@keystrokehq/platform 0.1.117 → 0.1.118

package/dist/{dist-AKkRwuhE.cjs → dist-ZPZwDr3w.cjs}

@@ -1,4 +1,4 @@
-const require_dist$3 = require("./dist-bLC4LOvt.cjs");
+const require_dist$3 = require("./dist-1gAqMJCK.cjs");
 let node_crypto = require("node:crypto");
 let _keystrokehq_database = require("@keystrokehq/database");
 let node_events = require("node:events");
@@ -10224,6 +10224,7 @@ function mcpProbeToAppTemplate(probe) {
 	};
 	return {
 		authKind: "api_key",
+		credentialScheme: "NO_AUTH",
 		credentialFields: {},
 		oauthScopes: [],
 		url
@@ -10724,10 +10725,10 @@ const CreateCredentialsRequestSchema = CredentialTargetsFieldsSchema.extend({
 		message: "OAuth credentials are created via the OAuth callback",
 		path: ["connectionKind"]
 	});
-	if (input.connectionKind === "none") ctx.addIssue({
+	if (input.connectionKind === "none" && input.value) ctx.addIssue({
 		code: "custom",
-		message: "No-auth credentials are created via the connect dialog",
-		path: ["connectionKind"]
+		message: "value is not allowed for no-auth connections",
+		path: ["value"]
 	});
 });
 /** Request body for `PATCH /api/credentials/:id`. */
@@ -13187,7 +13188,7 @@ function registerWorkflowRunGetter(fn) {
 }
 new node_async_hooks.AsyncLocalStorage();
 //#endregion
-//#region ../../packages/credentials/dist/store-C6DRzb2o.mjs
+//#region ../../packages/credentials/dist/store-B7IWQPwD.mjs
 function normalizeRow(row) {
 	const { projectId: _projectId, ...rest } = row;
 	return rest;
@@ -24843,21 +24844,29 @@ var StreamableHTTPClientTransport = class {
 };
 //#endregion
 //#region ../../packages/mcp/dist/index.mjs
-/** Union OAuth scope names from metadata sources, preserving first-seen order. */
-function mergeOAuthScopes(...lists) {
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const list of lists) {
-		if (!list?.length) continue;
-		for (const scope of list) {
-			const trimmed = scope.trim();
-			if (trimmed && !seen.has(trimmed)) {
-				seen.add(trimmed);
-				result.push(trimmed);
-			}
-		}
-	}
-	return result;
+function challengeParameter(value, name) {
+	const match = new RegExp(`(?:^|,)\\s*${name}\\s*=\\s*(?:"((?:[^"\\\\]|\\\\.)*)"|([^,\\s]+))`, "i").exec(value);
+	return (match?.[1] ?? match?.[2])?.replace(/\\(["\\])/g, "$1").trim() || void 0;
+}
+/** Parse the Bearer challenge even when another authentication scheme appears first. */
+function parseMcpBearerChallenge(response) {
+	const header = response.headers.get("www-authenticate");
+	if (!header) return {};
+	const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(header);
+	if (!bearer) return {};
+	const parameters = header.slice(bearer.index + bearer[0].length);
+	const resourceMetadata = challengeParameter(parameters, "resource_metadata");
+	const scope = challengeParameter(parameters, "scope");
+	const error = challengeParameter(parameters, "error");
+	let resourceMetadataUrl;
+	if (resourceMetadata) try {
+		resourceMetadataUrl = new URL(resourceMetadata);
+	} catch {}
+	return {
+		...resourceMetadataUrl ? { resourceMetadataUrl } : {},
+		...scope ? { scope } : {},
+		...error ? { error } : {}
+	};
 }
 /** Thrown when a URL is not safe for server-side outbound fetch (SSRF guard). */
 var PublicHttpUrlError = class extends Error {
@@ -24970,6 +24979,7 @@ function createPublicHttpFetch(fetchFn = fetch) {
 		});
 	};
 }
+const MCP_AUTHORIZATION_PROTOCOL_VERSION = "2025-11-25";
 function resourceNameFromMetadata(metadata) {
 	return metadata?.resource_name?.trim() || void 0;
 }
@@ -24989,6 +24999,74 @@ async function probeUnauthenticatedStatus(url, fetchFn) {
 		return {};
 	}
 }
+function assertHttps(value, label) {
+	if (new URL(value).protocol !== "https:") throw new Error(`${label} must use HTTPS`);
+}
+function assertPublicHttpsUrl(value, label) {
+	assertPublicHttpUrl(value);
+	assertHttps(value, label);
+}
+function assertResourceIdentity(serverUrl, resource) {
+	const resourceUrl = new URL(resource);
+	if (serverUrl.hash || resourceUrl.hash || resourceUrl.toString() !== serverUrl.toString()) throw new Error("MCP protected resource does not match the requested MCP server URL");
+}
+function validateAuthorizationServerMetadata(authorizationServerUrl, metadata) {
+	if (metadata.issuer !== authorizationServerUrl) throw new Error("MCP authorization server metadata issuer does not match authorization server");
