@mcp-z/client 1.2.1 → 1.3.0

package/dist/cjs/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/types.ts"],"sourcesContent":["/**\n * Shared types for OAuth and DCR authentication\n */\n\n/**\n * OAuth callback result from authorization server\n */\nexport interface CallbackResult {\n  /** Authorization code from OAuth server */\n  code: string;\n  /** State parameter for CSRF protection */\n  state?: string;\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)\n * Used to secure OAuth 2.0 authorization code flow for public clients\n */\nexport interface PkceParams {\n  /** Code verifier - cryptographically random string (43-128 characters) */\n  codeVerifier: string;\n  /** Code challenge - derived from code verifier using challenge method */\n  codeChallenge: string;\n  /** Code challenge method - S256 (SHA-256) or plain */\n  codeChallengeMethod: 'S256' | 'plain';\n}\n\n/**\n * OAuth token set with access and refresh tokens\n */\nexport interface TokenSet {\n  /** Access token for API requests */\n  accessToken: string;\n  /** Refresh token for obtaining new access tokens */\n  refreshToken: string;\n  /** Timestamp when access token expires (milliseconds since epoch) */\n  expiresAt: number;\n  /** Scopes granted for this token set */\n  scopes?: string[];\n  /** Client ID used for DCR registration (stored for future use) */\n  clientId?: string;\n  /** Client secret used for DCR registration (stored for future use) */\n  clientSecret?: string;\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728)\n * Response from .well-known/oauth-protected-resource endpoint\n */\nexport interface ProtectedResourceMetadata {\n  /** The protected resource identifier */\n  resource: string;\n  /** List of authorization server URLs that can issue tokens for this resource */\n  authorization_servers: string[];\n  /** Optional list of scopes supported by this resource */\n  scopes_supported?: string[];\n  /** Optional list of bearer token methods supported (header, query, body) */\n  bearer_methods_supported?: string[];\n}\n\n/**\n * OAuth 2.0 Authorization Server Metadata (RFC 8414)\n * Response from .well-known/oauth-authorization-server endpoint\n */\nexport interface AuthorizationServerMetadata {\n  /** The authorization server's issuer identifier */\n  issuer?: string;\n  /** URL of the authorization endpoint */\n  authorization_endpoint?: string;\n  /** URL of the token endpoint */\n  token_endpoint?: string;\n  /** URL of the client registration endpoint (DCR - RFC 7591) */\n  registration_endpoint?: string;\n  /** URL of the token introspection endpoint */\n  introspection_endpoint?: string;\n  /** List of OAuth scopes supported by the authorization server */\n  scopes_supported?: string[];\n  /** Response types supported (code, token, etc.) */\n  response_types_supported?: string[];\n  /** Grant types supported (authorization_code, refresh_token, etc.) */\n  grant_types_supported?: string[];\n  /** Token endpoint authentication methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n}\n\n/**\n * OAuth server capabilities discovered from .well-known endpoint\n */\nexport interface AuthCapabilities {\n  /** Whether the server supports Dynamic Client Registration (RFC 7591) */\n  supportsDcr: boolean;\n  /** DCR client registration endpoint */\n  registrationEndpoint?: string;\n  /** OAuth authorization endpoint */\n  authorizationEndpoint?: string;\n  /** OAuth token endpoint */\n  tokenEndpoint?: string;\n  /** Token introspection endpoint */\n  introspectionEndpoint?: string;\n  /** Supported OAuth scopes */\n  scopes?: string[];\n}\n\n/**\n * Client credentials from DCR registration\n */\nexport interface ClientCredentials {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret */\n  clientSecret: string;\n  /** Timestamp when client was registered */\n  issuedAt?: number;\n}\n\n/**\n * Options for DCR client registration\n */\nexport interface DcrRegistrationOptions {\n  /** Client name to register */\n  clientName?: string;\n  /** Redirect URI for OAuth callback */\n  redirectUri?: string;\n  /**\n   * Loopback trust grant for the registration_endpoint fetch (SSRF\n   * mitigation - see `src/auth/discovery-fetch.ts`). Compute this from the\n   * MCP server the caller is actually talking to, never from\n   * `registrationEndpoint` itself (which is typically sourced from\n   * remote-controlled AS metadata). Defaults to `false`.\n   */\n  allowLoopback?: boolean;\n}\n\n/**\n * Options for OAuth authorization flow\n */\nexport interface OAuthFlowOptions {\n  /** Port for OAuth callback listener (required - use get-port to find available port) */\n  port: number;\n  /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */\n  redirectUri?: string;\n  /** OAuth scopes to request */\n  scopes?: string[];\n  /** Resource parameter (RFC 8707) - target resource server identifier */\n  resource?: string;\n  /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */\n  pkce?: boolean;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Timeout for callback (milliseconds) */\n  timeout?: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: import('../utils/logger.ts').Logger;\n  /**\n   * Loopback trust grant for the token endpoint fetch (SSRF mitigation - see\n   * `src/auth/discovery-fetch.ts`). Compute this from the MCP server the\n   * caller is actually talking to, never from `tokenEndpoint` itself (which\n   * is typically sourced from remote-controlled AS metadata). Defaults to\n   * `false`.\n   */\n  allowLoopback?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/types.ts"],"sourcesContent":["/**\n * Shared types for OAuth and DCR authentication\n */\n\n/**\n * OAuth callback result from authorization server\n */\nexport interface CallbackResult {\n  /** Authorization code from OAuth server */\n  code: string;\n  /** State parameter for CSRF protection */\n  state?: string;\n  /** Issuer identifier of the authorization server that minted the response (RFC 9207) */\n  iss?: string;\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)\n * Used to secure OAuth 2.0 authorization code flow for public clients\n */\nexport interface PkceParams {\n  /** Code verifier - cryptographically random string (43-128 characters) */\n  codeVerifier: string;\n  /** Code challenge - derived from code verifier using challenge method */\n  codeChallenge: string;\n  /** Code challenge method - S256 (SHA-256) or plain */\n  codeChallengeMethod: 'S256' | 'plain';\n}\n\n/**\n * OAuth token set with access and refresh tokens\n */\nexport interface TokenSet {\n  /** Access token for API requests */\n  accessToken: string;\n  /** Refresh token for obtaining new access tokens */\n  refreshToken: string;\n  /** Timestamp when access token expires (milliseconds since epoch) */\n  expiresAt: number;\n  /** Scopes granted for this token set */\n  scopes?: string[];\n  /** Client ID used for DCR registration (stored for future use) */\n  clientId?: string;\n  /** Client secret used for DCR registration (stored for future use) */\n  clientSecret?: string;\n  /** Issuer identifier of the authorization server these credentials belong to (SEP-2352) */\n  issuer?: string;\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728)\n * Response from .well-known/oauth-protected-resource endpoint\n */\nexport interface ProtectedResourceMetadata {\n  /** The protected resource identifier */\n  resource: string;\n  /** List of authorization server URLs that can issue tokens for this resource */\n  authorization_servers: string[];\n  /** Optional list of scopes supported by this resource */\n  scopes_supported?: string[];\n  /** Optional list of bearer token methods supported (header, query, body) */\n  bearer_methods_supported?: string[];\n}\n\n/**\n * OAuth 2.0 Authorization Server Metadata (RFC 8414)\n * Response from .well-known/oauth-authorization-server endpoint\n */\nexport interface AuthorizationServerMetadata {\n  /** The authorization server's issuer identifier */\n  issuer?: string;\n  /** URL of the authorization endpoint */\n  authorization_endpoint?: string;\n  /** URL of the token endpoint */\n  token_endpoint?: string;\n  /** URL of the client registration endpoint (DCR - RFC 7591) */\n  registration_endpoint?: string;\n  /** URL of the token introspection endpoint */\n  introspection_endpoint?: string;\n  /** List of OAuth scopes supported by the authorization server */\n  scopes_supported?: string[];\n  /** Response types supported (code, token, etc.) */\n  response_types_supported?: string[];\n  /** Grant types supported (authorization_code, refresh_token, etc.) */\n  grant_types_supported?: string[];\n  /** Token endpoint authentication methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorization_response_iss_parameter_supported?: boolean;\n}\n\n/**\n * OAuth server capabilities discovered from .well-known endpoint\n */\nexport interface AuthCapabilities {\n  /** Whether the server supports Dynamic Client Registration (RFC 7591) */\n  supportsDcr: boolean;\n  /** Issuer identifier from the authorization server metadata (RFC 8414) */\n  issuer?: string;\n  /**\n   * The protected resource's canonical identifier, from the RFC 9728 metadata\n   * document's `resource` field. This is what an RFC 8707 `resource` indicator\n   * must carry, and it is the resource server's own statement of its identity -\n   * not the URL we happened to dial, and never the base URL discovery was\n   * performed against, which has any `/mcp` segment stripped off it.\n   *\n   * Absent when no protected-resource metadata was published and the\n   * authorization server was reached by direct RFC 8414 discovery instead.\n   */\n  resource?: string;\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** DCR client registration endpoint */\n  registrationEndpoint?: string;\n  /** OAuth authorization endpoint */\n  authorizationEndpoint?: string;\n  /** OAuth token endpoint */\n  tokenEndpoint?: string;\n  /** Token introspection endpoint */\n  introspectionEndpoint?: string;\n  /** Supported OAuth scopes */\n  scopes?: string[];\n}\n\n/**\n * Client credentials from DCR registration\n */\nexport interface ClientCredentials {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret */\n  clientSecret: string;\n  /** Timestamp when client was registered */\n  issuedAt?: number;\n}\n\n/**\n * Options for DCR client registration\n */\nexport interface DcrRegistrationOptions {\n  /** Redirect URI for OAuth callback, from the loopback listener the caller has already bound (RFC 8252) */\n  redirectUri: string;\n  /** Client name to register */\n  clientName?: string;\n  /**\n   * Loopback trust grant for the registration_endpoint fetch (SSRF\n   * mitigation - see `src/auth/discovery-fetch.ts`). Compute this from the\n   * MCP server the caller is actually talking to, never from\n   * `registrationEndpoint` itself (which is typically sourced from\n   * remote-controlled AS metadata). Defaults to `false`.\n   */\n  allowLoopback?: boolean;\n}\n\n/**\n * Options for OAuth authorization flow\n */\nexport interface OAuthFlowOptions {\n  /** Port for OAuth callback listener (required - use get-port to find available port) */\n  port: number;\n  /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */\n  issuer: string;\n  /** Canonical resource server URI, sent as `resource` on the authorization, token, and refresh requests (RFC 8707) */\n  resource: string;\n  /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */\n  redirectUri?: string;\n  /** OAuth scopes to request */\n  scopes?: string[];\n  /** Whether the authorization server advertises `authorization_response_iss_parameter_supported` (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */\n  pkce?: boolean;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Timeout for callback (milliseconds) */\n  timeout?: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: import('../utils/logger.ts').Logger;\n  /**\n   * Loopback trust grant for the token endpoint fetch (SSRF mitigation - see\n   * `src/auth/discovery-fetch.ts`). Compute this from the MCP server the\n   * caller is actually talking to, never from `tokenEndpoint` itself (which\n   * is typically sourced from remote-controlled AS metadata). Defaults to\n   * `false`.\n   */\n  allowLoopback?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC"}

package/dist/cjs/client-helpers.d.cts

@@ -1,5 +1,4 @@
-import type { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import type { RequestOptions } from '@modelcontextprotocol/sdk/shared/protocol.js';
+import type { Client } from '@modelcontextprotocol/client';
 import type { ToolArguments } from './connection/types.js';
 import { PromptResponseWrapper, ResourceResponseWrapper, ToolResponseWrapper } from './response-wrappers.js';
 export type PromptArguments = Record<string, string>;
@@ -33,10 +32,10 @@ export type ManagedClient = Omit<Client, 'callTool' | 'getPrompt' | 'readResourc
     readonly serverName: string;
     /** Underlying MCP SDK client for advanced scenarios. */
     readonly nativeClient: Client;
-    callTool(toolName: string, args?: ToolArguments, requestOptions?: RequestOptions): WrappedCallToolReturn;
-    callTool(invocation: NativeCallToolParams[0], sessionId?: NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]): WrappedCallToolReturn;
-    callToolRaw(toolName: string, args?: ToolArguments, requestOptions?: RequestOptions): NativeCallToolReturn;
-    callToolRaw(invocation: NativeCallToolParams[0], sessionId?: NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]): NativeCallToolReturn;
+    callTool(toolName: string, args?: ToolArguments, requestOptions?: NativeCallToolParams[1]): WrappedCallToolReturn;
+    callTool(invocation: NativeCallToolParams[0], requestOptions?: NativeCallToolParams[1]): WrappedCallToolReturn;
+    callToolRaw(toolName: string, args?: ToolArguments, requestOptions?: NativeCallToolParams[1]): NativeCallToolReturn;
+    callToolRaw(invocation: NativeCallToolParams[0], requestOptions?: NativeCallToolParams[1]): NativeCallToolReturn;
     getPrompt(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;
     getPrompt(invocation: NativeGetPromptParams[0], requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;
     getPromptRaw(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): NativeGetPromptReturn;

