@mcp-use/client 2.0.0-beta.1 → 2.0.0-beta.11

package/dist/auth/browser.d.ts

@@ -85,10 +85,12 @@ export declare class BrowserOAuthClientProvider implements OAuthClientProvider {
      * therefore never alters fetch behavior for other servers, other
      * connections, or the rest of the page.
      *
-     * When this provider is not configured to proxy OAuth requests (no
-     * `oauthProxyUrl`, or `proxyOAuthRequests` disabled), the provided
-     * `baseFetch` is returned as-is (or `undefined` when none is given, letting
-     * the SDK fall back to its default `fetch`).
+     * OAuth metadata is always fetched with `cache: "no-store"`, including in
+     * direct mode. Authorization servers commonly vary CORS headers by Origin;
+     * bypassing the browser HTTP cache prevents a revalidated response cached
+     * for another localhost origin from poisoning discovery. When OAuth proxying
+     * is disabled or no `oauthProxyUrl` is configured, all requests still go
+     * directly to their original URLs.
      *
      * @param baseFetch - The fetch used for non-OAuth requests and for the
      *   underlying proxy calls. Defaults to the global `fetch`.
@@ -116,6 +118,8 @@ export declare class BrowserOAuthClientProvider implements OAuthClientProvider {
      * Returns `null` before a successful authorization discovery.
      */
     getTokenEndpoint(): Promise<string | null>;
+    /** Return the protected-resource URL selected during OAuth discovery. */
+    getResource(): Promise<string | null>;
     /**
      * Return the stored public OAuth client ID. Browser providers do not retain
      * client secrets.

package/dist/auth/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAiBtC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IAGnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAuBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAqIjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAIV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IASxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAOhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAKT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDnE;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAMxC,YAAY,IAAI,MAAM;CAqCvB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAiBtC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IAGnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAuBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAyKjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAIV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IASxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAyBhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,yEAAyE;IACzE,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAKT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDnE;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAiCxC,YAAY,IAAI,MAAM;CAqCvB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/auth/session-store.d.ts

@@ -86,7 +86,7 @@ export declare class OAuthSessionStore {
     saveClientInformation(clientInformation: OAuthClientInformation, ctx?: OAuthClientInformationContext): Promise<void>;
     saveCodeVerifier(codeVerifier: string): Promise<void>;
     codeVerifier(): Promise<string>;
-    invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
+    invalidateCredentials(scope: "all" | "registration" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
     /**
      * Persist the OAuth discovery state (authorization-server metadata resolved
      * during the auth flow). Stored with the same durability as the code
@@ -109,6 +109,11 @@ export declare class OAuthSessionStore {
      * persists this state during `auth()`, avoiding a second discovery flow.
      */
     getTokenEndpoint(): Promise<string | null>;
+    /**
+     * Return the protected-resource URL selected during OAuth discovery.
+     * Consumers can persist it and reuse it for server-side refresh exchanges.
