@mcp-z/client 1.0.1 → 1.0.3

package/dist/cjs/auth/capability-discovery.d.cts

@@ -3,23 +3,4 @@
  * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata
  */
 import type { AuthCapabilities } from './types.js';
-/**
- * Probe OAuth server capabilities using RFC 9728 → RFC 8414 discovery chain
- * Returns capabilities including DCR support detection
- *
- * Discovery Strategy:
- * 1. Try RFC 9728 Protected Resource Metadata (supports cross-domain OAuth)
- * 2. If found, use first authorization_server to discover RFC 8414 Authorization Server Metadata
- * 3. Fall back to direct RFC 8414 discovery at resource origin
- *
- * @param baseUrl - Base URL of the protected resource (e.g., https://ai.todoist.net/mcp)
- * @returns AuthCapabilities object with discovered endpoints and features
- *
- * @example
- * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com
- * const caps = await probeAuthCapabilities('https://ai.todoist.net/mcp');
- * if (caps.supportsDcr) {
- *   console.log('Registration endpoint:', caps.registrationEndpoint);
- * }
- */
 export declare function probeAuthCapabilities(baseUrl: string): Promise<AuthCapabilities>;

package/dist/cjs/auth/capability-discovery.d.ts

@@ -3,23 +3,4 @@
  * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata
  */
 import type { AuthCapabilities } from './types.js';
-/**
- * Probe OAuth server capabilities using RFC 9728 → RFC 8414 discovery chain
- * Returns capabilities including DCR support detection
- *
- * Discovery Strategy:
- * 1. Try RFC 9728 Protected Resource Metadata (supports cross-domain OAuth)
- * 2. If found, use first authorization_server to discover RFC 8414 Authorization Server Metadata
- * 3. Fall back to direct RFC 8414 discovery at resource origin
- *
- * @param baseUrl - Base URL of the protected resource (e.g., https://ai.todoist.net/mcp)
- * @returns AuthCapabilities object with discovered endpoints and features
- *
- * @example
- * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com
- * const caps = await probeAuthCapabilities('https://ai.todoist.net/mcp');
- * if (caps.supportsDcr) {
- *   console.log('Registration endpoint:', caps.registrationEndpoint);
- * }
- */
 export declare function probeAuthCapabilities(baseUrl: string): Promise<AuthCapabilities>;

package/dist/cjs/auth/capability-discovery.js

@@ -156,17 +156,81 @@ function _ts_generator(thisArg, body) {
         return url;
     }
 }
+/**
+ * Probe OAuth server capabilities using RFC 9728 → RFC 8414 discovery chain
+ * Returns capabilities including DCR support detection
+ *
+ * Discovery Strategy:
+ * 1. Try RFC 9728 Protected Resource Metadata (supports cross-domain OAuth)
+ * 2. If found, use first authorization_server to discover RFC 8414 Authorization Server Metadata
+ * 3. Fall back to direct RFC 8414 discovery at resource origin
+ *
+ * @param baseUrl - Base URL of the protected resource (e.g., https://ai.todoist.net/mcp)
+ * @returns AuthCapabilities object with discovered endpoints and features
+ *
+ * @example
+ * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com
+ * const caps = await probeAuthCapabilities('https://ai.todoist.net/mcp');
+ * if (caps.supportsDcr) {
+ *   console.log('Registration endpoint:', caps.registrationEndpoint);
+ * }
+ */ function buildCapabilities(metadata, scopes) {
+    var supportsDcr = !!metadata.registration_endpoint;
+    var capabilities = {
+        supportsDcr: supportsDcr
+    };
+    if (metadata.registration_endpoint) {
+        capabilities.registrationEndpoint = metadata.registration_endpoint;
+    }
+    if (metadata.authorization_endpoint) {
+        capabilities.authorizationEndpoint = metadata.authorization_endpoint;
+    }
+    if (metadata.token_endpoint) capabilities.tokenEndpoint = metadata.token_endpoint;
+    if (metadata.introspection_endpoint) {
+        capabilities.introspectionEndpoint = metadata.introspection_endpoint;
+    }
+    if (scopes && scopes.length > 0) {
+        capabilities.scopes = scopes;
+    } else if (metadata.scopes_supported) {
+        capabilities.scopes = metadata.scopes_supported;
+    }
+    return capabilities;
+}
+function resolveCapabilitiesFromAuthorizationServer(authServerUrl, scopes) {
+    return _async_to_generator(function() {
+        var metadata;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        (0, _rfc9728discoveryts.discoverAuthorizationServerMetadata)(authServerUrl)
+                    ];
+                case 1:
+                    metadata = _state.sent();
+                    if (!metadata) return [
+                        2,
+                        null
+                    ];
+                    return [
+                        2,
+                        buildCapabilities(metadata, scopes)
+                    ];
+            }
+        });
+    })();
+}
 function probeAuthCapabilities(baseUrl) {
     return _async_to_generator(function() {
-        var resourceMetadata, authServerUrl, authServerMetadata, supportsDcr, capabilities, scopes, origin, authServerMetadata1, supportsDcr1, capabilities1, _error;
+        var resourceMetadata, authServerUrl, capabilities, issuer, issuerCapabilities, issuer1, issuerCapabilities1, origin, originCapabilities, _error;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
                     _state.trys.push([
                         0,
-                        5,
+                        10,
                         ,
-                        6
+                        11
                     ]);
                     return [
                         4,
@@ -176,7 +240,7 @@ function probeAuthCapabilities(baseUrl) {
                     resourceMetadata = _state.sent();
                     if (!(resourceMetadata && resourceMetadata.authorization_servers.length > 0)) return [
                         3,
-                        3
+                        5
                     ];
                     // Found protected resource metadata with authorization servers
                     // Discover the authorization server's metadata (RFC 8414)
@@ -192,66 +256,73 @@ function probeAuthCapabilities(baseUrl) {
                     }
                     return [
                         4,
-                        (0, _rfc9728discoveryts.discoverAuthorizationServerMetadata)(authServerUrl)
+                        resolveCapabilitiesFromAuthorizationServer(authServerUrl, resourceMetadata.scopes_supported)
                     ];
                 case 2:
-                    authServerMetadata = _state.sent();
-                    if (authServerMetadata) {
-                        // Successfully discovered full OAuth metadata via RFC 9728 → RFC 8414 chain
-                        supportsDcr = !!authServerMetadata.registration_endpoint;
-                        capabilities = {
-                            supportsDcr: supportsDcr
-                        };
-                        if (authServerMetadata.registration_endpoint) {
-                            capabilities.registrationEndpoint = authServerMetadata.registration_endpoint;
-                        }
-                        if (authServerMetadata.authorization_endpoint) {
-                            capabilities.authorizationEndpoint = authServerMetadata.authorization_endpoint;
-                        }
-                        if (authServerMetadata.token_endpoint) capabilities.tokenEndpoint = authServerMetadata.token_endpoint;
-                        if (authServerMetadata.introspection_endpoint) {
-                            capabilities.introspectionEndpoint = authServerMetadata.introspection_endpoint;
-                        }
-                        // Prefer resource scopes over auth server scopes
-                        scopes = resourceMetadata.scopes_supported || authServerMetadata.scopes_supported;
-                        if (scopes) capabilities.scopes = scopes;
+                    capabilities = _state.sent();
+                    if (capabilities) {
                         return [
                             2,
                             capabilities
                         ];
                     }
-                    _state.label = 3;
+                    return [
+                        4,
+                        (0, _rfc9728discoveryts.discoverAuthorizationServerIssuer)(baseUrl)
+                    ];
                 case 3:
+                    issuer = _state.sent();
+                    if (!issuer) return [
+                        3,
+                        5
+                    ];
+                    return [
+                        4,
+                        resolveCapabilitiesFromAuthorizationServer(issuer, resourceMetadata.scopes_supported)
+                    ];
+                case 4:
+                    issuerCapabilities = _state.sent();
+                    if (issuerCapabilities) return [
+                        2,
+                        issuerCapabilities
+                    ];
+                    _state.label = 5;
+                case 5:
+                    return [
+                        4,
+                        (0, _rfc9728discoveryts.discoverAuthorizationServerIssuer)(baseUrl)
+                    ];
+                case 6:
+                    issuer1 = _state.sent();
+                    if (!issuer1) return [
+                        3,
+                        8
+                    ];
+                    return [
+                        4,
+                        resolveCapabilitiesFromAuthorizationServer(issuer1)
+                    ];
+                case 7:
+                    issuerCapabilities1 = _state.sent();
+                    if (issuerCapabilities1) return [
+                        2,
+                        issuerCapabilities1
+                    ];
+                    _state.label = 8;
+                case 8:
                     // Strategy 2: Fall back to direct RFC 8414 discovery at resource origin
                     // This handles same-domain OAuth (traditional setup)
                     origin = getOrigin(baseUrl);
                     return [
                         4,
-                        (0, _rfc9728discoveryts.discoverAuthorizationServerMetadata)(origin)
+                        resolveCapabilitiesFromAuthorizationServer(origin)
+                    ];
+                case 9:
+                    originCapabilities = _state.sent();
+                    if (originCapabilities) return [
+                        2,
+                        originCapabilities
                     ];
-                case 4:
-                    authServerMetadata1 = _state.sent();
-                    if (authServerMetadata1) {
-                        supportsDcr1 = !!authServerMetadata1.registration_endpoint;
-                        capabilities1 = {
-                            supportsDcr: supportsDcr1
-                        };
-                        if (authServerMetadata1.registration_endpoint) {
-                            capabilities1.registrationEndpoint = authServerMetadata1.registration_endpoint;
-                        }
-                        if (authServerMetadata1.authorization_endpoint) {
-                            capabilities1.authorizationEndpoint = authServerMetadata1.authorization_endpoint;
-                        }
-                        if (authServerMetadata1.token_endpoint) capabilities1.tokenEndpoint = authServerMetadata1.token_endpoint;
-                        if (authServerMetadata1.introspection_endpoint) {
-                            capabilities1.introspectionEndpoint = authServerMetadata1.introspection_endpoint;
-                        }
-                        if (authServerMetadata1.scopes_supported) capabilities1.scopes = authServerMetadata1.scopes_supported;
-                        return [
-                            2,
-                            capabilities1
-                        ];
-                    }
                     // No OAuth metadata found
                     return [
                         2,
@@ -259,7 +330,7 @@ function probeAuthCapabilities(baseUrl) {
                             supportsDcr: false
                         }
                     ];
-                case 5:
+                case 10:
                     _error = _state.sent();
                     // Network error, invalid JSON, or other fetch failure
                     // Gracefully degrade - assume no DCR support
@@ -269,7 +340,7 @@ function probeAuthCapabilities(baseUrl) {
                             supportsDcr: false
                         }
                     ];
-                case 6:
+                case 11:
                     return [
                         2
                     ];

