@mcp-z/client 2.0.1 → 2.1.0

package/dist/esm/connection/connect-client.js

@@ -9,6 +9,7 @@ import getPort from 'get-port';
 import { probeAuthCapabilities } from '../auth/index.js';
 import { DCR_CAPABILTY_DISCOVERY_TIMEOUT } from '../constants.js';
 import { DcrAuthenticator } from '../dcr/index.js';
+import { normalizeUrl } from '../lib/url-utils.js';
 import { logger as defaultLogger } from '../utils/logger.js';
 import { ExistingProcessTransport } from './existing-process-transport.js';
 import { waitForHttpReady } from './wait-for-http-ready.js';
@@ -28,30 +29,6 @@ import { waitForHttpReady } from './wait-for-http-ready.js';
         })
     ]);
 }
-/**
- * Extract the "server base" by removing a trailing `/mcp` path segment if present.
- * Examples:
- *  - https://example.com/mcp -> https://example.com
- *  - https://example.com/sheets/mcp -> https://example.com/sheets
- *  - https://example.com/sheets/mcp/ -> https://example.com/sheets
- *  - https://example.com/sheets -> https://example.com/sheets
- */ export function extractBaseUrl(mcpUrl) {
-    const url = new URL(mcpUrl);
-    // Ignore query/hash for base URL purposes
-    url.search = '';
-    url.hash = '';
-    // Normalize path segments (removes empty segments from leading/trailing slashes)
-    const segments = url.pathname.split('/').filter(Boolean);
-    // If last segment is exactly "mcp", drop it
-    if (segments[segments.length - 1] === 'mcp') {
-        segments.pop();
-    }
-    // Rebuild pathname; empty means root
-    url.pathname = segments.length ? `/${segments.join('/')}` : '';
-    // Return without trailing slash (except root origin)
-    const out = url.origin + url.pathname;
-    return out === url.origin ? out : out.replace(/\/+$/, '');
-}
 /**
  * Infer transport type from server configuration with validation.
  *
@@ -181,8 +158,14 @@ import { waitForHttpReady } from './wait-for-http-ready.js';
         }
         const url = new URL(serverConfig.url);
         // Check for DCR support and handle authentication automatically
-        const baseUrl = extractBaseUrl(serverConfig.url);
-        const capabilities = await withTimeout(probeAuthCapabilities(baseUrl), DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery');
+        // The canonical MCP server URI, path segment and all. Both calls below need
+        // the server's identity, not its deployment root: discovery uses the path to
+        // find resource-specific metadata (RFC 9728 sub-path), and the authenticator
+        // audience-binds tokens to it (RFC 8707). Handing either the `/mcp`-stripped
+        // base names a different resource, which authorization servers that validate
+        // the `resource` indicator reject as `invalid_target`.
+        const mcpServerUrl = normalizeUrl(serverConfig.url);
+        const capabilities = await withTimeout(probeAuthCapabilities(mcpServerUrl), DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery');
         let authToken;
         if (capabilities.supportsDcr) {
             logger.debug(`🔐 Server '${serverName}' supports DCR authentication`);
@@ -197,7 +180,7 @@ import { waitForHttpReady } from './wait-for-http-ready.js';
                 ...options === null || options === void 0 ? void 0 : options.dcrAuthenticator
             });
             // Ensure we have valid tokens (performs DCR + OAuth if needed)
-            const tokens = await authenticator.ensureAuthenticated(baseUrl, capabilities);
+            const tokens = await authenticator.ensureAuthenticated(mcpServerUrl, capabilities);
             authToken = tokens.accessToken;
             logger.debug(`✅ Authentication complete for '${serverName}'`);
         } else {

package/dist/esm/connection/connect-client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/connection/connect-client.ts"],"sourcesContent":["/**\n * connect-mcp-client.ts\n *\n * Helper to connect MCP SDK clients to servers with intelligent transport inference.\n * Automatically detects transport type from URL protocol or type field.\n */\n\nimport type { Transport } from '@modelcontextprotocol/client';\nimport { Client, SSEClientTransport, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';\nimport { StdioClientTransport } from '@modelcontextprotocol/client/stdio';\nimport getPort from 'get-port';\nimport { probeAuthCapabilities } from '../auth/index.ts';\nimport { DCR_CAPABILTY_DISCOVERY_TIMEOUT } from '../constants.ts';\nimport { DcrAuthenticator, type DcrAuthenticatorOptions } from '../dcr/index.ts';\nimport type { ServerProcess } from '../spawn/spawn-server.ts';\nimport type { ServersConfig } from '../spawn/spawn-servers.ts';\n\n/**\n * Minimal interface for connecting to servers.\n * Only needs config and servers map for connection logic.\n */\ninterface RegistryLike {\n  config: ServersConfig;\n  servers: Map<string, ServerProcess>;\n}\n\nimport type { McpServerEntry, TransportType } from '../types.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { ExistingProcessTransport } from './existing-process-transport.ts';\nimport { waitForHttpReady } from './wait-for-http-ready.ts';\n\n/**\n * Wrap promise with timeout - throws if promise takes too long\n * Clears timeout when promise completes to prevent hanging event loop\n * @param promise - Promise to wrap\n * @param ms - Timeout in milliseconds\n * @param operation - Description of operation for error message\n * @returns Promise result or timeout error\n */\nasync function withTimeout<T>(promise: Promise<T>, ms: number, operation: string): Promise<T> {\n  let timeoutId: NodeJS.Timeout;\n\n  return Promise.race([\n    promise.finally(() => clearTimeout(timeoutId)),\n    new Promise<T>((_, reject) => {\n      timeoutId = setTimeout(() => reject(new Error(`Timeout after ${ms}ms: ${operation}`)), ms);\n    }),\n  ]);\n}\n\n/**\n * Extract the \"server base\" by removing a trailing `/mcp` path segment if present.\n * Examples:\n *  - https://example.com/mcp -> https://example.com\n *  - https://example.com/sheets/mcp -> https://example.com/sheets\n *  - https://example.com/sheets/mcp/ -> https://example.com/sheets\n *  - https://example.com/sheets -> https://example.com/sheets\n */\nexport function extractBaseUrl(mcpUrl: string): string {\n  const url = new URL(mcpUrl);\n\n  // Ignore query/hash for base URL purposes\n  url.search = '';\n  url.hash = '';\n\n  // Normalize path segments (removes empty segments from leading/trailing slashes)\n  const segments = url.pathname.split('/').filter(Boolean);\n\n  // If last segment is exactly \"mcp\", drop it\n  if (segments[segments.length - 1] === 'mcp') {\n    segments.pop();\n  }\n\n  // Rebuild pathname; empty means root\n  url.pathname = segments.length ? `/${segments.join('/')}` : '';\n\n  // Return without trailing slash (except root origin)\n  const out = url.origin + url.pathname;\n  return out === url.origin ? out : out.replace(/\\/+$/, '');\n}\n\n/**\n * Infer transport type from server configuration with validation.\n *\n * Priority:\n * 1. Explicit type field (if present)\n * 2. URL protocol (if URL present): http://, https://\n * 3. Default to 'stdio' (if neither present)\n *\n * @param config - Server configuration\n * @returns Transport type\n * @throws Error if configuration is invalid or has conflicts\n */\nfunction inferTransportType(config: McpServerEntry): TransportType {\n  // Priority 1: Explicit type field\n  if (config.type) {\n    // Validate consistency with URL if both present\n    if (config.url) {\n      const url = new URL(config.url);\n      const protocol = url.protocol;\n\n      if ((protocol === 'http:' || protocol === 'https:') && config.type !