+     */
+    getResource(): Promise<string | null>;
 }
 export {};
 //# sourceMappingURL=session-store.d.ts.map

package/dist/auth/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;QAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,UAAU,8BAA8B;IACtC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,iBAAiB,CAAU;gBAGjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,wBAAwB,EACjC,KAAK,EAAE,OAAO;IAyBhB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAYtC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAWxC;IAED,OAAO,CAAC,aAAa;YASP,cAAc;IAyCtB,MAAM,CACV,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAInC,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAWV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IA6CxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAkBV,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAW/B,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAsChB;;;;;OAKG;IACG,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,mEAAmE;IAC7D,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAahE;;;;;;OAMG;IACG,uBAAuB,CAC3B,gBAAgB,EAAE,GAAG,EACrB,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,MAAM,CAAC;IAiClB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAMjD"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;QAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,UAAU,8BAA8B;IACtC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,iBAAiB,CAAU;gBAGjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,wBAAwB,EACjC,KAAK,EAAE,OAAO;IAyBhB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAYtC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAWxC;IAED,OAAO,CAAC,aAAa;YASP,cAAc;IAyCtB,MAAM,CACV,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAInC,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAYV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAwDxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAkCV,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAW/B,qBAAqB,CACzB,KAAK,EACD,KAAK,GACL,cAAc,GACd,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,WAAW,GACd,OAAO,CAAC,IAAI,CAAC;IAoDhB;;;;;OAKG;IACG,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,mEAAmE;IAC7D,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAahE;;;;;;OAMG;IACG,uBAAuB,CAC3B,gBAAgB,EAAE,GAAG,EACrB,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,MAAM,CAAC;IAqClB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAOhD;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAI5C"}

package/dist/index-browser.d.ts

@@ -19,7 +19,7 @@ export * from "./transport/http.js";
 export * from "./utils/json-schema-validator.js";
 export { logger } from "./utils/logging.js";
 export { Tel, Telemetry, setTelemetrySource, setProductVersion, } from "./telemetry/telemetry-browser.js";
-export { telFetch, capturePostHog, captureScarf, POSTHOG_HOST, POSTHOG_API_KEY, SCARF_GATEWAY_URL, } from "./telemetry/tel-fetch.js";
+export { telFetch, capturePostHog, POSTHOG_HOST, POSTHOG_API_KEY, } from "./telemetry/tel-fetch.js";
 export { getPackageVersion, VERSION } from "./utils/version.js";
 export { detectFavicon } from "./utils/favicon.js";
 //# sourceMappingURL=index-browser.d.ts.map

package/dist/index-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index-browser.d.ts","sourceRoot":"","sources":["../src/index-browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,kCAAkC,CAAC;AAE1C,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gBAAgB,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAClE,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kCAAkC,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,GAAG,EACH,SAAS,EACT,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index-browser.d.ts","sourceRoot":"","sources":["../src/index-browser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,kCAAkC,CAAC;AAE1C,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,gBAAgB,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAClE,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kCAAkC,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,GAAG,EACH,SAAS,EACT,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index-browser.js

@@ -128,7 +128,7 @@ var Logger = class {
 var logger = Logger.get();
 
 // src/utils/version.ts
-var VERSION = "2.0.0-beta.0";
+var VERSION = "2.0.0-beta.10";
 function getPackageVersion() {
   return VERSION;
 }
@@ -265,62 +265,6 @@ async function telFetch(url, init) {
 }
 var POSTHOG_HOST = "https://eu.i.posthog.com";