package/dist/cjs/auth/capability-discovery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/libs/client/src/auth/capability-discovery.ts"],"sourcesContent":["/**\n * OAuth Server Capability Discovery\n * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata\n */\n\nimport { discoverAuthorizationServerMetadata, discoverProtectedResourceMetadata } from './rfc9728-discovery.ts';\nimport type { AuthCapabilities } from './types.ts';\n\n/**\n * Extract origin (protocol + host) from a URL\n * @param url - Full URL that may include a path\n * @returns Origin (e.g., \"https://example.com\") or original string if invalid URL\n *\n * @example\n * getOrigin('https://example.com/mcp') // → 'https://example.com'\n * getOrigin('http://localhost:9999/api/v1/mcp') // → 'http://localhost:9999'\n */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    // Invalid URL - return as-is for graceful degradation\n    return url;\n  }\n}\n\n/**\n * Probe OAuth server capabilities using RFC 9728 → RFC 8414 discovery chain\n * Returns capabilities including DCR support detection\n *\n * Discovery Strategy:\n * 1. Try RFC 9728 Protected Resource Metadata (supports cross-domain OAuth)\n * 2. If found, use first authorization_server to discover RFC 8414 Authorization Server Metadata\n * 3. Fall back to direct RFC 8414 discovery at resource origin\n *\n * @param baseUrl - Base URL of the protected resource (e.g., https://ai.todoist.net/mcp)\n * @returns AuthCapabilities object with discovered endpoints and features\n *\n * @example\n * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com\n * const caps = await probeAuthCapabilities('https://ai.todoist.net/mcp');\n * if (caps.supportsDcr) {\n *   console.log('Registration endpoint:', caps.registrationEndpoint);\n * }\n */\nexport async function probeAuthCapabilities(baseUrl: string): Promise<AuthCapabilities> {\n  try {\n    // Strategy 1: Try RFC 9728 Protected Resource Metadata discovery\n    // This handles cross-domain OAuth (e.g., Todoist: ai.todoist.net/mcp → todoist.com)\n    const resourceMetadata = await discoverProtectedResourceMetadata(baseUrl);\n\n    if (resourceMetadata && resourceMetadata.authorization_servers.length > 0) {\n      // Found protected resource metadata with authorization servers\n      // Discover the authorization server's metadata (RFC 8414)\n      const authServerUrl = resourceMetadata.authorization_servers[0];\n      if (!authServerUrl) {\n        // Array has length > 0 but first element is undefined/null - skip this path\n        return { supportsDcr: false };\n      }\n      const authServerMetadata = await discoverAuthorizationServerMetadata(authServerUrl);\n\n      if (authServerMetadata) {\n        // Successfully discovered full OAuth metadata via RFC 9728 → RFC 8414 chain\n        const supportsDcr = !!authServerMetadata.registration_endpoint;\n        const capabilities: AuthCapabilities = { supportsDcr };\n\n        if (authServerMetadata.registration_endpoint) {\n          capabilities.registrationEndpoint = authServerMetadata.registration_endpoint;\n        }\n        if (authServerMetadata.authorization_endpoint) {\n          capabilities.authorizationEndpoint = authServerMetadata.authorization_endpoint;\n        }\n        if (authServerMetadata.token_endpoint) capabilities.tokenEndpoint = authServerMetadata.token_endpoint;\n        if (authServerMetadata.introspection_endpoint) {\n          capabilities.introspectionEndpoint = authServerMetadata.introspection_endpoint;\n        }\n\n        // Prefer resource scopes over auth server scopes\n        const scopes = resourceMetadata.scopes_supported || authServerMetadata.scopes_supported;\n        if (scopes) capabilities.scopes = scopes;\n\n        return capabilities;\n      }\n    }\n\n    // Strategy 2: Fall back to direct RFC 8414 discovery at resource origin\n    // This handles same-domain OAuth (traditional setup)\n    const origin = getOrigin(baseUrl);\n    const authServerMetadata = await discoverAuthorizationServerMetadata(origin);\n\n    if (authServerMetadata) {\n      const supportsDcr = !!authServerMetadata.registration_endpoint;\n      const capabilities: AuthCapabilities = { supportsDcr };\n\n      if (authServerMetadata.registration_endpoint) {\n        capabilities.registrationEndpoint = authServerMetadata.registration_endpoint;\n      }\n      if (authServerMetadata.authorization_endpoint) {\n        capabilities.authorizationEndpoint = authServerMetadata.authorization_endpoint;\n      }\n      if (authServerMetadata.token_endpoint) capabilities.tokenEndpoint = authServerMetadata.token_endpoint;\n      if (authServerMetadata.introspection_endpoint) {\n        capabilities.introspectionEndpoint = authServerMetadata.introspection_endpoint;\n      }\n      if (authServerMetadata.scopes_supported) capabilities.scopes = authServerMetadata.scopes_supported;\n\n      return capabilities;\n    }\n\n    // No OAuth metadata found\n    return { supportsDcr: false };\n  } catch (_error) {\n    // Network error, invalid JSON, or other fetch failure\n    // Gracefully degrade - assume no DCR support\n    return { supportsDcr: false };\n  }\n}\n"],"names":["probeAuthCapabilities","getOrigin","url","URL","origin","baseUrl","resourceMetadata","authServerUrl","authServerMetadata","supportsDcr","capabilities","scopes","_error","discoverProtectedResourceMetadata","authorization_servers","length","discoverAuthorizationServerMetadata","registration_endpoint","registrationEndpoint","authorization_endpoint","authorizationEndpoint","token_endpoint","tokenEndpoint","introspection_endpoint","introspectionEndpoint","scopes_supported"],"mappings":"AAAA;;;CAGC;;;;+BA0CqBA;;;eAAAA;;;kCAxCiE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGvF;;;;;;;;CAQC,GACD,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,sDAAsD;QACtD,OAAOF;IACT;AACF;AAqBO,SAAeF,sBAAsBK,OAAe;;YAIjDC,kBAKEC,eAKAC,oBAIEC,aACAC,cAcAC,QASJP,QACAI,qBAGEC,cACAC,eAmBDE;;;;;;;;;;oBA9DkB;;wBAAMC,IAAAA,qDAAiC,EAACR;;;oBAA3DC,mBAAmB;yBAErBA,CAAAA,oBAAoBA,iBAAiBQ,qBAAqB,CAACC,MAAM,GAAG,CAAA,GAApET;;;;oBACF,+DAA+D;oBAC/D,0DAA0D;oBACpDC,gBAAgBD,iBAAiBQ,qBAAqB,CAAC,EAAE;oBAC/D,IAAI,CAACP,eAAe;wBAClB,4EAA4E;wBAC5E;;4BAAO;gCAAEE,aAAa;4BAAM;;oBAC9B;oBAC2B;;wBAAMO,IAAAA,uDAAmC,EAACT;;;oBAA/DC,qBAAqB;oBAE3B,IAAIA,oBAAoB;wBACtB,4EAA4E;wBACtEC,cAAc,CAAC,CAACD,mBAAmBS,qBAAqB;wBACxDP,eAAiC;4BAAED,aAAAA;wBAAY;wBAErD,IAAID,mBAAmBS,qBAAqB,EAAE;4BAC5CP,aAAaQ,oBAAoB,GAAGV,mBAAmBS,qBAAqB;wBAC9E;wBACA,IAAIT,mBAAmBW,sBAAsB,EAAE;4BAC7CT,aAAaU,qBAAqB,GAAGZ,mBAAmBW,sBAAsB;wBAChF;wBACA,IAAIX,mBAAmBa,cAAc,EAAEX,aAAaY,aAAa,GAAGd,mBAAmBa,cAAc;wBACrG,IAAIb,mBAAmBe,sBAAsB,EAAE;4BAC7Cb,aAAac,qBAAqB,GAAGhB,mBAAmBe,sBAAsB;wBAChF;wBAEA,iDAAiD;wBAC3CZ,SAASL,iBAAiBmB,gBAAgB,IAAIjB,mBAAmBiB,gBAAgB;wBACvF,IAAId,QAAQD,aAAaC,MAAM,GAAGA;wBAElC;;4BAAOD;;oBACT;;;oBAGF,wEAAwE;oBACxE,qDAAqD;oBAC/CN,SAASH,UAAUI;oBACE;;wBAAMW,IAAAA,uDAAmC,EAACZ;;;oBAA/DI,sBAAqB;oBAE3B,IAAIA,qBAAoB;wBAChBC,eAAc,CAAC,CAACD,oBAAmBS,qBAAqB;wBACxDP,gBAAiC;4BAAED,aAAAA;wBAAY;wBAErD,IAAID,oBAAmBS,qBAAqB,EAAE;4BAC5CP,cAAaQ,oBAAoB,GAAGV,oBAAmBS,qBAAqB;wBAC9E;wBACA,IAAIT,oBAAmBW,sBAAsB,EAAE;4BAC7CT,cAAaU,qBAAqB,GAAGZ,oBAAmBW,sBAAsB;wBAChF;wBACA,IAAIX,oBAAmBa,cAAc,EAAEX,cAAaY,aAAa,GAAGd,oBAAmBa,cAAc;wBACrG,IAAIb,oBAAmBe,sBAAsB,EAAE;4BAC7Cb,cAAac,qBAAqB,GAAGhB,oBAAmBe,sBAAsB;wBAChF;wBACA,IAAIf,oBAAmBiB,gBAAgB,EAAEf,cAAaC,MAAM,GAAGH,oBAAmBiB,gBAAgB;wBAElG;;4BAAOf;;oBACT;oBAEA,0BAA0B;oBAC1B;;wBAAO;4BAAED,aAAa;wBAAM;;;oBACrBG;oBACP,sDAAsD;oBACtD,6CAA6C;oBAC7C;;wBAAO;4BAAEH,aAAa;wBAAM;;;;;;;;IAEhC"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/client/src/auth/capability-discovery.ts"],"sourcesContent":["/**\n * OAuth Server Capability Discovery\n * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata\n */\n\nimport { discoverAuthorizationServerIssuer, discoverAuthorizationServerMetadata, discoverProtectedResourceMetadata } from './rfc9728-discovery.ts';\nimport type { AuthCapabilities, AuthorizationServerMetadata } from './types.ts';\n\n/**\n * Extract origin (protocol + host) from a URL\n * @param url - Full URL that may include a path\n * @returns Origin (e.g., \"https://example.com\") or original string if invalid URL\n *\n * @example\n * getOrigin('https://example.com/mcp') // → 'https://example.com'\n * getOrigin('http://localhost:9999/api/v1/mcp') // → 'http://localhost:9999'\n */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    // Invalid URL - return as-is for graceful degradation\n    return url;\n  }\n}\n\n/**\n * Probe OAuth server capabilities using RFC 9728 → RFC 8414 discovery chain\n * Returns capabilities including DCR support detection\n *\n * Discovery Strategy:\n * 1. Try RFC 9728 Protected Resource Metadata (supports cross-domain OAuth)\n * 2. If found, use first authorization_server to discover RFC 8414 Authorization Server Metadata\n * 3. Fall back to direct RFC 8414 discovery at resource origin\n *\n * @param baseUrl - Base URL of the protected resource (e.g., https://ai.todoist.net/mcp)\n * @returns AuthCapabilities object with discovered endpoints and features\n *\n * @example\n * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com\n * const caps = await probeAuthCapabilities('https://ai.todoist.net/mcp');\n * if (caps.supportsDcr) {\n *   console.log('Registration endpoint:', caps.registrationEndpoint);\n * }\n */\nfunction buildCapabilities(metadata: AuthorizationServerMetadata, scopes?: string[]): AuthCapabilities {\n  const supportsDcr = !!metadata.registration_endpoint;\n  const capabilities: AuthCapabilities = { supportsDcr };\n\n  if (metadata.registration_endpoint) {\n    capabilities.registrationEndpoint = metadata.registration_endpoint;\n  }\n  if (metadata.authorization_endpoint) {\n    capabilities.authorizationEndpoint = metadata.authorization_endpoint;\n  }\n  if (metadata.token_endpoint) capabilities.tokenEndpoint = metadata.token_endpoint;\n  if (metadata.introspection_endpoint) {\n    capabilities.introspectionEndpoint = metadata.introspection_endpoint;\n  }\n\n  if (scopes && scopes.length > 0) {\n    capabilities.scopes = scopes;\n  } else if (metadata.scopes_supported) {\n    capabilities.scopes = metadata.scopes_supported;\n  }\n\n  return capabilities;\n}\n\nasync function resolveCapabilitiesFromAuthorizationServer(authServerUrl: string, scopes?: string[]): Promise<AuthCapabilities | null> {\n  const metadata = await discoverAuthorizationServerMetadata(authServerUrl);\n  if (!metadata) return null;\n  return buildCapabilities(metadata, scopes);\n}\n\nexport async function probeAuthCapabilities(baseUrl: string): Promise<AuthCapabilities> {\n  try {\n    // Strategy 1: Try RFC 9728 Protected Resource Metadata discovery\n    // This handles cross-domain OAuth (e.g., Todoist: ai.todoist.net/mcp → todoist.com)\n    const resourceMetadata = await discoverProtectedResourceMetadata(baseUrl);\n\n    if (resourceMetadata && resourceMetadata.authorization_servers.length > 0) {\n      // Found protected resource metadata with authorization servers\n      // Discover the authorization server's metadata (RFC 8414)\n      const authServerUrl = resourceMetadata.authorization_servers[0];\n      if (!authServerUrl) {\n        // Array has length > 0 but first element is undefined/null - skip this path\n        return { supportsDcr: false };\n      }\n      const capabilities = await resolveCapabilitiesFromAuthorizationServer(authServerUrl, resourceMetadata.scopes_supported);\n      if (capabilities) {\n        return capabilities;\n      }\n\n      const issuer = await discoverAuthorizationServerIssuer(baseUrl);\n      if (issuer) {\n        const issuerCapabilities = await resolveCapabilitiesFromAuthorizationServer(issuer, resourceMetadata.scopes_supported);\n        if (issuerCapabilities) return issuerCapabilities;\n      }\n    }\n\n    const issuer = await discoverAuthorizationServerIssuer(baseUrl);\n    if (issuer) {\n      const issuerCapabilities = await resolveCapabilitiesFromAuthorizationServer(issuer);\n      if (issuerCapabilities) return issuerCapabilities;\n    }\n\n    // Strategy 2: Fall back to direct RFC 8414 discovery at resource origin\n    // This handles same-domain OAuth (traditional setup)\n    const origin = getOrigin(baseUrl);\n    const originCapabilities = await resolveCapabilitiesFromAuthorizationServer(origin);\n    if (originCapabilities) return originCapabilities;\n\n    // No OAuth metadata found\n    return { supportsDcr: false };\n  } catch (_error) {\n    // Network error, invalid JSON, or other fetch failure\n    // Gracefully degrade - assume no DCR support\n    return { supportsDcr: false };\n  }\n}\n"],"names":["probeAuthCapabilities","getOrigin","url","URL","origin","buildCapabilities","metadata","scopes","supportsDcr","registration_endpoint","capabilities","registrationEndpoint","authorization_endpoint","authorizationEndpoint","token_endpoint","tokenEndpoint","introspection_endpoint","introspectionEndpoint","length","scopes_supported","resolveCapabilitiesFromAuthorizationServer","authServerUrl","discoverAuthorizationServerMetadata","baseUrl","resourceMetadata","issuer","issuerCapabilities","originCapabilities","_error","discoverProtectedResourceMetadata","authorization_servers","discoverAuthorizationServerIssuer"],"mappings":"AAAA;;;CAGC;;;;+BAwEqBA;;;eAAAA;;;kCAtEoG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAG1H;;;;;;;;CAQC,GACD,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,sDAAsD;QACtD,OAAOF;IACT;AACF;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,SAASG,kBAAkBC,QAAqC,EAAEC,MAAiB;IACjF,IAAMC,cAAc,CAAC,CAACF,SAASG,qBAAqB;IACpD,IAAMC,eAAiC;QAAEF,aAAAA;IAAY;IAErD,IAAIF,SAASG,qBAAqB,EAAE;QAClCC,aAAaC,oBAAoB,GAAGL,SAASG,qBAAqB;IACpE;IACA,IAAIH,SAASM,sBAAsB,EAAE;QACnCF,aAAaG,qBAAqB,GAAGP,SAASM,sBAAsB;IACtE;IACA,IAAIN,SAASQ,cAAc,EAAEJ,aAAaK,aAAa,GAAGT,SAASQ,cAAc;IACjF,IAAIR,SAASU,sBAAsB,EAAE;QACnCN,aAAaO,qBAAqB,GAAGX,SAASU,sBAAsB;IACtE;IAEA,IAAIT,UAAUA,OAAOW,MAAM,GAAG,GAAG;QAC/BR,aAAaH,MAAM,GAAGA;IACxB,OAAO,IAAID,SAASa,gBAAgB,EAAE;QACpCT,aAAaH,MAAM,GAAGD,SAASa,gBAAgB;IACjD;IAEA,OAAOT;AACT;AAEA,SAAeU,2CAA2CC,aAAqB,EAAEd,MAAiB;;YAC1FD;;;;oBAAW;;wBAAMgB,IAAAA,uDAAmC,EAACD;;;oBAArDf,WAAW;oBACjB,IAAI,CAACA,UAAU;;wBAAO;;oBACtB;;wBAAOD,kBAAkBC,UAAUC;;;;IACrC;;AAEO,SAAeP,sBAAsBuB,OAAe;;YAIjDC,kBAKEH,eAKAX,cAKAe,QAEEC,oBAKJD,SAEEC,qBAMFtB,QACAuB,oBAKCC;;;;;;;;;;oBApCkB;;wBAAMC,IAAAA,qDAAiC,EAACN;;;oBAA3DC,mBAAmB;yBAErBA,CAAAA,oBAAoBA,iBAAiBM,qBAAqB,CAACZ,MAAM,GAAG,CAAA,GAApEM;;;;oBACF,+DAA+D;oBAC/D,0DAA0D;oBACpDH,gBAAgBG,iBAAiBM,qBAAqB,CAAC,EAAE;oBAC/D,IAAI,CAACT,eAAe;wBAClB,4EAA4E;wBAC5E;;4BAAO;gCAAEb,aAAa;4BAAM;;oBAC9B;oBACqB;;wBAAMY,2CAA2CC,eAAeG,iBAAiBL,gBAAgB;;;oBAAhHT,eAAe;oBACrB,IAAIA,cAAc;wBAChB;;4BAAOA;;oBACT;oBAEe;;wBAAMqB,IAAAA,qDAAiC,EAACR;;;oBAAjDE,SAAS;yBACXA,QAAAA;;;;oBACyB;;wBAAML,2CAA2CK,QAAQD,iBAAiBL,gBAAgB;;;oBAA/GO,qBAAqB;oBAC3B,IAAIA,oBAAoB;;wBAAOA;;;;oBAIpB;;wBAAMK,IAAAA,qDAAiC,EAACR;;;oBAAjDE,UAAS;yBACXA,SAAAA;;;;oBACyB;;wBAAML,2CAA2CK;;;oBAAtEC,sBAAqB;oBAC3B,IAAIA,qBAAoB;;wBAAOA;;;;oBAGjC,wEAAwE;oBACxE,qDAAqD;oBAC/CtB,SAASH,UAAUsB;oBACE;;wBAAMH,2CAA2ChB;;;oBAAtEuB,qBAAqB;oBAC3B,IAAIA,oBAAoB;;wBAAOA;;oBAE/B,0BAA0B;oBAC1B;;wBAAO;4BAAEnB,aAAa;wBAAM;;;oBACrBoB;oBACP,sDAAsD;oBACtD,6CAA6C;oBAC7C;;wBAAO;4BAAEpB,aAAa;wBAAM;;;;;;;;IAEhC"}