+	if (!metadata.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP authorization server metadata is missing required endpoints");
+	assertPublicHttpsUrl(metadata.authorization_endpoint, "MCP authorization endpoint");
+	assertPublicHttpsUrl(metadata.token_endpoint, "MCP token endpoint");
+	if (metadata.registration_endpoint) assertPublicHttpsUrl(metadata.registration_endpoint, "MCP registration endpoint");
+}
+async function discoverMcpOAuthServerFromProbe(url, safeFetch, initial) {
+	const serverUrl = new URL(url);
+	assertHttps(serverUrl, "MCP server URL");
+	const { status } = initial;
+	const wwwAuthenticate = status === 401 ? initial.wwwAuthenticate : void 0;
+	let resourceMetadataUrl;
+	let challengeScope;
+	if (wwwAuthenticate) {
+		const params = parseMcpBearerChallenge(new Response(null, { headers: { "www-authenticate": wwwAuthenticate } }));
+		resourceMetadataUrl = params.resourceMetadataUrl;
+		challengeScope = params.scope?.trim() || void 0;
+		if (resourceMetadataUrl) {
+			assertPublicHttpUrl(resourceMetadataUrl.toString());
+			assertHttps(resourceMetadataUrl, "MCP resource metadata URL");
+		}
+	}
+	const resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {
+		protocolVersion: MCP_AUTHORIZATION_PROTOCOL_VERSION,
+		...resourceMetadataUrl ? { resourceMetadataUrl } : {}
+	}, safeFetch);
+	if (!resourceMetadata.resource) throw new Error("MCP protected resource metadata is missing resource");
+	if (!resourceMetadata.authorization_servers?.length) throw new Error("MCP protected resource metadata is missing authorization_servers");
+	assertResourceIdentity(serverUrl, resourceMetadata.resource);
+	const authorizationServerUrl = resourceMetadata.authorization_servers[0];
+	if (!authorizationServerUrl) throw new Error("MCP protected resource metadata is missing authorization_servers");
+	assertPublicHttpsUrl(authorizationServerUrl, "MCP authorization server URL");
+	const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, {
+		fetchFn: safeFetch,
+		protocolVersion: MCP_AUTHORIZATION_PROTOCOL_VERSION
+	});
+	if (!authorizationServerMetadata) throw new Error("MCP authorization server metadata was not found");
+	validateAuthorizationServerMetadata(authorizationServerUrl, authorizationServerMetadata);
+	return {
+		authorizationServerUrl,
+		authorizationServerMetadata,
+		resourceMetadata,
+		...resourceMetadataUrl ? { resourceMetadataUrl: resourceMetadataUrl.toString() } : {},
+		...challengeScope ? { challengeScope } : {},
+		...status !== void 0 ? { unauthenticatedStatus: status } : {}
+	};
+}
+/**
+* Discover an MCP authorization server without the legacy origin fallback.
+* MCP 2025-11-25 requires protected-resource metadata for AS selection.
+*/
+async function discoverMcpOAuthServer(url, fetchFn = fetch) {
+	assertPublicHttpUrl(url);
+	const safeFetch = createPublicHttpFetch(fetchFn);
+	return discoverMcpOAuthServerFromProbe(url, safeFetch, await probeUnauthenticatedStatus(url, safeFetch));
+}
 function scopesFromMetadata(metadata) {
 	if (!metadata?.scopes_supported?.length) return [];
 	return metadata.scopes_supported;
@@ -25001,68 +25079,37 @@ function logProbeFallback(phase, error) {
 async function probeMcpAuth(url, fetchFn = fetch) {
 	assertPublicHttpUrl(url);
 	const safeFetch = createPublicHttpFetch(fetchFn);
-	const serverUrl = new URL(url);
-	const { status, wwwAuthenticate } = await probeUnauthenticatedStatus(url, safeFetch);
-	let resourceMetadataUrl;
-	if (wwwAuthenticate) {
-		resourceMetadataUrl = extractWWWAuthenticateParams(new Response(null, { headers: { "www-authenticate": wwwAuthenticate } })).resourceMetadataUrl?.toString();
-		if (resourceMetadataUrl) assertPublicHttpUrl(resourceMetadataUrl);
-	}
+	const initial = await probeUnauthenticatedStatus(url, safeFetch);
 	try {
-		const discovered = await discoverOAuthServerInfo(serverUrl, {
-			fetchFn: safeFetch,
-			...resourceMetadataUrl ? { resourceMetadataUrl: new URL(resourceMetadataUrl) } : {}
-		});
+		const discovered = await discoverMcpOAuthServerFromProbe(url, safeFetch, initial);
 		const metadata = discovered.authorizationServerMetadata;
 		if (metadata?.authorization_endpoint && metadata.token_endpoint) return {
 			url,
 			mode: "oauth",
-			unauthenticatedStatus: status,
+			unauthenticatedStatus: initial.status,
 			oauth: {
 				issuer: metadata.issuer,
 				authorizationEndpoint: metadata.authorization_endpoint,