package/dist/cjs/client-helpers.d.ts

@@ -1,5 +1,4 @@
-import type { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import type { RequestOptions } from '@modelcontextprotocol/sdk/shared/protocol.js';
+import type { Client } from '@modelcontextprotocol/client';
 import type { ToolArguments } from './connection/types.js';
 import { PromptResponseWrapper, ResourceResponseWrapper, ToolResponseWrapper } from './response-wrappers.js';
 export type PromptArguments = Record<string, string>;
@@ -33,10 +32,10 @@ export type ManagedClient = Omit<Client, 'callTool' | 'getPrompt' | 'readResourc
     readonly serverName: string;
     /** Underlying MCP SDK client for advanced scenarios. */
     readonly nativeClient: Client;
-    callTool(toolName: string, args?: ToolArguments, requestOptions?: RequestOptions): WrappedCallToolReturn;
-    callTool(invocation: NativeCallToolParams[0], sessionId?: NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]): WrappedCallToolReturn;
-    callToolRaw(toolName: string, args?: ToolArguments, requestOptions?: RequestOptions): NativeCallToolReturn;
-    callToolRaw(invocation: NativeCallToolParams[0], sessionId?: NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]): NativeCallToolReturn;
+    callTool(toolName: string, args?: ToolArguments, requestOptions?: NativeCallToolParams[1]): WrappedCallToolReturn;
+    callTool(invocation: NativeCallToolParams[0], requestOptions?: NativeCallToolParams[1]): WrappedCallToolReturn;
+    callToolRaw(toolName: string, args?: ToolArguments, requestOptions?: NativeCallToolParams[1]): NativeCallToolReturn;
+    callToolRaw(invocation: NativeCallToolParams[0], requestOptions?: NativeCallToolParams[1]): NativeCallToolReturn;
     getPrompt(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;
     getPrompt(invocation: NativeGetPromptParams[0], requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;
     getPromptRaw(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): NativeGetPromptReturn;

package/dist/cjs/client-helpers.js

@@ -55,23 +55,23 @@ function decorateClient(client, metadata) {
             return new _responsewrappersts.ToolResponseWrapper(payload);
         });
     };
-    enhanced.callTool = function(nameOrInvocation, argsOrSession, requestOptions) {
+    enhanced.callTool = function(nameOrInvocation, argsOrOptions, requestOptions) {
         if (typeof nameOrInvocation === 'string') {
             return wrapCallTool(nativeCallTool({
                 name: nameOrInvocation,
-                arguments: argsOrSession !== null && argsOrSession !== void 0 ? argsOrSession : {}
-            }, undefined, requestOptions));
+                arguments: argsOrOptions !== null && argsOrOptions !== void 0 ? argsOrOptions : {}
+            }, requestOptions));
         }
-        return wrapCallTool(nativeCallTool(nameOrInvocation, argsOrSession, requestOptions));
+        return wrapCallTool(nativeCallTool(nameOrInvocation, argsOrOptions));
     };
-    enhanced.callToolRaw = function(nameOrInvocation, argsOrSession, requestOptions) {
+    enhanced.callToolRaw = function(nameOrInvocation, argsOrOptions, requestOptions) {
         if (typeof nameOrInvocation === 'string') {
             return nativeCallTool({
                 name: nameOrInvocation,
-                arguments: argsOrSession !== null && argsOrSession !== void 0 ? argsOrSession : {}
-            }, undefined, requestOptions);
+                arguments: argsOrOptions !== null && argsOrOptions !== void 0 ? argsOrOptions : {}
+            }, requestOptions);
         }
-        return nativeCallTool(nameOrInvocation, argsOrSession, requestOptions);
+        return nativeCallTool(nameOrInvocation, argsOrOptions);
     };
     var nativeGetPrompt = client.getPrompt.bind(client);
     var wrapPrompt = function wrapPrompt(promise) {