 var POSTHOG_API_KEY = "phc_lyTtbYwvkdSbrcMQNPiKiiRWrrM1seyKIMjycSvItEI";
-var SCARF_GATEWAY_URL = "https://mcpuse.gateway.scarf.sh/events-ts";
-var SCARF_GATEWAY_BEACON_URL = "https://mcpuse.gateway.scarf.sh/simple/";
-var SCARF_BEACON_MAX_URL = 1800;
-var SCARF_BEACON_TRUNCATED_KEYS = /* @__PURE__ */ new Set(["query", "response", "messages"]);
-function stringifyScarfValue(value) {
-  if (value === null || value === void 0) return "";
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") {
-    return String(value);
-  }
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
-  }
-}
-function buildScarfBeaconUrl(properties, baseUrl = SCARF_GATEWAY_BEACON_URL) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(properties)) {
-    let serialized = stringifyScarfValue(value);
-    if (SCARF_BEACON_TRUNCATED_KEYS.has(key) && serialized.length > 120) {
-      serialized = `${serialized.slice(0, 117)}...`;
-    }
-    if (serialized !== "") params.set(key, serialized);
-  }
-  let url = `${baseUrl}${baseUrl.includes("?") ? "&" : "?"}${params.toString()}`;
-  if (url.length <= SCARF_BEACON_MAX_URL) return url;
-  const keys = [...params.keys()].sort(
-    (a, b) => (params.get(b)?.length ?? 0) - (params.get(a)?.length ?? 0)
-  );
-  for (const key of keys) {
-    if (url.length <= SCARF_BEACON_MAX_URL) break;
-    if (key === "event" || key === "user_id") continue;
-    params.delete(key);
-    url = `${baseUrl}${baseUrl.includes("?") ? "&" : "?"}${params.toString()}`;
-  }
-  return url.slice(0, SCARF_BEACON_MAX_URL);
-}
-function captureScarfPost(properties, endpoint) {
-  return telFetch(endpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    keepalive: true,
-    body: JSON.stringify(properties)
-  });
-}
-function captureScarfBeacon(properties, endpoint) {
-  try {
-    const url = buildScarfBeaconUrl(properties, endpoint);
-    const img = new Image();
-    img.referrerPolicy = "no-referrer-when-downgrade";
-    img.src = url;
-  } catch {
-  }
-  return Promise.resolve();
-}
 function capturePostHog(params) {
   const host = params.host ?? POSTHOG_HOST;
   const apiKey = params.apiKey ?? POSTHOG_API_KEY;
@@ -337,13 +281,6 @@ function capturePostHog(params) {
     })
   });
 }
-function captureScarf(properties, endpoint = SCARF_GATEWAY_URL) {
-  if (typeof window !== "undefined") {
-    const beaconEndpoint = endpoint === SCARF_GATEWAY_URL ? SCARF_GATEWAY_BEACON_URL : endpoint;
-    return captureScarfBeacon(properties, beaconEndpoint);
-  }
-  return captureScarfPost(properties, endpoint);
-}
 
 // src/telemetry/telemetry.ts
 function generateUUID() {
@@ -354,18 +291,6 @@ function secureRandomString() {
   globalThis.crypto.getRandomValues(array);
   return Array.from(array, (v) => v.toString(16).padStart(2, "0")).join("");
 }
-function isVersionGreater(a, b) {
-  const parse = (v) => v.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
-  const pa = parse(a);
-  const pb = parse(b);
-  const len = Math.max(pa.length, pb.length);
-  for (let i = 0; i < len; i++) {
-    const da = pa[i] ?? 0;
-    const db = pb[i] ?? 0;
-    if (da !== db) return da > db;
-  }
-  return false;
-}
 var USER_ID_STORAGE_KEY = "mcp_use_user_id";
 var PROJECT_API_KEY = "phc_lyTtbYwvkdSbrcMQNPiKiiRWrrM1seyKIMjycSvItEI";
 var HOST = "https://eu.i.posthog.com";
@@ -394,10 +319,7 @@ function createLocalStorageBackend() {
         localStorage.setItem(USER_ID_STORAGE_KEY, id);
       } catch {
       }
-    },
-    // Package-download dedup is node/Scarf-oriented; localStorage unused.
-    getDownloadedVersion: () => null,
-    setDownloadedVersion: () => void 0
+    }
   };
 }
 function detectRuntimeEnvironment() {
@@ -465,17 +387,13 @@ var Telemetry = class _Telemetry {
   _currUserId = null;
   _telemetryEnabled = false;
   _pending = /* @__PURE__ */ new Set();
-  _scarfEnabled = false;
   _runtimeEnvironment;
   _storageCapability;
   _storage;
-  /** True when node entry installed fs storage (package-download dedup). */
-  _fsBacked;
   _source;
   _productVersion;
   constructor() {
     this._runtimeEnvironment = detectRuntimeEnvironment();
-    this._fsBacked = configuredStorage !== null;
     this._storage = configuredStorage ?? createLocalStorageBackend() ?? null;
     this._storageCapability = this._storage ? "persistent" : "session-only";
     this._source = readSourceHint() || this._runtimeEnvironment;
@@ -494,14 +412,6 @@ var Telemetry = class _Telemetry {
         "Anonymized telemetry enabled. Set MCP_USE_ANONYMIZED_TELEMETRY=false to disable."