package/dist/cjs/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/libs/client/src/auth/index.ts"],"sourcesContent":["/**\n * Authentication Module\n * Exports public API for OAuth authentication only (DCR moved to ../dcr/)\n */\n\nexport { probeAuthCapabilities } from './capability-discovery.ts';\nexport { InteractiveOAuthFlow } from './interactive-oauth-flow.ts';\nexport type { OAuthCallbackListenerOptions } from './oauth-callback-listener.ts';\nexport { OAuthCallbackListener } from './oauth-callback-listener.ts';\nexport type { AuthCapabilities, CallbackResult, OAuthFlowOptions, TokenSet } from './types.ts';\n"],"names":["InteractiveOAuthFlow","OAuthCallbackListener","probeAuthCapabilities"],"mappings":"AAAA;;;CAGC;;;;;;;;;;;QAGQA;eAAAA,4CAAoB;;QAEpBC;eAAAA,8CAAqB;;QAHrBC;eAAAA,4CAAqB;;;qCAAQ;sCACD;uCAEC"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/client/src/auth/index.ts"],"sourcesContent":["/**\n * Authentication Module\n * Exports public API for OAuth authentication only (DCR moved to ../dcr/)\n */\n\nexport { probeAuthCapabilities } from './capability-discovery.ts';\nexport { InteractiveOAuthFlow } from './interactive-oauth-flow.ts';\nexport type { OAuthCallbackListenerOptions } from './oauth-callback-listener.ts';\nexport { OAuthCallbackListener } from './oauth-callback-listener.ts';\nexport type { AuthCapabilities, CallbackResult, OAuthFlowOptions, TokenSet } from './types.ts';\n"],"names":["InteractiveOAuthFlow","OAuthCallbackListener","probeAuthCapabilities"],"mappings":"AAAA;;;CAGC;;;;;;;;;;;QAGQA;eAAAA,4CAAoB;;QAEpBC;eAAAA,8CAAqB;;QAHrBC;eAAAA,4CAAqB;;;qCAAQ;sCACD;uCAEC"}