package/dist/cjs/client-helpers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/client-helpers.ts"],"sourcesContent":["import type { Client } from '@modelcontextprotocol/sdk/client/index.js';\nimport type { RequestOptions } from '@modelcontextprotocol/sdk/shared/protocol.js';\nimport type { ToolArguments } from './connection/types.ts';\nimport { type NativeCallToolResponse, type NativeGetPromptResponse, type NativeReadResourceResponse, PromptResponseWrapper, ResourceResponseWrapper, ToolResponseWrapper } from './response-wrappers.ts';\n\nexport type PromptArguments = Record<string, string>;\n\ntype NativeCallToolParams = Parameters<Client['callTool']>;\ntype NativeCallToolReturn = ReturnType<Client['callTool']>;\n/**\n * Fetch-style wrapper returned by `ManagedClient.callTool()`.\n * @public\n */\nexport type WrappedCallToolReturn = Promise<ToolResponseWrapper>;\n\ntype NativeGetPromptParams = Parameters<Client['getPrompt']>;\ntype NativeGetPromptReturn = ReturnType<Client['getPrompt']>;\n/**\n * Fetch-style wrapper returned by `ManagedClient.getPrompt()`.\n * @public\n */\nexport type WrappedGetPromptReturn = Promise<PromptResponseWrapper>;\n\ntype NativeReadResourceParams = Parameters<Client['readResource']>;\ntype NativeReadResourceReturn = ReturnType<Client['readResource']>;\n/**\n * Fetch-style wrapper returned by `ManagedClient.readResource()`.\n * @public\n */\nexport type WrappedReadResourceReturn = Promise<ResourceResponseWrapper>;\n\n/**\n * Client returned by registry.connect() with convenience overloads for\n * calling tools, reading resources, and getting prompts using simple arguments.\n */\nexport type ManagedClient = Omit<Client, 'callTool' | 'getPrompt' | 'readResource'> & {\n  /** Name of the server this client is connected to. */\n  readonly serverName: string;\n  /** Underlying MCP SDK client for advanced scenarios. */\n  readonly nativeClient: Client;\n\n  callTool(toolName: string, args?: ToolArguments, requestOptions?: RequestOptions): WrappedCallToolReturn;\n  callTool(invocation: NativeCallToolParams[0], sessionId?: NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]): WrappedCallToolReturn;\n  callToolRaw(toolName: string, args?: ToolArguments, requestOptions?: RequestOptions): NativeCallToolReturn;\n  callToolRaw(invocation: NativeCallToolParams[0], sessionId?: NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]): NativeCallToolReturn;\n\n  getPrompt(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;\n  getPrompt(invocation: NativeGetPromptParams[0], requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;\n  getPromptRaw(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): NativeGetPromptReturn;\n  getPromptRaw(invocation: NativeGetPromptParams[0], requestOptions?: NativeGetPromptParams[1]): NativeGetPromptReturn;\n\n  readResource(uri: string, requestOptions?: NativeReadResourceParams[1]): WrappedReadResourceReturn;\n  readResource(request: NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]): WrappedReadResourceReturn;\n  readResourceRaw(uri: string, requestOptions?: NativeReadResourceParams[1]): NativeReadResourceReturn;\n  readResourceRaw(request: NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]): NativeReadResourceReturn;\n};\n\n/**\n * Enhance an MCP SDK client with convenience overloads.\n */\nexport function decorateClient(client: Client, metadata: { serverName: string }): ManagedClient {\n  const enhanced = client as unknown as ManagedClient;\n\n  Object.defineProperty(enhanced, 'serverName', {\n    value: metadata.serverName,\n    enumerable: true,\n    configurable: false,\n    writable: false,\n  });\n  Object.defineProperty(enhanced, 'nativeClient', {\n    value: client,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  });\n\n  const nativeCallTool = client.callTool.bind(client);\n  const wrapCallTool = (promise: NativeCallToolReturn): WrappedCallToolReturn => promise.then((payload) => new ToolResponseWrapper(payload as NativeCallToolResponse));\n\n  enhanced.callTool = ((nameOrInvocation: string | NativeCallToolParams[0], argsOrSession?: ToolArguments | NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]) => {\n    if (typeof nameOrInvocation === 'string') {\n      return wrapCallTool(nativeCallTool({ name: nameOrInvocation, arguments: (argsOrSession as ToolArguments) ?? {} }, undefined, requestOptions));\n    }\n    return wrapCallTool(nativeCallTool(nameOrInvocation, argsOrSession as NativeCallToolParams[1], requestOptions));\n  }) as ManagedClient['callTool'];\n\n  enhanced.callToolRaw = ((nameOrInvocation: string | NativeCallToolParams[0], argsOrSession?: ToolArguments | NativeCallToolParams[1], requestOptions?: NativeCallToolParams[2]) => {\n    if (typeof nameOrInvocation === 'string') {\n      return nativeCallTool({ name: nameOrInvocation, arguments: (argsOrSession as ToolArguments) ?? {} }, undefined, requestOptions);\n    }\n    return nativeCallTool(nameOrInvocation, argsOrSession as NativeCallToolParams[1], requestOptions);\n  }) as ManagedClient['callToolRaw'];\n\n  const nativeGetPrompt = client.getPrompt.bind(client);\n  const wrapPrompt = (promise: NativeGetPromptReturn): WrappedGetPromptReturn => promise.then((payload) => new PromptResponseWrapper(payload as NativeGetPromptResponse));\n\n  enhanced.getPrompt = ((nameOrParams: string | NativeGetPromptParams[0], argsOrOptions?: PromptArguments | NativeGetPromptParams[1], requestOptions?: NativeGetPromptParams[1]) => {\n    if (typeof nameOrParams === 'string') {\n      return wrapPrompt(nativeGetPrompt({ name: nameOrParams, ...(argsOrOptions ? { arguments: argsOrOptions as PromptArguments } : {}) }, requestOptions));\n    }\n    return wrapPrompt(nativeGetPrompt(nameOrParams, argsOrOptions as NativeGetPromptParams[1]));\n  }) as ManagedClient['getPrompt'];\n\n  enhanced.getPromptRaw = ((nameOrParams: string | NativeGetPromptParams[0], argsOrOptions?: PromptArguments | NativeGetPromptParams[1], requestOptions?: NativeGetPromptParams[1]) => {\n    if (typeof nameOrParams === 'string') {\n      return nativeGetPrompt({ name: nameOrParams, ...(argsOrOptions ? { arguments: argsOrOptions as PromptArguments } : {}) }, requestOptions);\n    }\n    return nativeGetPrompt(nameOrParams, argsOrOptions as NativeGetPromptParams[1]);\n  }) as ManagedClient['getPromptRaw'];\n\n  const nativeReadResource = client.readResource.bind(client);\n  const wrapResource = (promise: NativeReadResourceReturn): WrappedReadResourceReturn => promise.then((payload) => new ResourceResponseWrapper(payload as NativeReadResourceResponse));\n\n  enhanced.readResource = ((uriOrRequest: string | NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]) => {\n    if (typeof uriOrRequest === 'string') {\n      return wrapResource(nativeReadResource({ uri: uriOrRequest }, requestOptions));\n    }\n    return wrapResource(nativeReadResource(uriOrRequest, requestOptions));\n  }) as ManagedClient['readResource'];\n\n  enhanced.readResourceRaw = ((uriOrRequest: string | NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]) => {\n    if (typeof uriOrRequest === 'string') {\n      return nativeReadResource({ uri: uriOrRequest }, requestOptions);\n    }\n    return nativeReadResource(uriOrRequest, requestOptions);\n  }) as ManagedClient['readResourceRaw'];\n\n  return enhanced;\n}\n"],"names":["decorateClient","client","metadata","enhanced","Object","defineProperty","value","serverName","enumerable","configurable","writable","nativeCallTool","callTool","bind","wrapCallTool","promise","then","payload","ToolResponseWrapper","nameOrInvocation","argsOrSession","requestOptions","name","arguments","undefined","callToolRaw","nativeGetPrompt","getPrompt","wrapPrompt","PromptResponseWrapper","nameOrParams","argsOrOptions","getPromptRaw","nativeReadResource","readResource","wrapResource","ResourceResponseWrapper","uriOrRequest","uri","readResourceRaw"],"mappings":";;;;+BA4DgBA;;;eAAAA;;;kCAzDgK;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDzK,SAASA,eAAeC,MAAc,EAAEC,QAAgC;IAC7E,IAAMC,WAAWF;IAEjBG,OAAOC,cAAc,CAACF,UAAU,cAAc;QAC5CG,OAAOJ,SAASK,UAAU;QAC1BC,YAAY;QACZC,cAAc;QACdC,UAAU;IACZ;IACAN,OAAOC,cAAc,CAACF,UAAU,gBAAgB;QAC9CG,OAAOL;QACPO,YAAY;QACZC,cAAc;QACdC,UAAU;IACZ;IAEA,IAAMC,iBAAiBV,OAAOW,QAAQ,CAACC,IAAI,CAACZ;IAC5C,IAAMa,eAAe,sBAACC;eAAyDA,QAAQC,IAAI,CAAC,SAACC;mBAAY,IAAIC,uCAAmB,CAACD;;;IAEjId,SAASS,QAAQ,GAAI,SAACO,kBAAoDC,eAAyDC;QACjI,IAAI,OAAOF,qBAAqB,UAAU;YACxC,OAAOL,aAAaH,eAAe;gBAAEW,MAAMH;gBAAkBI,SAAS,EAAGH,0BAAAA,2BAAAA,gBAAmC,CAAC;YAAE,GAAGI,WAAWH;QAC/H;QACA,OAAOP,aAAaH,eAAeQ,kBAAkBC,eAA0CC;IACjG;IAEAlB,SAASsB,WAAW,GAAI,SAACN,kBAAoDC,eAAyDC;QACpI,IAAI,OAAOF,qBAAqB,UAAU;YACxC,OAAOR,eAAe;gBAAEW,MAAMH;gBAAkBI,SAAS,EAAGH,0BAAAA,2BAAAA,gBAAmC,CAAC;YAAE,GAAGI,WAAWH;QAClH;QACA,OAAOV,eAAeQ,kBAAkBC,eAA0CC;IACpF;IAEA,IAAMK,kBAAkBzB,OAAO0B,SAAS,CAACd,IAAI,CAACZ;IAC9C,IAAM2B,aAAa,oBAACb;eAA2DA,QAAQC,IAAI,CAAC,SAACC;mBAAY,IAAIY,yCAAqB,CAACZ;;;IAEnId,SAASwB,SAAS,GAAI,SAACG,cAAiDC,eAA4DV;QAClI,IAAI,OAAOS,iBAAiB,UAAU;YACpC,OAAOF,WAAWF,gBAAgB;gBAAEJ,MAAMQ;eAAkBC,gBAAgB;gBAAER,WAAWQ;YAAiC,IAAI,CAAC,IAAMV;QACvI;QACA,OAAOO,WAAWF,gBAAgBI,cAAcC;IAClD;IAEA5B,SAAS6B,YAAY,GAAI,SAACF,cAAiDC,eAA4DV;QACrI,IAAI,OAAOS,iBAAiB,UAAU;YACpC,OAAOJ,gBAAgB;gBAAEJ,MAAMQ;eAAkBC,gBAAgB;gBAAER,WAAWQ;YAAiC,IAAI,CAAC,IAAMV;QAC5H;QACA,OAAOK,gBAAgBI,cAAcC;IACvC;IAEA,IAAME,qBAAqBhC,OAAOiC,YAAY,CAACrB,IAAI,CAACZ;IACpD,IAAMkC,eAAe,sBAACpB;eAAiEA,QAAQC,IAAI,CAAC,SAACC;mBAAY,IAAImB,2CAAuB,CAACnB;;;IAE7Id,SAAS+B,YAAY,GAAI,SAACG,cAAoDhB;QAC5E,IAAI,OAAOgB,iBAAiB,UAAU;YACpC,OAAOF,aAAaF,mBAAmB;gBAAEK,KAAKD;YAAa,GAAGhB;QAChE;QACA,OAAOc,aAAaF,mBAAmBI,cAAchB;IACvD;IAEAlB,SAASoC,eAAe,GAAI,SAACF,cAAoDhB;QAC/E,IAAI,OAAOgB,iBAAiB,UAAU;YACpC,OAAOJ,mBAAmB;gBAAEK,KAAKD;YAAa,GAAGhB;QACnD;QACA,OAAOY,mBAAmBI,cAAchB;IAC1C;IAEA,OAAOlB;AACT"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/client-helpers.ts"],"sourcesContent":["import type { Client } from '@modelcontextprotocol/client';\nimport type { ToolArguments } from './connection/types.ts';\nimport { type NativeCallToolResponse, type NativeGetPromptResponse, type NativeReadResourceResponse, PromptResponseWrapper, ResourceResponseWrapper, ToolResponseWrapper } from './response-wrappers.ts';\n\nexport type PromptArguments = Record<string, string>;\n\ntype NativeCallToolParams = Parameters<Client['callTool']>;\ntype NativeCallToolReturn = ReturnType<Client['callTool']>;\n/**\n * Fetch-style wrapper returned by `ManagedClient.callTool()`.\n * @public\n */\nexport type WrappedCallToolReturn = Promise<ToolResponseWrapper>;\n\ntype NativeGetPromptParams = Parameters<Client['getPrompt']>;\ntype NativeGetPromptReturn = ReturnType<Client['getPrompt']>;\n/**\n * Fetch-style wrapper returned by `ManagedClient.getPrompt()`.\n * @public\n */\nexport type WrappedGetPromptReturn = Promise<PromptResponseWrapper>;\n\ntype NativeReadResourceParams = Parameters<Client['readResource']>;\ntype NativeReadResourceReturn = ReturnType<Client['readResource']>;\n/**\n * Fetch-style wrapper returned by `ManagedClient.readResource()`.\n * @public\n */\nexport type WrappedReadResourceReturn = Promise<ResourceResponseWrapper>;\n\n/**\n * Client returned by registry.connect() with convenience overloads for\n * calling tools, reading resources, and getting prompts using simple arguments.\n */\nexport type ManagedClient = Omit<Client, 'callTool' | 'getPrompt' | 'readResource'> & {\n  /** Name of the server this client is connected to. */\n  readonly serverName: string;\n  /** Underlying MCP SDK client for advanced scenarios. */\n  readonly nativeClient: Client;\n\n  callTool(toolName: string, args?: ToolArguments, requestOptions?: NativeCallToolParams[1]): WrappedCallToolReturn;\n  callTool(invocation: NativeCallToolParams[0], requestOptions?: NativeCallToolParams[1]): WrappedCallToolReturn;\n  callToolRaw(toolName: string, args?: ToolArguments, requestOptions?: NativeCallToolParams[1]): NativeCallToolReturn;\n  callToolRaw(invocation: NativeCallToolParams[0], requestOptions?: NativeCallToolParams[1]): NativeCallToolReturn;\n\n  getPrompt(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;\n  getPrompt(invocation: NativeGetPromptParams[0], requestOptions?: NativeGetPromptParams[1]): WrappedGetPromptReturn;\n  getPromptRaw(name: string, args?: PromptArguments, requestOptions?: NativeGetPromptParams[1]): NativeGetPromptReturn;\n  getPromptRaw(invocation: NativeGetPromptParams[0], requestOptions?: NativeGetPromptParams[1]): NativeGetPromptReturn;\n\n  readResource(uri: string, requestOptions?: NativeReadResourceParams[1]): WrappedReadResourceReturn;\n  readResource(request: NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]): WrappedReadResourceReturn;\n  readResourceRaw(uri: string, requestOptions?: NativeReadResourceParams[1]): NativeReadResourceReturn;\n  readResourceRaw(request: NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]): NativeReadResourceReturn;\n};\n\n/**\n * Enhance an MCP SDK client with convenience overloads.\n */\nexport function decorateClient(client: Client, metadata: { serverName: string }): ManagedClient {\n  const enhanced = client as unknown as ManagedClient;\n\n  Object.defineProperty(enhanced, 'serverName', {\n    value: metadata.serverName,\n    enumerable: true,\n    configurable: false,\n    writable: false,\n  });\n  Object.defineProperty(enhanced, 'nativeClient', {\n    value: client,\n    enumerable: false,\n    configurable: false,\n    writable: false,\n  });\n\n  const nativeCallTool = client.callTool.bind(client);\n  const wrapCallTool = (promise: NativeCallToolReturn): WrappedCallToolReturn => promise.then((payload) => new ToolResponseWrapper(payload as NativeCallToolResponse));\n\n  enhanced.callTool = ((nameOrInvocation: string | NativeCallToolParams[0], argsOrOptions?: ToolArguments | NativeCallToolParams[1], requestOptions?: NativeCallToolParams[1]) => {\n    if (typeof nameOrInvocation === 'string') {\n      return wrapCallTool(nativeCallTool({ name: nameOrInvocation, arguments: (argsOrOptions as ToolArguments) ?? {} }, requestOptions));\n    }\n    return wrapCallTool(nativeCallTool(nameOrInvocation, argsOrOptions as NativeCallToolParams[1]));\n  }) as ManagedClient['callTool'];\n\n  enhanced.callToolRaw = ((nameOrInvocation: string | NativeCallToolParams[0], argsOrOptions?: ToolArguments | NativeCallToolParams[1], requestOptions?: NativeCallToolParams[1]) => {\n    if (typeof nameOrInvocation === 'string') {\n      return nativeCallTool({ name: nameOrInvocation, arguments: (argsOrOptions as ToolArguments) ?? {} }, requestOptions);\n    }\n    return nativeCallTool(nameOrInvocation, argsOrOptions as NativeCallToolParams[1]);\n  }) as ManagedClient['callToolRaw'];\n\n  const nativeGetPrompt = client.getPrompt.bind(client);\n  const wrapPrompt = (promise: NativeGetPromptReturn): WrappedGetPromptReturn => promise.then((payload) => new PromptResponseWrapper(payload as NativeGetPromptResponse));\n\n  enhanced.getPrompt = ((nameOrParams: string | NativeGetPromptParams[0], argsOrOptions?: PromptArguments | NativeGetPromptParams[1], requestOptions?: NativeGetPromptParams[1]) => {\n    if (typeof nameOrParams === 'string') {\n      return wrapPrompt(nativeGetPrompt({ name: nameOrParams, ...(argsOrOptions ? { arguments: argsOrOptions as PromptArguments } : {}) }, requestOptions));\n    }\n    return wrapPrompt(nativeGetPrompt(nameOrParams, argsOrOptions as NativeGetPromptParams[1]));\n  }) as ManagedClient['getPrompt'];\n\n  enhanced.getPromptRaw = ((nameOrParams: string | NativeGetPromptParams[0], argsOrOptions?: PromptArguments | NativeGetPromptParams[1], requestOptions?: NativeGetPromptParams[1]) => {\n    if (typeof nameOrParams === 'string') {\n      return nativeGetPrompt({ name: nameOrParams, ...(argsOrOptions ? { arguments: argsOrOptions as PromptArguments } : {}) }, requestOptions);\n    }\n    return nativeGetPrompt(nameOrParams, argsOrOptions as NativeGetPromptParams[1]);\n  }) as ManagedClient['getPromptRaw'];\n\n  const nativeReadResource = client.readResource.bind(client);\n  const wrapResource = (promise: NativeReadResourceReturn): WrappedReadResourceReturn => promise.then((payload) => new ResourceResponseWrapper(payload as NativeReadResourceResponse));\n\n  enhanced.readResource = ((uriOrRequest: string | NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]) => {\n    if (typeof uriOrRequest === 'string') {\n      return wrapResource(nativeReadResource({ uri: uriOrRequest }, requestOptions));\n    }\n    return wrapResource(nativeReadResource(uriOrRequest, requestOptions));\n  }) as ManagedClient['readResource'];\n\n  enhanced.readResourceRaw = ((uriOrRequest: string | NativeReadResourceParams[0], requestOptions?: NativeReadResourceParams[1]) => {\n    if (typeof uriOrRequest === 'string') {\n      return nativeReadResource({ uri: uriOrRequest }, requestOptions);\n    }\n    return nativeReadResource(uriOrRequest, requestOptions);\n  }) as ManagedClient['readResourceRaw'];\n\n  return enhanced;\n}\n"],"names":["decorateClient","client","metadata","enhanced","Object","defineProperty","value","serverName","enumerable","configurable","writable","nativeCallTool","callTool","bind","wrapCallTool","promise","then","payload","ToolResponseWrapper","nameOrInvocation","argsOrOptions","requestOptions","name","arguments","callToolRaw","nativeGetPrompt","getPrompt","wrapPrompt","PromptResponseWrapper","nameOrParams","getPromptRaw","nativeReadResource","readResource","wrapResource","ResourceResponseWrapper","uriOrRequest","uri","readResourceRaw"],"mappings":";;;;+BA2DgBA;;;eAAAA;;;kCAzDgK;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDzK,SAASA,eAAeC,MAAc,EAAEC,QAAgC;IAC7E,IAAMC,WAAWF;IAEjBG,OAAOC,cAAc,CAACF,UAAU,cAAc;QAC5CG,OAAOJ,SAASK,UAAU;QAC1BC,YAAY;QACZC,cAAc;QACdC,UAAU;IACZ;IACAN,OAAOC,cAAc,CAACF,UAAU,gBAAgB;QAC9CG,OAAOL;QACPO,YAAY;QACZC,cAAc;QACdC,UAAU;IACZ;IAEA,IAAMC,iBAAiBV,OAAOW,QAAQ,CAACC,IAAI,CAACZ;IAC5C,IAAMa,eAAe,sBAACC;eAAyDA,QAAQC,IAAI,CAAC,SAACC;mBAAY,IAAIC,uCAAmB,CAACD;;;IAEjId,SAASS,QAAQ,GAAI,SAACO,kBAAoDC,eAAyDC;QACjI,IAAI,OAAOF,qBAAqB,UAAU;YACxC,OAAOL,aAAaH,eAAe;gBAAEW,MAAMH;gBAAkBI,SAAS,EAAGH,0BAAAA,2BAAAA,gBAAmC,CAAC;YAAE,GAAGC;QACpH;QACA,OAAOP,aAAaH,eAAeQ,kBAAkBC;IACvD;IAEAjB,SAASqB,WAAW,GAAI,SAACL,kBAAoDC,eAAyDC;QACpI,IAAI,OAAOF,qBAAqB,UAAU;YACxC,OAAOR,eAAe;gBAAEW,MAAMH;gBAAkBI,SAAS,EAAGH,0BAAAA,2BAAAA,gBAAmC,CAAC;YAAE,GAAGC;QACvG;QACA,OAAOV,eAAeQ,kBAAkBC;IAC1C;IAEA,IAAMK,kBAAkBxB,OAAOyB,SAAS,CAACb,IAAI,CAACZ;IAC9C,IAAM0B,aAAa,oBAACZ;eAA2DA,QAAQC,IAAI,CAAC,SAACC;mBAAY,IAAIW,yCAAqB,CAACX;;;IAEnId,SAASuB,SAAS,GAAI,SAACG,cAAiDT,eAA4DC;QAClI,IAAI,OAAOQ,iBAAiB,UAAU;YACpC,OAAOF,WAAWF,gBAAgB;gBAAEH,MAAMO;eAAkBT,gBAAgB;gBAAEG,WAAWH;YAAiC,IAAI,CAAC,IAAMC;QACvI;QACA,OAAOM,WAAWF,gBAAgBI,cAAcT;IAClD;IAEAjB,SAAS2B,YAAY,GAAI,SAACD,cAAiDT,eAA4DC;QACrI,IAAI,OAAOQ,iBAAiB,UAAU;YACpC,OAAOJ,gBAAgB;gBAAEH,MAAMO;eAAkBT,gBAAgB;gBAAEG,WAAWH;YAAiC,IAAI,CAAC,IAAMC;QAC5H;QACA,OAAOI,gBAAgBI,cAAcT;IACvC;IAEA,IAAMW,qBAAqB9B,OAAO+B,YAAY,CAACnB,IAAI,CAACZ;IACpD,IAAMgC,eAAe,sBAAClB;eAAiEA,QAAQC,IAAI,CAAC,SAACC;mBAAY,IAAIiB,2CAAuB,CAACjB;;;IAE7Id,SAAS6B,YAAY,GAAI,SAACG,cAAoDd;QAC5E,IAAI,OAAOc,iBAAiB,UAAU;YACpC,OAAOF,aAAaF,mBAAmB;gBAAEK,KAAKD;YAAa,GAAGd;QAChE;QACA,OAAOY,aAAaF,mBAAmBI,cAAcd;IACvD;IAEAlB,SAASkC,eAAe,GAAI,SAACF,cAAoDd;QAC/E,IAAI,OAAOc,iBAAiB,UAAU;YACpC,OAAOJ,mBAAmB;gBAAEK,KAAKD;YAAa,GAAGd;QACnD;QACA,OAAOU,mBAAmBI,cAAcd;IAC1C;IAEA,OAAOlB;AACT"}

