@mcp-use/client 2.0.0-beta.13 → 2.0.0-beta.15

package/dist/auth/browser.d.ts

@@ -48,6 +48,7 @@ export declare class BrowserOAuthClientProvider implements OAuthClientProvider {
     private connectionUrl?;
     private proxyOAuthRequests;
     private lastAttemptedAuthUrl;
+    private authorizationPending;
     readonly onPopupWindow: ((url: string, features: string, window: globalThis.Window | null) => void) | undefined;
     constructor(serverUrl: string, options?: BrowserOAuthOptions);
     get storageKeyPrefix(): string;
@@ -59,6 +60,8 @@ export declare class BrowserOAuthClientProvider implements OAuthClientProvider {
     get scope(): string | undefined;
     get clientMetadataUrl(): string | undefined;
     getKey(keySuffix: string): string;
+    get hasPendingFlow(): boolean;
+    markFlowComplete(): void;
     /**
      * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
      * (proxy) origin onto the actual MCP server.

package/dist/auth/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAwBtC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAG9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAwBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAyKjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAKV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IASxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAyBhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,yEAAyE;IACzE,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAKT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDnE;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAIxC,YAAY,IAAI,MAAM;CAwBvB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAwBtC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC;CACX;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAG9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,eAAe,CAAC,CAAU;IAClC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,oBAAoB,CAAS;IACrC,QAAQ,CAAC,aAAa,EAClB,CAAC,CACC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,IAAI,KAC7B,IAAI,CAAC,GACV,SAAS,CAAC;gBAEF,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;IAwBhE,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIjC,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,gBAAgB,IAAI,IAAI;IAIxB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,KAAK,GAAG,SAAS;IAyKjE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAMV,iBAAiB,CACrB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IASxC,qBAAqB,CACzB,iBAAiB,EAAE,sBAAsB,EACzC,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAyBhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI1C,yEAAyE;IACzE,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrC;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAKT;;;;;OAKG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBrE;;;OAGG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDnE;;OAEG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAIxC,YAAY,IAAI,MAAM;CAoBvB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,mBAAmB,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/auth/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/auth/callback.ts"],"names":[],"mappings":"AA4MA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGlD"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/auth/callback.ts"],"names":[],"mappings":"AAuMA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGlD"}

package/dist/auth/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/auth/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAgBtC;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAgB/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,mBAAmB,EAC7B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GAC3D,OAAO,CAAC,IAAI,CAAC,CAyBf"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/auth/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAmBtC;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAgB/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,mBAAmB,EAC7B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgCf"}

package/dist/auth/node.d.ts

@@ -19,6 +19,13 @@ export declare class OAuthFlowError extends Error {
     readonly description?: string;
     constructor(code: string, description?: string);
 }
+/** Authorization response captured by the Node loopback callback. */
+export interface NodeOAuthAuthorizationResponse {
+    /** Authorization code returned by the authorization server. */
+    code: string;
+    /** RFC 9207 authorization-server issuer, when present in the callback. */
+    iss?: string;
+}
 /**
  * Node/CLI OAuth client provider for MCP. Owns a localhost loopback callback
  * server, opens the user's browser, and resolves the authorization code via
@@ -38,7 +45,7 @@ export declare class NodeOAuthClientProvider implements OAuthClientProvider {
     private server;
     /** Currently in-flight deferred — used to prevent overlapping flows. */
     private pending;
-    /** Latest deferred (settled or in-flight) — what `getAuthorizationCode()` returns. */
+    /** Latest deferred (settled or in-flight) for the loopback response. */
     private lastFlow;
     private pendingTimer;
     private constructor();
@@ -67,11 +74,19 @@ export declare class NodeOAuthClientProvider implements OAuthClientProvider {
     redirectToAuthorization(authorizationUrl: URL): Promise<void>;
     /**
      * Resolves with the authorization code captured by the loopback callback.
+     *
+     * @remarks This compatibility method omits the RFC 9207 issuer. OAuth flow
+     * orchestrators should use {@link getAuthorizationResponse} when available.
      * Must be called after `redirectToAuthorization()`. Returns the same
      * promise whether the callback has fired or not — callers may subscribe
      * before or after.
      */
     getAuthorizationCode(): Promise<string>;
+    /**
+     * Resolves with the authorization code and RFC 9207 issuer captured by the
+     * loopback callback.
+     */
+    getAuthorizationResponse(): Promise<NodeOAuthAuthorizationResponse>;
     /**
      * Cancel an in-progress flow (timeout, SIGINT, etc.) and close the loopback.
      */