package/dist/cjs/auth/interactive-oauth-flow.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/libs/client/src/auth/interactive-oauth-flow.ts"],"sourcesContent":["/**\n * OAuth Authorization Flow Handler\n * Manages browser-based OAuth flows and token exchange with PKCE support\n */\n\nimport * as child_process from 'node:child_process';\nimport { logger as defaultLogger } from '../utils/logger.ts';\nimport { OAuthCallbackListener } from './oauth-callback-listener.ts';\nimport { generatePkce } from './pkce.ts';\nimport type { OAuthFlowOptions, PkceParams, TokenSet } from './types.ts';\n\n/**\n * OAuth token response from token endpoint\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * InteractiveOAuthFlow manages the complete OAuth authorization code flow\n */\nexport class InteractiveOAuthFlow {\n  /**\n   * Perform OAuth authorization code flow\n   *\n   * @param authorizationEndpoint - OAuth authorization endpoint URL\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @param options - Flow options (port is required - use get-port to find available port)\n   * @returns Token set with access and refresh tokens\n   *\n   * @throws Error if flow fails or times out\n   *\n   * @example\n   * import getPort from 'get-port';\n   *\n   * const flow = new InteractiveOAuthFlow();\n   * const port = await getPort();\n   * const tokens = await flow.performAuthFlow(\n   *   'https://example.com/oauth/authorize',\n   *   'https://example.com/oauth/token',\n   *   'client-id',\n   *   'client-secret',\n   *   { port, scopes: ['read', 'write'] }\n   * );\n   */\n  async performAuthFlow(authorizationEndpoint: string, tokenEndpoint: string, clientId: string, clientSecret: string, options: OAuthFlowOptions): Promise<TokenSet> {\n    const logger = options.logger ?? defaultLogger;\n    const callbackListener = new OAuthCallbackListener({ port: options.port, logger });\n\n    // Generate PKCE parameters if requested (RFC 7636)\n    let pkce: PkceParams | undefined;\n    if (options.pkce) {\n      logger.debug('🔐 Generating PKCE parameters...');\n      pkce = await generatePkce();\n    }\n\n    try {\n      // Start callback server\n      await callbackListener.start();\n\n      // Build redirect URI\n      const redirectUri = options.redirectUri || `http://localhost:${options.port}/callback`;\n\n      // Build authorization URL\n      const authUrl = new URL(authorizationEndpoint);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('redirect_uri', redirectUri);\n      authUrl.searchParams.set('response_type', 'code');\n\n      if (options.scopes && options.scopes.length > 0) {\n        authUrl.searchParams.set('scope', options.scopes.join(' '));\n      }\n\n      // Add resource parameter if specified (RFC 8707)\n      if (options.resource) {\n        authUrl.searchParams.set('resource', options.resource);\n      }\n\n      // Add PKCE parameters if generated (RFC 7636)\n      if (pkce) {\n        authUrl.searchParams.set('code_challenge', pkce.codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);\n      }\n\n      // Open browser or print URL for headless mode\n      if (options.headless) {\n        logger.info('🔗 Please visit this URL to authorize:');\n        logger.info(authUrl.toString());\n        logger.info('Waiting for callback...');\n      } else {\n        logger.debug('🌐 Opening browser for OAuth authorization...');\n        // Try to open browser (requires 'open' package or native command)\n        await this.openBrowser(authUrl.toString());\n      }\n\n      // Wait for callback with timeout\n      const timeout = options.timeout || (options.headless ? 60000 : 300000);\n      const result = await callbackListener.waitForCallback(timeout);\n\n      // Exchange authorization code for tokens (with PKCE verifier if used)\n      const tokens = await this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, pkce?.codeVerifier);\n\n      return tokens;\n    } catch (error) {\n      logger.error('❌ OAuth flow failed:', error instanceof Error ? error.message : String(error));\n      throw error;\n    } finally {\n      // Always close callback server\n      await callbackListener.stop();\n    }\n  }\n\n  /**\n   * Exchange authorization code for access and refresh tokens\n   * @param codeVerifier - Optional PKCE code verifier (RFC 7636)\n   */\n  private async exchangeCodeForTokens(tokenEndpoint: string, code: string, clientId: string, clientSecret: string, redirectUri: string, codeVerifier?: string): Promise<TokenSet> {\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      client_secret: clientSecret,\n    });\n\n    // Add PKCE code verifier if provided (RFC 7636)\n    if (codeVerifier) {\n      params.set('code_verifier', codeVerifier);\n    }\n\n    const response = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n        Connection: 'close',\n      },\n      body: params,\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || '',\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   *\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param refreshToken - Refresh token from previous token set\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @returns New token set with refreshed access token\n   *\n   * @throws Error if refresh fails\n   */\n  async refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string): Promise<TokenSet> {\n    const response = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n        Connection: 'close',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token refresh response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || refreshToken, // Reuse old refresh token if not provided\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Open browser to authorization URL\n   * Uses platform-specific command to open default browser\n   */\n  private async openBrowser(url: string): Promise<void> {\n    // Determine platform-specific command\n    const platform = process.platform;\n    let command: string;\n    let args: string[];\n\n    if (platform === 'darwin') {\n      command = 'open';\n      args = [url];\n    } else if (platform === 'win32') {\n      command = 'cmd';\n      args = ['/c', 'start', url];\n    } else {\n      // Linux and others\n      command = 'xdg-open';\n      args = [url];\n    }\n\n    // Spawn browser process\n    const child = child_process.spawn(command, args, {\n      detached: true,\n      stdio: 'ignore',\n    });\n\n    child.unref();\n  }\n}\n"],"names":["InteractiveOAuthFlow","performAuthFlow","authorizationEndpoint","tokenEndpoint","clientId","clientSecret","options","logger","callbackListener","pkce","redirectUri","authUrl","timeout","result","tokens","error","defaultLogger","OAuthCallbackListener","port","debug","generatePkce","start","URL","searchParams","set","scopes","length","join","resource","codeChallenge","codeChallengeMethod","headless","info","toString","openBrowser","waitForCallback","exchangeCodeForTokens","code","codeVerifier","Error","message","String","stop","params","response","errorText","data","tokenSet","URLSearchParams","grant_type","redirect_uri","client_id","client_secret","fetch","method","headers","Accept","Connection","body","ok","text","status","json","access_token","accessToken","refreshToken","refresh_token","expiresAt","Date","now","expires_in","scope","split","refreshTokens","url","platform","command","args","child","process","child_process","spawn","detached","stdio","unref"],"mappings":"AAAA;;;CAGC;;;;+BAsBYA;;;eAAAA;;;yEApBkB;wBACS;uCACF;sBACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBtB,IAAA,AAAMA,qCAAN;;aAAMA;gCAAAA;;iBAAAA;IACX;;;;;;;;;;;;;;;;;;;;;;;;GAwBC,GACD,OAAMC,eAiEL,GAjED,SAAMA,gBAAgBC,qBAA6B,EAAEC,aAAqB,EAAEC,QAAgB,EAAEC,YAAoB,EAAEC,OAAyB;;gBAC5HA,iBAATC,QACAC,kBAGFC,MAWIC,aAGAC,SAgCAC,SACAC,QAGAC,QAGCC;;;;wBAzDHR,UAASD,kBAAAA,QAAQC,MAAM,cAAdD,6BAAAA,kBAAkBU,gBAAa;wBACxCR,mBAAmB,IAAIS,8CAAqB,CAAC;4BAAEC,MAAMZ,QAAQY,IAAI;4BAAEX,QAAAA;wBAAO;6BAI5ED,QAAQG,IAAI,EAAZH;;;;wBACFC,OAAOY,KAAK,CAAC;wBACN;;4BAAMC,IAAAA,oBAAY;;;wBAAzBX,OAAO;;;;;;;;;wBAIP,wBAAwB;wBACxB;;4BAAMD,iBAAiBa,KAAK;;;wBAA5B;wBAEA,qBAAqB;wBACfX,cAAcJ,QAAQI,WAAW,IAAI,AAAC,oBAAgC,OAAbJ,QAAQY,IAAI,EAAC;wBAE5E,0BAA0B;wBACpBP,UAAU,IAAIW,IAAIpB;wBACxBS,QAAQY,YAAY,CAACC,GAAG,CAAC,aAAapB;wBACtCO,QAAQY,YAAY,CAACC,GAAG,CAAC,gBAAgBd;wBACzCC,QAAQY,YAAY,CAACC,GAAG,CAAC,iBAAiB;wBAE1C,IAAIlB,QAAQmB,MAAM,IAAInB,QAAQmB,MAAM,CAACC,MAAM,GAAG,GAAG;4BAC/Cf,QAAQY,YAAY,CAACC,GAAG,CAAC,SAASlB,QAAQmB,MAAM,CAACE,IAAI,CAAC;wBACxD;wBAEA,iDAAiD;wBACjD,IAAIrB,QAAQsB,QAAQ,EAAE;4BACpBjB,QAAQY,YAAY,CAACC,GAAG,CAAC,YAAYlB,QAAQsB,QAAQ;wBACvD;wBAEA,8CAA8C;wBAC9C,IAAInB,MAAM;4BACRE,QAAQY,YAAY,CAACC,GAAG,CAAC,kBAAkBf,KAAKoB,aAAa;4BAC7DlB,QAAQY,YAAY,CAACC,GAAG,CAAC,yBAAyBf,KAAKqB,mBAAmB;wBAC5E;6BAGIxB,QAAQyB,QAAQ,EAAhBzB;;;;wBACFC,OAAOyB,IAAI,CAAC;wBACZzB,OAAOyB,IAAI,CAACrB,QAAQsB,QAAQ;wBAC5B1B,OAAOyB,IAAI,CAAC;;;;;;wBAEZzB,OAAOY,KAAK,CAAC;wBACb,kEAAkE;wBAClE;;4BAAM,IAAI,CAACe,WAAW,CAACvB,QAAQsB,QAAQ;;;wBAAvC;;;wBAGF,iCAAiC;wBAC3BrB,UAAUN,QAAQM,OAAO,IAAKN,CAAAA,QAAQyB,QAAQ,GAAG,QAAQ,MAAK;wBACrD;;4BAAMvB,iBAAiB2B,eAAe,CAACvB;;;wBAAhDC,SAAS;wBAGA;;4BAAM,IAAI,CAACuB,qBAAqB,CAACjC,eAAeU,OAAOwB,IAAI,EAAEjC,UAAUC,cAAcK,aAAaD,iBAAAA,2BAAAA,KAAM6B,YAAY;;;wBAA7HxB,SAAS;wBAEf;;4BAAOA;;;wBACAC;wBACPR,OAAOQ,KAAK,CAAC,wBAAwBA,AAAK,YAALA,OAAiBwB,SAAQxB,MAAMyB,OAAO,GAAGC,OAAO1B;wBACrF,MAAMA;;wBAEN,+BAA+B;wBAC/B;;4BAAMP,iBAAiBkC,IAAI;;;wBAA3B;;;;;;;;;;QAEJ;;IAEA;;;GAGC,GACD,OAAcN,qBAgDb,GAhDD,SAAcA,sBAAsBjC,aAAqB,EAAEkC,IAAY,EAAEjC,QAAgB,EAAEC,YAAoB,EAAEK,WAAmB,EAAE4B,YAAqB;;gBACnJK,QAaAC,UAWEC,WAIFC,MAMAC;;;;wBAlCAJ,SAAS,IAAIK,gBAAgB;4BACjCC,YAAY;4BACZZ,MAAAA;4BACAa,cAAcxC;4BACdyC,WAAW/C;4BACXgD,eAAe/C;wBACjB;wBAEA,gDAAgD;wBAChD,IAAIiC,cAAc;4BAChBK,OAAOnB,GAAG,CAAC,iBAAiBc;wBAC9B;wBAEiB;;4BAAMe,MAAMlD,eAAe;gCAC1CmD,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAMf;4BACR;;;wBARMC,WAAW;6BAUb,CAACA,SAASe,EAAE,EAAZ;;;;wBACgB;;4BAAMf,SAASgB,IAAI;;;wBAA/Bf,YAAY;wBAClB,MAAM,IAAIN,MAAM,AAAC,0BAA8CM,OAArBD,SAASiB,MAAM,EAAC,OAAe,OAAVhB;;wBAGnD;;4BAAMD,SAASkB,IAAI;;;wBAA3BhB,OAAQ;wBAEd,IAAI,CAACA,KAAKiB,YAAY,EAAE;4BACtB,MAAM,IAAIxB,MAAM;wBAClB;wBAEMQ,WAAqB;4BACzBiB,aAAalB,KAAKiB,YAAY;4BAC9BE,cAAcnB,KAAKoB,aAAa,IAAI;4BACpCC,WAAWC,KAAKC,GAAG,KAAKvB,KAAKwB,UAAU,GAAG;4BAC1ClE,UAAAA;4BACAC,cAAAA;wBACF;wBAEA,IAAIyC,KAAKyB,KAAK,EAAE;4BACdxB,SAAStB,MAAM,GAAGqB,KAAKyB,KAAK,CAACC,KAAK,CAAC;wBACrC;wBAEA;;4BAAOzB;;;;QACT;;IAEA;;;;;;;;;;GAUC,GACD,OAAM0B,aAwCL,GAxCD,SAAMA,cAActE,aAAqB,EAAE8D,YAAoB,EAAE7D,QAAgB,EAAEC,YAAoB;;gBAC/FuC,UAgBEC,WAIFC,MAMAC;;;;wBA1BW;;4BAAMM,MAAMlD,eAAe;gCAC1CmD,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAM,IAAIV,gBAAgB;oCACxBC,YAAY;oCACZiB,eAAeD;oCACfd,WAAW/C;oCACXgD,eAAe/C;gCACjB;4BACF;;;wBAbMuC,WAAW;6BAeb,CAACA,SAASe,EAAE,EAAZ;;;;wBACgB;;4BAAMf,SAASgB,IAAI;;;wBAA/Bf,YAAY;wBAClB,MAAM,IAAIN,MAAM,AAAC,yBAA6CM,OAArBD,SAASiB,MAAM,EAAC,OAAe,OAAVhB;;wBAGlD;;4BAAMD,SAASkB,IAAI;;;wBAA3BhB,OAAQ;wBAEd,IAAI,CAACA,KAAKiB,YAAY,EAAE;4BACtB,MAAM,IAAIxB,MAAM;wBAClB;wBAEMQ,WAAqB;4BACzBiB,aAAalB,KAAKiB,YAAY;4BAC9BE,cAAcnB,KAAKoB,aAAa,IAAID;4BACpCE,WAAWC,KAAKC,GAAG,KAAKvB,KAAKwB,UAAU,GAAG;4BAC1ClE,UAAAA;4BACAC,cAAAA;wBACF;wBAEA,IAAIyC,KAAKyB,KAAK,EAAE;4BACdxB,SAAStB,MAAM,GAAGqB,KAAKyB,KAAK,CAACC,KAAK,CAAC;wBACrC;wBAEA;;4BAAOzB;;;;QACT;;IAEA;;;GAGC,GACD,OAAcb,WAyBb,GAzBD,SAAcA,YAAYwC,GAAW;;gBAE7BC,UACFC,SACAC,MAeEC;;gBAlBN,sCAAsC;gBAChCH,WAAWI,QAAQJ,QAAQ;gBAIjC,IAAIA,aAAa,UAAU;oBACzBC,UAAU;oBACVC;wBAAQH;;gBACV,OAAO,IAAIC,aAAa,SAAS;oBAC/BC,UAAU;oBACVC;wBAAQ;wBAAM;wBAASH;;gBACzB,OAAO;oBACL,mBAAmB;oBACnBE,UAAU;oBACVC;wBAAQH;;gBACV;gBAEA,wBAAwB;gBAClBI,QAAQE,mBAAcC,KAAK,CAACL,SAASC,MAAM;oBAC/CK,UAAU;oBACVC,OAAO;gBACT;gBAEAL,MAAMM,KAAK;;;;;QACb;;WArOWpF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/client/src/auth/interactive-oauth-flow.ts"],"sourcesContent":["/**\n * OAuth Authorization Flow Handler\n * Manages browser-based OAuth flows and token exchange with PKCE support\n */\n\nimport * as child_process from 'node:child_process';\nimport { logger as defaultLogger } from '../utils/logger.ts';\nimport { OAuthCallbackListener } from './oauth-callback-listener.ts';\nimport { generatePkce } from './pkce.ts';\nimport type { OAuthFlowOptions, PkceParams, TokenSet } from './types.ts';\n\n/**\n * OAuth token response from token endpoint\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * InteractiveOAuthFlow manages the complete OAuth authorization code flow\n */\nexport class InteractiveOAuthFlow {\n  /**\n   * Perform OAuth authorization code flow\n   *\n   * @param authorizationEndpoint - OAuth authorization endpoint URL\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @param options - Flow options (port is required - use get-port to find available port)\n   * @returns Token set with access and refresh tokens\n   *\n   * @throws Error if flow fails or times out\n   *\n   * @example\n   * import getPort from 'get-port';\n   *\n   * const flow = new InteractiveOAuthFlow();\n   * const port = await getPort();\n   * const tokens = await flow.performAuthFlow(\n   *   'https://example.com/oauth/authorize',\n   *   'https://example.com/oauth/token',\n   *   'client-id',\n   *   'client-secret',\n   *   { port, scopes: ['read', 'write'] }\n   * );\n   */\n  async performAuthFlow(authorizationEndpoint: string, tokenEndpoint: string, clientId: string, clientSecret: string, options: OAuthFlowOptions): Promise<TokenSet> {\n    const logger = options.logger ?? defaultLogger;\n    const callbackListener = new OAuthCallbackListener({ port: options.port, logger });\n\n    // Generate PKCE parameters if requested (RFC 7636)\n    let pkce: PkceParams | undefined;\n    if (options.pkce) {\n      logger.debug('🔐 Generating PKCE parameters...');\n      pkce = await generatePkce();\n    }\n\n    try {\n      // Start callback server\n      await callbackListener.start();\n\n      // Build redirect URI\n      const redirectUri = options.redirectUri || `http://localhost:${options.port}/callback`;\n\n      // Build authorization URL\n      const authUrl = new URL(authorizationEndpoint);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('redirect_uri', redirectUri);\n      authUrl.searchParams.set('response_type', 'code');\n\n      if (options.scopes && options.scopes.length > 0) {\n        authUrl.searchParams.set('scope', options.scopes.join(' '));\n      }\n\n      // Add resource parameter if specified (RFC 8707)\n      if (options.resource) {\n        authUrl.searchParams.set('resource', options.resource);\n      }\n\n      // Add PKCE parameters if generated (RFC 7636)\n      if (pkce) {\n        authUrl.searchParams.set('code_challenge', pkce.codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);\n      }\n\n      // Open browser or print URL for headless mode\n      if (options.headless) {\n        logger.info('🔗 Please visit this URL to authorize:');\n        logger.info(authUrl.toString());\n        logger.info('Waiting for callback...');\n      } else {\n        logger.debug('🌐 Opening browser for OAuth authorization...');\n        // Try to open browser (requires 'open' package or native command)\n        await this.openBrowser(authUrl.toString());\n      }\n\n      // Wait for callback with timeout\n      const timeout = options.timeout || (options.headless ? 60000 : 300000);\n      const result = await callbackListener.waitForCallback(timeout);\n\n      // Exchange authorization code for tokens (with PKCE verifier if used)\n      const tokens = await this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, pkce?.codeVerifier);\n\n      return tokens;\n    } catch (error) {\n      logger.error('❌ OAuth flow failed:', error instanceof Error ? error.message : String(error));\n      throw error;\n    } finally {\n      // Always close callback server\n      await callbackListener.stop();\n    }\n  }\n\n  /**\n   * Exchange authorization code for access and refresh tokens\n   * @param codeVerifier - Optional PKCE code verifier (RFC 7636)\n   */\n  private async exchangeCodeForTokens(tokenEndpoint: string, code: string, clientId: string, clientSecret: string, redirectUri: string, codeVerifier?: string): Promise<TokenSet> {\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      client_secret: clientSecret,\n    });\n\n    // Add PKCE code verifier if provided (RFC 7636)\n    if (codeVerifier) {\n      params.set('code_verifier', codeVerifier);\n    }\n\n    const response = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n        Connection: 'close',\n      },\n      body: params,\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || '',\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   *\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param refreshToken - Refresh token from previous token set\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @returns New token set with refreshed access token\n   *\n   * @throws Error if refresh fails\n   */\n  async refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string): Promise<TokenSet> {\n    const response = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n        Connection: 'close',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: clientId,\n        client_secret: clientSecret,\n      }),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token refresh response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || refreshToken, // Reuse old refresh token if not provided\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Open browser to authorization URL\n   * Uses platform-specific command to open default browser\n   */\n  private async openBrowser(url: string): Promise<void> {\n    // Determine platform-specific command\n    const platform = process.platform;\n    let command: string;\n    let args: string[];\n\n    if (platform === 'darwin') {\n      command = 'open';\n      args = [url];\n    } else if (platform === 'win32') {\n      command = 'cmd';\n      args = ['/c', 'start', url];\n    } else {\n      // Linux and others\n      command = 'xdg-open';\n      args = [url];\n    }\n\n    // Spawn browser process\n    const child = child_process.spawn(command, args, {\n      detached: true,\n      stdio: 'ignore',\n    });\n\n    child.unref();\n  }\n}\n"],"names":["InteractiveOAuthFlow","performAuthFlow","authorizationEndpoint","tokenEndpoint","clientId","clientSecret","options","logger","callbackListener","pkce","redirectUri","authUrl","timeout","result","tokens","error","defaultLogger","OAuthCallbackListener","port","debug","generatePkce","start","URL","searchParams","set","scopes","length","join","resource","codeChallenge","codeChallengeMethod","headless","info","toString","openBrowser","waitForCallback","exchangeCodeForTokens","code","codeVerifier","Error","message","String","stop","params","response","errorText","data","tokenSet","URLSearchParams","grant_type","redirect_uri","client_id","client_secret","fetch","method","headers","Accept","Connection","body","ok","text","status","json","access_token","accessToken","refreshToken","refresh_token","expiresAt","Date","now","expires_in","scope","split","refreshTokens","url","platform","command","args","child","process","child_process","spawn","detached","stdio","unref"],"mappings":"AAAA;;;CAGC;;;;+BAsBYA;;;eAAAA;;;yEApBkB;wBACS;uCACF;sBACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBtB,IAAA,AAAMA,qCAAN;;aAAMA;gCAAAA;;iBAAAA;IACX;;;;;;;;;;;;;;;;;;;;;;;;GAwBC,GACD,OAAMC,eAiEL,GAjED,SAAMA,gBAAgBC,qBAA6B,EAAEC,aAAqB,EAAEC,QAAgB,EAAEC,YAAoB,EAAEC,OAAyB;;gBAC5HA,iBAATC,QACAC,kBAGFC,MAWIC,aAGAC,SAgCAC,SACAC,QAGAC,QAGCC;;;;wBAzDHR,UAASD,kBAAAA,QAAQC,MAAM,cAAdD,6BAAAA,kBAAkBU,gBAAa;wBACxCR,mBAAmB,IAAIS,8CAAqB,CAAC;4BAAEC,MAAMZ,QAAQY,IAAI;4BAAEX,QAAAA;wBAAO;6BAI5ED,QAAQG,IAAI,EAAZH;;;;wBACFC,OAAOY,KAAK,CAAC;wBACN;;4BAAMC,IAAAA,oBAAY;;;wBAAzBX,OAAO;;;;;;;;;wBAIP,wBAAwB;wBACxB;;4BAAMD,iBAAiBa,KAAK;;;wBAA5B;wBAEA,qBAAqB;wBACfX,cAAcJ,QAAQI,WAAW,IAAI,AAAC,oBAAgC,OAAbJ,QAAQY,IAAI,EAAC;wBAE5E,0BAA0B;wBACpBP,UAAU,IAAIW,IAAIpB;wBACxBS,QAAQY,YAAY,CAACC,GAAG,CAAC,aAAapB;wBACtCO,QAAQY,YAAY,CAACC,GAAG,CAAC,gBAAgBd;wBACzCC,QAAQY,YAAY,CAACC,GAAG,CAAC,iBAAiB;wBAE1C,IAAIlB,QAAQmB,MAAM,IAAInB,QAAQmB,MAAM,CAACC,MAAM,GAAG,GAAG;4BAC/Cf,QAAQY,YAAY,CAACC,GAAG,CAAC,SAASlB,QAAQmB,MAAM,CAACE,IAAI,CAAC;wBACxD;wBAEA,iDAAiD;wBACjD,IAAIrB,QAAQsB,QAAQ,EAAE;4BACpBjB,QAAQY,YAAY,CAACC,GAAG,CAAC,YAAYlB,QAAQsB,QAAQ;wBACvD;wBAEA,8CAA8C;wBAC9C,IAAInB,MAAM;4BACRE,QAAQY,YAAY,CAACC,GAAG,CAAC,kBAAkBf,KAAKoB,aAAa;4BAC7DlB,QAAQY,YAAY,CAACC,GAAG,CAAC,yBAAyBf,KAAKqB,mBAAmB;wBAC5E;6BAGIxB,QAAQyB,QAAQ,EAAhBzB;;;;wBACFC,OAAOyB,IAAI,CAAC;wBACZzB,OAAOyB,IAAI,CAACrB,QAAQsB,QAAQ;wBAC5B1B,OAAOyB,IAAI,CAAC;;;;;;wBAEZzB,OAAOY,KAAK,CAAC;wBACb,kEAAkE;wBAClE;;4BAAM,IAAI,CAACe,WAAW,CAACvB,QAAQsB,QAAQ;;;wBAAvC;;;wBAGF,iCAAiC;wBAC3BrB,UAAUN,QAAQM,OAAO,IAAKN,CAAAA,QAAQyB,QAAQ,GAAG,QAAQ,MAAK;wBACrD;;4BAAMvB,iBAAiB2B,eAAe,CAACvB;;;wBAAhDC,SAAS;wBAGA;;4BAAM,IAAI,CAACuB,qBAAqB,CAACjC,eAAeU,OAAOwB,IAAI,EAAEjC,UAAUC,cAAcK,aAAaD,iBAAAA,2BAAAA,KAAM6B,YAAY;;;wBAA7HxB,SAAS;wBAEf;;4BAAOA;;;wBACAC;wBACPR,OAAOQ,KAAK,CAAC,wBAAwBA,AAAK,YAALA,OAAiBwB,SAAQxB,MAAMyB,OAAO,GAAGC,OAAO1B;wBACrF,MAAMA;;wBAEN,+BAA+B;wBAC/B;;4BAAMP,iBAAiBkC,IAAI;;;wBAA3B;;;;;;;;;;QAEJ;;IAEA;;;GAGC,GACD,OAAcN,qBAgDb,GAhDD,SAAcA,sBAAsBjC,aAAqB,EAAEkC,IAAY,EAAEjC,QAAgB,EAAEC,YAAoB,EAAEK,WAAmB,EAAE4B,YAAqB;;gBACnJK,QAaAC,UAWEC,WAIFC,MAMAC;;;;wBAlCAJ,SAAS,IAAIK,gBAAgB;4BACjCC,YAAY;4BACZZ,MAAAA;4BACAa,cAAcxC;4BACdyC,WAAW/C;4BACXgD,eAAe/C;wBACjB;wBAEA,gDAAgD;wBAChD,IAAIiC,cAAc;4BAChBK,OAAOnB,GAAG,CAAC,iBAAiBc;wBAC9B;wBAEiB;;4BAAMe,MAAMlD,eAAe;gCAC1CmD,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAMf;4BACR;;;wBARMC,WAAW;6BAUb,CAACA,SAASe,EAAE,EAAZ;;;;wBACgB;;4BAAMf,SAASgB,IAAI;;;wBAA/Bf,YAAY;wBAClB,MAAM,IAAIN,MAAM,AAAC,0BAA8CM,OAArBD,SAASiB,MAAM,EAAC,OAAe,OAAVhB;;wBAGnD;;4BAAMD,SAASkB,IAAI;;;wBAA3BhB,OAAQ;wBAEd,IAAI,CAACA,KAAKiB,YAAY,EAAE;4BACtB,MAAM,IAAIxB,MAAM;wBAClB;wBAEMQ,WAAqB;4BACzBiB,aAAalB,KAAKiB,YAAY;4BAC9BE,cAAcnB,KAAKoB,aAAa,IAAI;4BACpCC,WAAWC,KAAKC,GAAG,KAAKvB,KAAKwB,UAAU,GAAG;4BAC1ClE,UAAAA;4BACAC,cAAAA;wBACF;wBAEA,IAAIyC,KAAKyB,KAAK,EAAE;4BACdxB,SAAStB,MAAM,GAAGqB,KAAKyB,KAAK,CAACC,KAAK,CAAC;wBACrC;wBAEA;;4BAAOzB;;;;QACT;;IAEA;;;;;;;;;;GAUC,GACD,OAAM0B,aAwCL,GAxCD,SAAMA,cAActE,aAAqB,EAAE8D,YAAoB,EAAE7D,QAAgB,EAAEC,YAAoB;;gBAC/FuC,UAgBEC,WAIFC,MAMAC;;;;wBA1BW;;4BAAMM,MAAMlD,eAAe;gCAC1CmD,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAM,IAAIV,gBAAgB;oCACxBC,YAAY;oCACZiB,eAAeD;oCACfd,WAAW/C;oCACXgD,eAAe/C;gCACjB;4BACF;;;wBAbMuC,WAAW;6BAeb,CAACA,SAASe,EAAE,EAAZ;;;;wBACgB;;4BAAMf,SAASgB,IAAI;;;wBAA/Bf,YAAY;wBAClB,MAAM,IAAIN,MAAM,AAAC,yBAA6CM,OAArBD,SAASiB,MAAM,EAAC,OAAe,OAAVhB;;wBAGlD;;4BAAMD,SAASkB,IAAI;;;wBAA3BhB,OAAQ;wBAEd,IAAI,CAACA,KAAKiB,YAAY,EAAE;4BACtB,MAAM,IAAIxB,MAAM;wBAClB;wBAEMQ,WAAqB;4BACzBiB,aAAalB,KAAKiB,YAAY;4BAC9BE,cAAcnB,KAAKoB,aAAa,IAAID;4BACpCE,WAAWC,KAAKC,GAAG,KAAKvB,KAAKwB,UAAU,GAAG;4BAC1ClE,UAAAA;4BACAC,cAAAA;wBACF;wBAEA,IAAIyC,KAAKyB,KAAK,EAAE;4BACdxB,SAAStB,MAAM,GAAGqB,KAAKyB,KAAK,CAACC,KAAK,CAAC;wBACrC;wBAEA;;4BAAOzB;;;;QACT;;IAEA;;;GAGC,GACD,OAAcb,WAyBb,GAzBD,SAAcA,YAAYwC,GAAW;;gBAE7BC,UACFC,SACAC,MAeEC;;gBAlBN,sCAAsC;gBAChCH,WAAWI,QAAQJ,QAAQ;gBAIjC,IAAIA,aAAa,UAAU;oBACzBC,UAAU;oBACVC;wBAAQH;;gBACV,OAAO,IAAIC,aAAa,SAAS;oBAC/BC,UAAU;oBACVC;wBAAQ;wBAAM;wBAASH;;gBACzB,OAAO;oBACL,mBAAmB;oBACnBE,UAAU;oBACVC;wBAAQH;;gBACV;gBAEA,wBAAwB;gBAClBI,QAAQE,mBAAcC,KAAK,CAACL,SAASC,MAAM;oBAC/CK,UAAU;oBACVC,OAAO;gBACT;gBAEAL,MAAMM,KAAK;;;;;QACb;;WArOWpF"}