package/dist/cjs/connection/connect-client.d.cts

@@ -4,8 +4,8 @@
  * Helper to connect MCP SDK clients to servers with intelligent transport inference.
  * Automatically detects transport type from URL protocol or type field.
  */
-import '../monkey-patches.js';
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import type { VersionNegotiationOptions } from '@modelcontextprotocol/client';
+import { Client } from '@modelcontextprotocol/client';
 import { type DcrAuthenticatorOptions } from '../dcr/index.js';
 import type { ServerProcess } from '../spawn/spawn-server.js';
 import type { ServersConfig } from '../spawn/spawn-servers.js';
@@ -18,15 +18,6 @@ interface RegistryLike {
     servers: Map<string, ServerProcess>;
 }
 import { type Logger } from '../utils/logger.js';
-/**
- * Extract the "server base" by removing a trailing `/mcp` path segment if present.
- * Examples:
- *  - https://example.com/mcp -> https://example.com
- *  - https://example.com/sheets/mcp -> https://example.com/sheets
- *  - https://example.com/sheets/mcp/ -> https://example.com/sheets
- *  - https://example.com/sheets -> https://example.com/sheets
- */
-export declare function extractBaseUrl(mcpUrl: string): string;
 /**
  * Connect MCP SDK client to server with full readiness handling.
  * @internal - Use registry.connect() instead
@@ -42,6 +33,15 @@ export declare function extractBaseUrl(mcpUrl: string): string;
  *
  * @param registryOrConfig - Result from createServerRegistry() or servers config object
  * @param serverName - Server name from servers config
+ * @param options - Connection options (see below)
+ * @param options.dcrAuthenticator - DCR authenticator options
+ * @param options.logger - Logger for connection diagnostics
+ * @param options.versionNegotiation - SDK protocol version negotiation (protocol revision
+ *   2026-07-28 and later). Omitted by default, which keeps the SDK's `'legacy'` mode:
+ *   the plain 2025 connect sequence. Pass `{ mode: 'auto' }` to probe the server and
+ *   fall back to 2025 when it cannot serve the modern era, or `{ mode: { pin: '2026-07-28' } }`
+ *   to require the pinned revision (a server that cannot serve it fails the connect with
+ *   a typed era-negotiation error).
  * @returns Connected MCP SDK Client (guaranteed ready)
  *
  * @example
@@ -64,5 +64,6 @@ export declare function extractBaseUrl(mcpUrl: string): string;
 export declare function connectMcpClient(registryOrConfig: RegistryLike | ServersConfig, serverName: string, options?: {
     dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;
     logger?: Logger;
+    versionNegotiation?: VersionNegotiationOptions;
 }): Promise<Client>;
 export {};

package/dist/cjs/connection/connect-client.d.ts

@@ -4,8 +4,8 @@
  * Helper to connect MCP SDK clients to servers with intelligent transport inference.
  * Automatically detects transport type from URL protocol or type field.
  */
-import '../monkey-patches.js';
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import type { VersionNegotiationOptions } from '@modelcontextprotocol/client';
+import { Client } from '@modelcontextprotocol/client';
 import { type DcrAuthenticatorOptions } from '../dcr/index.js';
 import type { ServerProcess } from '../spawn/spawn-server.js';
 import type { ServersConfig } from '../spawn/spawn-servers.js';
@@ -18,15 +18,6 @@ interface RegistryLike {
     servers: Map<string, ServerProcess>;
 }
 import { type Logger } from '../utils/logger.js';
-/**
- * Extract the "server base" by removing a trailing `/mcp` path segment if present.
- * Examples:
- *  - https://example.com/mcp -> https://example.com
- *  - https://example.com/sheets/mcp -> https://example.com/sheets
- *  - https://example.com/sheets/mcp/ -> https://example.com/sheets
- *  - https://example.com/sheets -> https://example.com/sheets
- */
-export declare function extractBaseUrl(mcpUrl: string): string;
 /**
  * Connect MCP SDK client to server with full readiness handling.
  * @internal - Use registry.connect() instead
@@ -42,6 +33,15 @@ export declare function extractBaseUrl(mcpUrl: string): string;
  *
  * @param registryOrConfig - Result from createServerRegistry() or servers config object
  * @param serverName - Server name from servers config
+ * @param options - Connection options (see below)
+ * @param options.dcrAuthenticator - DCR authenticator options
+ * @param options.logger - Logger for connection diagnostics
+ * @param options.versionNegotiation - SDK protocol version negotiation (protocol revision
+ *   2026-07-28 and later). Omitted by default, which keeps the SDK's `'legacy'` mode:
+ *   the plain 2025 connect sequence. Pass `{ mode: 'auto' }` to probe the server and
+ *   fall back to 2025 when it cannot serve the modern era, or `{ mode: { pin: '2026-07-28' } }`
+ *   to require the pinned revision (a server that cannot serve it fails the connect with
+ *   a typed era-negotiation error).
  * @returns Connected MCP SDK Client (guaranteed ready)
  *
  * @example
@@ -64,5 +64,6 @@ export declare function extractBaseUrl(mcpUrl: string): string;
 export declare function connectMcpClient(registryOrConfig: RegistryLike | ServersConfig, serverName: string, options?: {
     dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;
     logger?: Logger;
+    versionNegotiation?: VersionNegotiationOptions;
 }): Promise<Client>;
 export {};

package/dist/cjs/connection/connect-client.js

@@ -7,29 +7,19 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get connectMcpClient () {
+Object.defineProperty(exports, "connectMcpClient", {
+    enumerable: true,
+    get: function() {
         return connectMcpClient;
-    },
-    get extractBaseUrl () {
-        return extractBaseUrl;
     }
 });
-require("../monkey-patches.js");
-var _index = require("@modelcontextprotocol/sdk/client/index.js");
-var _sse = require("@modelcontextprotocol/sdk/client/sse.js");
-var _stdio = require("@modelcontextprotocol/sdk/client/stdio.js");
-var _streamableHttp = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+var _client = require("@modelcontextprotocol/client");
+var _stdio = require("@modelcontextprotocol/client/stdio");
 var _getport = /*#__PURE__*/ _interop_require_default(require("get-port"));
 var _indexts = require("../auth/index.js");
 var _constantsts = require("../constants.js");
 var _indexts1 = require("../dcr/index.js");
+var _urlutilsts = require("../lib/url-utils.js");
 var _loggerts = require("../utils/logger.js");
 var _existingprocesstransportts = require("./existing-process-transport.js");
 var _waitforhttpreadyts = require("./wait-for-http-ready.js");
@@ -222,23 +212,6 @@ function _ts_generator(thisArg, body) {
         });
     })();
 }
-function extractBaseUrl(mcpUrl) {
-    var url = new URL(mcpUrl);
-    // Ignore query/hash for base URL purposes
-    url.search = '';
-    url.hash = '';
-    // Normalize path segments (removes empty segments from leading/trailing slashes)
-    var segments = url.pathname.split('/').filter(Boolean);
-    // If last segment is exactly "mcp", drop it
-    if (segments[segments.length - 1] === 'mcp') {
-        segments.pop();
-    }
-    // Rebuild pathname; empty means root
-    url.pathname = segments.length ? "/".concat(segments.join('/')) : '';
-    // Return without trailing slash (except root origin)
-    var out = url.origin + url.pathname;
-    return out === url.origin ? out : out.replace(/\/+$/, '');
-}
 /**
  * Infer transport type from server configuration with validation.
  *
@@ -280,7 +253,7 @@ function extractBaseUrl(mcpUrl) {
 }
 function connectMcpClient(registryOrConfig, serverName, options) {
     return _async_to_generator(function() {
-        var _ref, isRegistry, serversConfig, registry, logger, serverConfig, available, transportType, client, serverHandle, transport, transport1, isSpawnedHttp, url, baseUrl, capabilities, authToken, port, redirectUri, authenticator, tokens, staticHeaders, dcrHeaders, mergedHeaders, transportOptions, transport2, error, errorMessage, cause, isConnectionRefused, shouldFallback, sseClient, staticHeaders1, dcrHeaders1, mergedHeaders1, sseTransportOptions, sseTransport, sseError;
+        var _ref, isRegistry, serversConfig, registry, logger, serverConfig, available, transportType, clientOptions, client, serverHandle, transport, transport1, isSpawnedHttp, url, mcpServerUrl, capabilities, authToken, port, redirectUri, authenticator, tokens, staticHeaders, dcrHeaders, mergedHeaders, transportOptions, transport2, error, errorMessage, cause, isConnectionRefused, shouldFallback, sseClient, staticHeaders1, dcrHeaders1, mergedHeaders1, sseTransportOptions, sseTransport, sseError;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -296,13 +269,20 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     }
                     // Infer transport type with validation
                     transportType = inferTransportType(serverConfig);
+                    // SDK client options for both transports (main + SSE fallback). versionNegotiation is
+                    // omitted rather than set to undefined so the default stays the SDK's 'legacy' mode —
+                    // the plain 2025 connect sequence — for callers that do not pass it.
+                    clientOptions = {
+                        capabilities: {}
+                    };
+                    if ((options === null || options === void 0 ? void 0 : options.versionNegotiation) !== undefined) {
+                        clientOptions.versionNegotiation = options.versionNegotiation;
+                    }
                     // Create MCP client
-                    client = new _index.Client({
+                    client = new _client.Client({
                         name: 'mcp-cli-client',
                         version: '1.0.0'
-                    }, {
-                        capabilities: {}
-                    });
+                    }, clientOptions);
                     if (!(transportType === 'stdio')) return [
                         3,
                         5
@@ -376,10 +356,16 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                 case 7:
                     url = new URL(serverConfig.url);
                     // Check for DCR support and handle authentication automatically
-                    baseUrl = extractBaseUrl(serverConfig.url);
+                    // The canonical MCP server URI, path segment and all. Both calls below need
+                    // the server's identity, not its deployment root: discovery uses the path to
+                    // find resource-specific metadata (RFC 9728 sub-path), and the authenticator
+                    // audience-binds tokens to it (RFC 8707). Handing either the `/mcp`-stripped
+                    // base names a different resource, which authorization servers that validate
+                    // the `resource` indicator reject as `invalid_target`.
+                    mcpServerUrl = (0, _urlutilsts.normalizeUrl)(serverConfig.url);
                     return [
                         4,
-                        withTimeout((0, _indexts.probeAuthCapabilities)(baseUrl), _constantsts.DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery')
+                        withTimeout((0, _indexts.probeAuthCapabilities)(mcpServerUrl), _constantsts.DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery')
                     ];
                 case 8:
                     capabilities = _state.sent();
@@ -403,7 +389,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     }, options === null || options === void 0 ? void 0 : options.dcrAuthenticator));
                     return [
                         4,
-                        authenticator.ensureAuthenticated(baseUrl, capabilities)
+                        authenticator.ensureAuthenticated(mcpServerUrl, capabilities)
                     ];
                 case 10:
                     tokens = _state.sent();
@@ -435,7 +421,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                             headers: mergedHeaders
                         }
                     } : undefined;
-                    transport2 = new _streamableHttp.StreamableHTTPClientTransport(url, transportOptions);
+                    transport2 = new _client.StreamableHTTPClientTransport(url, transportOptions);
                     // Type assertion: SDK transport has sessionId: string | undefined but Transport expects string
                     // This is safe at runtime - the undefined is valid per MCP spec
                     return [
@@ -480,12 +466,10 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                         logger.warn('Streamable HTTP connection failed, trying SSE transport as fallback');
                     }
                     // Create new client for SSE transport (required per SDK pattern)
-                    sseClient = new _index.Client({
+                    sseClient = new _client.Client({
                         name: 'mcp-cli-client',
                         version: '1.0.0'
-                    }, {
-                        capabilities: {}
-                    });
+                    }, clientOptions);
                     // SSE transport with merged headers (static + DCR auth)
                     // Reuse the same header merging logic as Streamable HTTP
                     staticHeaders1 = serverConfig.headers || {};
@@ -498,7 +482,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                             headers: mergedHeaders1
                         }
                     } : undefined;
-                    sseTransport = new _sse.SSEClientTransport(url, sseTransportOptions);
+                    sseTransport = new _client.SSEClientTransport(url, sseTransportOptions);
                     _state.label = 17;
                 case 17:
                     _state.trys.push([

