@mcp-z/client 1.1.1 → 2.0.0

package/dist/cjs/auth/rfc9728-discovery.js

@@ -23,6 +23,7 @@ _export(exports, {
     }
 });
 var _urlutilsts = require("../lib/url-utils.js");
+var _discoveryfetchts = require("./discovery-fetch.js");
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -148,30 +149,16 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
-/**
- * Extract origin (protocol + host) from a URL
- * @param url - Full URL that may include a path
- * @returns Origin (e.g., "https://example.com") or original string if invalid URL
- *
- * @example
- * getOrigin('https://example.com/mcp') // → 'https://example.com'
- * getOrigin('http://localhost:9999/api/v1/mcp') // → 'http://localhost:9999'
- */ function getOrigin(url) {
+/** Returns `url`'s origin (protocol + host), or the original string if it doesn't parse. */ function getOrigin(url) {
     try {
         return new URL(url).origin;
     } catch (unused) {
-        // Invalid URL - return as-is for graceful degradation
         return url;
     }
 }
-/**
- * Extract path from a URL (without origin)
- * @param url - Full URL
- * @returns Path component (e.g., "/mcp", "/api/v1/mcp") or empty string if no path
- */ function getPath(url) {
+/** Returns `url`'s pathname, or `''` for the root path or an unparseable URL. */ function getPath(url) {
     try {
         var parsed = new URL(url);
-        // pathname includes leading slash, e.g., "/mcp"
         return parsed.pathname === '/' ? '' : parsed.pathname;
     } catch (unused) {
         return '';
@@ -179,7 +166,7 @@ function _ts_generator(thisArg, body) {
 }
 function discoverProtectedResourceMetadata(resourceUrl) {
     return _async_to_generator(function() {
-        var normalizedResourceUrl, headerMetadata, localWellKnownUrl, response, unused, origin, path, rootUrl, response1, metadata, rootMetadata, subPathUrl, subPathResponse, unused1, unused2, subPathUrl1, response2, unused3, _error;
+        var normalizedResourceUrl, allowLoopback, headerMetadata, localWellKnownUrl, response, unused, origin, path, rootUrl, response1, metadata, rootMetadata, subPathUrl, subPathResponse, unused1, unused2, subPathUrl1, response2, unused3, _error;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -190,9 +177,12 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                         27
                     ]);
                     normalizedResourceUrl = (0, _urlutilsts.normalizeUrl)(resourceUrl);
+                    // resourceUrl is the server the caller configured (never remote-supplied);
+                    // its loopback-ness is the trust signal every fetch below relies on.
+                    allowLoopback = (0, _discoveryfetchts.isLoopbackUrl)(normalizedResourceUrl);
                     return [
                         4,
-                        discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl)
+                        discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl, allowLoopback)
                     ];
                 case 1:
                     headerMetadata = _state.sent();
@@ -212,12 +202,14 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ]);
                     return [
                         4,
-                        fetch(localWellKnownUrl, {
+                        (0, _discoveryfetchts.discoveryFetch)(localWellKnownUrl, {
                             method: 'GET',
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
                             }
+                        }, 'protected resource metadata (path-local)', {
+                            allowLoopback: allowLoopback
                         })
                     ];
                 case 3:
@@ -228,7 +220,7 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ];
                     return [
                         4,
-                        response.json()
+                        (0, _discoveryfetchts.readDiscoveryJson)(response, 'protected resource metadata (path-local)')
                     ];
                 case 4:
                     return [
@@ -261,12 +253,14 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ]);
                     return [
                         4,
-                        fetch(rootUrl, {
+                        (0, _discoveryfetchts.discoveryFetch)(rootUrl, {
                             method: 'GET',
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
                             }
+                        }, 'protected resource metadata (root)', {
+                            allowLoopback: allowLoopback
                         })
                     ];
                 case 9:
@@ -277,7 +271,7 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ];
                     return [
                         4,
-                        response1.json()
+                        (0, _discoveryfetchts.readDiscoveryJson)(response1, 'protected resource metadata (root)')
                     ];
                 case 10:
                     metadata = _state.sent();
@@ -315,12 +309,14 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ]);
                     return [
                         4,
-                        fetch(subPathUrl, {
+                        (0, _discoveryfetchts.discoveryFetch)(subPathUrl, {
                             method: 'GET',
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
                             }
+                        }, 'protected resource metadata (sub-path)', {
+                            allowLoopback: allowLoopback
                         })
                     ];
                 case 12:
@@ -331,7 +327,7 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ];
                     return [
                         4,
-                        subPathResponse.json()
+                        (0, _discoveryfetchts.readDiscoveryJson)(subPathResponse, 'protected resource metadata (sub-path)')
                     ];
                 case 13:
                     return [
@@ -382,12 +378,14 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ]);
                     return [
                         4,
-                        fetch(subPathUrl1, {
+                        (0, _discoveryfetchts.discoveryFetch)(subPathUrl1, {
                             method: 'GET',
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
                             }
+                        }, 'protected resource metadata (sub-path)', {
+                            allowLoopback: allowLoopback
                         })
                     ];
                 case 21:
@@ -398,7 +396,7 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ];
                     return [
                         4,
-                        response2.json()
+                        (0, _discoveryfetchts.readDiscoveryJson)(response2, 'protected resource metadata (sub-path)')
                     ];
                 case 22:
                     return [
@@ -437,7 +435,7 @@ function discoverProtectedResourceMetadata(resourceUrl) {
         });
     })();
 }
-function discoverProtectedResourceMetadataFromHeader(resourceUrl) {
+function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback) {
     return _async_to_generator(function() {
         var response, header, postResponse, match, metadataUrl, metadataResponse, _error;
         return _ts_generator(this, function(_state) {
@@ -492,15 +490,19 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl) {
                         2,
                         null
                     ];
+                    // metadataUrl is remote-server-chosen (the primary SSRF vector here);
+                    // allowLoopback reflects trust in resourceUrl, not in metadataUrl.