       );
       this._telemetryEnabled = true;
-      this._scarfEnabled = true;
-      if (this._fsBacked) {
-        setTimeout(() => {
-          this.trackPackageDownload({ triggered_by: "initialization" }).catch(
-            (e) => logger.debug(`Failed to track package download: ${e}`)
-          );
-        }, 0);
-      }
     }
   }
   get runtimeEnvironment() {
@@ -533,7 +443,7 @@ var Telemetry = class _Telemetry {
     this._productVersion = version;
   }
   get isEnabled() {
-    return this._telemetryEnabled || this._scarfEnabled;
+    return this._telemetryEnabled;
   }
   get userId() {
     if (this._currUserId) return this._currUserId;
@@ -556,7 +466,7 @@ var Telemetry = class _Telemetry {
     return this._currUserId;
   }
   async capture(event) {
-    if (!this._telemetryEnabled && !this._scarfEnabled) return;
+    if (!this._telemetryEnabled) return;
     const currentUserId = this.userId;
     const properties = {
       ...event.properties,
@@ -565,52 +475,15 @@ var Telemetry = class _Telemetry {
       source: this._source,
       runtime: this._runtimeEnvironment
     };
-    if (this._telemetryEnabled) {
-      const p = capturePostHog({
-        host: HOST,
-        apiKey: PROJECT_API_KEY,
-        event: event.name,
-        distinctId: currentUserId,
-        properties
-      });
-      this._pending.add(p);
-      void p.finally(() => this._pending.delete(p));
-    }
-    if (this._scarfEnabled) {
-      const p = captureScarf({
-        ...properties,
-        user_id: currentUserId,
-        event: event.name
-      });
-      this._pending.add(p);
-      void p.finally(() => this._pending.delete(p));
-    }
-  }
-  async trackPackageDownload(properties) {
-    if (!this._scarfEnabled || !this._fsBacked || !this._storage) return;
-    const currentVersion = getPackageVersion();
-    const saved = this._storage.getDownloadedVersion();
-    let firstDownload = false;
-    let shouldTrack = false;
-    if (!saved) {
-      shouldTrack = true;
-      firstDownload = true;
-      this._storage.setDownloadedVersion(currentVersion);
-    } else if (isVersionGreater(currentVersion, saved)) {
-      shouldTrack = true;
-      this._storage.setDownloadedVersion(currentVersion);
-    }
-    if (!shouldTrack) return;
-    await captureScarf({
-      ...properties || {},
-      mcp_use_version: currentVersion,
-      user_id: this.userId,
-      event: "package_download",
-      first_download: firstDownload,
-      language: "typescript",
-      source: this._source,
-      runtime: this._runtimeEnvironment
+    const p = capturePostHog({
+      host: HOST,
+      apiKey: PROJECT_API_KEY,
+      event: event.name,
+      distinctId: currentUserId,
+      properties
     });
+    this._pending.add(p);
+    void p.finally(() => this._pending.delete(p));
   }
   async trackAgentExecution(data) {
     if (!this.isEnabled) return;
@@ -868,29 +741,39 @@ var OAuthSessionStore = class _OAuthSessionStore {
     if (ctx) await this.store.set(this.credentialKey("tokens"), serialized);
     await this.store.remove(this.getKey("code_verifier"));
     await this.store.remove(this.getKey("last_auth_url"));
+    await this.store.remove(this.getKey("last_auth_callback_url"));
   }
   async clientInformation(ctx) {
+    if (!this.allowClientSecret) {
+      const registeredRedirectUri = await this.store.get(
+        this.getKey("client_info_redirect_uri")
+      );
+      if (registeredRedirectUri !== this.redirectUrl) {
+        await this.invalidateCredentials("registration");
+        console.info(
+          `[${this.storageKeyPrefix}] Re-registering browser OAuth client after its Inspector callback changed or could not be verified.`
+        );
+        return void 0;
+      }
+    }
     const stored = await this.readCredential("client_info", ctx);
     if (!stored) return void 0;
     const { key, value: clientInfo } = stored;
     try {
       if (!this.allowClientSecret && clientInfo.client_secret) {
-        await this.store.remove(key);
-        if (ctx) await this.store.remove(this.credentialKey("client_info"));
+        await this.invalidateCredentials("registration");
         console.warn(