package/dist/cjs/connection/connect-client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/connection/connect-client.ts"],"sourcesContent":["/**\n * connect-mcp-client.ts\n *\n * Helper to connect MCP SDK clients to servers with intelligent transport inference.\n * Automatically detects transport type from URL protocol or type field.\n */\n\nimport '../monkey-patches.ts';\n\nimport { Client } from '@modelcontextprotocol/sdk/client/index.js';\nimport { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';\nimport { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';\nimport getPort from 'get-port';\nimport { probeAuthCapabilities } from '../auth/index.ts';\nimport { DCR_CAPABILTY_DISCOVERY_TIMEOUT } from '../constants.ts';\nimport { DcrAuthenticator, type DcrAuthenticatorOptions } from '../dcr/index.ts';\nimport type { ServerProcess } from '../spawn/spawn-server.ts';\nimport type { ServersConfig } from '../spawn/spawn-servers.ts';\n\n/**\n * Minimal interface for connecting to servers.\n * Only needs config and servers map for connection logic.\n */\ninterface RegistryLike {\n  config: ServersConfig;\n  servers: Map<string, ServerProcess>;\n}\n\nimport type { McpServerEntry, TransportType } from '../types.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { ExistingProcessTransport } from './existing-process-transport.ts';\nimport { waitForHttpReady } from './wait-for-http-ready.ts';\n\n/**\n * Wrap promise with timeout - throws if promise takes too long\n * Clears timeout when promise completes to prevent hanging event loop\n * @param promise - Promise to wrap\n * @param ms - Timeout in milliseconds\n * @param operation - Description of operation for error message\n * @returns Promise result or timeout error\n */\nasync function withTimeout<T>(promise: Promise<T>, ms: number, operation: string): Promise<T> {\n  let timeoutId: NodeJS.Timeout;\n\n  return Promise.race([\n    promise.finally(() => clearTimeout(timeoutId)),\n    new Promise<T>((_, reject) => {\n      timeoutId = setTimeout(() => reject(new Error(`Timeout after ${ms}ms: ${operation}`)), ms);\n    }),\n  ]);\n}\n\n/**\n * Extract the \"server base\" by removing a trailing `/mcp` path segment if present.\n * Examples:\n *  - https://example.com/mcp -> https://example.com\n *  - https://example.com/sheets/mcp -> https://example.com/sheets\n *  - https://example.com/sheets/mcp/ -> https://example.com/sheets\n *  - https://example.com/sheets -> https://example.com/sheets\n */\nexport function extractBaseUrl(mcpUrl: string): string {\n  const url = new URL(mcpUrl);\n\n  // Ignore query/hash for base URL purposes\n  url.search = '';\n  url.hash = '';\n\n  // Normalize path segments (removes empty segments from leading/trailing slashes)\n  const segments = url.pathname.split('/').filter(Boolean);\n\n  // If last segment is exactly \"mcp\", drop it\n  if (segments[segments.length - 1] === 'mcp') {\n    segments.pop();\n  }\n\n  // Rebuild pathname; empty means root\n  url.pathname = segments.length ? `/${segments.join('/')}` : '';\n\n  // Return without trailing slash (except root origin)\n  const out = url.origin + url.pathname;\n  return out === url.origin ? out : out.replace(/\\/+$/, '');\n}\n\n/**\n * Infer transport type from server configuration with validation.\n *\n * Priority:\n * 1. Explicit type field (if present)\n * 2. URL protocol (if URL present): http://, https://\n * 3. Default to 'stdio' (if neither present)\n *\n * @param config - Server configuration\n * @returns Transport type\n * @throws Error if configuration is invalid or has conflicts\n */\nfunction inferTransportType(config: McpServerEntry): TransportType {\n  // Priority 1: Explicit type field\n  if (config.type) {\n    // Validate consistency with URL if both present\n    if (config.url) {\n      const url = new URL(config.url);\n      const protocol = url.protocol;\n\n      if ((protocol === 'http:' || protocol === 'https:') && config.type !== 'http' && config.type !== 'sse-ide') {\n        throw new Error(`Conflicting transport: URL protocol '${protocol}' requires type 'http', but got '${config.type}'`);\n      }\n    }\n\n    // Return normalized type\n    if (config.type === 'http' || config.type === 'sse-ide') return 'http';\n    if (config.type === 'stdio') return 'stdio';\n\n    throw new Error(`Unsupported transport type: ${config.type}`);\n  }\n\n  // Priority 2: Infer from URL protocol\n  if (config.url) {\n    const url = new URL(config.url);\n    const protocol = url.protocol;\n\n    if (protocol === 'http:' || protocol === 'https:') {\n      return 'http';\n    }\n    throw new Error(`Unsupported URL protocol: ${protocol}`);\n  }\n\n  // Priority 3: Default to stdio\n  return 'stdio';\n}\n\n/**\n * Connect MCP SDK client to server with full readiness handling.\n * @internal - Use registry.connect() instead\n *\n * **Completely handles readiness**: transport availability + MCP protocol handshake.\n *\n * Transport is intelligently inferred and handled:\n * - **Stdio servers**: Direct MCP connect (fast for spawned processes)\n * - **HTTP servers**: Transport polling (/mcp endpoint) + MCP connect\n * - **Registry result**: Handles both spawned and external servers\n *\n * Returns only when server is fully MCP-ready (initialize handshake complete).\n *\n * @param registryOrConfig - Result from createServerRegistry() or servers config object\n * @param serverName - Server name from servers config\n * @returns Connected MCP SDK Client (guaranteed ready)\n *\n * @example\n * // Using registry (recommended)\n * const registry = createServerRegistry({ echo: { command: 'node', args: ['server.ts'] } });\n * const client = await registry.connect('echo');\n * // Server is fully ready - transport available + MCP handshake complete\n *\n * @example\n * // HTTP server readiness (waits for /mcp polling + MCP handshake)\n * const registry = createServerRegistry(\n *   { http: { type: 'http', url: 'http://localhost:3000/mcp', start: {...} } },\n *   { dialects: ['start'] }\n * );\n * const client = await registry.connect('http');\n * // 1. Waits for HTTP server to respond on /mcp\n * // 2. Performs MCP initialize handshake\n * // 3. Returns ready client\n */\nexport async function connectMcpClient(\n  registryOrConfig: RegistryLike | ServersConfig,\n  serverName: string,\n  options?: {\n    dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;\n    logger?: Logger;\n  }\n): Promise<Client> {\n  // Detect whether we have a RegistryLike instance or just config\n  const isRegistry = 'servers' in registryOrConfig && registryOrConfig.servers instanceof Map;\n  const serversConfig: ServersConfig = isRegistry ? (registryOrConfig as RegistryLike).config : (registryOrConfig as ServersConfig);\n  const registry = isRegistry ? (registryOrConfig as RegistryLike) : undefined;\n  const logger = options?.logger ?? defaultLogger;\n\n  const serverConfig = serversConfig[serverName];\n\n  if (!serverConfig) {\n    const available = Object.keys(serversConfig).join(', ');\n    throw new Error(`Server '${serverName}' not found in config. Available servers: ${available || 'none'}`);\n  }\n\n  // Infer transport type with validation\n  const transportType = inferTransportType(serverConfig);\n\n  // Create MCP client\n  const client = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, { capabilities: {} });\n\n  // Connect based on inferred transport\n  if (transportType === 'stdio') {\n    // Check if we have a spawned process in the registry\n    const serverHandle = registry?.servers.get(serverName);\n\n    if (serverHandle) {\n      // Reuse the already-spawned process\n      const transport = new ExistingProcessTransport(serverHandle.process);\n      await client.connect(transport);\n    } else {\n      // No registry or server not in registry - spawn new process directly\n      // This is the standard fallback when process management is not used\n      if (!serverConfig.command) {\n        throw new Error(`Server '${serverName}' has stdio transport but missing 'command' field`);\n      }\n\n      const transport = new StdioClientTransport({\n        command: serverConfig.command,\n        args: serverConfig.args || [],\n        env: serverConfig.env || {},\n      });\n\n      // client.connect() performs initialize handshake - when it resolves, server is ready\n      await client.connect(transport);\n    }\n  } else if (transportType === 'http') {\n    if (!('url' in serverConfig) || !serverConfig.url) {\n      throw new Error(`Server '${serverName}' has http transport but missing 'url' field`);\n    }\n\n    // Check if this is a freshly spawned HTTP server (from registry)\n    // that might not be ready yet - transport readiness check needed\n    const isSpawnedHttp = registry?.servers.has(serverName);\n\n    if (isSpawnedHttp) {\n      logger.debug(`[connectMcpClient] waiting for HTTP server '${serverName}' at ${serverConfig.url}`);\n      await waitForHttpReady(serverConfig.url);\n      logger.debug(`[connectMcpClient] HTTP server '${serverName}' ready`);\n    }\n\n    const url = new URL(serverConfig.url);\n\n    // Check for DCR support and handle authentication automatically\n    const baseUrl = extractBaseUrl(serverConfig.url);\n    const capabilities = await withTimeout(probeAuthCapabilities(baseUrl), DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery');\n\n    let authToken: string | undefined;\n\n    if (capabilities.supportsDcr) {\n      logger.debug(`🔐 Server '${serverName}' supports DCR authentication`);\n\n      // Get available port and create the exact redirect URI to use\n      const port = await getPort();\n      const redirectUri = `http://localhost:${port}/callback`;\n\n      // Handle authentication using DcrAuthenticator with fully resolved redirectUri\n      const authenticator = new DcrAuthenticator({\n        headless: false,\n        redirectUri,\n        logger,\n        ...options?.dcrAuthenticator,\n      });\n\n      // Ensure we have valid tokens (performs DCR + OAuth if needed)\n      const tokens = await authenticator.ensureAuthenticated(baseUrl, capabilities);\n      authToken = tokens.accessToken;\n\n      logger.debug(`✅ Authentication complete for '${serverName}'`);\n    } else {\n      logger.debug(`ℹ️  Server '${serverName}' does not support DCR - connecting without authentication`);\n    }\n\n    try {\n      // Try modern Streamable HTTP first (protocol version 2025-03-26)\n      // Merge static headers from config with DCR auth headers (DCR Authorization takes precedence)\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const transportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const transport = new StreamableHTTPClientTransport(url, transportOptions);\n      // Type assertion: SDK transport has sessionId: string | undefined but Transport expects string\n      // This is safe at runtime - the undefined is valid per MCP spec\n      await withTimeout(client.connect(transport as unknown as Transport), 30000, 'StreamableHTTP connection');\n    } catch (error) {\n      // Fall back to SSE transport (MCP protocol version 2024-11-05)\n      // SSE is a standard MCP transport used by many servers (e.g., FastMCP ecosystem)\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      // Fast-fail: Don't try SSE if connection was refused (server not running)\n      // Check error.cause.code for ECONNREFUSED (fetch errors wrap the actual error in cause)\n      const cause = error instanceof Error ? (error as Error & { cause?: { code?: string } }).cause : undefined;\n      const isConnectionRefused = cause?.code === 'ECONNREFUSED' || errorMessage.includes('Connection refused');\n\n      if (isConnectionRefused) {\n        // Clean up client resources before throwing\n        await client.close().catch(() => {});\n        throw new Error(`Server not running at ${url}`);\n      }\n\n      // Check for known errors that indicate SSE fallback is needed\n      const shouldFallback =\n        errorMessage.includes('Missing session ID') || // FastMCP specific\n        errorMessage.includes('404') || // Server doesn't have streamable HTTP endpoint\n        errorMessage.includes('405'); // Method not allowed\n\n      if (shouldFallback) {\n        logger.warn(`Streamable HTTP failed (${errorMessage}), falling back to SSE transport`);\n      } else {\n        logger.warn('Streamable HTTP connection failed, trying SSE transport as fallback');\n      }\n\n      // Create new client for SSE transport (required per SDK pattern)\n      const sseClient = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, { capabilities: {} });\n\n      // SSE transport with merged headers (static + DCR auth)\n      // Reuse the same header merging logic as Streamable HTTP\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const sseTransportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const sseTransport = new SSEClientTransport(url, sseTransportOptions);\n\n      try {\n        await withTimeout(sseClient.connect(sseTransport), 30000, 'SSE connection');\n        // Return SSE client instead of original\n        return sseClient;\n      } catch (sseError) {\n        // SSE connection failed - clean up both clients before throwing\n        await Promise.all([client.close().catch(() => {}), sseClient.close().catch(() => {})]);\n        throw sseError;\n      }\n    }\n  }\n\n  return client; // Guaranteed ready when