                     metadataUrl = match[1];
                     return [
                         4,
-                        fetch(metadataUrl, {
+                        (0, _discoveryfetchts.discoveryFetch)(metadataUrl, {
                             method: 'GET',
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
                             }
+                        }, 'resource_metadata URL', {
+                            allowLoopback: allowLoopback
                         })
                     ];
                 case 4:
@@ -513,7 +515,7 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl) {
                     }
                     return [
                         4,
-                        metadataResponse.json()
+                        (0, _discoveryfetchts.readDiscoveryJson)(metadataResponse, 'resource_metadata URL')
                     ];
                 case 5:
                     return [
@@ -534,59 +536,68 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl) {
         });
     })();
 }
-function discoverAuthorizationServerMetadata(authServerUrl) {
-    return _async_to_generator(function() {
-        var normalizedAuthServerUrl, localWellKnownUrl, localResponse, origin, wellKnownUrl, response, _error;
+function discoverAuthorizationServerMetadata(_0) {
+    return _async_to_generator(function(authServerUrl) {
+        var options, _options_allowLoopback, allowLoopback, normalizedAuthServerUrl, localWellKnownUrl, localResponse, origin, wellKnownUrl, response, _error;
+        var _arguments = arguments;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    options = _arguments.length > 1 && _arguments[1] !== void 0 ? _arguments[1] : {};
+                    _options_allowLoopback = options.allowLoopback, allowLoopback = _options_allowLoopback === void 0 ? false : _options_allowLoopback;
+                    _state.label = 1;
+                case 1:
                     _state.trys.push([
-                        0,
-                        6,
+                        1,
+                        7,
                         ,
-                        7
+                        8
                     ]);
                     normalizedAuthServerUrl = (0, _urlutilsts.normalizeUrl)(authServerUrl);
                     localWellKnownUrl = (0, _urlutilsts.joinWellKnown)(normalizedAuthServerUrl, '/.well-known/oauth-authorization-server');
                     return [
                         4,
-                        fetch(localWellKnownUrl, {
+                        (0, _discoveryfetchts.discoveryFetch)(localWellKnownUrl, {
                             method: 'GET',
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
                             }
+                        }, 'authorization server metadata (path-local)', {
+                            allowLoopback: allowLoopback
                         })
                     ];
-                case 1:
+                case 2:
                     localResponse = _state.sent();
                     if (!localResponse.ok) return [
                         3,
-                        3
+                        4
                     ];
                     return [
                         4,
-                        localResponse.json()
+                        (0, _discoveryfetchts.readDiscoveryJson)(localResponse, 'authorization server metadata (path-local)')
                     ];
-                case 2:
+                case 3:
                     return [
                         2,
                         _state.sent()
                     ];
-                case 3:
+                case 4:
                     origin = getOrigin(normalizedAuthServerUrl);
                     wellKnownUrl = "".concat(origin, "/.well-known/oauth-authorization-server");
                     return [
                         4,
-                        fetch(wellKnownUrl, {
+                        (0, _discoveryfetchts.discoveryFetch)(wellKnownUrl, {
                             method: 'GET',
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
                             }
+                        }, 'authorization server metadata', {
+                            allowLoopback: allowLoopback
                         })
                     ];
-                case 4:
+                case 5:
                     response = _state.sent();
                     if (!response.ok) {
                         return [
@@ -596,26 +607,26 @@ function discoverAuthorizationServerMetadata(authServerUrl) {
                     }
                     return [
                         4,
-                        response.json()
+                        (0, _discoveryfetchts.readDiscoveryJson)(response, 'authorization server metadata')
                     ];
-                case 5:
+                case 6:
                     return [
                         2,
                         _state.sent()
                     ];
-                case 6:
+                case 7:
                     _error = _state.sent();
                     return [
                         2,
                         null
                     ];
-                case 7:
+                case 8:
                     return [
                         2
                     ];
             }
         });
-    })();
+    }).apply(this, arguments);
 }
 function discoverAuthorizationServerIssuer(resourceUrl) {
     return _async_to_generator(function() {

package/dist/cjs/auth/rfc9728-discovery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/rfc9728-discovery.ts"],"sourcesContent":["/**\n * RFC 9728 Protected Resource Metadata Discovery\n * Probes .well-known/oauth-protected-resource endpoint\n */\n\nimport { joinWellKnown, normalizeUrl } from '../lib/url-utils.ts';\nimport type { AuthorizationServerMetadata, ProtectedResourceMetadata } from './types.ts';\n\n/**\n * Extract origin (protocol + host) from a URL\n * @param url - Full URL that may include a path\n * @returns Origin (e.g., \"https://example.com\") or original string if invalid URL\n *\n * @example\n * getOrigin('https://example.com/mcp') // → 'https://example.com'\n * getOrigin('http://localhost:9999/api/v1/mcp') // → 'http://localhost:9999'\n */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    // Invalid URL - return as-is for graceful degradation\n    return url;\n  }\n}\n\n/**\n * Extract path from a URL (without origin)\n * @param url - Full URL\n * @returns Path component (e.g., \"/mcp\", \"/api/v1/mcp\") or empty string if no path\n */\nfunction getPath(url: string): string {\n  try {\n    const parsed = new URL(url);\n    // pathname includes leading slash, e.g., \"/mcp\"\n    return parsed.pathname === '/' ? '' : parsed.pathname;\n  } catch {\n    return '';\n  }\n}\n\n/**\n * Normalize a resource URL by stripping query/hash and trailing slashes.