 				tokenEndpoint: metadata.token_endpoint,
 				registrationEndpoint: metadata.registration_endpoint,
-				scopes: mergeOAuthScopes(scopesFromMetadata(metadata), scopesFromMetadata(discovered.resourceMetadata)),
+				scopes: discovered.challengeScope ? discovered.challengeScope.split(/\s+/).filter(Boolean) : scopesFromMetadata(discovered.resourceMetadata),
 				resource: discovered.resourceMetadata?.resource,
 				resourceName: resourceNameFromMetadata(discovered.resourceMetadata)
 			}
 		};
 	} catch (error) {
-		logProbeFallback("discoverOAuthServerInfo", error);
-	}
-	try {
-		const protectedResource = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, safeFetch);
-		const authorizationServerUrl = protectedResource.authorization_servers?.[0] ?? serverUrl.origin;
-		assertPublicHttpUrl(authorizationServerUrl);
-		const metadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: safeFetch });
-		if (metadata?.authorization_endpoint && metadata.token_endpoint) return {
-			url,
-			mode: "oauth",
-			unauthenticatedStatus: status,
-			oauth: {
-				issuer: metadata.issuer,
-				authorizationEndpoint: metadata.authorization_endpoint,
-				tokenEndpoint: metadata.token_endpoint,
-				registrationEndpoint: metadata.registration_endpoint,
-				scopes: mergeOAuthScopes(scopesFromMetadata(metadata), scopesFromMetadata(protectedResource)),
-				resource: protectedResource.resource,
-				resourceName: resourceNameFromMetadata(protectedResource)
-			}
-		};
-	} catch (error) {
-		logProbeFallback("discoverOAuthProtectedResourceMetadata", error);
+		logProbeFallback("discoverMcpOAuthServer", error);
 	}
-	if (status === 401 || status === 403) return {
+	if (initial.status === 401 || initial.status === 403) return {
 		url,
 		mode: "token",
-		unauthenticatedStatus: status,
+		unauthenticatedStatus: initial.status,
 		scheme: "BEARER_TOKEN"
 	};
 	return {
 		url,
 		mode: "none",
-		unauthenticatedStatus: status
+		unauthenticatedStatus: initial.status
 	};
 }
 /** Best-effort server metadata for no-auth MCP servers (initialize handshake). */
@@ -31882,11 +31929,70 @@ async function describeCredentialBindings(requirements, context) {
 		preload
 	}, preload));
 }
-function encodeOAuthState(payload) {
-	return (0, _keystrokehq_database.encryptCredentialPayload)(JSON.stringify(payload));
-}
-function decodeOAuthState(state) {
-	return JSON.parse((0, _keystrokehq_database.decryptCredentialPayload)(state));
+const DEFAULT_STATE_TTL_MS = 600 * 1e3;
+function defaultSigningKey() {
+	const secret = process.env.CREDENTIALS_ENCRYPTION_KEY?.trim();
+	if (!secret) throw new Error("CREDENTIALS_ENCRYPTION_KEY is required");
+	return secret;
+}
+function signPayload(payload, signingKey) {
+	return (0, node_crypto.createHmac)("sha256", signingKey()).update(payload).digest("base64url");
+}
+function createOAuthState(options = {}) {
+	const signingKey = options.signingKey ?? defaultSigningKey;
+	const payload = options.payload ?? {};
+	const payloadSegment = (options.serializePayload ?? (() => ""))(payload);
+	const id = (0, node_crypto.randomBytes)(16).toString("hex");
+	const expiresAt = Date.now() + (options.ttlMs ?? DEFAULT_STATE_TTL_MS);
+	const signedPayload = payloadSegment ? `${id}.${expiresAt}.${payloadSegment}` : `${id}.${expiresAt}`;
+	return {
+		state: `${signedPayload}.${signPayload(signedPayload, signingKey)}`,
+		payload,
+		id,
+		expiresAt
+	};
+}
+function verifyOAuthState(options, state) {
+	if (!state) return null;
+	const hasPayload = Boolean(options.deserializePayload);
+	const parts = state.split(".");
+	if (parts.length !== (hasPayload ? 4 : 3)) return null;
+	const [id, expiresRaw] = parts;
+	const signature = parts.at(-1);
+	if (!id || !expiresRaw || !signature) return null;
+	const payloadSegment = hasPayload ? parts[2] ?? "" : "";
+	const expected = signPayload(hasPayload ? `${id}.${expiresRaw}.${payloadSegment}` : `${id}.${expiresRaw}`, options.signingKey ?? defaultSigningKey);
+	const signatureBuffer = Buffer.from(signature);
+	const expectedBuffer = Buffer.from(expected);
+	if (signatureBuffer.length !== expectedBuffer.length || !(0, node_crypto.timingSafeEqual)(signatureBuffer, expectedBuffer)) return null;
+	const expiresAt = Number(expiresRaw);
+	if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) return null;
+	if (!hasPayload) return {};