== 'http' && config.type !== 'sse-ide') {\n        throw new Error(`Conflicting transport: URL protocol '${protocol}' requires type 'http', but got '${config.type}'`);\n      }\n    }\n\n    // Return normalized type\n    if (config.type === 'http' || config.type === 'sse-ide') return 'http';\n    if (config.type === 'stdio') return 'stdio';\n\n    throw new Error(`Unsupported transport type: ${config.type}`);\n  }\n\n  // Priority 2: Infer from URL protocol\n  if (config.url) {\n    const url = new URL(config.url);\n    const protocol = url.protocol;\n\n    if (protocol === 'http:' || protocol === 'https:') {\n      return 'http';\n    }\n    throw new Error(`Unsupported URL protocol: ${protocol}`);\n  }\n\n  // Priority 3: Default to stdio\n  return 'stdio';\n}\n\n/**\n * Connect MCP SDK client to server with full readiness handling.\n * @internal - Use registry.connect() instead\n *\n * **Completely handles readiness**: transport availability + MCP protocol handshake.\n *\n * Transport is intelligently inferred and handled:\n * - **Stdio servers**: Direct MCP connect (fast for spawned processes)\n * - **HTTP servers**: Transport polling (/mcp endpoint) + MCP connect\n * - **Registry result**: Handles both spawned and external servers\n *\n * Returns only when server is fully MCP-ready (initialize handshake complete).\n *\n * @param registryOrConfig - Result from createServerRegistry() or servers config object\n * @param serverName - Server name from servers config\n * @returns Connected MCP SDK Client (guaranteed ready)\n *\n * @example\n * // Using registry (recommended)\n * const registry = createServerRegistry({ echo: { command: 'node', args: ['server.ts'] } });\n * const client = await registry.connect('echo');\n * // Server is fully ready - transport available + MCP handshake complete\n *\n * @example\n * // HTTP server readiness (waits for /mcp polling + MCP handshake)\n * const registry = createServerRegistry(\n *   { http: { type: 'http', url: 'http://localhost:3000/mcp', start: {...} } },\n *   { dialects: ['start'] }\n * );\n * const client = await registry.connect('http');\n * // 1. Waits for HTTP server to respond on /mcp\n * // 2. Performs MCP initialize handshake\n * // 3. Returns ready client\n */\nexport async function connectMcpClient(\n  registryOrConfig: RegistryLike | ServersConfig,\n  serverName: string,\n  options?: {\n    dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;\n    logger?: Logger;\n  }\n): Promise<Client> {\n  // Detect whether we have a RegistryLike instance or just config\n  const isRegistry = 'servers' in registryOrConfig && registryOrConfig.servers instanceof Map;\n  const serversConfig: ServersConfig = isRegistry ? (registryOrConfig as RegistryLike).config : (registryOrConfig as ServersConfig);\n  const registry = isRegistry ? (registryOrConfig as RegistryLike) : undefined;\n  const logger = options?.logger ?? defaultLogger;\n\n  const serverConfig = serversConfig[serverName];\n\n  if (!serverConfig) {\n    const available = Object.keys(serversConfig).join(', ');\n    throw new Error(`Server '${serverName}' not found in config. Available servers: ${available || 'none'}`);\n  }\n\n  // Infer transport type with validation\n  const transportType = inferTransportType(serverConfig);\n\n  // Create MCP client\n  const client = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, { capabilities: {} });\n\n  // Connect based on inferred transport\n  if (transportType === 'stdio') {\n    // Check if we have a spawned process in the registry\n    const serverHandle = registry?.servers.get(serverName);\n\n    if (serverHandle) {\n      // Reuse the already-spawned process\n      const transport = new ExistingProcessTransport(serverHandle.process);\n      await client.connect(transport);\n    } else {\n      // No registry or server not in registry - spawn new process directly\n      // This is the standard fallback when process management is not used\n      if (!serverConfig.command) {\n        throw new Error(`Server '${serverName}' has stdio transport but missing 'command' field`);\n      }\n\n      const transport = new StdioClientTransport({\n        command: serverConfig.command,\n        args: serverConfig.args || [],\n        env: serverConfig.env || {},\n      });\n\n      // client.connect() performs initialize handshake - when it resolves, server is ready\n      await client.connect(transport);\n    }\n  } else if (transportType === 'http') {\n    if (!('url' in serverConfig) || !serverConfig.url) {\n      throw new Error(`Server '${serverName}' has http transport but missing 'url' field`);\n    }\n\n    // Check if this is a freshly spawned HTTP server (from registry)\n    // that might not be ready yet - transport readiness check needed\n    const isSpawnedHttp = registry?.servers.has(serverName);\n\n    if (isSpawnedHttp) {\n      logger.debug(`[connectMcpClient] waiting for HTTP server '${serverName}' at ${serverConfig.url}`);\n      await waitForHttpReady(serverConfig.url);\n      logger.debug(`[connectMcpClient] HTTP server '${serverName}' ready`);\n    }\n\n    const url = new URL(serverConfig.url);\n\n    // Check for DCR support and handle authentication automatically\n    const baseUrl = extractBaseUrl(serverConfig.url);\n    const capabilities = await withTimeout(probeAuthCapabilities(baseUrl), DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery');\n\n    let authToken: string | undefined;\n\n    if (capabilities.supportsDcr) {\n      logger.debug(`🔐 Server '${serverName}' supports DCR authentication`);\n\n      // Get available port and create the exact redirect URI to use\n      const port = await getPort();\n      const redirectUri = `http://localhost:${port}/callback`;\n\n      // Handle authentication using DcrAuthenticator with fully resolved redirectUri\n      const authenticator = new DcrAuthenticator({\n        headless: false,\n        redirectUri,\n        logger,\n        ...options?.dcrAuthenticator,\n      });\n\n      // Ensure we have valid tokens (performs DCR + OAuth if needed)\n      const tokens = await authenticator.ensureAuthenticated(baseUrl, capabilities);\n      authToken = tokens.accessToken;\n\n      logger.debug(`✅ Authentication complete for '${serverName}'`);\n    } else {\n      logger.debug(`ℹ️  Server '${serverName}' does not support DCR - connecting without authentication`);\n    }\n\n    try {\n      // Try modern Streamable HTTP first (protocol version 2025-03-26)\n      // Merge static headers from config with DCR auth headers (DCR Authorization takes precedence)\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const transportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const transport = new StreamableHTTPClientTransport(url, transportOptions);\n      // Type assertion: SDK transport has sessionId: string | undefined but Transport expects string\n      // This is safe at runtime - the undefined is valid per MCP spec\n      await withTimeout(client.connect(transport as unknown as Transport), 30000, 'StreamableHTTP connection');\n    } catch (error) {\n      // Fall back to SSE transport (MCP protocol version 2024-11-05)\n      // SSE is a standard MCP transport used by many servers (e.g., FastMCP ecosystem)\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      // Fast-fail: Don't try SSE if connection was refused (server not running)\n      // Check error.cause.code for ECONNREFUSED (fetch errors wrap the actual error in cause)\n      const cause = error instanceof Error ? (error as Error & { cause?: { code?: string } }).cause : undefined;\n      const isConnectionRefused = cause?.code === 'ECONNREFUSED' || errorMessage.includes('Connection refused');\n\n      if (isConnectionRefused) {\n        // Clean up client resources before throwing\n        await client.close().catch(() => {});\n        throw new Error(`Server not running at ${url}`);\n      }\n\n      // Check for known errors that indicate SSE fallback is needed\n      const shouldFallback =\n        errorMessage.includes('Missing session ID') || // FastMCP specific\n        errorMessage.includes('404') || // Server doesn't have streamable HTTP endpoint\n        errorMessage.includes('405'); // Method not allowed\n\n      if (shouldFallback) {\n        logger.warn(`Streamable HTTP failed (${errorMessage}), falling back to SSE transport`);\n      } else {\n        logger.warn('Streamable HTTP connection failed, trying SSE transport as fallback');\n      }\n\n      // Create new client for SSE transport (required per SDK pattern)\n      const sseClient = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, { capabilities: {} });\n\n      // SSE transport with merged headers (static + DCR auth)\n      // Reuse the same header merging logic as Streamable HTTP\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const sseTransportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const sseTransport = new SSEClientTransport(url, sseTransportOptions);\n\n      try {\n        await withTimeout(sseClient.connect(sseTransport), 30000, 'SSE connection');\n        // Return SSE client instead of original\n        return sseClient;\n      } catch (sseError) {\n        // SSE connection failed - clean up both clients before throwing\n        await Promise.all([client.close().catch(() => {}), sseClient.close().catch(() => {})]);\n        throw sseError;\n      }\n    }\n  }\n\n  return client; // Guaranteed ready when returned\n}\n"],"names":["Client","SSEClientTransport","StreamableHTTPClientTransport","StdioClientTransport","getPort","probeAuthCapabilities","DCR_CAPABILTY_DISCOVERY_TIMEOUT","DcrAuthenticator","logger","defaultLogger","ExistingProcessTransport","waitForHttpReady","withTimeout","promise","ms","operation","timeoutId","Promise","race","finally","clearTimeout","_","reject","setTimeout","Error","extractBaseUrl","mcpUrl","url","URL","search","hash","segments","pathname","split","filter","Boolean","length","pop","join","out","origin","replace","inferTransportType","config","type","protocol","connectMcpClient","registryOrConfig","serverName","options","isRegistry","servers","Map","serversConfig","registry","undefined","serverConfig","available","Object","keys","transportType","client","name","version","capabilities","serverHandle","get","transport","process","connect","command","args","env","isSpawnedHttp","has","debug","baseUrl","authToken","supportsDcr","port","redirectUri","authenticator","headless","dcrAuthenticator","tokens","ensureAuthenticated","accessToken","staticHeaders","headers","dcrHeaders","Authorization","mergedHeaders","transportOptions","requestInit","error","errorMessage","message","String","cause","isConnectionRefused","code","includes","close","catch","shouldFallback","warn","sseClient","sseTransportOptions","sseTransport","sseError","all"],"mappings":"AAAA;;;;;CAKC,GAGD,SAASA,MAAM,EAAEC,kBAAkB,EAAEC,6BAA6B,QAAQ,+BAA+B;AACzG,SAASC,oBAAoB,QAAQ,qCAAqC;AAC1E,OAAOC,aAAa,WAAW;AAC/B,SAASC,qBAAqB,QAAQ,mBAAmB;AACzD,SAASC,+BAA+B,QAAQ,kBAAkB;AAClE,SAASC,gBAAgB,QAAsC,kBAAkB;AAcjF,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAC1E,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,gBAAgB,QAAQ,2BAA2B;AAE5D;;;;;;;CAOC,GACD,eAAeC,YAAeC,OAAmB,EAAEC,EAAU,EAAEC,SAAiB;IAC9E,IAAIC;IAEJ,OAAOC,QAAQC,IAAI,CAAC;QAClBL,QAAQM,OAAO,CAAC,IAAMC,aAAaJ;QACnC,IAAIC,QAAW,CAACI,GAAGC;YACjBN,YAAYO,WAAW,IAAMD,OAAO,IAAIE,MAAM,CAAC,cAAc,EAAEV,GAAG,IAAI,EAAEC,WAAW,IAAID;QACzF;KACD;AACH;AAEA;;;;;;;CAOC,GACD,OAAO,SAASW,eAAeC,MAAc;IAC3C,MAAMC,MAAM,IAAIC,IAAIF;IAEpB,0CAA0C;IAC1CC,IAAIE,MAAM,GAAG;IACbF,IAAIG,IAAI,GAAG;IAEX,iFAAiF;IACjF,MAAMC,WAAWJ,IAAIK,QAAQ,CAACC,KAAK,CAAC,KAAKC,MAAM,CAACC;IAEhD,4CAA4C;IAC5C,IAAIJ,QAAQ,CAACA,SAASK,MAAM,GAAG,EAAE,KAAK,OAAO;QAC3CL,SAASM,GAAG;IACd;IAEA,qCAAqC;IACrCV,IAAIK,QAAQ,GAAGD,SAASK,MAAM,GAAG,CAAC,CAAC,EAAEL,SAASO,IAAI,CAAC,MAAM,GAAG;IAE5D,qDAAqD;IACrD,MAAMC,MAAMZ,IAAIa,MAAM,GAAGb,IAAIK,QAAQ;IACrC,OAAOO,QAAQZ,IAAIa,MAAM,GAAGD,MAAMA,IAAIE,OAAO,CAAC,QAAQ;AACxD;AAEA;;;;;;;;;;;CAWC,GACD,SAASC,mBAAmBC,MAAsB;IAChD,kCAAkC;IAClC,IAAIA,OAAOC,IAAI,EAAE;QACf,gDAAgD;QAChD,IAAID,OAAOhB,GAAG,EAAE;YACd,MAAMA,MAAM,IAAIC,IAAIe,OAAOhB,GAAG;YAC9B,MAAMkB,WAAWlB,IAAIkB,QAAQ;YAE7B,IAAI,AAACA,CAAAA,aAAa,WAAWA,aAAa,QAAO,KAAMF,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW;gBAC1G,MAAM,IAAIpB,MAAM,CAAC,qCAAqC,EAAEqB,SAAS,iCAAiC,EAAEF,OAAOC,IAAI,CAAC,CAAC,CAAC;YACpH;QACF;QAEA,yBAAyB;QACzB,IAAID,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW,OAAO;QAChE,IAAID,OAAOC,IAAI,KAAK,SAAS,OAAO;QAEpC,MAAM,IAAIpB,MAAM,CAAC,4BAA4B,EAAEmB,OAAOC,IAAI,EAAE;IAC9D;IAEA,sCAAsC;IACtC,IAAID,OAAOhB,GAAG,EAAE;QACd,MAAMA,MAAM,IAAIC,IAAIe,OAAOhB,GAAG;QAC9B,MAAMkB,WAAWlB,IAAIkB,QAAQ;QAE7B,IAAIA,aAAa,WAAWA,aAAa,UAAU;YACjD,OAAO;QACT;QACA,MAAM,IAAIrB,MAAM,CAAC,0BAA0B,EAAEqB,UAAU;IACzD;IAEA,+BAA+B;IAC/B,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GACD,OAAO,eAAeC,iBACpBC,gBAA8C,EAC9CC,UAAkB,EAClBC,OAGC;;IAED,gEAAgE;IAChE,MAAMC,aAAa,aAAaH,oBAAoBA,iBAAiBI,OAAO,YAAYC;IACxF,MAAMC,gBAA+BH,aAAa,AAACH,iBAAkCJ,MAAM,GAAII;IAC/F,MAAMO,WAAWJ,aAAcH,mBAAoCQ;IACnE,MAAM/C,iBAASyC,oBAAAA,8BAAAA,QAASzC,MAAM,uCAAIC;IAElC,MAAM+C,eAAeH,aAAa,CAACL,WAAW;IAE9C,IAAI,CAACQ,cAAc;QACjB,MAAMC,YAAYC,OAAOC,IAAI,CAACN,eAAef,IAAI,CAAC;QAClD,MAAM,IAAId,MAAM,CAAC,QAAQ,EAAEwB,WAAW,0CAA0C,EAAES,aAAa,QAAQ;IACzG;IAEA,uCAAuC;IACvC,MAAMG,gBAAgBlB,mBAAmBc;IAEzC,oBAAoB;IACpB,MAAMK,SAAS,IAAI7D,OAAO;QAAE8D,MAAM;QAAkBC,SAAS;IAAQ,GAAG;QAAEC,cAAc,CAAC;IAAE;IAE3F,sCAAsC;IACtC,IAAIJ,kBAAkB,SAAS;QAC7B,qDAAqD;QACrD,MAAMK,eAAeX,qBAAAA,+BAAAA,SAAUH,OAAO,CAACe,GAAG,CAAClB;QAE3C,IAAIiB,cAAc;YAChB,oCAAoC;YACpC,MAAME,YAAY,IAAIzD,yBAAyBuD,aAAaG,OAAO;YACnE,MAAMP,OAAOQ,OAAO,CAACF;QACvB,OAAO;YACL,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,CAACX,aAAac,OAAO,EAAE;gBACzB,MAAM,IAAI9C,MAAM,CAAC,QAAQ,EAAEwB,WAAW,iDAAiD,CAAC;YAC1F;YAEA,MAAMmB,YAAY,IAAIhE,qBAAqB;gBACzCmE,SAASd,aAAac,OAAO;gBAC7BC,MAAMf,aAAae,IAAI,IAAI,EAAE;gBAC7BC,KAAKhB,aAAagB,GAAG,IAAI,CAAC;YAC5B;YAEA,qFAAqF;YACrF,MAAMX,OAAOQ,OAAO,CAACF;QACvB;IACF,OAAO,IAAIP,kBAAkB,QAAQ;QACnC,IAAI,CAAE,CAAA,SAASJ,YAAW,KAAM,CAACA,aAAa7B,GAAG,EAAE;YACjD,MAAM,IAAIH,MAAM,CAAC,QAAQ,EAAEwB,WAAW,4CAA4C,CAAC;QACrF;QAEA,iEAAiE;QACjE,iEAAiE;QACjE,MAAMyB,gBAAgBnB,qBAAAA,+BAAAA,SAAUH,OAAO,CAACuB,GAAG,CAAC1B;QAE5C,IAAIyB,eAAe;YACjBjE,OAAOmE,KAAK,CAAC,CAAC,4CAA4C,EAAE3B,WAAW,KAAK,EAAEQ,aAAa7B,GAAG,EAAE;YAChG,MAAMhB,iBAAiB6C,aAAa7B,GAAG;YACvCnB,OAAOmE,KAAK,CAAC,CAAC,gCAAgC,EAAE3B,WAAW,OAAO,CAAC;QACrE;QAEA,MAAMrB,MAAM,IAAIC,IAAI4B,aAAa7B,GAAG;QAEpC,gEAAgE;QAChE,MAAMiD,UAAUnD,eAAe+B,aAAa7B,GAAG;QAC/C,MAAMqC,eAAe,MAAMpD,YAAYP,sBAAsBuE,UAAUtE,iCAAiC;QAExG,IAAIuE;QAEJ,IAAIb,aAAac,WAAW,EAAE;YAC5BtE,OAAOmE,KAAK,CAAC,CAAC,WAAW,EAAE3B,WAAW,6BAA6B,CAAC;YAEpE,8DAA8D;YAC9D,MAAM+B,OAAO,MAAM3E;YACnB,MAAM4E,cAAc,CAAC,iBAAiB,EAAED,KAAK,SAAS,CAAC;YAEvD,+EAA+E;YAC/E,MAAME,gBAAgB,IAAI1E,iBAAiB;gBACzC2E,UAAU;gBACVF;gBACAxE;mBACGyC,oBAAAA,8BAAAA,QAASkC,gBAAgB,AAA5B;YACF;YAEA,+DAA+D;YAC/D,MAAMC,SAAS,MAAMH,cAAcI,mBAAmB,CAACT,SAASZ;YAChEa,YAAYO,OAAOE,WAAW;YAE9B9E,OAAOmE,KAAK,CAAC,CAAC,+BAA+B,EAAE3B,WAAW,CAAC,CAAC;QAC9D,OAAO;YACLxC,OAAOmE,KAAK,CAAC,CAAC,YAAY,EAAE3B,WAAW,0DAA0D,CAAC;QACpG;QAEA,IAAI;YACF,iEAAiE;YACjE,8FAA8F;YAC9F,MAAMuC,gBAAgB/B,aAAagC,OAAO,IAAI,CAAC;YAC/C,MAAMC,aAAaZ,YAAY;gBAAEa,eAAe,CAAC,OAAO,EAAEb,WAAW;YAAC,IAAI,CAAC;YAC3E,MAAMc,gBAAgB;gBAAE,GAAGJ,aAAa;gBAAE,GAAGE,UAAU;YAAC;YAExD,MAAMG,mBACJlC,OAAOC,IAAI,CAACgC,eAAevD,MAAM,GAAG,IAChC;gBACEyD,aAAa;oBACXL,SAASG;gBACX;YACF,IACApC;YAEN,MAAMY,YAAY,IAAIjE,8BAA8ByB,KAAKiE;YACzD,+FAA+F;YAC/F,gEAAgE;YAChE,MAAMhF,YAAYiD,OAAOQ,OAAO,CAACF,YAAoC,OAAO;QAC9E,EAAE,OAAO2B,OAAO;YACd,+DAA+D;YAC/D,iFAAiF;YACjF,MAAMC,eAAeD,iBAAiBtE,QAAQsE,MAAME,OAAO,GAAGC,OAAOH;YAErE,0EAA0E;YAC1E,wFAAwF;YACxF,MAAMI,QAAQJ,iBAAiBtE,QAAQ,AAACsE,MAAgDI,KAAK,GAAG3C;YAChG,MAAM4C,sBAAsBD,CAAAA,kBAAAA,4BAAAA,MAAOE,IAAI,MAAK,kBAAkBL,aAAaM,QAAQ,CAAC;YAEpF,IAAIF,qBAAqB;gBACvB,4CAA4C;gBAC5C,MAAMtC,OAAOyC,KAAK,GAAGC,KAAK,CAAC,KAAO;gBAClC,MAAM,IAAI/E,MAAM,CAAC,sBAAsB,EAAEG,KAAK;YAChD;YAEA,8DAA8D;YAC9D,MAAM6E,iBACJT,aAAaM,QAAQ,CAAC,yBAAyB,mBAAmB;YAClEN,aAAaM,QAAQ,CAAC,UAAU,+CAA+C;YAC/EN,aAAaM,QAAQ,CAAC,QAAQ,qBAAqB;YAErD,IAAIG,gBAAgB;gBAClBhG,OAAOiG,IAAI,CAAC,CAAC,wBAAwB,EAAEV,aAAa,gCAAgC,CAAC;YACvF,OAAO;gBACLvF,OAAOiG,IAAI,CAAC;YACd;YAEA,iEAAiE;YACjE,MAAMC,YAAY,IAAI1G,OAAO;gBAAE8D,MAAM;gBAAkBC,SAAS;YAAQ,GAAG;gBAAEC,cAAc,CAAC;YAAE;YAE9F,wDAAwD;YACxD,yDAAyD;YACzD,MAAMuB,gBAAgB/B,aAAagC,OAAO,IAAI,CAAC;YAC/C,MAAMC,aAAaZ,YAAY;gBAAEa,eAAe,CAAC,OAAO,EAAEb,WAAW;YAAC,IAAI,CAAC;YAC3E,MAAMc,gBAAgB;gBAAE,GAAGJ,aAAa;gBAAE,GAAGE,UAAU;YAAC;YAExD,MAAMkB,sBACJjD,OAAOC,IAAI,CAACgC,eAAevD,MAAM,GAAG,IAChC;gBACEyD,aAAa;oBACXL,SAASG;gBACX;YACF,IACApC;YAEN,MAAMqD,eAAe,IAAI3G,mBAAmB0B,KAAKgF;YAEjD,IAAI;gBACF,MAAM/F,YAAY8F,UAAUrC,OAAO,CAACuC,eAAe,OAAO;gBAC1D,wCAAwC;gBACxC,OAAOF;YACT,EAAE,OAAOG,UAAU;gBACjB,gEAAgE;gBAChE,MAAM5F,QAAQ6F,GAAG,CAAC;oBAACjD,OAAOyC,KAAK,GAAGC,KAAK,CAAC,KAAO;oBAAIG,UAAUJ,KAAK,GAAGC,KAAK,CAAC,KAAO;iBAAG;gBACrF,MAAMM;YACR;QACF;IACF;IAEA,OAAOhD,QAAQ,iCAAiC;AAClD"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/connection/connect-client.ts"],"sourcesContent":["/**\n * connect-mcp-client.ts\n *\n * Helper to connect MCP SDK clients to servers with intelligent transport inference.\n * Automatically detects transport type from URL protocol or type field.\n */\n\nimport type { Transport } from '@modelcontextprotocol/client';\nimport { Client, SSEClientTransport, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';\nimport { StdioClientTransport } from '@modelcontextprotocol/client/stdio';\nimport getPort from 'get-port';\nimport { probeAuthCapabilities } from '../auth/index.ts';\nimport { DCR_CAPABILTY_DISCOVERY_TIMEOUT } from '../constants.ts';\nimport { DcrAuthenticator, type DcrAuthenticatorOptions } from '../dcr/index.ts';\nimport { normalizeUrl } from '../lib/url-utils.ts';\nimport type { ServerProcess } from '../spawn/spawn-server.ts';\nimport type { ServersConfig } from '../spawn/spawn-servers.ts';\n\n/**\n * Minimal interface for connecting to servers.\n * Only needs config and servers map for connection logic.\n */\ninterface RegistryLike {\n  config: ServersConfig;\n  servers: Map<string, ServerProcess>;\n}\n\nimport type { McpServerEntry, TransportType } from '../types.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { ExistingProcessTransport } from './existing-process-transport.ts';\nimport { waitForHttpReady } from './wait-for-http-ready.ts';\n\n/**\n * Wrap promise with timeout - throws if promise takes too long\n * Clears timeout when promise completes to prevent hanging event loop\n * @param promise - Promise to wrap\n * @param ms - Timeout in milliseconds\n * @param operation - Description of operation for error message\n * @returns Promise result or timeout error\n */\nasync function withTimeout<T>(promise: Promise<T>, ms: number, operation: string): Promise<T> {\n  let timeoutId: NodeJS.Timeout;\n\n  return Promise.race([\n    promise.finally(() => clearTimeout(timeoutId)),\n    new Promise<T>((_, reject) => {\n      timeoutId = setTimeout(() => reject(new Error(`Timeout after ${ms}ms: ${operation}`)), ms);\n    }),\n  ]);\n}\n\n/**\n * Infer transport type from server configuration with validation.\n *\n * Priority:\n * 1. Explicit type field (if present)\n * 2. URL protocol (if URL present): http://, https://\n * 3. Default to 'stdio' (if neither present)\n *\n * @param config - Server configuration\n * @returns Transport type\n * @throws Error if configuration is invalid or has conflicts\n */\nfunction inferTransportType(config: McpServerEntry): TransportType {\n  // Priority 1: Explicit type field\n  if (config.type) {\n    // Validate consistency with URL if both present\n    if (config.url) {\n      const url = new URL(config.url);\n      const protocol = url.protocol;\n\n      if ((protocol === 'http:' || protocol === 'https:') && config.type !== 'http' && config.type !== 'sse-ide') {\n        throw new Error(`Conflicting transport: URL protocol '${protocol}' requires type 'http', but got '${config.type}'`);\n      }\n    }\n\n    // Return normalized type\n    if (config.type === 'http' || config.type === 'sse-ide') return 'http';\n    if (config.type === 'stdio') return 'stdio';\n\n    throw new Error(`Unsupported transport type: ${config.type}`);\n  }\n\n  // Priority 2: Infer from URL protocol\n  if (config.url) {\n    const url = new URL(config.url);\n    const protocol = url.protocol;\n\n    if (protocol === 'http:' || protocol === 'https:') {\n      return 'http';\n    }\n    throw new Error(`Unsupported URL protocol: ${protocol}`);\n  }\n\n  // Priority 3: Default to stdio\n  return 'stdio';\n}\n\n/**\n * Connect MCP SDK client to server with full readiness handling.\n * @internal - Use registry.connect() instead\n *\n * **Completely handles readiness**: transport availability + MCP protocol handshake.\n *\n * Transport is intelligently inferred and handled:\n * - **Stdio servers**: Direct MCP connect (fast for spawned processes)\n * - **HTTP servers**: Transport polling (/mcp endpoint) + MCP connect\n * - **Registry result**: Handles both spawned and external servers\n *\n * Returns only when server is fully MCP-ready (initialize handshake complete).\n *\n * @param registryOrConfig - Result from createServerRegistry() or servers config object\n * @param serverName - Server name from servers config\n * @returns Connected MCP SDK Client (guaranteed ready)\n *\n * @example\n * // Using registry (recommended)\n * const registry = createServerRegistry({ echo: { command: 'node', args: ['server.ts'] } });\n * const client = await registry.connect('echo');\n * // Server is fully ready - transport available + MCP handshake complete\n *\n * @example\n * // HTTP server readiness (waits for /mcp polling + MCP handshake)\n * const registry = createServerRegistry(\n *   { http: { type: 'http', url: 'http://localhost:3000/mcp', start: {...