package/dist/auth/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/auth/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,oBAAoB,CAAC;AAM5B,MAAM,WAAW,gBAAiB,SAAQ,wBAAwB;IAChE,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrD;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAClB,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;CAM/C;AA+DD;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,mBAAmB,CAAC,CAAwC;IAEpE,OAAO,CAAC,MAAM,CAAuB;IACrC,wEAAwE;IACxE,OAAO,CAAC,OAAO,CAAiC;IAChD,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,YAAY,CAA+B;IAEnD,OAAO;WAeM,MAAM,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IA+CnC,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAID,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB,iBAAiB,CACf,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAI9C,qBAAqB,CACnB,IAAI,EAAE,sBAAsB,EAC5B,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB,gFAAgF;IAChF,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;;OAIG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CnE;;;;;OAKG;IACH,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAWvC;;OAEG;IACH,OAAO,IAAI,IAAI;IAQf,kDAAkD;IAClD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;;OAMG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;YAIa,aAAa;IAe3B,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,cAAc;CAqCvB;AAmBD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/auth/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,oBAAoB,CAAC;AAM5B,MAAM,WAAW,gBAAiB,SAAQ,wBAAwB;IAChE,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrD;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAClB,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;CAM/C;AAED,qEAAqE;AACrE,MAAM,WAAW,8BAA8B;IAC7C,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA+DD;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,EAAE,CAAU;IACpB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,mBAAmB,CAAC,CAAwC;IAEpE,OAAO,CAAC,MAAM,CAAuB;IACrC,wEAAwE;IACxE,OAAO,CAAC,OAAO,CAAyD;IACxE,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAyD;IACzE,OAAO,CAAC,YAAY,CAA+B;IAEnD,OAAO;WAeM,MAAM,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IA+CnC,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAID,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,MAAM,CACJ,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAInC,UAAU,CACR,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB,iBAAiB,CACf,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAI9C,qBAAqB,CACnB,IAAI,EAAE,sBAAsB,EAC5B,GAAG,CAAC,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/B,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,qBAAqB,CACnB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB,gFAAgF;IAChF,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,qEAAqE;IACrE,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAI1D;;;;OAIG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CnE;;;;;;;;OAQG;IACH,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIvC;;;OAGG;IACH,wBAAwB,IAAI,OAAO,CAAC,8BAA8B,CAAC;IAWnE;;OAEG;IACH,OAAO,IAAI,IAAI;IAQf,kDAAkD;IAClD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;;OAMG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;YAIa,aAAa;IAe3B,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,cAAc;CAsCvB;AAmBD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED,YAAY,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/index-browser.js

@@ -128,7 +128,7 @@ var Logger = class {
 var logger = Logger.get();
 