package/dist/cjs/auth/oauth-callback-listener.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/libs/client/src/auth/oauth-callback-listener.ts"],"sourcesContent":["/**\n * OAuth Callback Server for CLI Authentication\n * Listens for OAuth authorization callbacks and captures authorization code\n */\n\nimport http from 'node:http';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport type { CallbackResult } from './types.ts';\n\nexport interface OAuthCallbackListenerOptions {\n  /** Port to listen on (required - use get-port package to find available port) */\n  port: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * OAuthCallbackListener handles OAuth redirect callbacks\n * Starts a temporary HTTP server to receive authorization code\n *\n * Note: Caller is responsible for finding an available port using get-port package\n */\nexport class OAuthCallbackListener {\n  private server: http.Server | undefined;\n  private resolveCallback?: (result: CallbackResult) => void;\n  private rejectCallback?: (error: Error) => void;\n  private timeout: NodeJS.Timeout | undefined;\n  private port: number;\n  private logger: Logger;\n\n  constructor(options: OAuthCallbackListenerOptions) {\n    this.port = options.port;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Start the callback server\n   * Fails fast if port is already in use - caller should use get-port to find available port\n   */\n  async start(): Promise<void> {\n    await this.listen(this.port);\n    this.logger.debug(`✅ Callback server listening on http://localhost:${this.port}/callback`);\n  }\n\n  /**\n   * Listen on a specific port\n   */\n  private listen(port: number): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.server = http.createServer((req, res) => {\n        this.handleRequest(req, res);\n      });\n\n      this.server.on('error', (error) => {\n        reject(error);\n      });\n\n      this.server.listen(port, () => {\n        resolve();\n      });\n    });\n  }\n\n  /**\n   * Handle incoming HTTP requests\n   */\n  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {\n    const url = new URL(req.url || '', `http://localhost:${this.port}`);\n\n    if (url.pathname === '/callback') {\n      this.handleCallback(url, res);\n    } else {\n      res.writeHead(404, { 'Content-Type': 'text/plain' });\n      res.end('Not Found');\n    }\n  }\n\n  /**\n   * Handle OAuth callback\n   */\n  private handleCallback(url: URL, res: http.ServerResponse): void {\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n\n    // Handle OAuth errors\n    if (error) {\n      const errorMessage = errorDescription ? `${error}: ${errorDescription}` : error;\n\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Authorization Failed</h1>\n            <p>${errorMessage}</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error(errorMessage));\n      }\n      return;\n    }\n\n    // Validate code parameter\n    if (!code) {\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Invalid Callback</h1>\n            <p>Missing authorization code</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error('Missing authorization code'));\n      }\n      return;\n    }\n\n    // Success - send confirmation page\n    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n      <html>\n        <head>\n          <meta charset=\"UTF-8\">\n        </head>\n        <body>\n          <h1>Authorization Successful</h1>\n          <p>You can close this window and return to the terminal.</p>\n          <script>setTimeout(() => window.close(), 2000);</script>\n        </body>\n      </html>\n    `);\n\n    // Resolve the promise with authorization code\n    if (this.resolveCallback) {\n      const result: CallbackResult = { code };\n      if (state) {\n        result.state = state;\n      }\n      this.resolveCallback(result);\n    }\n  }\n\n  /**\n   * Wait for OAuth callback with timeout\n   */\n  async waitForCallback(timeoutMs = 300000): Promise<CallbackResult> {\n    return new Promise((resolve, reject) => {\n      this.resolveCallback = resolve;\n      this.rejectCallback = reject;\n\n      // Set timeout to prevent hanging forever\n      this.timeout = setTimeout(() => {\n        reject(new Error(`Authorization timeout - no callback received within ${timeoutMs / 1000} seconds`));\n        this.stop();\n      }, timeoutMs);\n    });\n  }\n\n  /**\n   * Stop the callback server and close\n   */\n  async stop(): Promise<void> {\n    // Clear the timeout\n    if (this.timeout) {\n      clearTimeout(this.timeout);\n      this.timeout = undefined;\n    }\n\n    // Close the server\n    if (this.server) {\n      await new Promise<void>((resolve) => {\n        this.server?.close(() => {\n          this.logger.debug('🔒 Callback server closed');\n          resolve();\n        });\n      });\n      this.server = undefined;\n    }\n  }\n\n  /**\n   * Get the callback URL for this server\n   */\n  getCallbackUrl(): string {\n    if (!this.port) {\n      throw new Error('Server not started - call start() first');\n    }\n    return `http://localhost:${this.port}/callback`;\n  }\n}\n"],"names":["OAuthCallbackListener","options","port","logger","defaultLogger","start","listen","debug","Promise","resolve","reject","server","http","createServer","req","res","handleRequest","on","error","url","URL","pathname","handleCallback","writeHead","end","code","searchParams","get","state","errorDescription","errorMessage","rejectCallback","Error","resolveCallback","result","waitForCallback","timeoutMs","timeout","setTimeout","stop","clearTimeout","undefined","close","getCallbackUrl"],"mappings":"AAAA;;;CAGC;;;;+BAmBYA;;;eAAAA;;;+DAjBI;wBACoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgB9C,IAAA,AAAMA,sCAAN;;aAAMA,sBAQCC,OAAqC;gCARtCD;YAUKC;QADd,IAAI,CAACC,IAAI,GAAGD,QAAQC,IAAI;QACxB,IAAI,CAACC,MAAM,IAAGF,kBAAAA,QAAQE,MAAM,cAAdF,6BAAAA,kBAAkBG,gBAAa;;iBAVpCJ;IAaX;;;GAGC,GACD,OAAMK,KAGL,GAHD,SAAMA;;;;;wBACJ;;4BAAM,IAAI,CAACC,MAAM,CAAC,IAAI,CAACJ,IAAI;;;wBAA3B;wBACA,IAAI,CAACC,MAAM,CAACI,KAAK,CAAC,AAAC,mDAA4D,OAAV,IAAI,CAACL,IAAI,EAAC;;;;;;QACjF;;IAEA;;GAEC,GACD,OAAQI,MAcP,GAdD,SAAQA,OAAOJ,IAAY;;QACzB,OAAO,IAAIM,QAAQ,SAACC,SAASC;YAC3B,MAAKC,MAAM,GAAGC,iBAAI,CAACC,YAAY,CAAC,SAACC,KAAKC;gBACpC,MAAKC,aAAa,CAACF,KAAKC;YAC1B;YAEA,MAAKJ,MAAM,CAACM,EAAE,CAAC,SAAS,SAACC;gBACvBR,OAAOQ;YACT;YAEA,MAAKP,MAAM,CAACL,MAAM,CAACJ,MAAM;gBACvBO;YACF;QACF;IACF;IAEA;;GAEC,GACD,OAAQO,aASP,GATD,SAAQA,cAAcF,GAAyB,EAAEC,GAAwB;QACvE,IAAMI,MAAM,IAAIC,IAAIN,IAAIK,GAAG,IAAI,IAAI,AAAC,oBAA6B,OAAV,IAAI,CAACjB,IAAI;QAEhE,IAAIiB,IAAIE,QAAQ,KAAK,aAAa;YAChC,IAAI,CAACC,cAAc,CAACH,KAAKJ;QAC3B,OAAO;YACLA,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAa;YAClDR,IAAIS,GAAG,CAAC;QACV;IACF;IAEA;;GAEC,GACD,OAAQF,cAqEP,GArED,SAAQA,eAAeH,GAAQ,EAAEJ,GAAwB;QACvD,IAAMU,OAAON,IAAIO,YAAY,CAACC,GAAG,CAAC;QAClC,IAAMC,QAAQT,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,IAAMT,QAAQC,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,IAAME,mBAAmBV,IAAIO,YAAY,CAACC,GAAG,CAAC;QAE9C,sBAAsB;QACtB,IAAIT,OAAO;YACT,IAAMY,eAAeD,mBAAmB,AAAC,GAAYA,OAAVX,OAAM,MAAqB,OAAjBW,oBAAqBX;YAE1EH,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC,AAAC,iGAIe,OAAbM,cAAa;YAMxB,IAAI,IAAI,CAACC,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAMF;YAChC;YACA;QACF;QAEA,0BAA0B;QAC1B,IAAI,CAACL,MAAM;YACTV,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC;YAUR,IAAI,IAAI,CAACO,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAM;YAChC;YACA;QACF;QAEA,mCAAmC;QACnCjB,IAAIQ,SAAS,CAAC,KAAK;YAAE,gBAAgB;QAA2B;QAChER,IAAIS,GAAG,CAAC;QAaR,8CAA8C;QAC9C,IAAI,IAAI,CAACS,eAAe,EAAE;YACxB,IAAMC,SAAyB;gBAAET,MAAAA;YAAK;YACtC,IAAIG,OAAO;gBACTM,OAAON,KAAK,GAAGA;YACjB;YACA,IAAI,CAACK,eAAe,CAACC;QACvB;IACF;IAEA;;GAEC,GACD,OAAMC,eAWL,GAXD,SAAMA;YAAgBC,YAAAA,iEAAY;;;;;gBAChC;;oBAAO,IAAI5B,QAAQ,SAACC,SAASC;wBAC3B,MAAKuB,eAAe,GAAGxB;wBACvB,MAAKsB,cAAc,GAAGrB;wBAEtB,yCAAyC;wBACzC,MAAK2B,OAAO,GAAGC,WAAW;4BACxB5B,OAAO,IAAIsB,MAAM,AAAC,uDAAuE,OAAjBI,YAAY,MAAK;4BACzF,MAAKG,IAAI;wBACX,GAAGH;oBACL;;;QACF;;IAEA;;GAEC,GACD,OAAMG,IAiBL,GAjBD,SAAMA;;;;;;;wBACJ,oBAAoB;wBACpB,IAAI,IAAI,CAACF,OAAO,EAAE;4BAChBG,aAAa,IAAI,CAACH,OAAO;4BACzB,IAAI,CAACA,OAAO,GAAGI;wBACjB;6BAGI,IAAI,CAAC9B,MAAM,EAAX;;;;wBACF;;4BAAM,IAAIH,QAAc,SAACC;oCACvB;iCAAA,eAAA,MAAKE,MAAM,cAAX,mCAAA,aAAa+B,KAAK,CAAC;oCACjB,MAAKvC,MAAM,CAACI,KAAK,CAAC;oCAClBE;gCACF;4BACF;;;wBALA;wBAMA,IAAI,CAACE,MAAM,GAAG8B;;;;;;;;QAElB;;IAEA;;GAEC,GACDE,OAAAA,cAKC,GALDA,SAAAA;QACE,IAAI,CAAC,IAAI,CAACzC,IAAI,EAAE;YACd,MAAM,IAAI8B,MAAM;QAClB;QACA,OAAO,AAAC,oBAA6B,OAAV,IAAI,CAAC9B,IAAI,EAAC;IACvC;WA/KWF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/client/src/auth/oauth-callback-listener.ts"],"sourcesContent":["/**\n * OAuth Callback Server for CLI Authentication\n * Listens for OAuth authorization callbacks and captures authorization code\n */\n\nimport http from 'node:http';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport type { CallbackResult } from './types.ts';\n\nexport interface OAuthCallbackListenerOptions {\n  /** Port to listen on (required - use get-port package to find available port) */\n  port: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * OAuthCallbackListener handles OAuth redirect callbacks\n * Starts a temporary HTTP server to receive authorization code\n *\n * Note: Caller is responsible for finding an available port using get-port package\n */\nexport class OAuthCallbackListener {\n  private server: http.Server | undefined;\n  private resolveCallback?: (result: CallbackResult) => void;\n  private rejectCallback?: (error: Error) => void;\n  private timeout: NodeJS.Timeout | undefined;\n  private port: number;\n  private logger: Logger;\n\n  constructor(options: OAuthCallbackListenerOptions) {\n    this.port = options.port;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Start the callback server\n   * Fails fast if port is already in use - caller should use get-port to find available port\n   */\n  async start(): Promise<void> {\n    await this.listen(this.port);\n    this.logger.debug(`✅ Callback server listening on http://localhost:${this.port}/callback`);\n  }\n\n  /**\n   * Listen on a specific port\n   */\n  private listen(port: number): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.server = http.createServer((req, res) => {\n        this.handleRequest(req, res);\n      });\n\n      this.server.on('error', (error) => {\n        reject(error);\n      });\n\n      this.server.listen(port, () => {\n        resolve();\n      });\n    });\n  }\n\n  /**\n   * Handle incoming HTTP requests\n   */\n  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {\n    const url = new URL(req.url || '', `http://localhost:${this.port}`);\n\n    if (url.pathname === '/callback') {\n      this.handleCallback(url, res);\n    } else {\n      res.writeHead(404, { 'Content-Type': 'text/plain' });\n      res.end('Not Found');\n    }\n  }\n\n  /**\n   * Handle OAuth callback\n   */\n  private handleCallback(url: URL, res: http.ServerResponse): void {\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n\n    // Handle OAuth errors\n    if (error) {\n      const errorMessage = errorDescription ? `${error}: ${errorDescription}` : error;\n\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Authorization Failed</h1>\n            <p>${errorMessage}</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error(errorMessage));\n      }\n      return;\n    }\n\n    // Validate code parameter\n    if (!code) {\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Invalid Callback</h1>\n            <p>Missing authorization code</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error('Missing authorization code'));\n      }\n      return;\n    }\n\n    // Success - send confirmation page\n    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n      <html>\n        <head>\n          <meta charset=\"UTF-8\">\n        </head>\n        <body>\n          <h1>Authorization Successful</h1>\n          <p>You can close this window and return to the terminal.</p>\n          <script>setTimeout(() => window.close(), 2000);</script>\n        </body>\n      </html>\n    `);\n\n    // Resolve the promise with authorization code\n    if (this.resolveCallback) {\n      const result: CallbackResult = { code };\n      if (state) {\n        result.state = state;\n      }\n      this.resolveCallback(result);\n    }\n  }\n\n  /**\n   * Wait for OAuth callback with timeout\n   */\n  async waitForCallback(timeoutMs = 300000): Promise<CallbackResult> {\n    return new Promise((resolve, reject) => {\n      this.resolveCallback = resolve;\n      this.rejectCallback = reject;\n\n      // Set timeout to prevent hanging forever\n      this.timeout = setTimeout(() => {\n        reject(new Error(`Authorization timeout - no callback received within ${timeoutMs / 1000} seconds`));\n        this.stop();\n      }, timeoutMs);\n    });\n  }\n\n  /**\n   * Stop the callback server and close\n   */\n  async stop(): Promise<void> {\n    // Clear the timeout\n    if (this.timeout) {\n      clearTimeout(this.timeout);\n      this.timeout = undefined;\n    }\n\n    // Close the server\n    if (this.server) {\n      await new Promise<void>((resolve) => {\n        this.server?.close(() => {\n          this.logger.debug('🔒 Callback server closed');\n          resolve();\n        });\n      });\n      this.server = undefined;\n    }\n  }\n\n  /**\n   * Get the callback URL for this server\n   */\n  getCallbackUrl(): string {\n    if (!this.port) {\n      throw new Error('Server not started - call start() first');\n    }\n    return `http://localhost:${this.port}/callback`;\n  }\n}\n"],"names":["OAuthCallbackListener","options","port","logger","defaultLogger","start","listen","debug","Promise","resolve","reject","server","http","createServer","req","res","handleRequest","on","error","url","URL","pathname","handleCallback","writeHead","end","code","searchParams","get","state","errorDescription","errorMessage","rejectCallback","Error","resolveCallback","result","waitForCallback","timeoutMs","timeout","setTimeout","stop","clearTimeout","undefined","close","getCallbackUrl"],"mappings":"AAAA;;;CAGC;;;;+BAmBYA;;;eAAAA;;;+DAjBI;wBACoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgB9C,IAAA,AAAMA,sCAAN;;aAAMA,sBAQCC,OAAqC;gCARtCD;YAUKC;QADd,IAAI,CAACC,IAAI,GAAGD,QAAQC,IAAI;QACxB,IAAI,CAACC,MAAM,IAAGF,kBAAAA,QAAQE,MAAM,cAAdF,6BAAAA,kBAAkBG,gBAAa;;iBAVpCJ;IAaX;;;GAGC,GACD,OAAMK,KAGL,GAHD,SAAMA;;;;;wBACJ;;4BAAM,IAAI,CAACC,MAAM,CAAC,IAAI,CAACJ,IAAI;;;wBAA3B;wBACA,IAAI,CAACC,MAAM,CAACI,KAAK,CAAC,AAAC,mDAA4D,OAAV,IAAI,CAACL,IAAI,EAAC;;;;;;QACjF;;IAEA;;GAEC,GACD,OAAQI,MAcP,GAdD,SAAQA,OAAOJ,IAAY;;QACzB,OAAO,IAAIM,QAAQ,SAACC,SAASC;YAC3B,MAAKC,MAAM,GAAGC,iBAAI,CAACC,YAAY,CAAC,SAACC,KAAKC;gBACpC,MAAKC,aAAa,CAACF,KAAKC;YAC1B;YAEA,MAAKJ,MAAM,CAACM,EAAE,CAAC,SAAS,SAACC;gBACvBR,OAAOQ;YACT;YAEA,MAAKP,MAAM,CAACL,MAAM,CAACJ,MAAM;gBACvBO;YACF;QACF;IACF;IAEA;;GAEC,GACD,OAAQO,aASP,GATD,SAAQA,cAAcF,GAAyB,EAAEC,GAAwB;QACvE,IAAMI,MAAM,IAAIC,IAAIN,IAAIK,GAAG,IAAI,IAAI,AAAC,oBAA6B,OAAV,IAAI,CAACjB,IAAI;QAEhE,IAAIiB,IAAIE,QAAQ,KAAK,aAAa;YAChC,IAAI,CAACC,cAAc,CAACH,KAAKJ;QAC3B,OAAO;YACLA,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAa;YAClDR,IAAIS,GAAG,CAAC;QACV;IACF;IAEA;;GAEC,GACD,OAAQF,cAqEP,GArED,SAAQA,eAAeH,GAAQ,EAAEJ,GAAwB;QACvD,IAAMU,OAAON,IAAIO,YAAY,CAACC,GAAG,CAAC;QAClC,IAAMC,QAAQT,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,IAAMT,QAAQC,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,IAAME,mBAAmBV,IAAIO,YAAY,CAACC,GAAG,CAAC;QAE9C,sBAAsB;QACtB,IAAIT,OAAO;YACT,IAAMY,eAAeD,mBAAmB,AAAC,GAAYA,OAAVX,OAAM,MAAqB,OAAjBW,oBAAqBX;YAE1EH,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC,AAAC,iGAIe,OAAbM,cAAa;YAMxB,IAAI,IAAI,CAACC,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAMF;YAChC;YACA;QACF;QAEA,0BAA0B;QAC1B,IAAI,CAACL,MAAM;YACTV,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC;YAUR,IAAI,IAAI,CAACO,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAM;YAChC;YACA;QACF;QAEA,mCAAmC;QACnCjB,IAAIQ,SAAS,CAAC,KAAK;YAAE,gBAAgB;QAA2B;QAChER,IAAIS,GAAG,CAAC;QAaR,8CAA8C;QAC9C,IAAI,IAAI,CAACS,eAAe,EAAE;YACxB,IAAMC,SAAyB;gBAAET,MAAAA;YAAK;YACtC,IAAIG,OAAO;gBACTM,OAAON,KAAK,GAAGA;YACjB;YACA,IAAI,CAACK,eAAe,CAACC;QACvB;IACF;IAEA;;GAEC,GACD,OAAMC,eAWL,GAXD,SAAMA;YAAgBC,YAAAA,iEAAY;;;;;gBAChC;;oBAAO,IAAI5B,QAAQ,SAACC,SAASC;wBAC3B,MAAKuB,eAAe,GAAGxB;wBACvB,MAAKsB,cAAc,GAAGrB;wBAEtB,yCAAyC;wBACzC,MAAK2B,OAAO,GAAGC,WAAW;4BACxB5B,OAAO,IAAIsB,MAAM,AAAC,uDAAuE,OAAjBI,YAAY,MAAK;4BACzF,MAAKG,IAAI;wBACX,GAAGH;oBACL;;;QACF;;IAEA;;GAEC,GACD,OAAMG,IAiBL,GAjBD,SAAMA;;;;;;;wBACJ,oBAAoB;wBACpB,IAAI,IAAI,CAACF,OAAO,EAAE;4BAChBG,aAAa,IAAI,CAACH,OAAO;4BACzB,IAAI,CAACA,OAAO,GAAGI;wBACjB;6BAGI,IAAI,CAAC9B,MAAM,EAAX;;;;wBACF;;4BAAM,IAAIH,QAAc,SAACC;oCACvB;iCAAA,eAAA,MAAKE,MAAM,cAAX,mCAAA,aAAa+B,KAAK,CAAC;oCACjB,MAAKvC,MAAM,CAACI,KAAK,CAAC;oCAClBE;gCACF;4BACF;;;wBALA;wBAMA,IAAI,CAACE,MAAM,GAAG8B;;;;;;;;QAElB;;IAEA;;GAEC,GACDE,OAAAA,cAKC,GALDA,SAAAA;QACE,IAAI,CAAC,IAAI,CAACzC,IAAI,EAAE;YACd,MAAM,IAAI8B,MAAM;QAClB;QACA,OAAO,AAAC,oBAA6B,OAAV,IAAI,CAAC9B,IAAI,EAAC;IACvC;WA/KWF"}