} } },\n *   { dialects: ['start'] }\n * );\n * const client = await registry.connect('http');\n * // 1. Waits for HTTP server to respond on /mcp\n * // 2. Performs MCP initialize handshake\n * // 3. Returns ready client\n */\nexport async function connectMcpClient(\n  registryOrConfig: RegistryLike | ServersConfig,\n  serverName: string,\n  options?: {\n    dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;\n    logger?: Logger;\n  }\n): Promise<Client> {\n  // Detect whether we have a RegistryLike instance or just config\n  const isRegistry = 'servers' in registryOrConfig && registryOrConfig.servers instanceof Map;\n  const serversConfig: ServersConfig = isRegistry ? (registryOrConfig as RegistryLike).config : (registryOrConfig as ServersConfig);\n  const registry = isRegistry ? (registryOrConfig as RegistryLike) : undefined;\n  const logger = options?.logger ?? defaultLogger;\n\n  const serverConfig = serversConfig[serverName];\n\n  if (!serverConfig) {\n    const available = Object.keys(serversConfig).join(', ');\n    throw new Error(`Server '${serverName}' not found in config. Available servers: ${available || 'none'}`);\n  }\n\n  // Infer transport type with validation\n  const transportType = inferTransportType(serverConfig);\n\n  // Create MCP client\n  const client = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, { capabilities: {} });\n\n  // Connect based on inferred transport\n  if (transportType === 'stdio') {\n    // Check if we have a spawned process in the registry\n    const serverHandle = registry?.servers.get(serverName);\n\n    if (serverHandle) {\n      // Reuse the already-spawned process\n      const transport = new ExistingProcessTransport(serverHandle.process);\n      await client.connect(transport);\n    } else {\n      // No registry or server not in registry - spawn new process directly\n      // This is the standard fallback when process management is not used\n      if (!serverConfig.command) {\n        throw new Error(`Server '${serverName}' has stdio transport but missing 'command' field`);\n      }\n\n      const transport = new StdioClientTransport({\n        command: serverConfig.command,\n        args: serverConfig.args || [],\n        env: serverConfig.env || {},\n      });\n\n      // client.connect() performs initialize handshake - when it resolves, server is ready\n      await client.connect(transport);\n    }\n  } else if (transportType === 'http') {\n    if (!('url' in serverConfig) || !serverConfig.url) {\n      throw new Error(`Server '${serverName}' has http transport but missing 'url' field`);\n    }\n\n    // Check if this is a freshly spawned HTTP server (from registry)\n    // that might not be ready yet - transport readiness check needed\n    const isSpawnedHttp = registry?.servers.has(serverName);\n\n    if (isSpawnedHttp) {\n      logger.debug(`[connectMcpClient] waiting for HTTP server '${serverName}' at ${serverConfig.url}`);\n      await waitForHttpReady(serverConfig.url);\n      logger.debug(`[connectMcpClient] HTTP server '${serverName}' ready`);\n    }\n\n    const url = new URL(serverConfig.url);\n\n    // Check for DCR support and handle authentication automatically\n    // The canonical MCP server URI, path segment and all. Both calls below need\n    // the server's identity, not its deployment root: discovery uses the path to\n    // find resource-specific metadata (RFC 9728 sub-path), and the authenticator\n    // audience-binds tokens to it (RFC 8707). Handing either the `/mcp`-stripped\n    // base names a different resource, which authorization servers that validate\n    // the `resource` indicator reject as `invalid_target`.\n    const mcpServerUrl = normalizeUrl(serverConfig.url);\n    const capabilities = await withTimeout(probeAuthCapabilities(mcpServerUrl), DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery');\n\n    let authToken: string | undefined;\n\n    if (capabilities.supportsDcr) {\n      logger.debug(`🔐 Server '${serverName}' supports DCR authentication`);\n\n      // Get available port and create the exact redirect URI to use\n      const port = await getPort();\n      const redirectUri = `http://localhost:${port}/callback`;\n\n      // Handle authentication using DcrAuthenticator with fully resolved redirectUri\n      const authenticator = new DcrAuthenticator({\n        headless: false,\n        redirectUri,\n        logger,\n        ...options?.dcrAuthenticator,\n      });\n\n      // Ensure we have valid tokens (performs DCR + OAuth if needed)\n      const tokens = await authenticator.ensureAuthenticated(mcpServerUrl, capabilities);\n      authToken = tokens.accessToken;\n\n      logger.debug(`✅ Authentication complete for '${serverName}'`);\n    } else {\n      logger.debug(`ℹ️  Server '${serverName}' does not support DCR - connecting without authentication`);\n    }\n\n    try {\n      // Try modern Streamable HTTP first (protocol version 2025-03-26)\n      // Merge static headers from config with DCR auth headers (DCR Authorization takes precedence)\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const transportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const transport = new StreamableHTTPClientTransport(url, transportOptions);\n      // Type assertion: SDK transport has sessionId: string | undefined but Transport expects string\n      // This is safe at runtime - the undefined is valid per MCP spec\n      await withTimeout(client.connect(transport as unknown as Transport), 30000, 'StreamableHTTP connection');\n    } catch (error) {\n      // Fall back to SSE transport (MCP protocol version 2024-11-05)\n      // SSE is a standard MCP transport used by many servers (e.g., FastMCP ecosystem)\n      const errorMessage = error instanceof Error ? error.message : String(error);\n\n      // Fast-fail: Don't try SSE if connection was refused (server not running)\n      // Check error.cause.code for ECONNREFUSED (fetch errors wrap the actual error in cause)\n      const cause = error instanceof Error ? (error as Error & { cause?: { code?: string } }).cause : undefined;\n      const isConnectionRefused = cause?.code === 'ECONNREFUSED' || errorMessage.includes('Connection refused');\n\n      if (isConnectionRefused) {\n        // Clean up client resources before throwing\n        await client.close().catch(() => {});\n        throw new Error(`Server not running at ${url}`);\n      }\n\n      // Check for known errors that indicate SSE fallback is needed\n      const shouldFallback =\n        errorMessage.includes('Missing session ID') || // FastMCP specific\n        errorMessage.includes('404') || // Server doesn't have streamable HTTP endpoint\n        errorMessage.includes('405'); // Method not allowed\n\n      if (shouldFallback) {\n        logger.warn(`Streamable HTTP failed (${errorMessage}), falling back to SSE transport`);\n      } else {\n        logger.warn('Streamable HTTP connection failed, trying SSE transport as fallback');\n      }\n\n      // Create new client for SSE transport (required per SDK pattern)\n      const sseClient = new Client({ name: 'mcp-cli-client', version: '1.0.0' }, { capabilities: {} });\n\n      // SSE transport with merged headers (static + DCR auth)\n      // Reuse the same header merging logic as Streamable HTTP\n      const staticHeaders = serverConfig.headers || {};\n      const dcrHeaders = authToken ? { Authorization: `Bearer ${authToken}` } : {};\n      const mergedHeaders = { ...staticHeaders, ...dcrHeaders };\n\n      const sseTransportOptions =\n        Object.keys(mergedHeaders).length > 0\n          ? {\n              requestInit: {\n                headers: mergedHeaders,\n              },\n            }\n          : undefined;\n\n      const sseTransport = new SSEClientTransport(url, sseTransportOptions);\n\n      try {\n        await withTimeout(sseClient.connect(sseTransport), 30000, 'SSE connection');\n        // Return SSE client instead of original\n        return sseClient;\n      } catch (sseError) {\n        // SSE connection failed - clean up both clients before throwing\n        await Promise.all([client.close().catch(() => {}), sseClient.close().catch(() => {})]);\n        throw sseError;\n      }\n    }\n  }\n\n  return client; // Guaranteed ready when returned\n}\n"],"names":["Client","SSEClientTransport","StreamableHTTPClientTransport","StdioClientTransport","getPort","probeAuthCapabilities","DCR_CAPABILTY_DISCOVERY_TIMEOUT","DcrAuthenticator","normalizeUrl","logger","defaultLogger","ExistingProcessTransport","waitForHttpReady","withTimeout","promise","ms","operation","timeoutId","Promise","race","finally","clearTimeout","_","reject","setTimeout","Error","inferTransportType","config","type","url","URL","protocol","connectMcpClient","registryOrConfig","serverName","options","isRegistry","servers","Map","serversConfig","registry","undefined","serverConfig","available","Object","keys","join","transportType","client","name","version","capabilities","serverHandle","get","transport","process","connect","command","args","env","isSpawnedHttp","has","debug","mcpServerUrl","authToken","supportsDcr","port","redirectUri","authenticator","headless","dcrAuthenticator","tokens","ensureAuthenticated","accessToken","staticHeaders","headers","dcrHeaders","Authorization","mergedHeaders","transportOptions","length","requestInit","error","errorMessage","message","String","cause","isConnectionRefused","code","includes","close","catch","shouldFallback","warn","sseClient","sseTransportOptions","sseTransport","sseError","all"],"mappings":"AAAA;;;;;CAKC,GAGD,SAASA,MAAM,EAAEC,kBAAkB,EAAEC,6BAA6B,QAAQ,+BAA+B;AACzG,SAASC,oBAAoB,QAAQ,qCAAqC;AAC1E,OAAOC,aAAa,WAAW;AAC/B,SAASC,qBAAqB,QAAQ,mBAAmB;AACzD,SAASC,+BAA+B,QAAQ,kBAAkB;AAClE,SAASC,gBAAgB,QAAsC,kBAAkB;AACjF,SAASC,YAAY,QAAQ,sBAAsB;AAcnD,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAC1E,SAASC,wBAAwB,QAAQ,kCAAkC;AAC3E,SAASC,gBAAgB,QAAQ,2BAA2B;AAE5D;;;;;;;CAOC,GACD,eAAeC,YAAeC,OAAmB,EAAEC,EAAU,EAAEC,SAAiB;IAC9E,IAAIC;IAEJ,OAAOC,QAAQC,IAAI,CAAC;QAClBL,QAAQM,OAAO,CAAC,IAAMC,aAAaJ;QACnC,IAAIC,QAAW,CAACI,GAAGC;YACjBN,YAAYO,WAAW,IAAMD,OAAO,IAAIE,MAAM,CAAC,cAAc,EAAEV,GAAG,IAAI,EAAEC,WAAW,IAAID;QACzF;KACD;AACH;AAEA;;;;;;;;;;;CAWC,GACD,SAASW,mBAAmBC,MAAsB;IAChD,kCAAkC;IAClC,IAAIA,OAAOC,IAAI,EAAE;QACf,gDAAgD;QAChD,IAAID,OAAOE,GAAG,EAAE;YACd,MAAMA,MAAM,IAAIC,IAAIH,OAAOE,GAAG;YAC9B,MAAME,WAAWF,IAAIE,QAAQ;YAE7B,IAAI,AAACA,CAAAA,aAAa,WAAWA,aAAa,QAAO,KAAMJ,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW;gBAC1G,MAAM,IAAIH,MAAM,CAAC,qCAAqC,EAAEM,SAAS,iCAAiC,EAAEJ,OAAOC,IAAI,CAAC,CAAC,CAAC;YACpH;QACF;QAEA,yBAAyB;QACzB,IAAID,OAAOC,IAAI,KAAK,UAAUD,OAAOC,IAAI,KAAK,WAAW,OAAO;QAChE,IAAID,OAAOC,IAAI,KAAK,SAAS,OAAO;QAEpC,MAAM,IAAIH,MAAM,CAAC,4BAA4B,EAAEE,OAAOC,IAAI,EAAE;IAC9D;IAEA,sCAAsC;IACtC,IAAID,OAAOE,GAAG,EAAE;QACd,MAAMA,MAAM,IAAIC,IAAIH,OAAOE,GAAG;QAC9B,MAAME,WAAWF,IAAIE,QAAQ;QAE7B,IAAIA,aAAa,WAAWA,aAAa,UAAU;YACjD,OAAO;QACT;QACA,MAAM,IAAIN,MAAM,CAAC,0BAA0B,EAAEM,UAAU;IACzD;IAEA,+BAA+B;IAC/B,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GACD,OAAO,eAAeC,iBACpBC,gBAA8C,EAC9CC,UAAkB,EAClBC,OAGC;;IAED,gEAAgE;IAChE,MAAMC,aAAa,aAAaH,oBAAoBA,iBAAiBI,OAAO,YAAYC;IACxF,MAAMC,gBAA+BH,aAAa,AAACH,iBAAkCN,MAAM,GAAIM;IAC/F,MAAMO,WAAWJ,aAAcH,mBAAoCQ;IACnE,MAAMhC,iBAAS0B,oBAAAA,8BAAAA,QAAS1B,MAAM,uCAAIC;IAElC,MAAMgC,eAAeH,aAAa,CAACL,WAAW;IAE9C,IAAI,CAACQ,cAAc;QACjB,MAAMC,YAAYC,OAAOC,IAAI,CAACN,eAAeO,IAAI,CAAC;QAClD,MAAM,IAAIrB,MAAM,CAAC,QAAQ,EAAES,WAAW,0CAA0C,EAAES,aAAa,QAAQ;IACzG;IAEA,uCAAuC;IACvC,MAAMI,gBAAgBrB,mBAAmBgB;IAEzC,oBAAoB;IACpB,MAAMM,SAAS,IAAIhD,OAAO;QAAEiD,MAAM;QAAkBC,SAAS;IAAQ,GAAG;QAAEC,cAAc,CAAC;IAAE;IAE3F,sCAAsC;IACtC,IAAIJ,kBAAkB,SAAS;QAC7B,qDAAqD;QACrD,MAAMK,eAAeZ,qBAAAA,+BAAAA,SAAUH,OAAO,CAACgB,GAAG,CAACnB;QAE3C,IAAIkB,cAAc;YAChB,oCAAoC;YACpC,MAAME,YAAY,IAAI3C,yBAAyByC,aAAaG,OAAO;YACnE,MAAMP,OAAOQ,OAAO,CAACF;QACvB,OAAO;YACL,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,CAACZ,aAAae,OAAO,EAAE;gBACzB,MAAM,IAAIhC,MAAM,CAAC,QAAQ,EAAES,WAAW,iDAAiD,CAAC;YAC1F;YAEA,MAAMoB,YAAY,IAAInD,qBAAqB;gBACzCsD,SAASf,aAAae,OAAO;gBAC7BC,MAAMhB,aAAagB,IAAI,IAAI,EAAE;gBAC7BC,KAAKjB,aAAaiB,GAAG,IAAI,CAAC;YAC5B;YAEA,qFAAqF;YACrF,MAAMX,OAAOQ,OAAO,CAACF;QACvB;IACF,OAAO,IAAIP,kBAAkB,QAAQ;QACnC,IAAI,CAAE,CAAA,SAASL,YAAW,KAAM,CAACA,aAAab,GAAG,EAAE;YACjD,MAAM,IAAIJ,MAAM,CAAC,QAAQ,EAAES,WAAW,4CAA4C,CAAC;QACrF;QAEA,iEAAiE;QACjE,iEAAiE;QACjE,MAAM0B,gBAAgBpB,qBAAAA,+BAAAA,SAAUH,OAAO,CAACwB,GAAG,CAAC3B;QAE5C,IAAI0B,eAAe;YACjBnD,OAAOqD,KAAK,CAAC,CAAC,4CAA4C,EAAE5B,WAAW,KAAK,EAAEQ,aAAab,GAAG,EAAE;YAChG,MAAMjB,iBAAiB8B,aAAab,GAAG;YACvCpB,OAAOqD,KAAK,CAAC,CAAC,gCAAgC,EAAE5B,WAAW,OAAO,CAAC;QACrE;QAEA,MAAML,MAAM,IAAIC,IAAIY,aAAab,GAAG;QAEpC,gEAAgE;QAChE,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,uDAAuD;QACvD,MAAMkC,eAAevD,aAAakC,aAAab,GAAG;QAClD,MAAMsB,eAAe,MAAMtC,YAAYR,sBAAsB0D,eAAezD,iCAAiC;QAE7G,IAAI0D;QAEJ,IAAIb,aAAac,WAAW,EAAE;YAC5BxD,OAAOqD,KAAK,CAAC,CAAC,WAAW,EAAE5B,WAAW,6BAA6B,CAAC;YAEpE,8DAA8D;YAC9D,MAAMgC,OAAO,MAAM9D;YACnB,MAAM+D,cAAc,CAAC,iBAAiB,EAAED,KAAK,SAAS,CAAC;YAEvD,+EAA+E;YAC/E,MAAME,gBAAgB,IAAI7D,iBAAiB;gBACzC8D,UAAU;gBACVF;gBACA1D;mBACG0B,oBAAAA,8BAAAA,QAASmC,gBAAgB,AAA5B;YACF;YAEA,+DAA+D;YAC/D,MAAMC,SAAS,MAAMH,cAAcI,mBAAmB,CAACT,cAAcZ;YACrEa,YAAYO,OAAOE,WAAW;YAE9BhE,OAAOqD,KAAK,CAAC,CAAC,+BAA+B,EAAE5B,WAAW,CAAC,CAAC;QAC9D,OAAO;YACLzB,OAAOqD,KAAK,CAAC,CAAC,YAAY,EAAE5B,WAAW,0DAA0D,CAAC;QACpG;QAEA,IAAI;YACF,iEAAiE;YACjE,8FAA8F;YAC9F,MAAMwC,gBAAgBhC,aAAaiC,OAAO,IAAI,CAAC;YAC/C,MAAMC,aAAaZ,YAAY;gBAAEa,eAAe,CAAC,OAAO,EAAEb,WAAW;YAAC,IAAI,CAAC;YAC3E,MAAMc,gBAAgB;gBAAE,GAAGJ,aAAa;gBAAE,GAAGE,UAAU;YAAC;YAExD,MAAMG,mBACJnC,OAAOC,IAAI,CAACiC,eAAeE,MAAM,GAAG,IAChC;gBACEC,aAAa;oBACXN,SAASG;gBACX;YACF,IACArC;YAEN,MAAMa,YAAY,IAAIpD,8BAA8B2B,KAAKkD;YACzD,+FAA+F;YAC/F,gEAAgE;YAChE,MAAMlE,YAAYmC,OAAOQ,OAAO,CAACF,YAAoC,OAAO;QAC9E,EAAE,OAAO4B,OAAO;YACd,+DAA+D;YAC/D,iFAAiF;YACjF,MAAMC,eAAeD,iBAAiBzD,QAAQyD,MAAME,OAAO,GAAGC,OAAOH;YAErE,0EAA0E;YAC1E,wFAAwF;YACxF,MAAMI,QAAQJ,iBAAiBzD,QAAQ,AAACyD,MAAgDI,KAAK,GAAG7C;YAChG,MAAM8C,sBAAsBD,CAAAA,kBAAAA,4BAAAA,MAAOE,IAAI,MAAK,kBAAkBL,aAAaM,QAAQ,CAAC;YAEpF,IAAIF,qBAAqB;gBACvB,4CAA4C;gBAC5C,MAAMvC,OAAO0C,KAAK,GAAGC,KAAK,CAAC,KAAO;gBAClC,MAAM,IAAIlE,MAAM,CAAC,sBAAsB,EAAEI,KAAK;YAChD;YAEA,8DAA8D;YAC9D,MAAM+D,iBACJT,aAAaM,QAAQ,CAAC,yBAAyB,mBAAmB;YAClEN,aAAaM,QAAQ,CAAC,UAAU,+CAA+C;YAC/EN,aAAaM,QAAQ,CAAC,QAAQ,qBAAqB;YAErD,IAAIG,gBAAgB;gBAClBnF,OAAOoF,IAAI,CAAC,CAAC,wBAAwB,EAAEV,aAAa,gCAAgC,CAAC;YACvF,OAAO;gBACL1E,OAAOoF,IAAI,CAAC;YACd;YAEA,iEAAiE;YACjE,MAAMC,YAAY,IAAI9F,OAAO;gBAAEiD,MAAM;gBAAkBC,SAAS;YAAQ,GAAG;gBAAEC,cAAc,CAAC;YAAE;YAE9F,wDAAwD;YACxD,yDAAyD;YACzD,MAAMuB,gBAAgBhC,aAAaiC,OAAO,IAAI,CAAC;YAC/C,MAAMC,aAAaZ,YAAY;gBAAEa,eAAe,CAAC,OAAO,EAAEb,WAAW;YAAC,IAAI,CAAC;YAC3E,MAAMc,gBAAgB;gBAAE,GAAGJ,aAAa;gBAAE,GAAGE,UAAU;YAAC;YAExD,MAAMmB,sBACJnD,OAAOC,IAAI,CAACiC,eAAeE,MAAM,GAAG,IAChC;gBACEC,aAAa;oBACXN,SAASG;gBACX;YACF,IACArC;YAEN,MAAMuD,eAAe,IAAI/F,mBAAmB4B,KAAKkE;YAEjD,IAAI;gBACF,MAAMlF,YAAYiF,UAAUtC,OAAO,CAACwC,eAAe,OAAO;gBAC1D,wCAAwC;gBACxC,OAAOF;YACT,EAAE,OAAOG,UAAU;gBACjB,gEAAgE;gBAChE,MAAM/E,QAAQgF,GAAG,CAAC;oBAAClD,OAAO0C,KAAK,GAAGC,KAAK,CAAC,KAAO;oBAAIG,UAAUJ,KAAK,GAAGC,KAAK,CAAC,KAAO;iBAAG;gBACrF,MAAMM;YACR;QACF;IACF;IAEA,OAAOjD,QAAQ,iCAAiC;AAClD"}