-          `[${this.storageKeyPrefix}] Removed OAuth client information containing a browser client_secret.`
+          `[${this.storageKeyPrefix}] Recovered stale browser OAuth credentials containing a client_secret.`
         );
         return void 0;
       }
       const storedRedirectUris = Array.isArray(clientInfo.redirect_uris) ? clientInfo.redirect_uris : [];
-      const hasMatchingRedirect = storedRedirectUris.length === 0 || storedRedirectUris.includes(this.redirectUrl);
+      const hasMatchingRedirect = storedRedirectUris.length === 0 && this.allowClientSecret || storedRedirectUris.includes(this.redirectUrl);
       if (!hasMatchingRedirect) {
         console.info(
-          `[${this.storageKeyPrefix}] Invalidating cached OAuth client info due to redirect URI mismatch.`
+          `[${this.storageKeyPrefix}] Recovering cached OAuth credentials after a redirect URI change.`
         );
-        await this.store.remove(key);
-        await this.store.remove(this.credentialKey("tokens", ctx));
-        await this.store.remove(this.getKey("last_auth_url"));
+        await this.invalidateCredentials("registration");
         return void 0;
       }
       return clientInfo;
@@ -908,11 +791,20 @@ var OAuthSessionStore = class _OAuthSessionStore {
         "Browser OAuth clients must be public clients; client_secret persistence is not allowed."
       );
     }
-    const serialized = JSON.stringify(clientInformation);
+    const persistedClientInformation = !this.allowClientSecret && (!("redirect_uris" in clientInformation) || !Array.isArray(
+      clientInformation.redirect_uris
+    ) || clientInformation.redirect_uris.length === 0) ? { ...clientInformation, redirect_uris: [this.redirectUrl] } : clientInformation;
+    const serialized = JSON.stringify(persistedClientInformation);
     await this.store.set(this.credentialKey("client_info", ctx), serialized);
     if (ctx) {
       await this.store.set(this.credentialKey("client_info"), serialized);
     }
+    if (!this.allowClientSecret) {
+      await this.store.set(
+        this.getKey("client_info_redirect_uri"),
+        this.redirectUrl
+      );
+    }
   }
   async saveCodeVerifier(codeVerifier) {
     await this.store.set(this.getKey("code_verifier"), codeVerifier);
@@ -937,11 +829,22 @@ var OAuthSessionStore = class _OAuthSessionStore {
       }
     };
     switch (scope) {
+      case "registration":
+        await removeCredentialKeys("tokens");
+        await removeCredentialKeys("client_info");
+        await this.store.remove(this.getKey("code_verifier"));
+        await this.store.remove(this.getKey("last_auth_url"));
+        await this.store.remove(this.getKey("last_auth_callback_url"));
+        await this.store.remove(this.getKey("client_info_redirect_uri"));
+        await this.store.remove(this.getKey("token_endpoint"));
+        break;
       case "all":
         await removeCredentialKeys("tokens");
         await removeCredentialKeys("client_info");
         await this.store.remove(this.getKey("code_verifier"));
         await this.store.remove(this.getKey("last_auth_url"));
+        await this.store.remove(this.getKey("last_auth_callback_url"));
+        await this.store.remove(this.getKey("client_info_redirect_uri"));
         await this.store.remove(this.getKey("discovery_state"));
         await this.store.remove(this.getKey("token_endpoint"));
         break;
@@ -1011,6 +914,10 @@ var OAuthSessionStore = class _OAuthSessionStore {
     authorizationUrl.searchParams.set("state", state);
     const sanitizedAuthUrl = sanitizeUrl(authorizationUrl.toString());
     await this.store.set(stateKey, JSON.stringify(stateData));
+    await this.store.set(
+      this.getKey("last_auth_callback_url"),
+      this.redirectUrl
+    );
     await this.store.set(this.getKey("last_auth_url"), sanitizedAuthUrl);
     return sanitizedAuthUrl;
   }
@@ -1021,6 +928,14 @@ var OAuthSessionStore = class _OAuthSessionStore {
   async getTokenEndpoint() {
     return (await this.discoveryState())?.authorizationServerMetadata?.token_endpoint ?? null;
   }
+  /**
+   * Return the protected-resource URL selected during OAuth discovery.
