@mcp-use/client 2.0.0-beta.12 → 2.0.0-beta.13

package/dist/auth/browser.d.ts

@@ -41,11 +41,13 @@ export declare class BrowserOAuthClientProvider implements OAuthClientProvider {
     readonly serverUrl: string;
     readonly staticClientInfo?: OAuthClientInformation;
     private session;
+    private readonly storage;
     readonly preventAutoAuth?: boolean;
     private useRedirectFlow?;
     private oauthProxyUrl?;
     private connectionUrl?;
     private proxyOAuthRequests;
+    private lastAttemptedAuthUrl;
     readonly onPopupWindow: ((url: string, features: string, window: globalThis.Window | null) => void) | undefined;
     constructor(serverUrl: string, options?: BrowserOAuthOptions);
     get storageKeyPrefix(): string;

package/dist/auth/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAiBtC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IAGnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAuBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAyKjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAIV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IASxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAyBhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,yEAAyE;IACzE,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAKT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDnE;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAiCxC,YAAY,IAAI,MAAM;CAqCvB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAwBtC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAG9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAwBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAyKjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAKV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IASxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAyBhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,yEAAyE;IACzE,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAKT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDnE;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAIxC,YAAY,IAAI,MAAM;CAwBvB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/auth/storage.d.ts

@@ -12,14 +12,23 @@ export interface KVStore {
     keys(): Promise<string[]> | string[];
 }
 /**
- * `KVStore` implementation backed by `globalThis.localStorage`.
+ * Encrypted `KVStore` backed by `globalThis.localStorage`.
+ *
+ * Values use AES-256-GCM with a non-extractable origin key held by IndexedDB.
+ * Legacy plaintext values are encrypted on first read. When durable browser
+ * cryptography is unavailable, the store removes plaintext and falls back to
+ * memory for the lifetime of this instance.
  *
  * @internal
  */
 export declare class LocalStorageKVStore implements KVStore {
-    get(key: string): string | null;
-    set(key: string, value: string): void;
+    private readonly fallback;
+    private keyPromise;
+    private durable;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
     remove(key: string): void;
     keys(): string[];
+    private getCryptoKey;
 }
 //# sourceMappingURL=storage.d.ts.map

package/dist/auth/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IACzD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1C,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;CACtC;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,OAAO;IACjD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAI/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIrC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIzB,IAAI,IAAI,MAAM,EAAE;CAQjB"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IACzD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1C,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;CACtC;AAeD;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,YAAW,OAAO;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,OAAO,CAAQ;IAEjB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoCxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCpD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IASzB,IAAI,IAAI,MAAM,EAAE;IAehB,OAAO,CAAC,YAAY;CAIrB"}

package/dist/index-browser.js

@@ -128,7 +128,7 @@ var Logger = class {
 var logger = Logger.get();
 
 // src/utils/version.ts
-var VERSION = "2.0.0-beta.11";
+var VERSION = "2.0.0-beta.13";
 function getPackageVersion() {
   return VERSION;
 }
@@ -589,6 +589,186 @@ setConnectorTelemetryTracker(
   (data) => Telemetry.getInstance().trackConnectorInit(data).catch(() => void 0)
 );
 