\n */\n/**\n * Discover OAuth 2.0 Protected Resource Metadata (RFC 9728)\n * Probes .well-known/oauth-protected-resource endpoint\n *\n * Discovery Strategy:\n * 1. Try origin root: {origin}/.well-known/oauth-protected-resource\n * 2. If 404, try sub-path: {origin}/.well-known/oauth-protected-resource{path}\n *\n * @param resourceUrl - URL of the protected resource (e.g., https://ai.todoist.net/mcp)\n * @returns ProtectedResourceMetadata if discovered, null otherwise\n *\n * @example\n * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com\n * const metadata = await discoverProtectedResourceMetadata('https://ai.todoist.net/mcp');\n * // Returns: { resource: \"https://ai.todoist.net/mcp\", authorization_servers: [\"https://todoist.com\"] }\n */\nexport async function discoverProtectedResourceMetadata(resourceUrl: string): Promise<ProtectedResourceMetadata | null> {\n  try {\n    const normalizedResourceUrl = normalizeUrl(resourceUrl);\n    const headerMetadata = await discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl);\n    if (headerMetadata) return headerMetadata;\n\n    // Strategy 0: Try path-local well-known (supports path-prefixed deployments like /outlook)\n    const localWellKnownUrl = joinWellKnown(normalizedResourceUrl, '/.well-known/oauth-protected-resource');\n    try {\n      const response = await fetch(localWellKnownUrl, {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      });\n      if (response.ok) {\n        return (await response.json()) as ProtectedResourceMetadata;\n      }\n    } catch {\n      // Continue to origin-based discovery\n    }\n\n    const origin = getOrigin(normalizedResourceUrl);\n    const path = getPath(normalizedResourceUrl);\n\n    // Strategy 1: Try root location (REQUIRED by RFC 9728)\n    const rootUrl = `${origin}/.well-known/oauth-protected-resource`;\n\n    try {\n      const response = await fetch(rootUrl, {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      });\n\n      if (response.ok) {\n        const metadata = (await response.json()) as ProtectedResourceMetadata;\n        // Check if the discovered resource matches what we're looking for\n        if (metadata.resource === normalizedResourceUrl) {\n          return metadata;\n        }\n        // If there's no path component, return root metadata\n        // (e.g., looking for http://example.com and found it)\n        if (!path) {\n          return metadata;\n        }\n        // If requested URL starts with metadata.resource, the root metadata applies to sub-paths\n        // (e.g., looking for http://example.com/api/v1/mcp, found http://example.com)\n        if (normalizedResourceUrl.startsWith(metadata.resource)) {\n          // Still try sub-path location to see if there's more specific metadata\n          // But save root metadata as fallback\n          const rootMetadata = metadata;\n\n          // Try sub-path location for more specific metadata\n          const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n          try {\n            const subPathResponse = await fetch(subPathUrl, {\n              method: 'GET',\n              headers: { Accept: 'application/json', Connection: 'close' },\n            });\n            if (subPathResponse.ok) {\n              return (await subPathResponse.json()) as ProtectedResourceMetadata;\n            }\n          } catch {\n            // Sub-path failed, use root metadata\n          }\n\n          // Return root metadata as it applies to this resource\n          return rootMetadata;\n        }\n        // Otherwise, try sub-path location before giving up\n      }\n    } catch {\n      // Continue to sub-path location\n    }\n\n    // Strategy 2: Try sub-path location (MCP spec extension)\n    // Only try if there's a path component\n    if (path) {\n      const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n\n      try {\n        const response = await fetch(subPathUrl, {\n          method: 'GET',\n          headers: { Accept: 'application/json', Connection: 'close' },\n        });\n\n        if (response.ok) {\n          return (await response.json()) as ProtectedResourceMetadata;\n        }\n      } catch {\n        // Fall through to return null\n      }\n    }\n\n    // Neither location found or resource didn't match\n    return null;\n  } catch (_error) {\n    // Network error, invalid URL, or other failure\n    return null;\n  }\n}\n\nasync function discoverProtectedResourceMetadataFromHeader(resourceUrl: string): Promise<ProtectedResourceMetadata | null> {\n  try {\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    let header = response.headers.get('www-authenticate');\n    if (!header) {\n      const postResponse = await fetch(resourceUrl, {\n        method: 'POST',\n        headers: { Accept: 'application/json', Connection: 'close', 'Content-Type': 'application/json' },\n        body: '{}',\n      });\n      header = postResponse.headers.get('www-authenticate');\n    }\n\n    if (!header) return null;\n\n    const match = header.match(/resource_metadata=\"([^\"]+)\"/i);\n    if (!match || !match[1]) return null;\n\n    const metadataUrl = match[1];\n    const metadataResponse = await fetch(metadataUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    if (!metadataResponse.ok) {\n      return null;\n    }\n\n    return (await metadataResponse.json()) as ProtectedResourceMetadata;\n  } catch (_error) {\n    return null;\n  }\n}\n\n/**\n * Discover OAuth 2.0 Authorization Server Metadata (RFC 8414)\n * Probes .well-known/oauth-authorization-server endpoint\n *\n * @param authServerUrl - URL of the authorization server (typically from RFC 9728 discovery)\n * @returns AuthorizationServerMetadata if discovered, null otherwise\n *\n * @example\n * const metadata = await discoverAuthorizationServerMetadata('https://todoist.com');\n * // Returns: { issuer: \"https://todoist.com\", authorization_endpoint: \"...\", ... }\n */\nexport async function discoverAuthorizationServerMetadata(authServerUrl: string): Promise<AuthorizationServerMetadata | null> {\n  try {\n    const normalizedAuthServerUrl = normalizeUrl(authServerUrl);\n    const localWellKnownUrl = joinWellKnown(normalizedAuthServerUrl, '/.well-known/oauth-authorization-server');\n    const localResponse = await fetch(localWellKnownUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    if (localResponse.ok) {\n      return (await localResponse.json()) as AuthorizationServerMetadata;\n    }\n\n    const origin = getOrigin(normalizedAuthServerUrl);\n    const wellKnownUrl = `${origin}/.well-known/oauth-authorization-server`;\n\n    const response = await fetch(wellKnownUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    return (await response.json()) as AuthorizationServerMetadata;\n  } catch (_error) {\n    return null;\n  }\n}\n\n/**\n * Discover OAuth Authorization Server Issuer from resource response (RFC 9207)\n *\n * @param resourceUrl - URL of the protected resource\n * @returns Issuer URL if present in WWW-Authenticate header, null otherwise\n */\nexport async function discoverAuthorizationServerIssuer(resourceUrl: string): Promise<string | null> {\n  try {\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    const header = response.headers.get('www-authenticate');\n    if (!header) return null;\n\n    const match = header.match(/(?:authorization_server|issuer)=\"([^\"]+)\"/i);\n    if (!match) return null;\n\n    return match[1] ?? null;\n  } catch (_error) {\n    return null;\n  }\n}\n"],"names":["discoverAuthorizationServerIssuer","discoverAuthorizationServerMetadata","discoverProtectedResourceMetadata","getOrigin","url","URL","origin","getPath","parsed","pathname","resourceUrl","normalizedResourceUrl","headerMetadata","localWellKnownUrl","response","path","rootUrl","metadata","rootMetadata","subPathUrl","subPathResponse","_error","normalizeUrl","discoverProtectedResourceMetadataFromHeader","joinWellKnown","fetch","method","headers","Accept","Connection","ok","json","resource","startsWith","header","postResponse","match","metadataUrl","metadataResponse","get","body","authServerUrl","normalizedAuthServerUrl","localResponse","wellKnownUrl"],"mappings":"AAAA;;;CAGC;;;;;;;;;;;QAmPqBA;eAAAA;;QArCAC;eAAAA;;QArJAC;eAAAA;;;0BAvDsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAG5C;;;;;;;;CAQC,GACD,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,sDAAsD;QACtD,OAAOF;IACT;AACF;AAEA;;;;CAIC,GACD,SAASG,QAAQH,GAAW;IAC1B,IAAI;QACF,IAAMI,SAAS,IAAIH,IAAID;QACvB,gDAAgD;QAChD,OAAOI,OAAOC,QAAQ,KAAK,MAAM,KAAKD,OAAOC,QAAQ;IACvD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAqBO,SAAeP,kCAAkCQ,WAAmB;;YAEjEC,uBACAC,gBAIAC,mBAEEC,kBAWFR,QACAS,MAGAC,SAGEF,WAMEG,UAeEC,cAGAC,YAEEC,mCAuBND,aAGEL,oBAeHO;;;;;;;;;;oBA5FDV,wBAAwBW,IAAAA,wBAAY,EAACZ;oBACpB;;wBAAMa,4CAA4CZ;;;oBAAnEC,iBAAiB;oBACvB,IAAIA,gBAAgB;;wBAAOA;;oBAE3B,2FAA2F;oBACrFC,oBAAoBW,IAAAA,yBAAa,EAACb,uBAAuB;;;;;;;;;oBAE5C;;wBAAMc,MAAMZ,mBAAmB;4BAC9Ca,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMf,WAAW;yBAIbA,SAASgB,EAAE,EAAXhB;;;;oBACM;;wBAAMA,SAASiB,IAAI;;;oBAA3B;;wBAAQ;;;;;;;;;;;;;;oBAMNzB,SAASH,UAAUQ;oBACnBI,OAAOR,QAAQI;oBAErB,uDAAuD;oBACjDK,UAAU,AAAC,GAAS,OAAPV,QAAO;;;;;;;;;oBAGP;;wBAAMmB,MAAMT,SAAS;4BACpCU,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMf,YAAW;yBAKbA,UAASgB,EAAE,EAAXhB;;;;oBACgB;;wBAAMA,UAASiB,IAAI;;;oBAA/Bd,WAAY;oBAClB,kEAAkE;oBAClE,IAAIA,SAASe,QAAQ,KAAKrB,uBAAuB;wBAC/C;;4BAAOM;;oBACT;oBACA,qDAAqD;oBACrD,sDAAsD;oBACtD,IAAI,CAACF,MAAM;wBACT;;4BAAOE;;oBACT;yBAGIN,sBAAsBsB,UAAU,CAAChB,SAASe,QAAQ,GAAlDrB;;;;oBACF,uEAAuE;oBACvE,qCAAqC;oBAC/BO,eAAeD;oBAErB,mDAAmD;oBAC7CE,aAAa,AAAC,GAAgDJ,OAA9CT,QAAO,yCAA4C,OAALS;;;;;;;;;oBAE1C;;wBAAMU,MAAMN,YAAY;4BAC9CO,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMT,kBAAkB;yBAIpBA,gBAAgBU,EAAE,EAAlBV;;;;oBACM;;wBAAMA,gBAAgBW,IAAI;;;oBAAlC;;wBAAQ;;;;;;;;;;;;;;oBAMZ,sDAAsD;oBACtD;;wBAAOb;;;;;;;;;;;;;;yBAUTH,MAAAA;;;;oBACII,cAAa,AAAC,GAAgDJ,OAA9CT,QAAO,yCAA4C,OAALS;;;;;;;;;oBAGjD;;wBAAMU,MAAMN,aAAY;4BACvCO,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMf,YAAW;yBAKbA,UAASgB,EAAE,EAAXhB;;;;oBACM;;wBAAMA,UAASiB,IAAI;;;oBAA3B;;wBAAQ;;;;;;;;;;;;;;oBAOd,kDAAkD;oBAClD;;wBAAO;;;oBACAV;oBACP,+CAA+C;oBAC/C;;wBAAO;;;;;;;;IAEX;;AAEA,SAAeE,4CAA4Cb,WAAmB;;YAEpEI,UAKFoB,QAEIC,cAUFC,OAGAC,aACAC,kBAUCjB;;;;;;;;;;oBA/BU;;wBAAMI,MAAMf,aAAa;4BACxCgB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMf,WAAW;oBAKboB,SAASpB,SAASa,OAAO,CAACY,GAAG,CAAC;yBAC9B,CAACL,QAAD;;;;oBACmB;;wBAAMT,MAAMf,aAAa;4BAC5CgB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;gCAAS,gBAAgB;4BAAmB;4BAC/FW,MAAM;wBACR;;;oBAJML,eAAe;oBAKrBD,SAASC,aAAaR,OAAO,CAACY,GAAG,CAAC;;;oBAGpC,IAAI,CAACL,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,SAAS,CAACA,KAAK,CAAC,EAAE,EAAE;;wBAAO;;oBAE1BC,cAAcD,KAAK,CAAC,EAAE;oBACH;;wBAAMX,MAAMY,aAAa;4BAChDX,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMS,mBAAmB;oBAKzB,IAAI,CAACA,iBAAiBR,EAAE,EAAE;wBACxB;;4BAAO;;oBACT;oBAEQ;;wBAAMQ,iBAAiBP,IAAI;;;oBAAnC;;wBAAQ;;;oBACDV;oBACP;;wBAAO;;;;;;;;IAEX;;AAaO,SAAepB,oCAAoCwC,aAAqB;;YAErEC,yBACA7B,mBACA8B,eASArC,QACAsC,cAEA9B,UAUCO;;;;;;;;;;oBAxBDqB,0BAA0BpB,IAAAA,wBAAY,EAACmB;oBACvC5B,oBAAoBW,IAAAA,yBAAa,EAACkB,yBAAyB;oBAC3C;;wBAAMjB,MAAMZ,mBAAmB;4BACnDa,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMc,gBAAgB;yBAKlBA,cAAcb,EAAE,EAAhBa;;;;oBACM;;wBAAMA,cAAcZ,IAAI;;;oBAAhC;;wBAAQ;;;oBAGJzB,SAASH,UAAUuC;oBACnBE,eAAe,AAAC,GAAS,OAAPtC,QAAO;oBAEd;;wBAAMmB,MAAMmB,cAAc;4BACzClB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMf,WAAW;oBAKjB,IAAI,CAACA,SAASgB,EAAE,EAAE;wBAChB;;4BAAO;;oBACT;oBAEQ;;wBAAMhB,SAASiB,IAAI;;;oBAA3B;;wBAAQ;;;oBACDV;oBACP;;wBAAO;;;;;;;;IAEX;;AAQO,SAAerB,kCAAkCU,WAAmB;;YAahE0B,SAXDtB,UAKAoB,QAGAE,OAICf;;;;;;;;;;oBAZU;;wBAAMI,MAAMf,aAAa;4BACxCgB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMf,WAAW;oBAKXoB,SAASpB,SAASa,OAAO,CAACY,GAAG,CAAC;oBACpC,IAAI,CAACL,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,OAAO;;wBAAO;;oBAEnB;;yBAAOA,UAAAA,KAAK,CAAC,EAAE,cAARA,qBAAAA,UAAY;;;oBACZf;oBACP;;wBAAO;;;;;;;;IAEX"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/rfc9728-discovery.ts"],"sourcesContent":["/**\n * RFC 9728 Protected Resource Metadata Discovery\n * Probes .well-known/oauth-protected-resource endpoint\n */\n\nimport { joinWellKnown, normalizeUrl } from '../lib/url-utils.ts';\nimport { discoveryFetch, isLoopbackUrl, readDiscoveryJson } from './discovery-fetch.ts';\nimport type { AuthorizationServerMetadata, ProtectedResourceMetadata } from './types.ts';\n\n/** Returns `url`'s origin (protocol + host), or the original string if it doesn't parse. */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\n/** Returns `url`'s pathname, or `''` for the root path or an unparseable URL. */\nfunction getPath(url: string): string {\n  try {\n    const parsed = new URL(url);\n    return parsed.pathname === '/' ? '' : parsed.pathname;\n  } catch {\n    return '';\n  }\n}\n\n/**\n * Discovers RFC 9728 Protected Resource Metadata: the `WWW-Authenticate`\n * header first, then `.well-known/oauth-protected-resource` at the origin root and, for a path-prefixed resource, its sub-path variant.\n *\n * @param resourceUrl - URL of the protected resource (e.g. `https://ai.todoist.net/mcp`).\n * @returns Discovered metadata, or `null` if none is found.\n */\nexport async function discoverProtectedResourceMetadata(resourceUrl: string): Promise<ProtectedResourceMetadata | null> {\n  try {\n    const normalizedResourceUrl = normalizeUrl(resourceUrl);\n    // resourceUrl is the server the caller configured (never remote-supplied);\n    // its loopback-ness is the trust signal every fetch below relies on.\n    const allowLoopback = isLoopbackUrl(normalizedResourceUrl);\n    const headerMetadata = await discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl, allowLoopback);\n    if (headerMetadata) return headerMetadata;\n\n    // Strategy 0: Try path-local well-known (supports path-prefixed deployments like /outlook)\n    const localWellKnownUrl = joinWellKnown(normalizedResourceUrl, '/.well-known/oauth-protected-resource');\n    try {\n      const response = await discoveryFetch(\n        localWellKnownUrl,\n        {\n          method: 'GET',\n          headers: { Accept: 'application/json', Connection: 'close' },\n        },\n        'protected resource metadata (path-local)',\n        { allowLoopback }\n      );\n      if (response.ok) {\n        return await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (path-local)');\n      }\n    } catch {\n      // Continue to origin-based discovery\n    }\n\n    const origin = getOrigin(normalizedResourceUrl);\n    const path = getPath(normalizedResourceUrl);\n\n    // Strategy 1: Try root location (REQUIRED by RFC 9728)\n    const rootUrl = `${origin}/.well-known/oauth-protected-resource`;\n\n    try {\n      const response = await discoveryFetch(\n        rootUrl,\n        {\n          method: 'GET',\n          headers: { Accept: 'application/json', Connection: 'close' },\n        },\n        'protected resource metadata (root)',\n        { allowLoopback }\n      );\n\n      if (response.ok) {\n        const metadata = await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (root)');\n        // Check if the discovered resource matches what we're looking for\n        if (metadata.resource === normalizedResourceUrl) {\n          return metadata;\n        }\n        // If there's no path component, return root metadata\n        // (e.g., looking for http://example.com and found it)\n        if (!path) {\n          return metadata;\n        }\n        // If requested URL starts with metadata.resource, the root metadata applies to sub-paths\n        // (e.g., looking for http://example.com/api/v1/mcp, found http://example.com)\n        if (normalizedResourceUrl.startsWith(metadata.resource)) {\n          // Still try sub-path location to see if there's more specific metadata\n          // But save root metadata