+   * Consumers can persist it and reuse it for server-side refresh exchanges.
+   */
+  async getResource() {
+    const resource = (await this.discoveryState())?.resourceMetadata?.resource;
+    return typeof resource === "string" ? resource : null;
+  }
 };
 
 // src/auth/browser.ts
@@ -1138,20 +1053,19 @@ var BrowserOAuthClientProvider = class {
    * therefore never alters fetch behavior for other servers, other
    * connections, or the rest of the page.
    *
-   * When this provider is not configured to proxy OAuth requests (no
-   * `oauthProxyUrl`, or `proxyOAuthRequests` disabled), the provided
-   * `baseFetch` is returned as-is (or `undefined` when none is given, letting
-   * the SDK fall back to its default `fetch`).
+   * OAuth metadata is always fetched with `cache: "no-store"`, including in
+   * direct mode. Authorization servers commonly vary CORS headers by Origin;
+   * bypassing the browser HTTP cache prevents a revalidated response cached
+   * for another localhost origin from poisoning discovery. When OAuth proxying
+   * is disabled or no `oauthProxyUrl` is configured, all requests still go
+   * directly to their original URLs.
    *
    * @param baseFetch - The fetch used for non-OAuth requests and for the
    *   underlying proxy calls. Defaults to the global `fetch`.
    */
   getProxyFetch(baseFetch) {
-    if (!this.proxyOAuthRequests || !this.oauthProxyUrl) {
-      return baseFetch;
-    }
     const base = baseFetch ?? globalThis.fetch.bind(globalThis);
-    const oauthProxyUrl = this.oauthProxyUrl;
+    const oauthProxyUrl = this.proxyOAuthRequests && this.oauthProxyUrl ? this.oauthProxyUrl : void 0;
     const discoveredEndpoints = /* @__PURE__ */ new Set();
     let restoredDiscovery = false;
     return async (input, init) => {
@@ -1164,6 +1078,12 @@ var BrowserOAuthClientProvider = class {
         return await base(input, init);
       }
       const isMetadata = pathname.includes("/.well-known/");
+      if (!oauthProxyUrl) {
+        return await base(
+          isMetadata ? url : input,
+          isMetadata ? { ...init, cache: "no-store" } : init
+        );
+      }
       if (!restoredDiscovery) {
         restoredDiscovery = true;
         const metadata = (await this.discoveryState())?.authorizationServerMetadata;
@@ -1198,7 +1118,8 @@ var BrowserOAuthClientProvider = class {
       if (isMetadata) {
         const response2 = await base(proxyEndpoint, {
           ...init,
-          method: "GET"
+          method: "GET",
+          cache: "no-store"
         });
         try {
           const metadata = await response2.clone().json();
@@ -1216,23 +1137,40 @@ var BrowserOAuthClientProvider = class {
         }
         return response2;
       }
-      const body = init?.body ? await serializeBody(init.body) : void 0;
+      const inputRequest = input instanceof Request ? input : void 0;
+      const method = init?.method ?? inputRequest?.method ?? "POST";
+      const requestHeaders = init?.headers ?? inputRequest?.headers;
+      let body;
+      if (init?.body !== void 0 && init.body !== null) {
+        body = await serializeBody(init.body);
+      } else if (inputRequest?.body && method !== "GET" && method !== "HEAD") {
+        body = await inputRequest.clone().text();
+      }
       const response = await base(proxyEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           serverUrl: this.serverUrl,
           url,
-          method: init?.method || "POST",
