...(session.config.clientConfig.dcr?.tokenEndpointAuthMethod
+            ? { token_endpoint_auth_method: session.config.clientConfig.dcr.tokenEndpointAuthMethod }
+            : {}),
         client_name: 'MCP Lab OAuth Debugger',
         grant_types: ['authorization_code'],
         response_types: ['code'],
@@ -920,6 +990,9 @@ export function oauthDebuggerSessionView(session) {
             tokenType: typeof token?.token_type === 'string' ? token.token_type : undefined,
             grantedScopes: typeof token?.scope === 'string'
                 ? String(token.scope).split(/\s+/).filter(Boolean)
+                : undefined,
+            accessToken: session.config.display.showSensitiveValues && typeof token?.access_token === 'string'
+                ? token.access_token
                 : undefined
         }
     };