returned\n}\n"],"names":["connectMcpClient","extractBaseUrl","withTimeout","promise","ms","operation","timeoutId","Promise","race","finally","clearTimeout","_","reject","setTimeout","Error","mcpUrl","url","URL","search","hash","segments","pathname","split","filter","Boolean","length","pop","join","out","origin","replace","inferTransportType","config","type","protocol","registryOrConfig","serverName","options","isRegistry","serversConfig","registry","logger","serverConfig","available","transportType","client","serverHandle","transport","isSpawnedHttp","baseUrl","capabilities","authToken","port","redirectUri","authenticator","tokens","staticHeaders","dcrHeaders","mergedHeaders","transportOptions","error","errorMessage","cause","isConnectionRefused","shouldFallback","sseClient","sseTransportOptions","sseTransport","sseError","servers","Map","undefined","defaultLogger","Object","keys","Client","name","version","get","ExistingProcessTransport","process","connect","command","StdioClientTransport","args","env","has","debug","waitForHttpReady","probeAuthCapabilities","DCR_CAPABILTY_DISCOVERY_TIMEOUT","supportsDcr","getPort","DcrAuthenticator","headless","dcrAuthenticator","ensureAuthenticated","accessToken","headers","Authorization","requestInit","StreamableHTTPClientTransport","message","String","code","includes","close","catch","warn","SSEClientTransport","all"],"mappings":"AAAA;;;;;CAKC;;;;;;;;;;;QAiKqBA;eAAAA;;QAxGNC;eAAAA;;;QAvDT;qBAEgB;mBACY;qBACE;8BACS;8DAE1B;uBACkB;2BACU;wBACe;wBAcV;0CACZ;kCACR;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjC;;;;;;;CAOC,GACD,SAAeC,YAAeC,OAAmB,EAAEC,EAAU,EAAEC,SAAiB;;YAC1EC;;YAEJ;;gBAAOC,QAAQC,IAAI;oBACjBL,QAAQM,OAAO,CAAC;+BAAMC,aAAaJ;;oBACnC,IAAIC,QAAW,SAACI,GAAGC;wBACjBN,YAAYO,WAAW;mCAAMD,OAAO,IAAIE,MAAM,AAAC,iBAAyBT,OAATD,IAAG,QAAgB,OAAVC;2BAAeD;oBACzF;;;;IAEJ;;AAUO,SAASH,eAAec,MAAc;IAC3C,IAAMC,MAAM,IAAIC,IAAIF;IAEpB,0CAA0C;IAC1CC,IAAIE,MAAM,GAAG;IACbF,IAAIG,IAAI,GAAG;IAEX,iFAAiF;IACjF,IAAMC,WAAWJ,IAAIK,QAAQ,CAACC,KAAK,CAAC,KAAKC,MAAM,CAACC;IAEhD,4CAA4C;IAC5C,IAAIJ,QAAQ,CAACA,SAASK,MAAM,GAAG,EAAE,KAAK,OAAO;QAC3CL,SAASM,GAAG;IACd;IAEA,qCAAqC;IACrCV,IAAIK,QAAQ,GAAGD,SAASK,MAAM,GAAG,AAAC,IAAsB,OAAnBL,SAASO,IAAI,CAAC,QAAS;IAE5D,qDAAqD;IACrD,IAAMC,MAAMZ,IAAIa,MAAM,GAAGb,IAAIK,QAAQ;IACrC,OAAOO,QAAQZ,IAAIa,MAAM,GAAGD,MAAMA,IAAIE,OAAO,CAAC,QAAQ;AACxD;AAEA;;;;;;;;;;;CAWC,GACD,SAASC,mBAAmBC,MAAsB;IAChD,kCAAkC;IAClC,IAAIA,OAAOC,IAAI,EAAE;QACf,gDAAgD;QAChD,IAAID,OAAOhB,GAAG,EAAE;YACd,IAAMA,MAAM,IAAIC,IAAIe,OAAOhB,GAAG;YAC9B,IAAMkB,WAAWlB,IAAIkB,QAAQ;YAE7B,IAAI,AAACA,CAAAA,aAAa,WAAWA,aAAa,QAAO,KAAMF,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW;gBAC1G,MAAM,IAAInB,MAAM,AAAC,wCAAmFkB,OAA5CE,UAAS,qCAA+C,OAAZF,OAAOC,IAAI,EAAC;YAClH;QACF;QAEA,yBAAyB;QACzB,IAAID,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW,OAAO;QAChE,IAAID,OAAOC,IAAI,KAAK,SAAS,OAAO;QAEpC,MAAM,IAAInB,MAAM,AAAC,+BAA0C,OAAZkB,OAAOC,IAAI;IAC5D;IAEA,sCAAsC;IACtC,IAAID,OAAOhB,GAAG,EAAE;QACd,IAAMA,OAAM,IAAIC,IAAIe,OAAOhB,GAAG;QAC9B,IAAMkB,YAAWlB,KAAIkB,QAAQ;QAE7B,IAAIA,cAAa,WAAWA,cAAa,UAAU;YACjD,OAAO;QACT;QACA,MAAM,IAAIpB,MAAM,AAAC,6BAAqC,OAAToB;IAC/C;IAEA,+BAA+B;IAC/B,OAAO;AACT;AAoCO,SAAelC,iBACpBmC,gBAA8C,EAC9CC,UAAkB,EAClBC,OAGC;;kBAGKC,YACAC,eACAC,UACAC,QAEAC,cAGEC,WAKFC,eAGAC,QAKEC,cAIEC,WASAA,YAgBFC,eAQAhC,KAGAiC,SACAC,cAEFC,WAMIC,MACAC,aAGAC,eAQAC,QAWAC,eACAC,YACAC,eAEAC,kBASAZ,YAICa,OAGDC,cAIAC,OACAC,qBASAC,gBAYAC,WAIAT,gBACAC,aACAC,gBAEAQ,qBASAC,cAMGC;;;;oBAnKb,gEAAgE;oBAC1D9B,aAAa,aAAaH,oBAAoBA,AAAwB,YAAxBA,iBAAiBkC,OAAO,EAAYC;oBAClF/B,gBAA+BD,aAAa,AAACH,iBAAkCH,MAAM,GAAIG;oBACzFK,WAAWF,aAAcH,mBAAoCoC;oBAC7D9B,iBAASJ,oBAAAA,8BAAAA,QAASI,MAAM,uCAAI+B,gBAAa;oBAEzC9B,eAAeH,aAAa,CAACH,WAAW;oBAE9C,IAAI,CAACM,cAAc;wBACXC,YAAY8B,OAAOC,IAAI,CAACnC,eAAeZ,IAAI,CAAC;wBAClD,MAAM,IAAIb,MAAM,AAAC,WAAiE6B,OAAvDP,YAAW,8CAAgE,OAApBO,aAAa;oBACjG;oBAEA,uCAAuC;oBACjCC,gBAAgBb,mBAAmBW;oBAEzC,oBAAoB;oBACdG,SAAS,IAAI8B,aAAM,CAAC;wBAAEC,MAAM;wBAAkBC,SAAS;oBAAQ,GAAG;wBAAE3B,cAAc,CAAC;oBAAE;yBAGvFN,CAAAA,kBAAkB,OAAM,GAAxBA;;;;oBACF,qDAAqD;oBAC/CE,eAAeN,qBAAAA,+BAAAA,SAAU6B,OAAO,CAACS,GAAG,CAAC1C;yBAEvCU,cAAAA;;;;oBACF,oCAAoC;oBAC9BC,YAAY,IAAIgC,oDAAwB,CAACjC,aAAakC,OAAO;oBACnE;;wBAAMnC,OAAOoC,OAAO,CAAClC;;;oBAArB;;;;;;oBAEA,qEAAqE;oBACrE,oEAAoE;oBACpE,IAAI,CAACL,aAAawC,OAAO,EAAE;wBACzB,MAAM,IAAIpE,MAAM,AAAC,WAAqB,OAAXsB,YAAW;oBACxC;oBAEMW,aAAY,IAAIoC,2BAAoB,CAAC;wBACzCD,SAASxC,aAAawC,OAAO;wBAC7BE,MAAM1C,aAAa0C,IAAI;wBACvBC,KAAK3C,aAAa2C,GAAG,IAAI,CAAC;oBAC5B;oBAEA,qFAAqF;oBACrF;;wBAAMxC,OAAOoC,OAAO,CAAClC;;;oBAArB;;;;;;;;yBAEOH,CAAAA,kBAAkB,MAAK,GAAvBA;;;;oBACT,IAAI,CAAE,CAAA,SAASF,YAAW,KAAM,CAACA,aAAa1B,GAAG,EAAE;wBACjD,MAAM,IAAIF,MAAM,AAAC,WAAqB,OAAXsB,YAAW;oBACxC;oBAEA,iEAAiE;oBACjE,iEAAiE;oBAC3DY,gBAAgBR,qBAAAA,+BAAAA,SAAU6B,OAAO,CAACiB,GAAG,CAAClD;yBAExCY,eAAAA;;;;oBACFP,OAAO8C,KAAK,CAAC,AAAC,+CAAgE7C,OAAlBN,YAAW,SAAwB,OAAjBM,aAAa1B,GAAG;oBAC9F;;wBAAMwE,IAAAA,oCAAgB,EAAC9C,aAAa1B,GAAG;;;oBAAvC;oBACAyB,OAAO8C,KAAK,CAAC,AAAC,mCAA6C,OAAXnD,YAAW;;;oBAGvDpB,MAAM,IAAIC,IAAIyB,aAAa1B,GAAG;oBAEpC,gEAAgE;oBAC1DiC,UAAUhD,eAAeyC,aAAa1B,GAAG;oBAC1B;;wBAAMd,YAAYuF,IAAAA,8BAAqB,EAACxC,UAAUyC,4CAA+B,EAAE;;;oBAAlGxC,eAAe;yBAIjBA,aAAayC,WAAW,EAAxBzC;;;;oBACFT,OAAO8C,KAAK,CAAC,AAAC,wBAAwB,OAAXnD,YAAW;oBAGzB;;wBAAMwD,IAAAA,gBAAO;;;oBAApBxC,OAAO;oBACPC,cAAc,AAAC,oBAAwB,OAALD,MAAK;oBAE7C,+EAA+E;oBACzEE,gBAAgB,IAAIuC,0BAAgB,CAAC;wBACzCC,UAAU;wBACVzC,aAAAA;wBACAZ,QAAAA;uBACGJ,oBAAAA,8BAAAA,QAAS0D,gBAAgB;oBAIf;;wBAAMzC,cAAc0C,mBAAmB,CAAC/C,SAASC;;;oBAA1DK,SAAS;oBACfJ,YAAYI,OAAO0C,WAAW;oBAE9BxD,OAAO8C,KAAK,CAAC,AAAC,kCAA4C,OAAXnD,YAAW;;;;;;oBAE1DK,OAAO8C,KAAK,CAAC,AAAC,eAAyB,OAAXnD,YAAW;;;;;;;;;oBAIvC,iEAAiE;oBACjE,8FAA8F;oBACxFoB,gBAAgBd,aAAawD,OAAO,IAAI,CAAC;oBACzCzC,aAAaN,YAAY;wBAAEgD,eAAe,AAAC,UAAmB,OAAVhD;oBAAY,IAAI,CAAC;oBACrEO,gBAAgB,mBAAKF,eAAkBC;oBAEvCE,mBACJc,OAAOC,IAAI,CAAChB,eAAejC,MAAM,GAAG,IAChC;wBACE2E,aAAa;4BACXF,SAASxC;wBACX;oBACF,IACAa;oBAEAxB,aAAY,IAAIsD,6CAA6B,CAACrF,KAAK2C;oBACzD,+FAA+F;oBAC/F,gEAAgE;oBAChE;;wBAAMzD,YAAY2C,OAAOoC,OAAO,CAAClC,aAAoC,OAAO;;;oBAA5E;;;;;;oBACOa;oBACP,+DAA+D;oBAC/D,iFAAiF;oBAC3EC,eAAeD,AAAK,YAALA,OAAiB9C,SAAQ8C,MAAM0C,OAAO,GAAGC,OAAO3C;oBAErE,0EAA0E;oBAC1E,wFAAwF;oBAClFE,QAAQF,AAAK,YAALA,OAAiB9C,SAAQ,AAAC8C,MAAgDE,KAAK,GAAGS;oBAC1FR,sBAAsBD,CAAAA,kBAAAA,4BAAAA,MAAO0C,IAAI,MAAK,kBAAkB3C,aAAa4C,QAAQ,CAAC;yBAEhF1C,qBAAAA;;;;oBACF,4CAA4C;oBAC5C;;wBAAMlB,OAAO6D,KAAK,GAAGC,KAAK,CAAC,YAAO;;;oBAAlC;oBACA,MAAM,IAAI7F,MAAM,AAAC,yBAA4B,OAAJE;;oBAG3C,8DAA8D;oBACxDgD,iBACJH,aAAa4C,QAAQ,CAAC,yBAAyB,mBAAmB;oBAClE5C,aAAa4C,QAAQ,CAAC,UAAU,+CAA+C;oBAC/E5C,aAAa4C,QAAQ,CAAC,QAAQ,qBAAqB;oBAErD,IAAIzC,gBAAgB;wBAClBvB,OAAOmE,IAAI,CAAC,AAAC,2BAAuC,OAAb/C,cAAa;oBACtD,OAAO;wBACLpB,OAAOmE,IAAI,CAAC;oBACd;oBAEA,iEAAiE;oBAC3D3C,YAAY,IAAIU,aAAM,CAAC;wBAAEC,MAAM;wBAAkBC,SAAS;oBAAQ,GAAG;wBAAE3B,cAAc,CAAC;oBAAE;oBAE9F,wDAAwD;oBACxD,yDAAyD;oBACnDM,iBAAgBd,aAAawD,OAAO,IAAI,CAAC;oBACzCzC,cAAaN,YAAY;wBAAEgD,eAAe,AAAC,UAAmB,OAAVhD;oBAAY,IAAI,CAAC;oBACrEO,iBAAgB,mBAAKF,gBAAkBC;oBAEvCS,sBACJO,OAAOC,IAAI,CAAChB,gBAAejC,MAAM,GAAG,IAChC;wBACE2E,aAAa;4BACXF,SAASxC;wBACX;oBACF,IACAa;oBAEAJ,eAAe,IAAI0C,uBAAkB,CAAC7F,KAAKkD;;;;;;;;;oBAG/C;;wBAAMhE,YAAY+D,UAAUgB,OAAO,CAACd,eAAe,OAAO;;;oBAA1D;oBACA,wCAAwC;oBACxC;;wBAAOF;;;oBACAG;oBACP,gEAAgE;oBAChE;;wBAAM7D,QAAQuG,GAAG;4BAAEjE,OAAO6D,KAAK,GAAGC,KAAK,CAAC,YAAO;4BAAI1C,UAAUyC,KAAK,GAAGC,KAAK,CAAC,YAAO;;;;oBAAlF;oBACA,MAAMvC;;;;;;;oBAKZ;;wBAAOvB;uBAAQ,iCAAiC;;;IAClD"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/connection/connect-client.ts"],"sourcesContent":["/**\n * connect-mcp-client.ts\n *\n * Helper to connect MCP SDK clients to servers with intelligent transport inference.\n * Automatically detects transport type from URL protocol or type field.\n */\n\nimport type { ClientOptions, Transport, VersionNegotiationOptions } from '@modelcontextprotocol/client';\nimport { Client, SSEClientTransport, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';\nimport { StdioClientTransport } from '@modelcontextprotocol/client/stdio';\nimport getPort from 'get-port';\nimport { probeAuthCapabilities } from '../auth/index.ts';\nimport { DCR_CAPABILTY_DISCOVERY_TIMEOUT } from '../constants.ts';\nimport { DcrAuthenticator, type DcrAuthenticatorOptions } from '../dcr/index.ts';\nimport { normalizeUrl } from '../lib/url-utils.ts';\nimport type { ServerProcess } from '../spawn/spawn-server.ts';\nimport type { ServersConfig } from '../spawn/spawn-servers.ts';\n\n/**\n * Minimal interface for connecting to servers.\n * Only needs config and servers map for connection logic.\n */\ninterface RegistryLike {\n  config: ServersConfig;\n  servers: Map<string, ServerProcess>;\n}\n\nimport type { McpServerEntry, TransportType } from '../types.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { ExistingProcessTransport } from './existing-process-transport.ts';\nimport { waitForHttpReady } from './wait-for-http-ready.ts';\n\n/**\n * Wrap promise with timeout - throws if promise takes too long\n * Clears timeout when promise completes to prevent hanging event loop\n * @param promise - Promise to wrap\n * @param ms - Timeout in milliseconds\n * @param operation - Description of operation for error message\n * @returns Promise result or timeout error\n */\nasync function withTimeout<T>(promise: Promise<T>, ms: number, operation: string): Promise<T> {\n  let timeoutId: NodeJS.Timeout;\n\n  return Promise.race([\n    promise.finally(() => clearTimeout(timeoutId)),\n    new Promise<T>((_, reject) => {\n      timeoutId = setTimeout(() => reject(new Error(`Timeout after ${ms}ms: ${operation}`)), ms);\n    }),\n  ]);\n}\n\n/**\n * Infer transport type from server configuration with validation.\n *\n * Priority:\n * 1. Explicit type field (if present)\n * 2. URL protocol (if URL present): http://, https://\n * 3. Default to 'stdio' (if neither present)\n *\n * @param config - Server configuration\n * @returns Transport type\n * @throws Error if configuration is invalid or has conflicts\n */\nfunction inferTransportType(config: McpServerEntry): TransportType {\n  // Priority 1: Explicit type field\n  if (config.type) {\n    // Validate consistency with URL if both present\n    if (config.url) {\n      const url = new URL(config.url);\n      const protocol = url.protocol;\n\n      if ((protocol === 'http:' || protocol === 'https:') && config.type !== 'http' && config.type !== 'sse-ide') {\n        throw new Error(`Conflicting transport: URL protocol '${protocol}' requires type 'http', but got '${config.type}'`);\n      }\n    }\n\n    // Return normalized type\n    if (config.type === 'http' || config.type === 'sse-ide') return 'http';\n    if (config.type === 'stdio') return 'stdio';\n\n    throw new Error(`Unsupported transport type: ${config.type}`);\n  }\n\n  // Priority 2: Infer from URL protocol\n  if (config.url) {\n    const url = new URL(config.url);\n    const protocol = url.protocol;\n\n    if (protocol === 'http:' || protocol === 'https:') {\n      return 'http';\n    }\n    throw new Error(`Unsupported URL protocol: ${protocol}`);\n  }\n\n  // Priority 3: Default to stdio\n  return 'stdio';\n}\n\n/**\n * Connect MCP SDK client to server with full readiness handling.\n * @internal - Use registry.connect() instead\n *\n * **Completely handles readiness**: transport availability + MCP protocol handshake.\n *\n * Transport is intelligently inferred and handled:\n * - **Stdio servers**: Direct MCP connect (fast for spawned processes)\n * - **HTTP servers**: Transport polling (/mcp endpoint) + MCP connect\n * - **Registry result**: Handles both spawned and external servers\n *\n * Returns only when server is fully MCP-ready (initialize handshake complete).\n *\n * @param registryOrConfig - Result from createServerRegistry() or servers config object\n * @param serverName - Server name from servers config\n * @param options - Connection options (see below)\n * @param options.dcrAuthenticator - DCR authenticator options\n * @param options.logger - Logger for connection diagnostics\n * @param options.versionNegotiation - SDK protocol version negotiation (protocol revision\n *   2026-07-28 and later). Omitted by default, which keeps the SDK's `'legacy'` mode:\n *   the plain 2025 connect sequence. Pass `{ mode: 'auto' }` to probe the server and\n *   fall back to 2025 when it cannot serve the modern era, or `{ mode: { pin: '2026-07-28' } }`\n *   to require the pinned revision (a server that cannot serve it fails the connect with\n *   a typed era-negotiation error).\n * @returns Connected MCP SDK Client (guaranteed ready)\n *\n * @example\n * // Using registry (recommended)\n * const registry = createServerRegistry({ echo: { command: 'node', args: ['server.ts'] } });\n * const client = await registry.connect('echo');\n * // Server is fully ready - transport available + MCP handshake complete\n *\n * @example\n * // HTTP server readiness (waits for /mcp polling + MCP handshake)\n * const registry = createServerRegistry(\n *   { http: { type: 'http', url: 'http://localhost:3000/mcp', start: {...} } },\n *   { dialects: ['start'] }\n * );\n * const client = await registry.connect('http');\n * // 1. Waits for HTTP server to respond on /mcp\n * // 2. Performs MCP initialize handshake\n * // 3. Returns ready client\n */\nexport async function connectMcpClient(\n  registryOrConfig: RegistryLike | ServersConfig,\n  serverName: string,\n  options?: {\n    dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;\n    logger?: Logger;\n    versionNegotiation?: VersionNegotiationOptions;\n  }\n): Promise<Client> {\n  // Detect whether we have a RegistryLike instance or just config\n  const isRegistry = 'servers' in registryOrConfig && registryOrConfig.servers instanceof Map;\n  const serversConfig: ServersConfig = isRegistry ? (registryOrConfig as RegistryLike).config : (registryOrConfig as ServersConfig);\n  const registry = isRegistry ? (registryOrConfig as RegistryLike) : undefined;\n  const logger = options?.logger ?? defaultLogger;\n\n  const serverConfig = serversConfig[serverName];\n\n  if (!serverConfig) {\n    const available = Object.keys(serversConfig).join(', ');\n    throw new Error(`Server '${serverName}' not found in config. Available servers: ${available || 'none'}`);\n  }\n\n  // Infer transport type with validation\n  const transportType = inferTransportType(serverConfig);\n\n  // SDK client options for both transports (main + SSE fallback). versionNegotiation is\n  // omitted rather than set to undefined so the default stays the SDK's 'legacy' mode —\n  // the plain 2025 connect sequence — for callers that do not pass it.