as fallback\n          const rootMetadata = metadata;\n\n          // Try sub-path location for more specific metadata\n          const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n          try {\n            const subPathResponse = await discoveryFetch(\n              subPathUrl,\n              {\n                method: 'GET',\n                headers: { Accept: 'application/json', Connection: 'close' },\n              },\n              'protected resource metadata (sub-path)',\n              { allowLoopback }\n            );\n            if (subPathResponse.ok) {\n              return await readDiscoveryJson<ProtectedResourceMetadata>(subPathResponse, 'protected resource metadata (sub-path)');\n            }\n          } catch {\n            // Sub-path failed, use root metadata\n          }\n\n          // Return root metadata as it applies to this resource\n          return rootMetadata;\n        }\n        // Otherwise, try sub-path location before giving up\n      }\n    } catch {\n      // Continue to sub-path location\n    }\n\n    // Strategy 2: Try sub-path location (MCP spec extension)\n    // Only try if there's a path component\n    if (path) {\n      const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n\n      try {\n        const response = await discoveryFetch(\n          subPathUrl,\n          {\n            method: 'GET',\n            headers: { Accept: 'application/json', Connection: 'close' },\n          },\n          'protected resource metadata (sub-path)',\n          { allowLoopback }\n        );\n\n        if (response.ok) {\n          return await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (sub-path)');\n        }\n      } catch {\n        // Fall through to return null\n      }\n    }\n\n    // Neither location found or resource didn't match\n    return null;\n  } catch (_error) {\n    // Network error, invalid URL, or other failure\n    return null;\n  }\n}\n\nasync function discoverProtectedResourceMetadataFromHeader(resourceUrl: string, allowLoopback: boolean): Promise<ProtectedResourceMetadata | null> {\n  try {\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    let header = response.headers.get('www-authenticate');\n    if (!header) {\n      const postResponse = await fetch(resourceUrl, {\n        method: 'POST',\n        headers: { Accept: 'application/json', Connection: 'close', 'Content-Type': 'application/json' },\n        body: '{}',\n      });\n      header = postResponse.headers.get('www-authenticate');\n    }\n\n    if (!header) return null;\n\n    const match = header.match(/resource_metadata=\"([^\"]+)\"/i);\n    if (!match || !match[1]) return null;\n\n    // metadataUrl is remote-server-chosen (the primary SSRF vector here);\n    // allowLoopback reflects trust in resourceUrl, not in metadataUrl.\n    const metadataUrl = match[1];\n    const metadataResponse = await discoveryFetch(\n      metadataUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      },\n      'resource_metadata URL',\n      { allowLoopback }\n    );\n\n    if (!metadataResponse.ok) {\n      return null;\n    }\n\n    return await readDiscoveryJson<ProtectedResourceMetadata>(metadataResponse, 'resource_metadata URL');\n  } catch (_error) {\n    return null;\n  }\n}\n\n/**\n * Discovers RFC 8414 Authorization Server Metadata at\n * `.well-known/oauth-authorization-server`, path-local variant first.\n *\n * @param authServerUrl - URL of the authorization server (typically from RFC 9728 discovery).\n * @param options.allowLoopback - Loopback trust grant computed from the server the caller is actually talking to, never from `authServerUrl` itself. Defaults to `false`.\n * @returns Discovered metadata, or `null` if none is found.\n */\nexport async function discoverAuthorizationServerMetadata(authServerUrl: string, options: { allowLoopback?: boolean } = {}): Promise<AuthorizationServerMetadata | null> {\n  const { allowLoopback = false } = options;\n  try {\n    const normalizedAuthServerUrl = normalizeUrl(authServerUrl);\n    const localWellKnownUrl = joinWellKnown(normalizedAuthServerUrl, '/.well-known/oauth-authorization-server');\n    const localResponse = await discoveryFetch(\n      localWellKnownUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      },\n      'authorization server metadata (path-local)',\n      { allowLoopback }\n    );\n\n    if (localResponse.ok) {\n      return await readDiscoveryJson<AuthorizationServerMetadata>(localResponse, 'authorization server metadata (path-local)');\n    }\n\n    const origin = getOrigin(normalizedAuthServerUrl);\n    const wellKnownUrl = `${origin}/.well-known/oauth-authorization-server`;\n\n    const response = await discoveryFetch(\n      wellKnownUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      },\n      'authorization server metadata',\n      { allowLoopback }\n    );\n\n    if (!response.ok) {\n      return null;\n    }\n\n    return await readDiscoveryJson<AuthorizationServerMetadata>(response, 'authorization server metadata');\n  } catch (_error) {\n    return null;\n  }\n}\n\n/**\n * Discover OAuth Authorization Server Issuer from resource response (RFC 9207)\n *\n * @param resourceUrl - URL of the protected resource\n * @returns Issuer URL if present in WWW-Authenticate header, null otherwise\n */\nexport async function discoverAuthorizationServerIssuer(resourceUrl: string): Promise<string | null> {\n  try {\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    const header = response.headers.get('www-authenticate');\n    if (!header) return null;\n\n    const match = header.match(/(?:authorization_server|issuer)=\"([^\"]+)\"/i);\n    if (!match) return null;\n\n    return match[1] ?? null;\n  } catch (_error) {\n    return null;\n  }\n}\n"],"names":["discoverAuthorizationServerIssuer","discoverAuthorizationServerMetadata","discoverProtectedResourceMetadata","getOrigin","url","URL","origin","getPath","parsed","pathname","resourceUrl","normalizedResourceUrl","allowLoopback","headerMetadata","localWellKnownUrl","response","path","rootUrl","metadata","rootMetadata","subPathUrl","subPathResponse","_error","normalizeUrl","isLoopbackUrl","discoverProtectedResourceMetadataFromHeader","joinWellKnown","discoveryFetch","method","headers","Accept","Connection","ok","readDiscoveryJson","resource","startsWith","header","postResponse","match","metadataUrl","metadataResponse","fetch","get","body","authServerUrl","options","normalizedAuthServerUrl","localResponse","wellKnownUrl"],"mappings":"AAAA;;;CAGC;;;;;;;;;;;QAgQqBA;eAAAA;;QAhDAC;eAAAA;;QAhLAC;eAAAA;;;0BA9BsB;gCACqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGjE,0FAA0F,GAC1F,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,OAAOF;IACT;AACF;AAEA,+EAA+E,GAC/E,SAASG,QAAQH,GAAW;IAC1B,IAAI;QACF,IAAMI,SAAS,IAAIH,IAAID;QACvB,OAAOI,OAAOC,QAAQ,KAAK,MAAM,KAAKD,OAAOC,QAAQ;IACvD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AASO,SAAeP,kCAAkCQ,WAAmB;;YAEjEC,uBAGAC,eACAC,gBAIAC,mBAEEC,kBAgBFT,QACAU,MAGAC,SAGEF,WAWEG,UAeEC,cAGAC,YAEEC,mCA4BND,aAGEL,oBAoBHO;;;;;;;;;;oBAnHDX,wBAAwBY,IAAAA,wBAAY,EAACb;oBAC3C,2EAA2E;oBAC3E,qEAAqE;oBAC/DE,gBAAgBY,IAAAA,+BAAa,EAACb;oBACb;;wBAAMc,4CAA4Cd,uBAAuBC;;;oBAA1FC,iBAAiB;oBACvB,IAAIA,gBAAgB;;wBAAOA;;oBAE3B,2FAA2F;oBACrFC,oBAAoBY,IAAAA,yBAAa,EAACf,uBAAuB;;;;;;;;;oBAE5C;;wBAAMgB,IAAAA,gCAAc,EACnCb,mBACA;4BACEc,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,4CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,WAAW;yBASbA,SAASiB,EAAE,EAAXjB;;;;oBACK;;wBAAMkB,IAAAA,mCAAiB,EAA4BlB,UAAU;;;oBAApE;;wBAAO;;;;;;;;;;;;;;oBAMLT,SAASH,UAAUQ;oBACnBK,OAAOT,QAAQI;oBAErB,uDAAuD;oBACjDM,UAAU,AAAC,GAAS,OAAPX,QAAO;;;;;;;;;oBAGP;;wBAAMqB,IAAAA,gCAAc,EACnCV,SACA;4BACEW,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,sCACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,YAAW;yBAUbA,UAASiB,EAAE,EAAXjB;;;;oBACe;;wBAAMkB,IAAAA,mCAAiB,EAA4BlB,WAAU;;;oBAAxEG,WAAW;oBACjB,kEAAkE;oBAClE,IAAIA,SAASgB,QAAQ,KAAKvB,uBAAuB;wBAC/C;;4BAAOO;;oBACT;oBACA,qDAAqD;oBACrD,sDAAsD;oBACtD,IAAI,CAACF,MAAM;wBACT;;4BAAOE;;oBACT;yBAGIP,sBAAsBwB,UAAU,CAACjB,SAASgB,QAAQ,GAAlDvB;;;;oBACF,uEAAuE;oBACvE,qCAAqC;oBAC/BQ,eAAeD;oBAErB,mDAAmD;oBAC7CE,aAAa,AAAC,GAAgDJ,OAA9CV,QAAO,yCAA4C,OAALU;;;;;;;;;oBAE1C;;wBAAMW,IAAAA,gCAAc,EAC1CP,YACA;4BACEQ,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,0CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZS,kBAAkB;yBASpBA,gBAAgBW,EAAE,EAAlBX;;;;oBACK;;wBAAMY,IAAAA,mCAAiB,EAA4BZ,iBAAiB;;;oBAA3E;;wBAAO;;;;;;;;;;;;;;oBAMX,sDAAsD;oBACtD;;wBAAOF;;;;;;;;;;;;;;yBAUTH,MAAAA;;;;oBACII,cAAa,AAAC,GAAgDJ,OAA9CV,QAAO,yCAA4C,OAALU;;;;;;;;;oBAGjD;;wBAAMW,IAAAA,gCAAc,EACnCP,aACA;4BACEQ,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,0CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,YAAW;yBAUbA,UAASiB,EAAE,EAAXjB;;;;oBACK;;wBAAMkB,IAAAA,mCAAiB,EAA4BlB,WAAU;;;oBAApE;;wBAAO;;;;;;;;;;;;;;oBAOb,kDAAkD;oBAClD;;wBAAO;;;oBACAO;oBACP,+CAA+C;oBAC/C;;wBAAO;;;;;;;;IAEX;;AAEA,SAAeG,4CAA4Cf,WAAmB,EAAEE,aAAsB;;YAE5FG,UAKFqB,QAEIC,cAUFC,OAKAC,aACAC,kBAeClB;;;;;;;;;;oBAtCU;;wBAAMmB,MAAM/B,aAAa;4BACxCkB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMhB,WAAW;oBAKbqB,SAASrB,SAASc,OAAO,CAACa,GAAG,CAAC;yBAC9B,CAACN,QAAD;;;;oBACmB;;wBAAMK,MAAM/B,aAAa;4BAC5CkB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;gCAAS,gBAAgB;4BAAmB;4BAC/FY,MAAM;wBACR;;;oBAJMN,eAAe;oBAKrBD,SAASC,aAAaR,OAAO,CAACa,GAAG,CAAC;;;oBAGpC,IAAI,CAACN,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,SAAS,CAACA,KAAK,CAAC,EAAE,EAAE;;wBAAO;;oBAEhC,sEAAsE;oBACtE,mEAAmE;oBAC7DC,cAAcD,KAAK,CAAC,EAAE;oBACH;;wBAAMX,IAAAA,gCAAc,EAC3CY,aACA;4BACEX,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,yBACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZ4B,mBAAmB;oBAUzB,IAAI,CAACA,iBAAiBR,EAAE,EAAE;wBACxB;;4BAAO;;oBACT;oBAEO;;wBAAMC,IAAAA,mCAAiB,EAA4BO,kBAAkB;;;oBAA5E;;wBAAO;;;oBACAlB;oBACP;;wBAAO;;;;;;;;IAEX;;AAUO,SAAerB;wCAAoC2C,aAAqB;YAAEC,iCACvEjC,eAEAkC,yBACAhC,mBACAiC,eAcAzC,QACA0C,cAEAjC,UAeCO;;;;;oBArCsEuB,UAAAA,oEAAuC,CAAC;6CACrFA,QAA1BjC,eAAAA,oDAAgB;;;;;;;;;oBAEhBkC,0BAA0BvB,IAAAA,wBAAY,EAACqB;oBACvC9B,oBAAoBY,IAAAA,yBAAa,EAACoB,yBAAyB;oBAC3C;;wBAAMnB,IAAAA,gCAAc,EACxCb,mBACA;4BACEc,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,8CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZmC,gBAAgB;yBAUlBA,cAAcf,EAAE,EAAhBe;;;;oBACK;;wBAAMd,IAAAA,mCAAiB,EAA8Bc,eAAe;;;oBAA3E;;wBAAO;;;oBAGHzC,SAASH,UAAU2C;oBACnBE,eAAe,AAAC,GAAS,OAAP1C,QAAO;oBAEd;;wBAAMqB,IAAAA,gCAAc,EACnCqB,cACA;4BACEpB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,iCACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,WAAW;oBAUjB,IAAI,CAACA,SAASiB,EAAE,EAAE;wBAChB;;4BAAO;;oBACT;oBAEO;;wBAAMC,IAAAA,mCAAiB,EAA8BlB,UAAU;;;oBAAtE;;wBAAO;;;oBACAO;oBACP;;wBAAO;;;;;;;;IAEX;;AAQO,SAAetB,kCAAkCU,WAAmB;;YAahE4B,SAXDvB,UAKAqB,QAGAE,OAIChB;;;;;;;;;;oBAZU;;wBAAMmB,MAAM/B,aAAa;4BACxCkB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMhB,WAAW;oBAKXqB,SAASrB,SAASc,OAAO,CAACa,GAAG,CAAC;oBACpC,IAAI,CAACN,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,OAAO;;wBAAO;;oBAEnB;;yBAAOA,UAAAA,KAAK,CAAC,EAAE,cAARA,qBAAAA,UAAY;;;oBACZhB;oBACP;;wBAAO;;;;;;;;IAEX"}

package/dist/cjs/auth/types.d.cts

@@ -9,6 +9,8 @@ export interface CallbackResult {
     code: string;
     /** State parameter for CSRF protection */
     state?: string;
+    /** Issuer identifier of the authorization server that minted the response (RFC 9207) */
+    iss?: string;
 }
 /**
  * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)
@@ -38,6 +40,8 @@ export interface TokenSet {
     clientId?: string;
     /** Client secret used for DCR registration (stored for future use) */
     clientSecret?: string;
+    /** Issuer identifier of the authorization server these credentials belong to (SEP-2352) */
+    issuer?: string;
 }
 /**
  * OAuth 2.0 Protected Resource Metadata (RFC 9728)
@@ -76,6 +80,8 @@ export interface AuthorizationServerMetadata {
     grant_types_supported?: string[];
     /** Token endpoint authentication methods supported */
     token_endpoint_auth_methods_supported?: string[];
+    /** Whether the authorization response carries an `iss` parameter (RFC 9207) */
+    authorization_response_iss_parameter_supported?: boolean;
 }
 /**
  * OAuth server capabilities discovered from .well-known endpoint
@@ -83,6 +89,10 @@ export interface AuthorizationServerMetadata {
 export interface AuthCapabilities {
     /** Whether the server supports Dynamic Client Registration (RFC 7591) */
     supportsDcr: boolean;
+    /** Issuer identifier from the authorization server metadata (RFC 8414) */
+    issuer?: string;
+    /** Whether the authorization response carries an `iss` parameter (RFC 9207) */
+    authorizationResponseIssSupported?: boolean;
     /** DCR client registration endpoint */
     registrationEndpoint?: string;
     /** OAuth authorization endpoint */
@@ -109,10 +119,18 @@ export interface ClientCredentials {
  * Options for DCR client registration
  */
 export interface DcrRegistrationOptions {
+    /** Redirect URI for OAuth callback, from the loopback listener the caller has already bound (RFC 8252) */
+    redirectUri: string;
     /** Client name to register */
     clientName?: string;
-    /** Redirect URI for OAuth callback */
-    redirectUri?: string;
+    /**
+     * Loopback trust grant for the registration_endpoint fetch (SSRF
+     * mitigation - see `src/auth/discovery-fetch.ts`). Compute this from the
+     * MCP server the caller is actually talking to, never from
+     * `registrationEndpoint` itself (which is typically sourced from
+     * remote-controlled AS metadata). Defaults to `false`.
+     */
+    allowLoopback?: boolean;
 }
 /**
  * Options for OAuth authorization flow
@@ -120,12 +138,16 @@ export interface DcrRegistrationOptions {
 export interface OAuthFlowOptions {
     /** Port for OAuth callback listener (required - use get-port to find available port) */
     port: number;
+    /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */
+    issuer: string;
+    /** Canonical resource server URI, sent as `resource` on the authorization, token, and refresh requests (RFC 8707) */
+    resource: string;
     /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */
     redirectUri?: string;
     /** OAuth scopes to request */
     scopes?: string[];
-    /** Resource parameter (RFC 8707) - target resource server identifier */
-    resource?: string;
+    /** Whether the authorization server advertises `authorization_response_iss_parameter_supported` (RFC 9207) */
+    authorizationResponseIssSupported?: boolean;
     /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */
     pkce?: boolean;
     /** Headless mode (don't open browser) */
@@ -134,4 +156,12 @@ export interface OAuthFlowOptions {
     timeout?: number;
     /** Optional logger for debug output (defaults to singleton logger) */
     logger?: import('../utils/logger.js').Logger;
+    /**
+     * Loopback trust grant for the token endpoint fetch (SSRF mitigation - see
+     * `src/auth/discovery-fetch.ts`). Compute this from the MCP server the
+     * caller is actually talking to, never from `tokenEndpoint` itself (which
+     * is typically sourced from remote-controlled AS metadata). Defaults to
+     * `false`.