+	return options.deserializePayload(payloadSegment);
+}
+async function encodeOAuthState(payload, ttlMs) {
+	const { state, id, expiresAt } = createOAuthState({
+		payload,
+		ttlMs
+	});
+	await (0, _keystrokehq_platform_database.putOAuthPendingState)({
+		id,
+		payloadCiphertext: (0, _keystrokehq_database.encryptCredentialPayload)(JSON.stringify(payload)),
+		expiresAt: new Date(expiresAt)
+	});
+	return state;
+}
+async function decodeOAuthState(state) {
+	const verified = verifyOAuthState({}, state);
+	const id = state.split(".")[0];
+	if (!verified || !id) throw new Error("OAuth state is invalid or expired");
+	const ciphertext = await (0, _keystrokehq_platform_database.takeOAuthPendingState)(id);
+	if (!ciphertext) throw new Error("OAuth state is invalid or expired");
+	try {
+		return JSON.parse((0, _keystrokehq_database.decryptCredentialPayload)(ciphertext));
+	} catch {
+		throw new Error("OAuth state is invalid or expired");
+	}
 }
 function oauthAppMetadata(oauth, mcpUrl, options) {
 	return {
@@ -31897,7 +32003,9 @@ function oauthAppMetadata(oauth, mcpUrl, options) {
 		resource: oauth.resource,
 		issuer: oauth.issuer,
 		scopes: oauth.scopes,
-		...options?.tokenEndpointAuthMethod ? { tokenEndpointAuthMethod: options.tokenEndpointAuthMethod } : {}
+		...options?.tokenEndpointAuthMethod ? { tokenEndpointAuthMethod: options.tokenEndpointAuthMethod } : {},
+		...options?.clientRegistrationMode ? { clientRegistrationMode: options.clientRegistrationMode } : {},
+		...options?.redirectUri ? { redirectUri: options.redirectUri } : {}
 	};
 }
 function oauthClientSecretForStorage(clientSecret) {
@@ -31928,14 +32036,62 @@ async function discoverMcpApp(url) {
 	};
 }
 var McpOAuthConnectError = class extends Error {
+	phase;
 	diagnostics;
-	phase = "dynamic_client_registration";
-	constructor(cause, diagnostics) {
-		super(cause instanceof Error ? cause.message : "Dynamic client registration failed", { cause });
+	constructor(phase, message, diagnostics = {}) {
+		super(message);
+		this.phase = phase;
 		this.diagnostics = diagnostics;
 		this.name = "McpOAuthConnectError";
 	}
 };
+function oauthErrorCode(error) {
+	if (!error || typeof error !== "object" || !("errorCode" in error)) return;
+	const value = Reflect.get(error, "errorCode");
+	return typeof value === "string" && /^[a-z0-9_]+$/i.test(value) ? value : void 0;
+}
+const SUPPORTED_TOKEN_AUTH_METHODS = [
+	"client_secret_basic",
+	"client_secret_post",
+	"none"
+];
+function requireHttpsUrl(value, label) {
+	const url = new URL(value);
+	if (url.protocol !== "https:") throw new Error(`${label} must use HTTPS`);
+	return url;
+}
+function validateRedirectUri(value) {
+	const url = new URL(value);
+	const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocalhost)) throw new Error("OAuth redirect URI must use HTTPS or HTTP localhost");
+}
+function validateMcpResource(mcpUrl, resourceUrl) {
+	const serverUrl = new URL(mcpUrl);
+	if (serverUrl.hash || resourceUrl.hash || resourceUrl.toString() !== serverUrl.toString()) throw new Error("MCP protected resource does not identify the requested MCP server");
+}
+function selectTokenEndpointAuthMethod(metadata) {
+	const advertised = metadata.token_endpoint_auth_methods_supported;
+	const supported = advertised?.length ? advertised : ["client_secret_basic"];
+	const selected = SUPPORTED_TOKEN_AUTH_METHODS.find((method) => supported.includes(method));
+	if (!selected) throw new Error(`MCP authorization server only supports unsupported token endpoint authentication methods: ${supported.join(", ")}`);
+	return selected;
+}
+function validateAuthorizationCapabilities(metadata) {
+	if (!metadata.response_types_supported?.includes("code")) throw new Error("MCP authorization server does not support the code response type");
+	if (metadata.grant_types_supported?.length && !metadata.grant_types_supported.includes("authorization_code")) throw new Error("MCP authorization server does not support authorization_code");
+	if (!metadata.code_challenge_methods_supported?.includes("S256")) throw new Error("MCP authorization server does not advertise PKCE S256 support");
+}
+function validateRegisteredClientInformation(clientInformation, requestedMethod, advertisedMethods) {
+	const assignedMethod = clientInformation.token_endpoint_auth_method ?? requestedMethod;