+// src/auth/storage.ts
+var AUTH_CRYPTO_DATABASE = "mcp-use-oauth-crypto";
+var AUTH_CRYPTO_STORE = "keys";
+var AUTH_CRYPTO_KEY = "aes-gcm-v1";
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder();
+var LocalStorageKVStore = class {
+  fallback = /* @__PURE__ */ new Map();
+  keyPromise;
+  durable = true;
+  async get(key) {
+    if (!this.durable) return this.fallback.get(key) ?? null;
+    let stored;
+    try {
+      stored = localStorage.getItem(key);
+    } catch {
+      this.durable = false;
+      return this.fallback.get(key) ?? null;
+    }
+    if (stored === null) return null;
+    const envelope = parseEncryptedEnvelope(stored);
+    if (!envelope) {
+      await this.set(key, stored);
+      return stored;
+    }
+    try {
+      const cryptoKey = await this.getCryptoKey();
+      const plaintext = await globalThis.crypto.subtle.decrypt(
+        {
+          name: "AES-GCM",
+          iv: decodeBase64(envelope.iv),
+          additionalData: textEncoder.encode(key)
+        },
+        cryptoKey,
+        decodeBase64(envelope.ciphertext)
+      );
+      return textDecoder.decode(plaintext);
+    } catch {
+      await this.remove(key);
+      return null;
+    }
+  }
+  async set(key, value) {
+    if (!this.durable) {
+      this.fallback.set(key, value);
+      return;
+    }
+    try {
+      const cryptoKey = await this.getCryptoKey();
+      const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+      const ciphertext = await globalThis.crypto.subtle.encrypt(
+        {
+          name: "AES-GCM",
+          iv,
+          additionalData: textEncoder.encode(key)
+        },
+        cryptoKey,
+        textEncoder.encode(value)
+      );
+      const envelope = {
+        v: 1,
+        alg: "A256GCM",
+        iv: encodeBase64(iv),
+        ciphertext: encodeBase64(new Uint8Array(ciphertext))
+      };
+      localStorage.setItem(key, JSON.stringify(envelope));
+      this.fallback.delete(key);
+    } catch {
+      this.durable = false;
+      try {
+        localStorage.removeItem(key);
+      } catch {
+      }
+      this.fallback.set(key, value);
+    }
+  }
+  remove(key) {
+    this.fallback.delete(key);
+    try {
+      localStorage.removeItem(key);
+    } catch {
+      this.durable = false;
+    }
+  }
+  keys() {
+    const out = new Set(this.fallback.keys());
+    if (this.durable) {
+      try {
+        for (let i = 0; i < localStorage.length; i++) {
+          const key = localStorage.key(i);
+          if (key) out.add(key);
+        }
+      } catch {
+        this.durable = false;
+      }
+    }
+    return [...out];
+  }
+  getCryptoKey() {
+    this.keyPromise ??= getOrCreateCryptoKey();
+    return this.keyPromise;
+  }
+};
+function parseEncryptedEnvelope(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== "object" || !("v" in parsed) || parsed.v !== 1 || !("alg" in parsed) || parsed.alg !== "A256GCM" || !("iv" in parsed) || typeof parsed.iv !== "string" || !("ciphertext" in parsed) || typeof parsed.ciphertext !== "string") {
+      return void 0;
+    }
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function getOrCreateCryptoKey() {
+  if (!globalThis.crypto?.subtle || typeof indexedDB === "undefined") {
+    throw new Error("Durable browser cryptography is unavailable");
+  }
+  const candidate = await globalThis.crypto.subtle.generateKey(
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+  const database = await openCryptoDatabase();
+  try {
+    return await new Promise((resolve, reject) => {
+      const transaction = database.transaction(AUTH_CRYPTO_STORE, "readwrite");
+      const store = transaction.objectStore(AUTH_CRYPTO_STORE);
+      const request = store.get(AUTH_CRYPTO_KEY);
+      let selected;
+      request.onsuccess = () => {
+        selected = request.result;
+        if (!selected) {
+          selected = candidate;
+          store.put(candidate, AUTH_CRYPTO_KEY);
+        }
+      };
+      request.onerror = () => reject(request.error);
+      transaction.oncomplete = () => {
+        if (selected) resolve(selected);
+        else reject(new Error("OAuth encryption key was not initialized"));
+      };
+      transaction.onerror = () => reject(transaction.error);
+      transaction.onabort = () => reject(transaction.error);
+    });
+  } finally {
+    database.close();
+  }
+}
+function openCryptoDatabase() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(AUTH_CRYPTO_DATABASE, 1);
+    request.onupgradeneeded = () => {
+      const database = request.result;
+      if (!database.objectStoreNames.contains(AUTH_CRYPTO_STORE)) {
+        database.createObjectStore(AUTH_CRYPTO_STORE);
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+    request.onblocked = () => reject(new Error("OAuth encryption database is blocked"));
+  });
+}
+function encodeBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function decodeBase64(value) {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index++) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+
+// src/auth/session-store.ts
+import { validateClientMetadataUrl } from "@modelcontextprotocol/client";
+
 // src/auth/url.ts
 function sanitizeUrl(raw) {
   const abort = () => {
@@ -613,29 +793,7 @@ function sanitizeParam([k, v]) {
   return `${encodeURIComponent(k)}${v.length > 0 ? `=${encodeURIComponent(v)}` : ""}`;
 }
 