 // src/utils/version.ts
-var VERSION = "2.0.0-beta.13";
+var VERSION = "2.0.0-beta.15";
 function getPackageVersion() {
   return VERSION;
 }
@@ -148,16 +148,13 @@ var MCPAgentExecutionEvent = class extends BaseTelemetryEvent {
     return {
       // Core execution info
       execution_method: this.data.executionMethod,
-      query: this.data.query,
       query_length: this.data.query.length,
       success: this.data.success,
       // Agent configuration
       model_provider: this.data.modelProvider,
       model_name: this.data.modelName,
       server_count: this.data.serverCount,
-      server_identifiers: this.data.serverIdentifiers,
       total_tools_available: this.data.totalToolsAvailable,
-      tools_available_names: this.data.toolsAvailableNames,
       max_steps_configured: this.data.maxStepsConfigured,
       memory_enabled: this.data.memoryEnabled,
       use_server_manager: this.data.useServerManager,
@@ -168,8 +165,6 @@ var MCPAgentExecutionEvent = class extends BaseTelemetryEvent {
       // Execution results (always include, even if null)
       steps_taken: this.data.stepsTaken ?? null,
       tools_used_count: this.data.toolsUsedCount ?? null,
-      tools_used_names: this.data.toolsUsedNames ?? null,
-      response: this.data.response ?? null,
       response_length: this.data.response ? this.data.response.length : null,
       execution_time_ms: this.data.executionTimeMs ?? null,
       error_type: this.data.errorType ?? null,
@@ -265,21 +260,72 @@ async function telFetch(url, init) {
 }
 var POSTHOG_HOST = "https://eu.i.posthog.com";
 var POSTHOG_API_KEY = "phc_lyTtbYwvkdSbrcMQNPiKiiRWrrM1seyKIMjycSvItEI";
-function capturePostHog(params) {
-  const host = params.host ?? POSTHOG_HOST;
-  const apiKey = params.apiKey ?? POSTHOG_API_KEY;
-  return telFetch(`${host}/i/v0/e/`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    keepalive: true,
-    body: JSON.stringify({
+var CONTENT_PROPERTY = /(^|_)(arguments?|args|body|command|headers?|location|message|query|response|secret|subject|token|uri|url|user_agent)(_|$)/i;
+var IDENTIFYING_PROPERTY = /(^|_)(server_identifiers?|server_names?|servers|tool_names?|tools_(available|used)_names)(_|$)/i;
+var AGGREGATE_PROPERTY = /(_count|_length|_duration(?:_ms)?|_time_ms|(^|_)num_[a-z0-9_]+)$/i;
+function normalizePropertyKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^a-z0-9_$]+/gi, "_").toLowerCase();
+}
+function sanitizeValue(value, seen) {
+  if (Array.isArray(value)) {
+    if (seen.has(value)) {
+      throw new TypeError("Cyclic telemetry properties are not supported");
+    }
+    seen.add(value);
+    const sanitized = value.map((item) => sanitizeValue(item, seen));
+    seen.delete(value);
+    return sanitized;
+  }
+  if (value !== null && typeof value === "object" && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) {
+    if (seen.has(value)) {
+      throw new TypeError("Cyclic telemetry properties are not supported");
+    }
+    seen.add(value);
+    const sanitized = sanitizeProperties(
+      value,
+      seen
+    );
+    seen.delete(value);
+    return sanitized;
+  }
+  return value;
+}
+function sanitizeProperties(properties, seen = /* @__PURE__ */ new WeakSet()) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(properties)) {
+    const normalizedKey = normalizePropertyKey(key);
+    if (AGGREGATE_PROPERTY.test(normalizedKey)) {
+      if (value === null || typeof value === "number") {
+        sanitized[key] = value;
+      }
+      continue;
+    }
+    if (IDENTIFYING_PROPERTY.test(normalizedKey) || CONTENT_PROPERTY.test(normalizedKey)) {
+      continue;
+    }
+    sanitized[key] = sanitizeValue(value, seen);
+  }
+  return sanitized;
+}
+async function capturePostHog(params) {
+  try {
+    const host = params.host ?? POSTHOG_HOST;
+    const apiKey = params.apiKey ?? POSTHOG_API_KEY;
+    const body = JSON.stringify({
       api_key: apiKey,
       event: params.event,
       distinct_id: params.distinctId,
-      properties: params.properties,
+      properties: sanitizeProperties(params.properties),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    })
-  });
+    });
+    await telFetch(`${host}/i/v0/e/`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      keepalive: true,
+      body
+    });
+  } catch {
+  }
 }
 