+	if (!SUPPORTED_TOKEN_AUTH_METHODS.includes(assignedMethod)) throw new Error(`MCP authorization server assigned unsupported token endpoint authentication method: ${assignedMethod}`);
+	if (!advertisedMethods.includes(assignedMethod)) throw new Error(`MCP authorization server assigned an unadvertised token endpoint authentication method: ${assignedMethod}`);
+	if (assignedMethod !== "none" && !clientInformation.client_secret?.trim()) throw new Error(`MCP authorization server assigned ${assignedMethod} without a client_secret`);
+	return {
+		...clientInformation,
+		token_endpoint_auth_method: assignedMethod,
+		registrationMode: "dcr"
+	};
+}
 /**
 * Prefer CIMD (URL client_id) when the AS advertises support and we have an
 * HTTPS metadata URL; otherwise DCR. Localhost HTTP cannot be a CIMD client_id
@@ -31946,15 +32102,27 @@ var McpOAuthConnectError = class extends Error {
 */
 async function resolveMcpOAuthClientInformation(options) {
 	const supportsCimd = options.metadata.client_id_metadata_document_supported === true;
-	if (supportsCimd && Boolean(options.clientMetadataUrl) && isHttpsUrl(options.clientMetadataUrl) && options.clientMetadataUrl) return {
+	const supportsPublicClient = options.metadata.token_endpoint_auth_methods_supported?.includes("none") === true;
+	if (supportsCimd && supportsPublicClient && Boolean(options.clientMetadataUrl) && isHttpsUrl(options.clientMetadataUrl) && options.clientMetadataUrl) return {
 		client_id: options.clientMetadataUrl,
-		token_endpoint_auth_method: "none"
+		token_endpoint_auth_method: "none",
+		registrationMode: "cimd"
 	};
 	if (options.metadata.registration_endpoint) {
-		const grantTypes = ["authorization_code", "refresh_token"];
-		const tokenEndpointAuthMethod = "client_secret_post";
+		const grantTypes = ["authorization_code", ...options.metadata.grant_types_supported?.includes("refresh_token") ? ["refresh_token"] : []];
+		const tokenEndpointAuthMethod = selectTokenEndpointAuthMethod(options.metadata);
+		const currentlySupportedAuthMethods = options.metadata.token_endpoint_auth_methods_supported?.length ? options.metadata.token_endpoint_auth_methods_supported : ["client_secret_basic"];
+		const existing = await (0, _keystrokehq_platform_database.getDecryptedOAuthAppBySlug)(options.appSlug);
+		if (existing?.provider === "mcp" && existing.metadata?.clientRegistrationMode === "dcr" && existing.metadata.issuer === options.metadata.issuer && existing.metadata.registrationEndpoint === options.metadata.registration_endpoint && existing.metadata.resource === options.resource && existing.metadata.redirectUri === options.redirectUri && existing.metadata.tokenEndpointAuthMethod && SUPPORTED_TOKEN_AUTH_METHODS.includes(existing.metadata.tokenEndpointAuthMethod) && currentlySupportedAuthMethods.includes(existing.metadata.tokenEndpointAuthMethod)) return {
+			client_id: existing.clientId,
+			...existing.clientSecret ? { client_secret: existing.clientSecret } : {},
+			token_endpoint_auth_method: existing.metadata.tokenEndpointAuthMethod,
+			registrationMode: "dcr"
+		};
+		let providerHttpStatus;
 		try {
-			return await registerClient(options.authorizationServerUrl, {
+			const safeFetch = createPublicHttpFetch();
+			return validateRegisteredClientInformation(await registerClient(options.authorizationServerUrl, {
 				metadata: options.metadata,
 				clientMetadata: {
 					client_name: "Keystroke",
@@ -31963,54 +32131,112 @@ async function resolveMcpOAuthClientInformation(options) {
 					response_types: ["code"],
 					token_endpoint_auth_method: tokenEndpointAuthMethod
 				},
-				scope: options.scope
-			});
+				scope: options.scope,
+				fetchFn: async (input, init) => {
+					const response = await safeFetch(input, init);
+					providerHttpStatus = response.status;
+					return response;
+				}
+			}), tokenEndpointAuthMethod, currentlySupportedAuthMethods);
 		} catch (error) {
-			throw new McpOAuthConnectError(error, {
+			throw new McpOAuthConnectError("client_registration", providerHttpStatus === 403 ? "MCP server rejected dynamic client registration; it may require a pre-approved OAuth client" : "MCP OAuth client registration failed", {
+				correlationId: options.correlationId,
 				authorizationServerUrl: options.authorizationServerUrl,
 				registrationEndpoint: options.metadata.registration_endpoint,
 				grantTypes,
-				tokenEndpointAuthMethod
+				tokenEndpointAuthMethod,