-// src/auth/storage.ts
-var LocalStorageKVStore = class {
-  get(key) {
-    return localStorage.getItem(key);
-  }
-  set(key, value) {
-    localStorage.setItem(key, value);
-  }
-  remove(key) {
-    localStorage.removeItem(key);
-  }
-  keys() {
-    const out = [];
-    for (let i = 0; i < localStorage.length; i++) {
-      const k = localStorage.key(i);
-      if (k) out.push(k);
-    }
-    return out;
-  }
-};
-
 // src/auth/session-store.ts
-import { validateClientMetadataUrl } from "@modelcontextprotocol/client";
 var OAuthSessionStore = class _OAuthSessionStore {
   serverUrl;
   storageKeyPrefix;
@@ -947,16 +1105,25 @@ async function serializeBody(body) {
   if (body instanceof Blob) return await body.text();
   return body;
 }
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) {
+    end--;
+  }
+  return value.slice(0, end);
+}
 var BrowserOAuthClientProvider = class {
   serverUrl;
   staticClientInfo;
   session;
+  storage;
   // Browser-only state
   preventAutoAuth;
   useRedirectFlow;
   oauthProxyUrl;
   connectionUrl;
   proxyOAuthRequests;
+  lastAttemptedAuthUrl = null;
   onPopupWindow;
   constructor(serverUrl, options = {}) {
     if (options.staticClientInfo?.client_secret) {
@@ -965,10 +1132,11 @@ var BrowserOAuthClientProvider = class {
       );
     }
     this.serverUrl = serverUrl;
+    this.storage = new LocalStorageKVStore();
     this.session = new OAuthSessionStore(
       serverUrl,
       { ...options, allowClientSecret: false },
-      new LocalStorageKVStore()
+      this.storage
     );
     this.preventAutoAuth = options.preventAutoAuth;
     this.useRedirectFlow = options.useRedirectFlow;
@@ -1033,8 +1201,8 @@ var BrowserOAuthClientProvider = class {
       const [doc, ...suffixParts] = rest.split("/");
       if (!doc) return url;
       const suffix = suffixParts.length ? `/${suffixParts.join("/")}` : "";
-      const connectionPath = connection.pathname.replace(/\/+$/, "");
-      const targetPath = target.pathname.replace(/\/+$/, "");
+      const connectionPath = trimTrailingSlashes(connection.pathname);
+      const targetPath = trimTrailingSlashes(target.pathname);
       const newSuffix = suffix && suffix === connectionPath ? targetPath : suffix;
       return `${target.origin}/.well-known/${doc}${newSuffix}${requested.search}`;
     } catch {
@@ -1185,6 +1353,7 @@ var BrowserOAuthClientProvider = class {
     return this.session.tokens(ctx);
   }
   saveTokens(tokens, ctx) {
+    this.lastAttemptedAuthUrl = null;
     return this.session.saveTokens(tokens, ctx);
   }
   async clientInformation(ctx) {
@@ -1251,16 +1420,21 @@ var BrowserOAuthClientProvider = class {
    * use `redirectToAuthorization` for that.
    */
   async prepareAuthorizationUrl(authorizationUrl) {
-    return this.session.storeAuthorizationState(authorizationUrl, {
-      extraProviderOptions: {
-        oauthProxyUrl: this.oauthProxyUrl,
-        ...this.clientMetadataUrl ? { clientMetadataUrl: this.clientMetadataUrl } : {},
-        ...this.staticClientInfo ? { staticClientInfo: this.staticClientInfo } : {},
-        ...this.scope ? { scope: this.scope } : {}
-      },
-      flowType: this.useRedirectFlow ? "redirect" : "popup",