package/dist/cjs/auth/pkce.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/libs/client/src/auth/pkce.ts"],"sourcesContent":["/**\n * PKCE (Proof Key for Code Exchange) utilities\n * Implements RFC 7636 for OAuth 2.0 public client security\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport type { PkceParams } from './types.ts';\n\n/**\n * Generate random code verifier for PKCE (RFC 7636 Section 4.1)\n * Returns cryptographically random string of 43-128 characters using base64url encoding\n */\nfunction generateRandomCodeVerifier(): string {\n  // RFC 7636 recommends 43-128 characters\n  // Using 32 random bytes -> 43 base64url characters\n  return randomBytes(32).toString('base64url');\n}\n\n/**\n * Calculate PKCE code challenge from code verifier (RFC 7636 Section 4.2)\n * Uses S256 method: BASE64URL(SHA256(ASCII(code_verifier)))\n */\nasync function calculatePKCECodeChallenge(codeVerifier: string): Promise<string> {\n  const hash = createHash('sha256').update(codeVerifier, 'ascii').digest();\n  return Buffer.from(hash).toString('base64url');\n}\n\n/**\n * Generate PKCE parameters for OAuth 2.0 authorization code flow\n * Uses S256 method (SHA-256 hash) as recommended by RFC 7636\n *\n * @returns PkceParams with code verifier, challenge, and method\n *\n * @example\n * const pkce = await generatePkce();\n * // Use pkce.codeChallenge and pkce.codeChallengeMethod in authorization URL\n * // Store pkce.codeVerifier for token exchange\n */\nexport async function generatePkce(): Promise<PkceParams> {\n  // Generate cryptographically random code verifier (RFC 7636 § 4.1)\n  const codeVerifier = generateRandomCodeVerifier();\n\n  // Generate code challenge using S256 method (RFC 7636 § 4.2)\n  // S256: BASE64URL(SHA256(ASCII(code_verifier)))\n  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);\n\n  return {\n    codeVerifier,\n    codeChallenge,\n    codeChallengeMethod: 'S256',\n  };\n}\n"],"names":["generatePkce","generateRandomCodeVerifier","randomBytes","toString","calculatePKCECodeChallenge","codeVerifier","hash","createHash","update","digest","Buffer","from","codeChallenge","codeChallengeMethod"],"mappings":"AAAA;;;CAGC;;;;+BAmCqBA;;;eAAAA;;;0BAjCkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGxC;;;CAGC,GACD,SAASC;IACP,wCAAwC;IACxC,mDAAmD;IACnD,OAAOC,IAAAA,uBAAW,EAAC,IAAIC,QAAQ,CAAC;AAClC;AAEA;;;CAGC,GACD,SAAeC,2BAA2BC,YAAoB;;YACtDC;;YAAAA,OAAOC,IAAAA,sBAAU,EAAC,UAAUC,MAAM,CAACH,cAAc,SAASI,MAAM;YACtE;;gBAAOC,OAAOC,IAAI,CAACL,MAAMH,QAAQ,CAAC;;;IACpC;;AAaO,SAAeH;;YAEdK,cAIAO;;;;oBALN,mEAAmE;oBAC7DP,eAAeJ;oBAIC;;wBAAMG,2BAA2BC;;;oBAAjDO,gBAAgB;oBAEtB;;wBAAO;4BACLP,cAAAA;4BACAO,eAAAA;4BACAC,qBAAqB;wBACvB;;;;IACF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/client/src/auth/pkce.ts"],"sourcesContent":["/**\n * PKCE (Proof Key for Code Exchange) utilities\n * Implements RFC 7636 for OAuth 2.0 public client security\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport type { PkceParams } from './types.ts';\n\n/**\n * Generate random code verifier for PKCE (RFC 7636 Section 4.1)\n * Returns cryptographically random string of 43-128 characters using base64url encoding\n */\nfunction generateRandomCodeVerifier(): string {\n  // RFC 7636 recommends 43-128 characters\n  // Using 32 random bytes -> 43 base64url characters\n  return randomBytes(32).toString('base64url');\n}\n\n/**\n * Calculate PKCE code challenge from code verifier (RFC 7636 Section 4.2)\n * Uses S256 method: BASE64URL(SHA256(ASCII(code_verifier)))\n */\nasync function calculatePKCECodeChallenge(codeVerifier: string): Promise<string> {\n  const hash = createHash('sha256').update(codeVerifier, 'ascii').digest();\n  return Buffer.from(hash).toString('base64url');\n}\n\n/**\n * Generate PKCE parameters for OAuth 2.0 authorization code flow\n * Uses S256 method (SHA-256 hash) as recommended by RFC 7636\n *\n * @returns PkceParams with code verifier, challenge, and method\n *\n * @example\n * const pkce = await generatePkce();\n * // Use pkce.codeChallenge and pkce.codeChallengeMethod in authorization URL\n * // Store pkce.codeVerifier for token exchange\n */\nexport async function generatePkce(): Promise<PkceParams> {\n  // Generate cryptographically random code verifier (RFC 7636 § 4.1)\n  const codeVerifier = generateRandomCodeVerifier();\n\n  // Generate code challenge using S256 method (RFC 7636 § 4.2)\n  // S256: BASE64URL(SHA256(ASCII(code_verifier)))\n  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);\n\n  return {\n    codeVerifier,\n    codeChallenge,\n    codeChallengeMethod: 'S256',\n  };\n}\n"],"names":["generatePkce","generateRandomCodeVerifier","randomBytes","toString","calculatePKCECodeChallenge","codeVerifier","hash","createHash","update","digest","Buffer","from","codeChallenge","codeChallengeMethod"],"mappings":"AAAA;;;CAGC;;;;+BAmCqBA;;;eAAAA;;;0BAjCkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGxC;;;CAGC,GACD,SAASC;IACP,wCAAwC;IACxC,mDAAmD;IACnD,OAAOC,IAAAA,uBAAW,EAAC,IAAIC,QAAQ,CAAC;AAClC;AAEA;;;CAGC,GACD,SAAeC,2BAA2BC,YAAoB;;YACtDC;;YAAAA,OAAOC,IAAAA,sBAAU,EAAC,UAAUC,MAAM,CAACH,cAAc,SAASI,MAAM;YACtE;;gBAAOC,OAAOC,IAAI,CAACL,MAAMH,QAAQ,CAAC;;;IACpC;;AAaO,SAAeH;;YAEdK,cAIAO;;;;oBALN,mEAAmE;oBAC7DP,eAAeJ;oBAIC;;wBAAMG,2BAA2BC;;;oBAAjDO,gBAAgB;oBAEtB;;wBAAO;4BACLP,cAAAA;4BACAO,eAAAA;4BACAC,qBAAqB;wBACvB;;;;IACF"}