\n  const clientOptions: ClientOptions = { capabilities: {} };\n  if (options?.versionNegotiation !== undefined) {\n    clientOptions.versionNegotiation = options.versionNegotiation;\n  }\n\n  // Create MCP client\n  const client = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, clientOptions);\n\n  // Connect based on inferred transport\n  if (transportType === 'stdio') {\n    // Check if we have a spawned process in the registry\n    const serverHandle = registry?.servers.get(serverName);\n\n    if (serverHandle) {\n      // Reuse the already-spawned process\n      const transport = new ExistingProcessTransport(serverHandle.process);\n      await client.connect(transport);\n    } else {\n      // No registry or server not in registry - spawn new process directly\n      // This is the standard fallback when process management is not used\n      if (!serverConfig.command) {\n        throw new Error(`Server '${serverName}' has stdio transport but missing 'command' field`);\n      }\n\n      const transport = new StdioClientTransport({\n        command: serverConfig.command,\n        args: serverConfig.args || [],\n        env: serverConfig.env || {},\n      });\n\n      // client.connect() performs initialize handshake - when it resolves, server is ready\n      await client.connect(transport);\n    }\n  } else if (transportType === 'http') {\n    if (!('url' in serverConfig) || !serverConfig.url) {\n      throw new Error(`Server '${serverName}' has http transport but missing 'url' field`);\n    }\n\n    // Check if this is a freshly spawned HTTP server (from registry)\n    // that might not be ready yet - transport readiness check needed\n    const isSpawnedHttp = registry?.servers.has(serverName);\n\n    if (isSpawnedHttp) {\n      logger.debug(`[connectMcpClient] waiting for HTTP server '${serverName}' at ${serverConfig.url}`);\n      await waitForHttpReady(serverConfig.url);\n      logger.debug(`[connectMcpClient] HTTP server '${serverName}' ready`);\n    }\n\n    const url = new URL(serverConfig.url);\n\n    // Check for DCR support and handle authentication automatically\n    // The canonical MCP server URI, path segment and all. Both calls below need\n    // the server's identity, not its deployment root: discovery uses the path to\n    // find resource-specific metadata (RFC 9728 sub-path), and the authenticator\n    // audience-binds tokens to it (RFC 8707). Handing either the `/mcp`-stripped\n    // base names a different resource, which authorization servers that validate\n    // the `resource` indicator reject as `invalid_target`.\n    const mcpServerUrl = normalizeUrl(serverConfig.url);\n    const capabilities = await withTimeout(probeAuthCapabilities(mcpServerUrl), DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery');\n\n    let authToken: string | undefined;\n\n    if (capabilities.supportsDcr) {\n      logger.debug(`🔐 Server '${serverName}' supports DCR authentication`);\n\n      // Get available port and create the exact redirect URI to use\n      const port = await getPort();\n      const redirectUri = `http://localhost:${port}/callback`;\n\n      // Handle authentication using DcrAuthenticator with fully resolved redirectUri\n      const authenticator = new DcrAuthenticator({\n        headless: false,\n        redirectUri,\n        logger,\n        ...options?.dcrAuthenticator,\n      });\n\n      // Ensure we have valid tokens (performs DCR + OAuth if needed)\n      const tokens = await authenticator.ensureAuthenticated(mcpServerUrl, capabilities);\n      authToken = tokens.accessToken;\n\n      logger.debug(`✅ Authentication complete for '${serverName}'`);\n    } else {\n      logger.debug(`ℹ️  Server '${serverName}' does not support DCR - connecting without authentication`);\n    }\n\n    try {\n      // Try modern Streamable HTTP first (protocol version 2025-03-26)\n      // Merge static headers from config with DCR auth headers (DCR Authorization takes precedence)\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const transportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const transport = new StreamableHTTPClientTransport(url, transportOptions);\n      // Type assertion: SDK transport has sessionId: string | undefined but Transport expects string\n      // This is safe at runtime - the undefined is valid per MCP spec\n      await withTimeout(client.connect(transport as unknown as Transport), 30000, 'StreamableHTTP connection');\n    } catch (error) {\n      // Fall back to SSE transport (MCP protocol version 2024-11-05)\n      // SSE is a standard MCP transport used by many servers (e.g., FastMCP ecosystem)\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      // Fast-fail: Don't try SSE if connection was refused (server not running)\n      // Check error.cause.code for ECONNREFUSED (fetch errors wrap the actual error in cause)\n      const cause = error instanceof Error ? (error as Error & { cause?: { code?: string } }).cause : undefined;\n      const isConnectionRefused = cause?.code === 'ECONNREFUSED' || errorMessage.includes('Connection refused');\n\n      if (isConnectionRefused) {\n        // Clean up client resources before throwing\n        await client.close().catch(() => {});\n        throw new Error(`Server not running at ${url}`);\n      }\n\n      // Check for known errors that indicate SSE fallback is needed\n      const shouldFallback =\n        errorMessage.includes('Missing session ID') || // FastMCP specific\n        errorMessage.includes('404') || // Server doesn't have streamable HTTP endpoint\n        errorMessage.includes('405'); // Method not allowed\n\n      if (shouldFallback) {\n        logger.warn(`Streamable HTTP failed (${errorMessage}), falling back to SSE transport`);\n      } else {\n        logger.warn('Streamable HTTP connection failed, trying SSE transport as fallback');\n      }\n\n      // Create new client for SSE transport (required per SDK pattern)\n      const sseClient = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, clientOptions);\n\n      // SSE transport with merged headers (static + DCR auth)\n      // Reuse the same header merging logic as Streamable HTTP\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const sseTransportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const sseTransport = new SSEClientTransport(url, sseTransportOptions);\n\n      try {\n        await withTimeout(sseClient.connect(sseTransport), 30000, 'SSE connection');\n        // Return SSE client instead of original\n        return sseClient;\n      } catch (sseError) {\n        // SSE connection failed - clean up both clients before throwing\n        await Promise.all([client.close().catch(() => {}), sseClient.close().catch(() => {})]);\n        throw sseError;\n      }\n    }\n  }\n\n  return client; // Guaranteed ready when returned\n}\n"],"names":["connectMcpClient","withTimeout","promise","ms","operation","timeoutId","Promise","race","finally","clearTimeout","_","reject","setTimeout","Error","inferTransportType","config","type","url","URL","protocol","registryOrConfig","serverName","options","isRegistry","serversConfig","registry","logger","serverConfig","available","transportType","clientOptions","client","serverHandle","transport","isSpawnedHttp","mcpServerUrl","capabilities","authToken","port","redirectUri","authenticator","tokens","staticHeaders","dcrHeaders","mergedHeaders","transportOptions","error","errorMessage","cause","isConnectionRefused","shouldFallback","sseClient","sseTransportOptions","sseTransport","sseError","servers","Map","undefined","defaultLogger","Object","keys","join","versionNegotiation","Client","name","version","get","ExistingProcessTransport","process","connect","command","StdioClientTransport","args","env","has","debug","waitForHttpReady","normalizeUrl","probeAuthCapabilities","DCR_CAPABILTY_DISCOVERY_TIMEOUT","supportsDcr","getPort","DcrAuthenticator","headless","dcrAuthenticator","ensureAuthenticated","accessToken","headers","Authorization","length","requestInit","StreamableHTTPClientTransport","message","String","code","includes","close","catch","warn","SSEClientTransport","all"],"mappings":"AAAA;;;;;CAKC;;;;+BAwIqBA;;;eAAAA;;;sBArIoD;qBACrC;8DACjB;uBACkB;2BACU;wBACe;0BAClC;wBAcwB;0CACZ;kCACR;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjC;;;;;;;CAOC,GACD,SAAeC,YAAeC,OAAmB,EAAEC,EAAU,EAAEC,SAAiB;;YAC1EC;;YAEJ;;gBAAOC,QAAQC,IAAI;oBACjBL,QAAQM,OAAO,CAAC;+BAAMC,aAAaJ;;oBACnC,IAAIC,QAAW,SAACI,GAAGC;wBACjBN,YAAYO,WAAW;mCAAMD,OAAO,IAAIE,MAAM,AAAC,iBAAyBT,OAATD,IAAG,QAAgB,OAAVC;2BAAeD;oBACzF;;;;IAEJ;;AAEA;;;;;;;;;;;CAWC,GACD,SAASW,mBAAmBC,MAAsB;IAChD,kCAAkC;IAClC,IAAIA,OAAOC,IAAI,EAAE;QACf,gDAAgD;QAChD,IAAID,OAAOE,GAAG,EAAE;YACd,IAAMA,MAAM,IAAIC,IAAIH,OAAOE,GAAG;YAC9B,IAAME,WAAWF,IAAIE,QAAQ;YAE7B,IAAI,AAACA,CAAAA,aAAa,WAAWA,aAAa,QAAO,KAAMJ,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW;gBAC1G,MAAM,IAAIH,MAAM,AAAC,wCAAmFE,OAA5CI,UAAS,qCAA+C,OAAZJ,OAAOC,IAAI,EAAC;YAClH;QACF;QAEA,yBAAyB;QACzB,IAAID,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW,OAAO;QAChE,IAAID,OAAOC,IAAI,KAAK,SAAS,OAAO;QAEpC,MAAM,IAAIH,MAAM,AAAC,+BAA0C,OAAZE,OAAOC,IAAI;IAC5D;IAEA,sCAAsC;IACtC,IAAID,OAAOE,GAAG,EAAE;QACd,IAAMA,OAAM,IAAIC,IAAIH,OAAOE,GAAG;QAC9B,IAAME,YAAWF,KAAIE,QAAQ;QAE7B,IAAIA,cAAa,WAAWA,cAAa,UAAU;YACjD,OAAO;QACT;QACA,MAAM,IAAIN,MAAM,AAAC,6BAAqC,OAATM;IAC/C;IAEA,+BAA+B;IAC/B,OAAO;AACT;AA6CO,SAAenB,iBACpBoB,gBAA8C,EAC9CC,UAAkB,EAClBC,OAIC;;kBAGKC,YACAC,eACAC,UACAC,QAEAC,cAGEC,WAKFC,eAKAC,eAMAC,QAKEC,cAIEC,WASAA,YAgBFC,eAQAjB,KASAkB,cACAC,cAEFC,WAMIC,MACAC,aAGAC,eAQAC,QAWAC,eACAC,YACAC,eAEAC,kBASAZ,YAICa,OAGDC,cAIAC,OACAC,qBASAC,gBAYAC,WAIAT,gBACAC,aACAC,gBAEAQ,qBASAC,cAMGC;;;;oBAjLb,gEAAgE;oBAC1D/B,aAAa,aAAaH,oBAAoBA,AAAwB,YAAxBA,iBAAiBmC,OAAO,EAAYC;oBAClFhC,gBAA+BD,aAAa,AAACH,iBAAkCL,MAAM,GAAIK;oBACzFK,WAAWF,aAAcH,mBAAoCqC;oBAC7D/B,iBAASJ,oBAAAA,8BAAAA,QAASI,MAAM,uCAAIgC,gBAAa;oBAEzC/B,eAAeH,aAAa,CAACH,WAAW;oBAE9C,IAAI,CAACM,cAAc;wBACXC,YAAY+B,OAAOC,IAAI,CAACpC,eAAeqC,IAAI,CAAC;wBAClD,MAAM,IAAIhD,MAAM,AAAC,WAAiEe,OAAvDP,YAAW,8CAAgE,OAApBO,aAAa;oBACjG;oBAEA,uCAAuC;oBACjCC,gBAAgBf,mBAAmBa;oBAEzC,sFAAsF;oBACtF,sFAAsF;oBACtF,qEAAqE;oBAC/DG,gBAA+B;wBAAEM,cAAc,CAAC;oBAAE;oBACxD,IAAId,CAAAA,oBAAAA,8BAAAA,QAASwC,kBAAkB,MAAKL,WAAW;wBAC7C3B,cAAcgC,kBAAkB,GAAGxC,QAAQwC,kBAAkB;oBAC/D;oBAEA,oBAAoB;oBACd/B,SAAS,IAAIgC,cAAM,CAAC;wBAAEC,MAAM;wBAAkBC,SAAS;oBAAQ,GAAGnC;yBAGpED,CAAAA,kBAAkB,OAAM,GAAxBA;;;;oBACF,qDAAqD;oBAC/CG,eAAeP,qBAAAA,+BAAAA,SAAU8B,OAAO,CAACW,GAAG,CAAC7C;yBAEvCW,cAAAA;;;;oBACF,oCAAoC;oBAC9BC,YAAY,IAAIkC,oDAAwB,CAACnC,aAAaoC,OAAO;oBACnE;;wBAAMrC,OAAOsC,OAAO,CAACpC;;;oBAArB;;;;;;oBAEA,qEAAqE;oBACrE,oEAAoE;oBACpE,IAAI,CAACN,aAAa2C,OAAO,EAAE;wBACzB,MAAM,IAAIzD,MAAM,AAAC,WAAqB,OAAXQ,YAAW;oBACxC;oBAEMY,aAAY,IAAIsC,2BAAoB,CAAC;wBACzCD,SAAS3C,aAAa2C,OAAO;wBAC7BE,MAAM7C,aAAa6C,IAAI;wBACvBC,KAAK9C,aAAa8C,GAAG,IAAI,CAAC;oBAC5B;oBAEA,qFAAqF;oBACrF;;wBAAM1C,OAAOsC,OAAO,CAACpC;;;oBAArB;;;;;;;;yBAEOJ,CAAAA,kBAAkB,MAAK,GAAvBA;;;;oBACT,IAAI,CAAE,CAAA,SAASF,YAAW,KAAM,CAACA,aAAaV,GAAG,EAAE;wBACjD,MAAM,IAAIJ,MAAM,AAAC,WAAqB,OAAXQ,YAAW;oBACxC;oBAEA,iEAAiE;oBACjE,iEAAiE;oBAC3Da,gBAAgBT,qBAAAA,+BAAAA,SAAU8B,OAAO,CAACmB,GAAG,CAACrD;yBAExCa,eAAAA;;;;oBACFR,OAAOiD,KAAK,CAAC,AAAC,+CAAgEhD,OAAlBN,YAAW,SAAwB,OAAjBM,aAAaV,GAAG;oBAC9F;;wBAAM2D,IAAAA,oCAAgB,EAACjD,aAAaV,GAAG;;;oBAAvC;oBACAS,OAAOiD,KAAK,CAAC,AAAC,mCAA6C,OAAXtD,YAAW;;;oBAGvDJ,MAAM,IAAIC,IAAIS,aAAaV,GAAG;oBAEpC,gEAAgE;oBAChE,4EAA4E;oBAC5E,6EAA6E;oBAC7E,6EAA6E;oBAC7E,6EAA6E;oBAC7E,6EAA6E;oBAC7E,uDAAuD;oBACjDkB,eAAe0C,IAAAA,wBAAY,EAAClD,aAAaV,GAAG;oBAC7B;;wBAAMhB,YAAY6E,IAAAA,8BAAqB,EAAC3C,eAAe4C,4CAA+B,EAAE;;;oBAAvG3C,eAAe;yBAIjBA,aAAa4C,WAAW,EAAxB5C;;;;oBACFV,OAAOiD,KAAK,CAAC,AAAC,wBAAwB,OAAXtD,YAAW;oBAGzB;;wBAAM4D,IAAAA,gBAAO;;;oBAApB3C,OAAO;oBACPC,cAAc,AAAC,oBAAwB,OAALD,MAAK;oBAE7C,+EAA+E;oBACzEE,gBAAgB,IAAI0C,0BAAgB,CAAC;wBACzCC,UAAU;wBACV5C,aAAAA;wBACAb,QAAAA;uBACGJ,oBAAAA,8BAAAA,QAAS8D,gBAAgB;oBAIf;;wBAAM5C,cAAc6C,mBAAmB,CAAClD,cAAcC;;;oBAA/DK,SAAS;oBACfJ,YAAYI,OAAO6C,WAAW;oBAE9B5D,OAAOiD,KAAK,CAAC,AAAC,kCAA4C,OAAXtD,YAAW;;;;;;oBAE1DK,OAAOiD,KAAK,CAAC,AAAC,eAAyB,OAAXtD,YAAW;;;;;;;;;oBAIvC,iEAAiE;oBACjE,8FAA8F;oBACxFqB,gBAAgBf,aAAa4D,OAAO,IAAI,CAAC;oBACzC5C,aAAaN,YAAY;wBAAEmD,eAAe,AAAC,UAAmB,OAAVnD;oBAAY,IAAI,CAAC;oBACrEO,gBAAgB,mBAAKF,eAAkBC;oBAEvCE,mBACJc,OAAOC,IAAI,CAAChB,eAAe6C,MAAM,GAAG,IAChC;wBACEC,aAAa;4BACXH,SAAS3C;wBACX;oBACF,IACAa;oBAEAxB,aAAY,IAAI0D,qCAA6B,CAAC1E,KAAK4B;oBACzD,+FAA+F;oBAC/F,gEAAgE;oBAChE;;wBAAM5C,YAAY8B,OAAOsC,OAAO,CAACpC,aAAoC,OAAO;;;oBAA5E;;;;;;oBACOa;oBACP,+DAA+D;oBAC/D,iFAAiF;oBAC3EC,eAAeD,AAAK,YAALA,OAAiBjC,SAAQiC,MAAM8C,OAAO,GAAGC,OAAO/C;oBAErE,0EAA0E;oBAC1E,wFAAwF;oBAClFE,QAAQF,AAAK,YAALA,OAAiBjC,SAAQ,AAACiC,MAAgDE,KAAK,GAAGS;oBAC1FR,sBAAsBD,CAAAA,kBAAAA,4BAAAA,MAAO8C,IAAI,MAAK,kBAAkB/C,aAAagD,QAAQ,CAAC;yBAEhF9C,qBAAAA;;;;oBACF,4CAA4C;oBAC5C;;wBAAMlB,OAAOiE,KAAK,GAAGC,KAAK,CAAC,YAAO;;;oBAAlC;oBACA,MAAM,IAAIpF,MAAM,AAAC,yBAA4B,OAAJI;;oBAG3C,8DAA8D;oBACxDiC,iBACJH,aAAagD,QAAQ,CAAC,yBAAyB,mBAAmB;oBAClEhD,aAAagD,QAAQ,CAAC,UAAU,+CAA+C;oBAC/EhD,aAAagD,QAAQ,CAAC,QAAQ,qBAAqB;oBAErD,IAAI7C,gBAAgB;wBAClBxB,OAAOwE,IAAI,CAAC,AAAC,2BAAuC,OAAbnD,cAAa;oBACtD,OAAO;wBACLrB,OAAOwE,IAAI,CAAC;oBACd;oBAEA,iEAAiE;oBAC3D/C,YAAY,IAAIY,cAAM,CAAC;wBAAEC,MAAM;wBAAkBC,SAAS;oBAAQ,GAAGnC;oBAE3E,wDAAwD;oBACxD,yDAAyD;oBACnDY,iBAAgBf,aAAa4D,OAAO,IAAI,CAAC;oBACzC5C,cAAaN,YAAY;wBAAEmD,eAAe,AAAC,UAAmB,OAAVnD;oBAAY,IAAI,CAAC;oBACrEO,iBAAgB,mBAAKF,gBAAkBC;oBAEvCS,sBACJO,OAAOC,IAAI,CAAChB,gBAAe6C,MAAM,GAAG,IAChC;wBACEC,aAAa;4BACXH,SAAS3C;wBACX;oBACF,IACAa;oBAEAJ,eAAe,IAAI8C,0BAAkB,CAAClF,KAAKmC;;;;;;;;;oBAG/C;;wBAAMnD,YAAYkD,UAAUkB,OAAO,CAAChB,eAAe,OAAO;;;oBAA1D;oBACA,wCAAwC;oBACxC;;wBAAOF;;;oBACAG;oBACP,gEAAgE;oBAChE;;wBAAMhD,QAAQ8F,GAAG;4BAAErE,OAAOiE,KAAK,GAAGC,KAAK,CAAC,YAAO;4BAAI9C,UAAU6C,KAAK,GAAGC,KAAK,CAAC,YAAO;;;;oBAAlF;oBACA,MAAM3C;;;;;;;oBAKZ;;wBAAOvB;uBAAQ,iCAAiC;;;IAClD"}