+     */
+    allowLoopback?: boolean;
 }

package/dist/cjs/auth/types.d.ts

@@ -9,6 +9,8 @@ export interface CallbackResult {
     code: string;
     /** State parameter for CSRF protection */
     state?: string;
+    /** Issuer identifier of the authorization server that minted the response (RFC 9207) */
+    iss?: string;
 }
 /**
  * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)
@@ -38,6 +40,8 @@ export interface TokenSet {
     clientId?: string;
     /** Client secret used for DCR registration (stored for future use) */
     clientSecret?: string;
+    /** Issuer identifier of the authorization server these credentials belong to (SEP-2352) */
+    issuer?: string;
 }
 /**
  * OAuth 2.0 Protected Resource Metadata (RFC 9728)
@@ -76,6 +80,8 @@ export interface AuthorizationServerMetadata {
     grant_types_supported?: string[];
     /** Token endpoint authentication methods supported */
     token_endpoint_auth_methods_supported?: string[];
+    /** Whether the authorization response carries an `iss` parameter (RFC 9207) */
+    authorization_response_iss_parameter_supported?: boolean;
 }
 /**
  * OAuth server capabilities discovered from .well-known endpoint
@@ -83,6 +89,10 @@ export interface AuthorizationServerMetadata {
 export interface AuthCapabilities {
     /** Whether the server supports Dynamic Client Registration (RFC 7591) */
     supportsDcr: boolean;
+    /** Issuer identifier from the authorization server metadata (RFC 8414) */
+    issuer?: string;
+    /** Whether the authorization response carries an `iss` parameter (RFC 9207) */
+    authorizationResponseIssSupported?: boolean;
     /** DCR client registration endpoint */
     registrationEndpoint?: string;
     /** OAuth authorization endpoint */
@@ -109,10 +119,18 @@ export interface ClientCredentials {
  * Options for DCR client registration
  */
 export interface DcrRegistrationOptions {
+    /** Redirect URI for OAuth callback, from the loopback listener the caller has already bound (RFC 8252) */
+    redirectUri: string;
     /** Client name to register */
     clientName?: string;
-    /** Redirect URI for OAuth callback */
-    redirectUri?: string;
+    /**
+     * Loopback trust grant for the registration_endpoint fetch (SSRF
+     * mitigation - see `src/auth/discovery-fetch.ts`). Compute this from the
+     * MCP server the caller is actually talking to, never from
+     * `registrationEndpoint` itself (which is typically sourced from
+     * remote-controlled AS metadata). Defaults to `false`.
+     */
+    allowLoopback?: boolean;
 }
 /**
  * Options for OAuth authorization flow
@@ -120,12 +138,16 @@ export interface DcrRegistrationOptions {
 export interface OAuthFlowOptions {
     /** Port for OAuth callback listener (required - use get-port to find available port) */
     port: number;
+    /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */
+    issuer: string;
+    /** Canonical resource server URI, sent as `resource` on the authorization, token, and refresh requests (RFC 8707) */
+    resource: string;
     /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */
     redirectUri?: string;
     /** OAuth scopes to request */
     scopes?: string[];
-    /** Resource parameter (RFC 8707) - target resource server identifier */
-    resource?: string;
+    /** Whether the authorization server advertises `authorization_response_iss_parameter_supported` (RFC 9207) */
+    authorizationResponseIssSupported?: boolean;
     /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */
     pkce?: boolean;
     /** Headless mode (don't open browser) */
@@ -134,4 +156,12 @@ export interface OAuthFlowOptions {
     timeout?: number;
     /** Optional logger for debug output (defaults to singleton logger) */
     logger?: import('../utils/logger.js').Logger;
+    /**
+     * Loopback trust grant for the token endpoint fetch (SSRF mitigation - see
+     * `src/auth/discovery-fetch.ts`). Compute this from the MCP server the
+     * caller is actually talking to, never from `tokenEndpoint` itself (which
+     * is typically sourced from remote-controlled AS metadata). Defaults to
+     * `false`.
+     */
+    allowLoopback?: boolean;
 }

package/dist/cjs/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/types.ts"],"sourcesContent":["/**\n * Shared types for OAuth and DCR authentication\n */\n\n/**\n * OAuth callback result from authorization server\n */\nexport interface CallbackResult {\n  /** Authorization code from OAuth server */\n  code: string;\n  /** State parameter for CSRF protection */\n  state?: string;\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)\n * Used to secure OAuth 2.0 authorization code flow for public clients\n */\nexport interface PkceParams {\n  /** Code verifier - cryptographically random string (43-128 characters) */\n  codeVerifier: string;\n  /** Code challenge - derived from code verifier using challenge method */\n  codeChallenge: string;\n  /** Code challenge method - S256 (SHA-256) or plain */\n  codeChallengeMethod: 'S256' | 'plain';\n}\n\n/**\n * OAuth token set with access and refresh tokens\n */\nexport interface TokenSet {\n  /** Access token for API requests */\n  accessToken: string;\n  /** Refresh token for obtaining new access tokens */\n  refreshToken: string;\n  /** Timestamp when access token expires (milliseconds since epoch) */\n  expiresAt: number;\n  /** Scopes granted for this token set */\n  scopes?: string[];\n  /** Client ID used for DCR registration (stored for future use) */\n  clientId?: string;\n  /** Client secret used for DCR registration (stored for future use) */\n  clientSecret?: string;\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728)\n * Response from .well-known/oauth-protected-resource endpoint\n */\nexport interface ProtectedResourceMetadata {\n  /** The protected resource identifier */\n  resource: string;\n  /** List of authorization server URLs that can issue tokens for this resource */\n  authorization_servers: string[];\n  /** Optional list of scopes supported by this resource */\n  scopes_supported?: string[];\n  /** Optional list of bearer token methods supported (header, query, body) */\n  bearer_methods_supported?: string[];\n}\n\n/**\n * OAuth 2.0 Authorization Server Metadata (RFC 8414)\n * Response from .well-known/oauth-authorization-server endpoint\n */\nexport interface AuthorizationServerMetadata {\n  /** The authorization server's issuer identifier */\n  issuer?: string;\n  /** URL of the authorization endpoint */\n  authorization_endpoint?: string;\n  /** URL of the token endpoint */\n  token_endpoint?: string;\n  /** URL of the client registration endpoint (DCR - RFC 7591) */\n  registration_endpoint?: string;\n  /** URL of the token introspection endpoint */\n  introspection_endpoint?: string;\n  /** List of OAuth scopes supported by the authorization server */\n  scopes_supported?: string[];\n  /** Response types supported (code, token, etc.) */\n  response_types_supported?: string[];\n  /** Grant types supported (authorization_code, refresh_token, etc.) */\n  grant_types_supported?: string[];\n  /** Token endpoint authentication methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n}\n\n/**\n * OAuth server capabilities discovered from .well-known endpoint\n */\nexport interface AuthCapabilities {\n  /** Whether the server supports Dynamic Client Registration (RFC 7591) */\n  supportsDcr: boolean;\n  /** DCR client registration endpoint */\n  registrationEndpoint?: string;\n  /** OAuth authorization endpoint */\n  authorizationEndpoint?: string;\n  /** OAuth token endpoint */\n  tokenEndpoint?: string;\n  /** Token introspection endpoint */\n  introspectionEndpoint?: string;\n  /** Supported OAuth scopes */\n  scopes?: string[];\n}\n\n/**\n * Client credentials from DCR registration\n */\nexport interface ClientCredentials {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret */\n  clientSecret: string;\n  /** Timestamp when client was registered */\n  issuedAt?: number;\n}\n\n/**\n * Options for DCR client registration\n */\nexport interface DcrRegistrationOptions {\n  /** Client name to register */\n  clientName?: string;\n  /** Redirect URI for OAuth callback */\n  redirectUri?: string;\n}\n\n/**\n * Options