-      returnUrl: typeof window !== "undefined" ? window.location.href : void 0
-    });
+    const prepared = await this.session.storeAuthorizationState(
+      authorizationUrl,
+      {
+        extraProviderOptions: {
+          oauthProxyUrl: this.oauthProxyUrl,
+          ...this.clientMetadataUrl ? { clientMetadataUrl: this.clientMetadataUrl } : {},
+          ...this.staticClientInfo ? { staticClientInfo: this.staticClientInfo } : {},
+          ...this.scope ? { scope: this.scope } : {}
+        },
+        flowType: this.useRedirectFlow ? "redirect" : "popup",
+        returnUrl: typeof window !== "undefined" ? window.location.href : void 0
+      }
+    );
+    this.lastAttemptedAuthUrl = prepared;
+    return prepared;
   }
   /**
    * Redirects the user agent to the authorization URL, storing necessary state.
@@ -1312,64 +1486,24 @@ var BrowserOAuthClientProvider = class {
    * Retrieves the last URL passed to `redirectToAuthorization`. Useful for manual fallback.
    */
   getLastAttemptedAuthUrl() {
-    const storedUrl = localStorage.getItem(this.getKey("last_auth_url"));
-    if (!storedUrl) return null;
-    const storedCallbackUrl = localStorage.getItem(
-      this.getKey("last_auth_callback_url")
-    );
-    if (storedCallbackUrl !== this.callbackUrl) {
-      console.info(
-        `[${this.storageKeyPrefix}] Recovering stale OAuth state whose callback cannot be verified.`
-      );
-      this.clearStorage();
-      return null;
-    }
-    const sanitized = sanitizeUrl(storedUrl);
-    try {
-      const redirectUri = new URL(sanitized).searchParams.get("redirect_uri");
-      if (redirectUri && new URL(redirectUri).toString() !== new URL(this.callbackUrl).toString()) {
-        console.info(
-          `[${this.storageKeyPrefix}] Recovering stale OAuth state after the Inspector callback path changed.`
-        );
-        this.clearStorage();
-        return null;
-      }
-    } catch {
-      this.clearStorage();
-      return null;
-    }
-    return sanitized;
+    return this.lastAttemptedAuthUrl;
   }
   clearStorage() {
+    this.lastAttemptedAuthUrl = null;
     const prefixPattern = `${this.storageKeyPrefix}_${this.serverUrlHash}_`;
     const statePattern = `${this.storageKeyPrefix}:state_`;
     const keysToRemove = [];
     let count = 0;
-    for (let i = 0; i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (!key) continue;
+    for (const key of this.storage.keys()) {
       if (key.startsWith(prefixPattern)) {
         keysToRemove.push(key);
       } else if (key.startsWith(statePattern)) {
-        try {
-          const item = localStorage.getItem(key);
-          if (item) {
-            const state = JSON.parse(item);
-            if (state.serverUrlHash === this.serverUrlHash) {
-              keysToRemove.push(key);
-            }
-          }
-        } catch (e) {
-          console.warn(
-            `[${this.storageKeyPrefix}] Error parsing state key ${key} during clearStorage:`,
-            e
-          );
-        }
+        keysToRemove.push(key);
       }
     }
     const uniqueKeysToRemove = [...new Set(keysToRemove)];
     uniqueKeysToRemove.forEach((key) => {
-      localStorage.removeItem(key);
+      this.storage.remove(key);
       count++;
     });
     return count;