-          headers: init?.headers ? Object.fromEntries(new Headers(init.headers)) : {},
+          method,
+          headers: requestHeaders ? Object.fromEntries(new Headers(requestHeaders)) : {},
           body
         })
       });
       const data = await response.json();
+      if (!response.ok || typeof data.status !== "number") {
+        return new Response(JSON.stringify(data), {
+          status: response.status,
+          statusText: response.statusText,
+          headers: response.headers
+        });
+      }
       return new Response(JSON.stringify(data.body), {
         status: data.status,
-        statusText: data.statusText,
-        headers: new Headers(data.headers)
+        statusText: typeof data.statusText === "string" ? data.statusText : void 0,
+        headers: new Headers(
+          data.headers && typeof data.headers === "object" ? data.headers : void 0
+        )
       });
     };
   }
@@ -1255,7 +1193,16 @@ var BrowserOAuthClientProvider = class {
   }
   async saveClientInformation(clientInformation, ctx) {
     if (this.staticClientInfo) return;
-    return this.session.saveClientInformation(clientInformation, ctx);
+    const { client_secret: discardedClientSecret, ...publicClientInformation } = clientInformation;
+    if (discardedClientSecret) {
+      console.info(
+        `[${this.storageKeyPrefix}] Discarded client_secret returned for a public browser OAuth client.`
+      );
+    }
+    return this.session.saveClientInformation(
+      publicClientInformation,
+      ctx
+    );
   }
   codeVerifier() {
     return this.session.codeVerifier();
@@ -1285,6 +1232,10 @@ var BrowserOAuthClientProvider = class {
   getTokenEndpoint() {
     return this.session.getTokenEndpoint();
   }
+  /** Return the protected-resource URL selected during OAuth discovery. */
+  getResource() {
+    return this.session.getResource();
+  }
   /**
    * Return the stored public OAuth client ID. Browser providers do not retain
    * client secrets.
@@ -1363,7 +1314,31 @@ var BrowserOAuthClientProvider = class {
   getLastAttemptedAuthUrl() {
     const storedUrl = localStorage.getItem(this.getKey("last_auth_url"));
     if (!storedUrl) return null;
-    return sanitizeUrl(storedUrl);
+    const storedCallbackUrl = localStorage.getItem(
+      this.getKey("last_auth_callback_url")
+    );
+    if (storedCallbackUrl !== this.callbackUrl) {
+      console.info(
+        `[${this.storageKeyPrefix}] Recovering stale OAuth state whose callback cannot be verified.`
+      );
+      this.clearStorage();
+      return null;
+    }
+    const sanitized = sanitizeUrl(storedUrl);
+    try {
+      const redirectUri = new URL(sanitized).searchParams.get("redirect_uri");
+      if (redirectUri && new URL(redirectUri).toString() !== new URL(this.callbackUrl).toString()) {
+        console.info(
+          `[${this.storageKeyPrefix}] Recovering stale OAuth state after the Inspector callback path changed.`
+        );
+        this.clearStorage();
+        return null;
+      }
+    } catch {
+      this.clearStorage();
+      return null;
+    }
+    return sanitized;
   }
   clearStorage() {
     const prefixPattern = `${this.storageKeyPrefix}_${this.serverUrlHash}_`;
@@ -4123,14 +4098,12 @@ export {
   MCPConnection as MCPSession,
   POSTHOG_API_KEY,
   POSTHOG_HOST,
-  SCARF_GATEWAY_URL,
   Tel,
   Telemetry,
   UnauthorizedError3 as UnauthorizedError,
   VERSION,
   auth2 as auth,
   capturePostHog,
-  captureScarf,
   completeOAuthFlow,
   createConnectorFromConfig,
   createOAuthProvider,