+				...providerHttpStatus ? { providerHttpStatus } : {},
+				...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
 			});
 		}
 	}
-	if (supportsCimd) throw new Error("Authorization server requires Client ID Metadata Documents, but Keystroke has no HTTPS client metadata URL configured (set PUBLIC_PLATFORM_URL or PUBLIC_PLATFORM_PROXY_URL to an HTTPS origin)");
+	if (supportsCimd) throw new Error("Authorization server supports Client ID Metadata Documents, but not Keystroke's public-client authentication or HTTPS metadata URL");
 	throw new Error("MCP authorization server does not support Client ID Metadata Documents or Dynamic Client Registration");
 }
 async function beginMcpOAuthConnect(options) {
 	const appUrl = options.app.url?.trim();
 	if (!appUrl || options.app.source !== "mcp" || options.app.authKind !== "oauth") throw new Error("App is not a direct MCP OAuth app");
-	const discovered = await discoverOAuthServerInfo(new URL(appUrl), {});
+	const correlationId = crypto.randomUUID();
+	let discovered;
+	try {
+		validateRedirectUri(options.redirectUri);
+		requireHttpsUrl(appUrl, "MCP server URL");
+		discovered = await discoverMcpOAuthServer(appUrl);
+	} catch {
+		throw new McpOAuthConnectError("resource_discovery", "Failed to discover MCP OAuth protected-resource metadata", { correlationId });
+	}
 	const metadata = discovered.authorizationServerMetadata;
-	if (!metadata?.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP server does not expose OAuth authorization metadata");
+	try {
+		if (!metadata?.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP server does not expose OAuth authorization metadata");
+		validateAuthorizationCapabilities(metadata);
+		requireHttpsUrl(discovered.authorizationServerUrl, "OAuth authorization server URL");
+		requireHttpsUrl(metadata.authorization_endpoint, "OAuth authorization endpoint");
+		requireHttpsUrl(metadata.token_endpoint, "OAuth token endpoint");
+		if (metadata.registration_endpoint) requireHttpsUrl(metadata.registration_endpoint, "OAuth registration endpoint");
+	} catch {
+		throw new McpOAuthConnectError("authorization_server_discovery", "MCP authorization server metadata is incompatible", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl
+		});
+	}
+	let resourceUrl;
+	try {
+		resourceUrl = requireHttpsUrl(discovered.resourceMetadata.resource, "MCP protected resource");
+		if (resourceUrl.hash) throw new Error("MCP protected resource must not include a fragment");
+		validateMcpResource(appUrl, resourceUrl);
+	} catch {
+		throw new McpOAuthConnectError("resource_discovery", "MCP protected-resource metadata contains an invalid resource", { correlationId });
+	}
 	const oauth = {
 		issuer: metadata.issuer,
 		authorizationEndpoint: metadata.authorization_endpoint,
 		tokenEndpoint: metadata.token_endpoint,
 		registrationEndpoint: metadata.registration_endpoint,
-		scopes: mergeOAuthScopes(metadata.scopes_supported, discovered.resourceMetadata?.scopes_supported, options.app.oauthScopes.map((scope) => scope.name)),
-		resource: discovered.resourceMetadata?.resource,
+		scopes: discovered.challengeScope ? discovered.challengeScope.split(/\s+/).filter(Boolean) : discovered.resourceMetadata.scopes_supported ?? [],
+		resource: resourceUrl.toString(),
 		resourceName: discovered.resourceMetadata?.resource_name?.trim() || void 0
 	};
-	const defaultScopeNames = options.app.oauthScopes.flatMap((entry) => entry.defaultSelected !== false ? [entry.name] : []);
-	const scope = options.input.scopes?.join(" ") || (defaultScopeNames.length > 0 ? defaultScopeNames.join(" ") : oauth.scopes.join(" "));
-	const clientInformation = await resolveMcpOAuthClientInformation({
-		authorizationServerUrl: discovered.authorizationServerUrl,
-		metadata,
-		redirectUri: options.redirectUri,
-		scope: scope || void 0,
-		clientMetadataUrl: options.clientMetadataUrl
-	});
-	await (0, _keystrokehq_platform_database.ensureOAuthApp)({
-		slug: options.app.slug,
-		provider: "mcp",
-		tokenStrategy: "refresh",
-		clientId: clientInformation.client_id,
-		clientSecret: oauthClientSecretForStorage(clientInformation.client_secret),
-		metadata: oauthAppMetadata(oauth, appUrl, { tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method })
-	});
-	const resourceUrl = oauth.resource ? new URL(oauth.resource) : new URL(appUrl);