package/dist/esm/dcr/dcr-authenticator.d.ts

@@ -39,7 +39,9 @@ export declare class DcrAuthenticator {
      * Ensure server is authenticated, performing DCR and OAuth if needed
      * Proactively refreshes tokens if they're within 5 minutes of expiry
      *
-     * @param baseUrl - Base URL of the server (e.g., https://example.com)
+     * @param mcpServerUrl - The MCP server's canonical URL, exactly as configured,
+     *   with its path intact (`https://example.com/mcp`). Not a deployment root:
+     *   the path is what identifies the resource an issued token is bound to.
      * @param capabilities - Auth capabilities from .well-known endpoint
      * @returns Valid token set ready to use
      *
@@ -48,11 +50,30 @@ export declare class DcrAuthenticator {
      * @example
      * const authenticator = new DcrAuthenticator({ redirectUri: 'http://localhost:3000/callback' });
      * const tokens = await authenticator.ensureAuthenticated(
-     *   'https://example.com',
+     *   'https://example.com/mcp',
      *   capabilities
      * );
      */
-    ensureAuthenticated(baseUrl: string, capabilities: AuthCapabilities): Promise<TokenSet>;
+    ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet>;
+    /**
+     * The three things a server URL is used for here, kept apart on purpose.
+     *
+     * They were one value once, and collapsing them is what sent an authorization
+     * server the wrong audience: `resource` was derived from the deployment root,
+     * so a server at `https://host/mcp` was asked to mint a token for
+     * `https://host`, and any server that validates the indicator answered
+     * `invalid_target`.
+     *
+     * - `serverBaseUrl` builds the server's own endpoints (`/oauth/verify`), so a
+     *   trailing `/mcp` comes off.
+     * - `resource` is the RFC 8707 audience. The resource server names itself in
+     *   its RFC 9728 metadata; that name wins. Only when no such document exists
+     *   do we fall back to the URL we were configured with.
+     * - `storeKey` identifies the credential locally. It stays the configured URL
+     *   rather than the discovered `resource`, so it can be computed without a
+     *   network round trip - `deleteTokens` has only the URL to work from.
+     */
+    private resolveUrls;
     /**
      * Handle authentication for self-hosted DCR servers
      * Self-hosted servers manage their own token storage via /oauth/verify
@@ -68,9 +89,14 @@ export declare class DcrAuthenticator {
     private refreshTokens;
     /**
      * Deletes both stored token families for a server, across every issuer they were bound to.
+     *
+     * Takes the same `mcpServerUrl` that {@link DcrAuthenticator.ensureAuthenticated}
+     * was given - keys are built from the configured URL, never from the discovered
+     * RFC 8707 resource, precisely so this can find them without doing discovery.
+     *
      * @throws CredentialBindingError if the configured store cannot enumerate keys.
      */
-    deleteTokens(baseUrl: string): Promise<void>;
+    deleteTokens(mcpServerUrl: string): Promise<void>;
     /** Discards a stored credential that is not bound to `issuer` (SEP-2352), including one stored before issuer binding existed. */
     private loadTokens;
     private buildFlowOptions;

package/dist/esm/dcr/dcr-authenticator.js

@@ -7,7 +7,7 @@ import Keyv from 'keyv';
 import { KeyvFile } from 'keyv-file';
 import { isLoopbackUrl } from '../auth/discovery-fetch.js';
 import { InteractiveOAuthFlow } from '../auth/interactive-oauth-flow.js';
-import { normalizeUrl } from '../lib/url-utils.js';
+import { extractBaseUrl, normalizeUrl } from '../lib/url-utils.js';
 import { logger as defaultLogger } from '../utils/logger.js';
 import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
 /**
@@ -35,13 +35,13 @@ import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
     /**
    * Detect if server is self-hosted DCR (vs external OAuth provider)
    * Self-hosted servers have their own OAuth endpoints and manage token storage
-   */ async detectSelfHostedMode(baseUrl) {
+   */ async detectSelfHostedMode(mcpServerUrl) {
         try {
             // Self-hosted DCR servers typically run their own OAuth server
             // Check if this is a self-hosted instance by testing OAuth metadata
-            // For now, assume self-hosted if baseUrl matches common localhost patterns
+            // For now, assume self-hosted if the URL matches common localhost patterns
             // TODO: Implement proper self-hosted detection logic
-            return baseUrl.includes('localhost') || baseUrl.includes('127.0.0.1');
+            return mcpServerUrl.includes('localhost') || mcpServerUrl.includes('127.0.0.1');
         } catch (_error) {
             return false; // Assume external mode if detection fails
         }
@@ -50,7 +50,9 @@ import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
    * Ensure server is authenticated, performing DCR and OAuth if needed
    * Proactively refreshes tokens if they're within 5 minutes of expiry
    *
-   * @param baseUrl - Base URL of the server (e.g., https://example.com)
+   * @param mcpServerUrl - The MCP server's canonical URL, exactly as configured,
+   *   with its path intact (`https://example.com/mcp`). Not a deployment root:
+   *   the path is what identifies the resource an issued token is bound to.
    * @param capabilities - Auth capabilities from .well-known endpoint
    * @returns Valid token set ready to use
    *
@@ -59,33 +61,59 @@ import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
    * @example
    * const authenticator = new DcrAuthenticator({ redirectUri: 'http://localhost:3000/callback' });
    * const tokens = await authenticator.ensureAuthenticated(
-   *   'https://example.com',
+   *   'https://example.com/mcp',
    *   capabilities
    * );
-   */ async ensureAuthenticated(baseUrl, capabilities) {
+   */ async ensureAuthenticated(mcpServerUrl, capabilities) {
         // Auto-detect server mode
-        const isSelfHosted = await this.detectSelfHostedMode(baseUrl);
+        const isSelfHosted = await this.detectSelfHostedMode(mcpServerUrl);
         if (isSelfHosted) {
-            return this.ensureAuthenticatedSelfHosted(baseUrl, capabilities);
+            return this.ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities);
         }
-        return this.ensureAuthenticatedExternal(baseUrl, capabilities);
+        return this.ensureAuthenticatedExternal(mcpServerUrl, capabilities);
+    }
+    /**
+   * The three things a server URL is used for here, kept apart on purpose.
+   *
+   * They were one value once, and collapsing them is what sent an authorization
+   * server the wrong audience: `resource` was derived from the deployment root,
+   * so a server at `https://host/mcp` was asked to mint a token for
+   * `https://host`, and any server that validates the indicator answered
+   * `invalid_target`.