package/dist/cjs/connection/existing-process-transport.d.cts

@@ -4,8 +4,7 @@
  * MCP transport that wraps an existing child process for stdio communication.
  * Used when connecting to servers already spawned by initServers().
  */
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
-import type { JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';
+import type { JSONRPCMessage, Transport } from '@modelcontextprotocol/client';
 import type { ChildProcess } from 'child_process';
 /**
  * Transport that communicates with an existing child process via stdio.

package/dist/cjs/connection/existing-process-transport.d.ts

@@ -4,8 +4,7 @@
  * MCP transport that wraps an existing child process for stdio communication.
  * Used when connecting to servers already spawned by initServers().
  */
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
-import type { JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';
+import type { JSONRPCMessage, Transport } from '@modelcontextprotocol/client';
 import type { ChildProcess } from 'child_process';
 /**
  * Transport that communicates with an existing child process via stdio.

package/dist/cjs/connection/existing-process-transport.js

@@ -13,7 +13,7 @@ Object.defineProperty(exports, "ExistingProcessTransport", {
         return ExistingProcessTransport;
     }
 });
-var _stdio = require("@modelcontextprotocol/sdk/shared/stdio.js");
+var _client = require("@modelcontextprotocol/client");
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -152,7 +152,7 @@ var ExistingProcessTransport = /*#__PURE__*/ function() {
             throw new Error('Child process must have stdin and stdout pipes');
         }
         this._process = process;
-        this._readBuffer = new _stdio.ReadBuffer();
+        this._readBuffer = new _client.ReadBuffer();
     }
     var _proto = ExistingProcessTransport.prototype;
     /**
@@ -253,7 +253,7 @@ var ExistingProcessTransport = /*#__PURE__*/ function() {
                             reject(new Error('stdin is not available'));
                             return;
                         }
-                        var json = (0, _stdio.serializeMessage)(message);
+                        var json = (0, _client.serializeMessage)(message);
                         if (_this._process.stdin.write(json)) {
                             resolve();
                         } else {