+	const requestedScopes = options.input.scopes?.map((value) => value.trim()).filter(Boolean) ?? [];
+	const challengedScopes = discovered.challengeScope?.split(/\s+/).filter(Boolean) ?? [];
+	const selectedScopes = challengedScopes.length > 0 ? [...new Set([...challengedScopes, ...requestedScopes])] : requestedScopes.length > 0 ? requestedScopes : discovered.resourceMetadata.scopes_supported ?? [];
+	const scope = selectedScopes.length > 0 ? selectedScopes.join(" ") : void 0;
+	let clientInformation;
+	try {
+		clientInformation = await resolveMcpOAuthClientInformation({
+			appSlug: options.app.slug,
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl,
+			metadata,
+			resource: resourceUrl.toString(),
+			redirectUri: options.redirectUri,
+			scope,
+			clientMetadataUrl: options.clientMetadataUrl
+		});
+	} catch (error) {
+		if (error instanceof McpOAuthConnectError) throw error;
+		throw new McpOAuthConnectError("client_registration", "MCP authorization server does not support a compatible client registration", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl
+		});
+	}
+	try {
+		await (0, _keystrokehq_platform_database.ensureOAuthApp)({
+			slug: options.app.slug,
+			provider: "mcp",
+			tokenStrategy: "refresh",
+			clientId: clientInformation.client_id,
+			clientSecret: oauthClientSecretForStorage(clientInformation.client_secret),
+			metadata: oauthAppMetadata(oauth, appUrl, {
+				tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method,
+				clientRegistrationMode: clientInformation.registrationMode,
+				redirectUri: options.redirectUri
+			})
+		});
+	} catch {
+		throw new McpOAuthConnectError("credential_persistence", "Failed to save MCP OAuth client registration", { correlationId });
+	}
 	const statePayload = {
+		correlationId,
 		codeVerifier: "",
 		appSlug: options.app.slug,
 		organizationId: options.organizationId,
@@ -32022,76 +32248,107 @@ async function beginMcpOAuthConnect(options) {
 		authorizationServerUrl: discovered.authorizationServerUrl,
 		resource: oauth.resource,
 		oauthMetadata: oauth,
+		authorizationServerMetadata: metadata,
 		mcpUrl: appUrl,
 		redirectUri: options.redirectUri,
 		clientId: clientInformation.client_id,
 		clientSecret: clientInformation.client_secret,
 		tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method,
+		clientRegistrationMode: clientInformation.registrationMode,
 		label: options.input.label,
 		credentialInstanceId: options.input.credentialInstanceId
 	};
-	const { authorizationUrl, codeVerifier } = await startAuthorization(discovered.authorizationServerUrl, {
-		metadata,
-		clientInformation,
-		redirectUrl: options.redirectUri,
-		scope: scope || void 0,
-		resource: resourceUrl
-	});
+	let authorizationUrl;
+	let codeVerifier;
+	try {
+		({authorizationUrl, codeVerifier} = await startAuthorization(discovered.authorizationServerUrl, {
+			metadata,
+			clientInformation,
+			redirectUrl: options.redirectUri,
+			scope,
+			resource: resourceUrl
+		}));
+	} catch (error) {
+		throw new McpOAuthConnectError("authorization_start", "Failed to start MCP authorization", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl,
+			...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
+		});
+	}
 	statePayload.codeVerifier = codeVerifier;
-	const state = encodeOAuthState(statePayload);
+	const state = await encodeOAuthState(statePayload);
 	authorizationUrl.searchParams.set("state", state);
 	return { authorizeUrl: authorizationUrl.toString() };
 }
 async function completeMcpOAuthConnect(options) {
-	const payload = decodeOAuthState(options.state);
-	const metadata = {
-		issuer: payload.oauthMetadata.issuer ?? payload.authorizationServerUrl,
-		authorization_endpoint: payload.oauthMetadata.authorizationEndpoint,
-		token_endpoint: payload.oauthMetadata.tokenEndpoint,
-		registration_endpoint: payload.oauthMetadata.registrationEndpoint,
-		scopes_supported: payload.oauthMetadata.scopes,
-		response_types_supported: ["code"],
-		code_challenge_methods_supported: ["S256"]
-	};
+	const { payload } = options;
 	const resourceUrl = payload.resource ? new URL(payload.resource) : void 0;
-	const tokens = await exchangeAuthorization(payload.authorizationServerUrl, {
-		metadata,
-		clientInformation: {
-			client_id: payload.clientId,
-			...payload.clientSecret ? { client_secret: payload.clientSecret } : {},