package/dist/cjs/auth/rfc9728-discovery.d.cts

@@ -32,3 +32,10 @@ export declare function discoverProtectedResourceMetadata(resourceUrl: string):
  * // Returns: { issuer: "https://todoist.com", authorization_endpoint: "...", ... }
  */
 export declare function discoverAuthorizationServerMetadata(authServerUrl: string): Promise<AuthorizationServerMetadata | null>;
+/**
+ * Discover OAuth Authorization Server Issuer from resource response (RFC 9207)
+ *
+ * @param resourceUrl - URL of the protected resource
+ * @returns Issuer URL if present in WWW-Authenticate header, null otherwise
+ */
+export declare function discoverAuthorizationServerIssuer(resourceUrl: string): Promise<string | null>;

package/dist/cjs/auth/rfc9728-discovery.d.ts

@@ -32,3 +32,10 @@ export declare function discoverProtectedResourceMetadata(resourceUrl: string):
  * // Returns: { issuer: "https://todoist.com", authorization_endpoint: "...", ... }
  */
 export declare function discoverAuthorizationServerMetadata(authServerUrl: string): Promise<AuthorizationServerMetadata | null>;
+/**
+ * Discover OAuth Authorization Server Issuer from resource response (RFC 9207)
+ *
+ * @param resourceUrl - URL of the protected resource
+ * @returns Issuer URL if present in WWW-Authenticate header, null otherwise
+ */
+export declare function discoverAuthorizationServerIssuer(resourceUrl: string): Promise<string | null>;