 // src/telemetry/telemetry.ts
@@ -1052,7 +1098,7 @@ var OAuthSessionStore = class _OAuthSessionStore {
    */
   async storeAuthorizationState(authorizationUrl, opts = {}) {
     const state = globalThis.crypto.randomUUID();
-    const stateKey = `${this.storageKeyPrefix}:state_${state}`;
+    const stateKey = `${this.storageKeyPrefix}_${this.serverUrlHash}_state_${state}`;
     const stateData = {
       serverUrlHash: this.serverUrlHash,
       expiry: Date.now() + 1e3 * 60 * 10,
@@ -1124,6 +1170,7 @@ var BrowserOAuthClientProvider = class {
   connectionUrl;
   proxyOAuthRequests;
   lastAttemptedAuthUrl = null;
+  authorizationPending = false;
   onPopupWindow;
   constructor(serverUrl, options = {}) {
     if (options.staticClientInfo?.client_secret) {
@@ -1174,6 +1221,12 @@ var BrowserOAuthClientProvider = class {
   getKey(keySuffix) {
     return this.session.getKey(keySuffix);
   }
+  get hasPendingFlow() {
+    return this.authorizationPending;
+  }
+  markFlowComplete() {
+    this.authorizationPending = false;
+  }
   /**
    * Re-anchor an SDK-derived OAuth discovery URL from the MCP connection
    * (proxy) origin onto the actual MCP server.
@@ -1354,6 +1407,7 @@ var BrowserOAuthClientProvider = class {
   }
   saveTokens(tokens, ctx) {
     this.lastAttemptedAuthUrl = null;
+    this.authorizationPending = false;
     return this.session.saveTokens(tokens, ctx);
   }
   async clientInformation(ctx) {
@@ -1434,6 +1488,7 @@ var BrowserOAuthClientProvider = class {
       }
     );
     this.lastAttemptedAuthUrl = prepared;
+    this.authorizationPending = true;
     return prepared;
   }
   /**
@@ -1490,15 +1545,13 @@ var BrowserOAuthClientProvider = class {
   }
   clearStorage() {
     this.lastAttemptedAuthUrl = null;
+    this.authorizationPending = false;
     const prefixPattern = `${this.storageKeyPrefix}_${this.serverUrlHash}_`;
-    const statePattern = `${this.storageKeyPrefix}:state_`;
     const keysToRemove = [];
     let count = 0;
     for (const key of this.storage.keys()) {
       if (key.startsWith(prefixPattern)) {
         keysToRemove.push(key);
-      } else if (key.startsWith(statePattern)) {
-        keysToRemove.push(key);
       }
     }
     const uniqueKeysToRemove = [...new Set(keysToRemove)];
@@ -1711,20 +1764,14 @@ function renderResult(title, message, error, returnUrl) {
   }
   document.body.appendChild(container);
 }
-function findStoredState(state) {
-  const defaultKey = `mcp:auth:state_${state}`;
-  let key = localStorage.getItem(defaultKey) ? defaultKey : null;
-  if (!key) {
-    const suffix = `:state_${state}`;
-    for (let index = 0; index < localStorage.length; index++) {
-      const candidate = localStorage.key(index);
-      if (candidate?.endsWith(suffix)) {
-        key = candidate;
-        break;
-      }
-    }
-  }
-  const serialized = key ? localStorage.getItem(key) : null;
+async function findStoredState(state) {
+  const store = new LocalStorageKVStore();
+  const legacySuffix = `:state_${state}`;
+  const scopedSuffix = `_state_${state}`;
+  const key = (await store.keys()).find(
+    (candidate) => candidate.endsWith(legacySuffix) || candidate.endsWith(scopedSuffix)
+  );
+  const serialized = key ? await store.get(key) : null;
   if (!key || !serialized) {
     throw new Error(`Invalid or expired OAuth state "${state}".`);
   }
@@ -1732,10 +1779,10 @@ function findStoredState(state) {
   try {
     value = JSON.parse(serialized);
   } catch {
-    localStorage.removeItem(key);
+    await store.remove(key);
     throw new Error("Failed to parse stored OAuth state.");
   }
-  return { key, value };
+  return { key, value, store };
 }
 function redirectWithError(returnUrl, message) {
   const url = new URL(returnUrl);
@@ -1794,17 +1841,19 @@ async function completeAuthorization() {
   const callbackParams = new URLSearchParams(window.location.search);
   const state = callbackParams.get("state");