-			...payload.tokenEndpointAuthMethod ? { token_endpoint_auth_method: payload.tokenEndpointAuthMethod } : {}
-		},
-		authorizationCode: options.code,
-		codeVerifier: payload.codeVerifier,
-		redirectUri: payload.redirectUri,
-		resource: resourceUrl
-	});
-	const { id: oauthAppId } = await (0, _keystrokehq_platform_database.ensureOAuthApp)({
-		slug: payload.appSlug,
-		provider: "mcp",
-		tokenStrategy: "refresh",
-		clientId: payload.clientId,
-		clientSecret: oauthClientSecretForStorage(payload.clientSecret),
-		metadata: oauthAppMetadata(payload.oauthMetadata, payload.mcpUrl, { tokenEndpointAuthMethod: payload.tokenEndpointAuthMethod })
-	});
-	const connectionId = await (0, _keystrokehq_platform_database.saveOAuthConnection)({
-		appId: oauthAppId,
-		externalId: payload.userId,
-		accessToken: tokens.access_token,
-		refreshToken: tokens.refresh_token,
-		accessTokenExpiresAt: accessTokenExpiresAt(tokens.expires_in),
-		grantedScopes: grantedScopesFromToken(tokens.scope, payload.oauthMetadata.scopes),
-		metadata: { mcpUrl: payload.oauthMetadata.resource }
-	});
-	await (0, _keystrokehq_database.ensureOAuthCredentialInstance)({
-		credentialKey: payload.appSlug,
-		connectionId,
-		accountLabel: payload.label,
-		externalId: payload.userId,
-		userLabel: payload.label,
-		targets: payload.scopeTargets,
-		credentialInstanceId: payload.credentialInstanceId
-	});
+	if (!resourceUrl) throw new McpOAuthConnectError("authorization_callback", "OAuth callback state is missing the MCP resource", { correlationId: payload.correlationId });
+	let tokens;
+	let providerHttpStatus;
+	try {
+		const safeFetch = createPublicHttpFetch();
+		tokens = await exchangeAuthorization(payload.authorizationServerUrl, {
+			metadata: payload.authorizationServerMetadata,
+			clientInformation: {
+				client_id: payload.clientId,
+				...payload.clientSecret ? { client_secret: payload.clientSecret } : {},
+				...payload.tokenEndpointAuthMethod ? { token_endpoint_auth_method: payload.tokenEndpointAuthMethod } : {}
+			},
+			authorizationCode: options.code,
+			codeVerifier: payload.codeVerifier,
+			redirectUri: payload.redirectUri,
+			resource: resourceUrl,
+			fetchFn: async (input, init) => {
+				const response = await safeFetch(input, init);
+				providerHttpStatus = response.status;
+				return response;
+			}
+		});
+	} catch (error) {
+		throw new McpOAuthConnectError("token_exchange", "MCP OAuth token exchange failed", {
+			correlationId: payload.correlationId,
+			authorizationServerUrl: payload.authorizationServerUrl,
+			...providerHttpStatus ? { providerHttpStatus } : {},
+			...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
+		});
+	}
+	let oauthAppId;
+	let connectionId;
+	try {
+		({id: oauthAppId} = await (0, _keystrokehq_platform_database.ensureOAuthApp)({
+			slug: payload.appSlug,
+			provider: "mcp",
+			tokenStrategy: "refresh",
+			clientId: payload.clientId,
+			clientSecret: oauthClientSecretForStorage(payload.clientSecret),
+			metadata: oauthAppMetadata(payload.oauthMetadata, payload.mcpUrl, {
+				tokenEndpointAuthMethod: payload.tokenEndpointAuthMethod,
+				clientRegistrationMode: payload.clientRegistrationMode,
+				redirectUri: payload.redirectUri
+			})
+		}));
+		connectionId = await (0, _keystrokehq_platform_database.saveOAuthConnection)({
+			appId: oauthAppId,
+			externalId: payload.userId,
+			accessToken: tokens.access_token,
+			refreshToken: tokens.refresh_token,
+			accessTokenExpiresAt: accessTokenExpiresAt(tokens.expires_in),
+			grantedScopes: grantedScopesFromToken(tokens.scope, payload.oauthMetadata.scopes),
+			metadata: { mcpUrl: payload.oauthMetadata.resource }
+		});
+		await (0, _keystrokehq_database.ensureOAuthCredentialInstance)({
+			credentialKey: payload.appSlug,
+			connectionId,
+			accountLabel: payload.label,
+			externalId: payload.userId,
+			userLabel: payload.label,
+			targets: payload.scopeTargets,
+			credentialInstanceId: payload.credentialInstanceId
+		});
+	} catch {
+		throw new McpOAuthConnectError("credential_persistence", "Failed to save the MCP OAuth credential", { correlationId: payload.correlationId });
+	}
 	return {
 		appSlug: payload.appSlug,
 		connectionId,
@@ -39121,4 +39378,4 @@ Object.defineProperty(exports, "withCredentialAssignments", {
 	}
 });
 
-//# sourceMappingURL=dist-AKkRwuhE.cjs.map
+//# sourceMappingURL=dist-ZPZwDr3w.cjs.map