for OAuth authorization flow\n */\nexport interface OAuthFlowOptions {\n  /** Port for OAuth callback listener (required - use get-port to find available port) */\n  port: number;\n  /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */\n  redirectUri?: string;\n  /** OAuth scopes to request */\n  scopes?: string[];\n  /** Resource parameter (RFC 8707) - target resource server identifier */\n  resource?: string;\n  /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */\n  pkce?: boolean;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Timeout for callback (milliseconds) */\n  timeout?: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: import('../utils/logger.ts').Logger;\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/types.ts"],"sourcesContent":["/**\n * Shared types for OAuth and DCR authentication\n */\n\n/**\n * OAuth callback result from authorization server\n */\nexport interface CallbackResult {\n  /** Authorization code from OAuth server */\n  code: string;\n  /** State parameter for CSRF protection */\n  state?: string;\n  /** Issuer identifier of the authorization server that minted the response (RFC 9207) */\n  iss?: string;\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)\n * Used to secure OAuth 2.0 authorization code flow for public clients\n */\nexport interface PkceParams {\n  /** Code verifier - cryptographically random string (43-128 characters) */\n  codeVerifier: string;\n  /** Code challenge - derived from code verifier using challenge method */\n  codeChallenge: string;\n  /** Code challenge method - S256 (SHA-256) or plain */\n  codeChallengeMethod: 'S256' | 'plain';\n}\n\n/**\n * OAuth token set with access and refresh tokens\n */\nexport interface TokenSet {\n  /** Access token for API requests */\n  accessToken: string;\n  /** Refresh token for obtaining new access tokens */\n  refreshToken: string;\n  /** Timestamp when access token expires (milliseconds since epoch) */\n  expiresAt: number;\n  /** Scopes granted for this token set */\n  scopes?: string[];\n  /** Client ID used for DCR registration (stored for future use) */\n  clientId?: string;\n  /** Client secret used for DCR registration (stored for future use) */\n  clientSecret?: string;\n  /** Issuer identifier of the authorization server these credentials belong to (SEP-2352) */\n  issuer?: string;\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728)\n * Response from .well-known/oauth-protected-resource endpoint\n */\nexport interface ProtectedResourceMetadata {\n  /** The protected resource identifier */\n  resource: string;\n  /** List of authorization server URLs that can issue tokens for this resource */\n  authorization_servers: string[];\n  /** Optional list of scopes supported by this resource */\n  scopes_supported?: string[];\n  /** Optional list of bearer token methods supported (header, query, body) */\n  bearer_methods_supported?: string[];\n}\n\n/**\n * OAuth 2.0 Authorization Server Metadata (RFC 8414)\n * Response from .well-known/oauth-authorization-server endpoint\n */\nexport interface AuthorizationServerMetadata {\n  /** The authorization server's issuer identifier */\n  issuer?: string;\n  /** URL of the authorization endpoint */\n  authorization_endpoint?: string;\n  /** URL of the token endpoint */\n  token_endpoint?: string;\n  /** URL of the client registration endpoint (DCR - RFC 7591) */\n  registration_endpoint?: string;\n  /** URL of the token introspection endpoint */\n  introspection_endpoint?: string;\n  /** List of OAuth scopes supported by the authorization server */\n  scopes_supported?: string[];\n  /** Response types supported (code, token, etc.) */\n  response_types_supported?: string[];\n  /** Grant types supported (authorization_code, refresh_token, etc.) */\n  grant_types_supported?: string[];\n  /** Token endpoint authentication methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorization_response_iss_parameter_supported?: boolean;\n}\n\n/**\n * OAuth server capabilities discovered from .well-known endpoint\n */\nexport interface AuthCapabilities {\n  /** Whether the server supports Dynamic Client Registration (RFC 7591) */\n  supportsDcr: boolean;\n  /** Issuer identifier from the authorization server metadata (RFC 8414) */\n  issuer?: string;\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** DCR client registration endpoint */\n  registrationEndpoint?: string;\n  /** OAuth authorization endpoint */\n  authorizationEndpoint?: string;\n  /** OAuth token endpoint */\n  tokenEndpoint?: string;\n  /** Token introspection endpoint */\n  introspectionEndpoint?: string;\n  /** Supported OAuth scopes */\n  scopes?: string[];\n}\n\n/**\n * Client credentials from DCR registration\n */\nexport interface ClientCredentials {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret */\n  clientSecret: string;\n  /** Timestamp when client was registered */\n  issuedAt?: number;\n}\n\n/**\n * Options for DCR client registration\n */\nexport interface DcrRegistrationOptions {\n  /** Redirect URI for OAuth callback, from the loopback listener the caller has already bound (RFC 8252) */\n  redirectUri: string;\n  /** Client name to register */\n  clientName?: string;\n  /**\n   * Loopback trust grant for the registration_endpoint fetch (SSRF\n   * mitigation - see `src/auth/discovery-fetch.ts`). Compute this from the\n   * MCP server the caller is actually talking to, never from\n   * `registrationEndpoint` itself (which is typically sourced from\n   * remote-controlled AS metadata). Defaults to `false`.\n   */\n  allowLoopback?: boolean;\n}\n\n/**\n * Options for OAuth authorization flow\n */\nexport interface OAuthFlowOptions {\n  /** Port for OAuth callback listener (required - use get-port to find available port) */\n  port: number;\n  /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */\n  issuer: string;\n  /** Canonical resource server URI, sent as `resource` on the authorization, token, and refresh requests (RFC 8707) */\n  resource: string;\n  /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */\n  redirectUri?: string;\n  /** OAuth scopes to request */\n  scopes?: string[];\n  /** Whether the authorization server advertises `authorization_response_iss_parameter_supported` (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */\n  pkce?: boolean;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Timeout for callback (milliseconds) */\n  timeout?: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: import('../utils/logger.ts').Logger;\n  /**\n   * Loopback trust grant for the token endpoint fetch (SSRF mitigation - see\n   * `src/auth/discovery-fetch.ts`). Compute this from the MCP server the\n   * caller is actually talking to, never from `tokenEndpoint` itself (which\n   * is typically sourced from remote-controlled AS metadata). Defaults to\n   * `false`.\n   */\n  allowLoopback?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC"}

package/dist/cjs/dcr/dcr-authenticator.d.cts

@@ -58,16 +58,20 @@ export declare class DcrAuthenticator {
      * Self-hosted servers manage their own token storage via /oauth/verify
      */
     private ensureAuthenticatedSelfHosted;
-    /**
-     * Handle authentication for external OAuth providers (original implementation)
-     */
+    /** Handles authentication for external (non-self-hosted) OAuth providers. */
     private ensureAuthenticatedExternal;
     /**
-     * Refresh access token using refresh token
+     * Refreshes an access token using a refresh token.
+     * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).
+     * @param allowLoopback - Loopback trust grant computed from the server actually being talked to (SSRF mitigation, see discovery-fetch.ts). Defaults to `false`.
      */
     private refreshTokens;
     /**
-     * Delete stored tokens for a server
+     * Deletes both stored token families for a server, across every issuer they were bound to.
+     * @throws CredentialBindingError if the configured store cannot enumerate keys.
      */
     deleteTokens(baseUrl: string): Promise<void>;
+    /** Discards a stored credential that is not bound to `issuer` (SEP-2352), including one stored before issuer binding existed. */
+    private loadTokens;
+    private buildFlowOptions;
 }