   let stateKey = null;
+  let stateStore = null;
   let storedState = null;
   let provider = null;
   try {
     if (!state) {
       throw new Error("OAuth callback is missing the state parameter.");
     }
-    const stored = findStoredState(state);
+    const stored = await findStoredState(state);
     stateKey = stored.key;
+    stateStore = stored.store;
     storedState = stored.value;
     if (!storedState.expiry || storedState.expiry < Date.now()) {
-      localStorage.removeItem(stateKey);
+      await stateStore.remove(stateKey);
       throw new Error(
         "OAuth state has expired. Please start authentication again."
       );
@@ -1819,7 +1868,7 @@ async function completeAuthorization() {
       fetch: provider.getProxyFetch()
     });
     await transport.finishAuth(callbackParams);
-    localStorage.removeItem(stateKey);
+    await stateStore.remove(stateKey);
     signalResult(true, void 0, storedState, {
       state,
       serverUrlHash: storedState.serverUrlHash
@@ -1827,8 +1876,12 @@ async function completeAuthorization() {
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     console.error("[mcp-callback] OAuth callback failed:", error);
-    if (stateKey) localStorage.removeItem(stateKey);
-    if (provider) localStorage.removeItem(provider.getKey("last_auth_url"));
+    if (stateKey && stateStore) await stateStore.remove(stateKey);
+    if (provider) {
+      await (stateStore ?? new LocalStorageKVStore()).remove(
+        provider.getKey("last_auth_url")
+      );
+    }
     signalResult(false, message, storedState, {
       state,
       serverUrlHash: storedState?.serverUrlHash
@@ -1870,11 +1923,12 @@ async function completeOAuthFlow(provider, serverUrl, options = {}) {
       throw new Error(`Unexpected OAuth auth() result: ${result}`);
     }
   }
-  if (typeof flowProvider.getAuthorizationCode === "function") {
-    const code = await flowProvider.getAuthorizationCode();
+  if (typeof flowProvider.getAuthorizationResponse === "function" || typeof flowProvider.getAuthorizationCode === "function") {
+    const response = typeof flowProvider.getAuthorizationResponse === "function" ? await flowProvider.getAuthorizationResponse() : { code: await flowProvider.getAuthorizationCode() };
     await auth(provider, {
       serverUrl,
-      authorizationCode: code,
+      authorizationCode: response.code,
+      ...response.iss !== void 0 ? { iss: response.iss } : {},
       fetchFn
     });
     return;
@@ -1888,6 +1942,8 @@ async function waitForBrowserAuthComplete(provider, timeoutMs) {
     );
   }
   if (provider.useRedirectFlow) {
+    await new Promise(() => {
+    });
     return;
   }
   const tokensKey = provider.getKey?.("tokens");
@@ -1904,25 +1960,29 @@ async function waitForBrowserAuthComplete(provider, timeoutMs) {
     } catch {
     }
   }
-  const result = await runAuthPopup({
-    popup: null,
-    state,
-    tokensKey,
-    timeoutMs
-  });
-  switch (result.kind) {
-    case "success":
-      return;
-    case "cancelled":
-      throw new Error("OAuth authentication was cancelled.");
-    case "timeout":
-      throw new Error(
-        `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
-      );
-    case "error":
-      throw new Error(result.error);
-    default:
-      throw new Error("Unexpected OAuth popup result");
+  try {
+    const result = await runAuthPopup({
+      popup: null,
+      state,
+      tokensKey,
+      timeoutMs
+    });
+    switch (result.kind) {
+      case "success":
+        return;
+      case "cancelled":
+        throw new Error("OAuth authentication was cancelled.");
+      case "timeout":
+        throw new Error(
+          `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
+        );
+      case "error":
+        throw new Error(result.error);
+      default:
+        throw new Error("Unexpected OAuth popup result");
+    }
+  } finally {
+    provider.markFlowComplete?.();
   }
 }