+   *
+   * - `serverBaseUrl` builds the server's own endpoints (`/oauth/verify`), so a
+   *   trailing `/mcp` comes off.
+   * - `resource` is the RFC 8707 audience. The resource server names itself in
+   *   its RFC 9728 metadata; that name wins. Only when no such document exists
+   *   do we fall back to the URL we were configured with.
+   * - `storeKey` identifies the credential locally. It stays the configured URL
+   *   rather than the discovered `resource`, so it can be computed without a
+   *   network round trip - `deleteTokens` has only the URL to work from.
+   */ resolveUrls(mcpServerUrl, capabilities) {
+        var _capabilities_resource;
+        const storeKey = normalizeUrl(mcpServerUrl);
+        return {
+            serverBaseUrl: extractBaseUrl(mcpServerUrl),
+            resource: (_capabilities_resource = capabilities.resource) !== null && _capabilities_resource !== void 0 ? _capabilities_resource : storeKey,
+            storeKey
+        };
     }
     /**
    * Handle authentication for self-hosted DCR servers
    * Self-hosted servers manage their own token storage via /oauth/verify
-   */ async ensureAuthenticatedSelfHosted(baseUrl, capabilities) {
+   */ async ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities) {
         // Loopback trust for every discovery-derived fetch below, computed from
         // the server we're talking to, never from capabilities' endpoints (see discovery-fetch.ts).
-        const allowLoopback = isLoopbackUrl(baseUrl);
+        const allowLoopback = isLoopbackUrl(mcpServerUrl);
         const issuer = requireIssuer(capabilities);
-        const resource = normalizeUrl(baseUrl);
-        const dcrTokenKey = `dcr-tokens:${issuer}:${resource}`;
+        const { serverBaseUrl, resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);
+        const dcrTokenKey = `dcr-tokens:${issuer}:${storeKey}`;
         // 1. Check for existing DCR tokens (different from external tokens)
         let tokens = await this.loadTokens(dcrTokenKey, issuer);
         if (tokens) {
             // 2. Verify token is still valid by calling /oauth/verify
             try {
-                const verifyUrl = `${baseUrl}/oauth/verify`;
+                const verifyUrl = `${serverBaseUrl}/oauth/verify`;
                 const verifyResponse = await fetch(verifyUrl, {
                     headers: {
                         Authorization: `Bearer ${tokens.accessToken}`,
@@ -124,7 +152,7 @@ import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
         tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);
         // For self-hosted mode, verify the token works with /oauth/verify immediately
         try {
-            const verifyUrl = `${baseUrl}/oauth/verify`;
+            const verifyUrl = `${serverBaseUrl}/oauth/verify`;
             const verifyResponse = await fetch(verifyUrl, {
                 headers: {
                     Authorization: `Bearer ${tokens.accessToken}`,
@@ -151,12 +179,12 @@ import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
         this.logger.debug('✅ Self-hosted DCR authentication successful, tokens saved');
         return tokens;
     }
-    /** Handles authentication for external (non-self-hosted) OAuth providers. */ async ensureAuthenticatedExternal(baseUrl, capabilities) {
+    /** Handles authentication for external (non-self-hosted) OAuth providers. */ async ensureAuthenticatedExternal(mcpServerUrl, capabilities) {
         // See ensureAuthenticatedSelfHosted - same loopback trust rule.
-        const allowLoopback = isLoopbackUrl(baseUrl);
+        const allowLoopback = isLoopbackUrl(mcpServerUrl);
         const issuer = requireIssuer(capabilities);
-        const resource = normalizeUrl(baseUrl);
-        const tokenKey = `tokens:${issuer}:${resource}`;
+        const { resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);
+        const tokenKey = `tokens:${issuer}:${storeKey}`;
         // 1. Check for existing tokens
         let tokens = await this.loadTokens(tokenKey, issuer);
         if (tokens) {
@@ -223,9 +251,14 @@ import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
     }
     /**
    * Deletes both stored token families for a server, across every issuer they were bound to.
+   *
+   * Takes the same `mcpServerUrl` that {@link DcrAuthenticator.ensureAuthenticated}
+   * was given - keys are built from the configured URL, never from the discovered
+   * RFC 8707 resource, precisely so this can find them without doing discovery.
+   *
    * @throws CredentialBindingError if the configured store cannot enumerate keys.
-   */ async deleteTokens(baseUrl) {
-        const suffix = `:${normalizeUrl(baseUrl)}`;
+   */ async deleteTokens(mcpServerUrl) {
+        const suffix = `:${normalizeUrl(mcpServerUrl)}`;
         if (!this.tokenStore.iterator) {
             throw new CredentialBindingError('Token store does not support key enumeration, which issuer-keyed credentials require');
         }
@@ -234,7 +267,7 @@ import { DynamicClientRegistrar } from './dynamic-client-registrar.js';
                 await this.tokenStore.delete(key);
             }
         }
-        this.logger.debug(`🗑️  Deleted tokens for ${baseUrl}`);
+        this.logger.debug(`🗑️  Deleted tokens for ${mcpServerUrl}`);
     }
     /** Discards a stored credential that is not bound to `issuer` (SEP-2352), including one stored before issuer binding existed. */ async loadTokens(key, issuer) {
         const tokens = await this.tokenStore.get(key);

package/dist/esm/dcr/dcr-authenticator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/dcr/dcr-authenticator.ts"],"sourcesContent":["/**\n * DCR Authenticator\n * Consolidates DCR and OAuth flow logic for MCP HTTP servers\n */\n\nimport path from 'node:path';\nimport * as fs from 'fs';\nimport Keyv from 'keyv';\nimport { KeyvFile } from 'keyv-file';\nimport { isLoopbackUrl } from '../auth/discovery-fetch.ts';\nimport { InteractiveOAuthFlow } from '../auth/interactive-oauth-flow.ts';\nimport type { AuthCapabilities, OAuthFlowOptions, TokenSet } from '../auth/types.ts';\nimport { normalizeUrl } from '../lib/url-utils.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { DynamicClientRegistrar } from './dynamic-client-registrar.ts';\n\n/**\n * DcrAuthenticator configuration options\n */\nexport interface DcrAuthenticatorOptions {\n  /** Custom Keyv store (for testing) - if not provided, uses default ~/.mcpeasy/tokens.json */\n  tokenStore?: Keyv;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Required redirect URI for OAuth callback */\n  redirectUri: string;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * Buffer time before token expiry to trigger proactive refresh (5 minutes)\n */\nconst REFRESH_BUFFER_MS = 5 * 60 * 1000;\n\n/** Raised when a credential cannot be bound to, or looked up by, an issuer. */\nclass CredentialBindingError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'CredentialBindingError';\n  }\n}\n\n/**\n * The issuer credentials are keyed by, so they can never be presented to a\n * different authorization server even when the resource keeps its URL (SEP-2352).\n */\nfunction requireIssuer(capabilities: AuthCapabilities): string {\n  if (!capabilities.issuer) {\n    throw new CredentialBindingError('Authorization server metadata has no issuer - credentials cannot be bound to an authorization server (RFC 8414 requires issuer)');\n  }\n  return capabilities.issuer;\n}\n\n/**\n * DcrAuthenticator manages authentication for MCP HTTP servers\n * Handles DCR registration, OAuth flows, and token management\n */\nexport class DcrAuthenticator {\n  private tokenStore: Keyv;\n  private dcrClient: DynamicClientRegistrar;\n  private oauthFlow: InteractiveOAuthFlow;\n  private headless: boolean;\n  private redirectUri: string;\n  private logger: Logger;\n\n  constructor(options: DcrAuthenticatorOptions) {\n    if (options.tokenStore) {\n      this.tokenStore = options.tokenStore;\n    } else {\n      // Default CLI store in .mcp-z directory (per-project)\n      const storePath = path.join(process.cwd(), '.mcp-z', 'tokens.json');\n\n      // Ensure directory exists before creating store\n      fs.mkdirSync(path.dirname(storePath), { recursive: true });\n\n      this.tokenStore = new Keyv({\n        store: new KeyvFile({ filename: storePath }),\n      });\n    }\n    this.dcrClient = new DynamicClientRegistrar();\n    this.oauthFlow = new InteractiveOAuthFlow();\n    this.headless = options.headless || false;\n    this.redirectUri = options.redirectUri;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Detect if server is self-hosted DCR (vs external OAuth provider)\n   * Self-hosted servers have their own OAuth endpoints and manage token storage\n   */\n  private async detectSelfHostedMode(baseUrl: string): Promise<boolean> {\n    try {\n      // Self-hosted DCR servers typically run their own OAuth server\n      // Check if this is a self-hosted instance by testing OAuth metadata\n      // For now, assume self-hosted if baseUrl matches common localhost patterns\n      // TODO: Implement proper self-hosted detection logic\n      return baseUrl.includes('localhost') || baseUrl.includes('127.0.0.1');\n    } catch (_error) {\n      return false; // Assume external mode if detection fails\n    }\n  }\n\n  /**\n   * Ensure server is authenticated, performing DCR and OAuth if needed\n   * Proactively refreshes tokens if they're within 5 minutes of expiry\n   *\n   * @param baseUrl - Base URL of the server (e.g., https://example.com)\n   * @param capabilities - Auth capabilities from .well-known endpoint\n   * @returns Valid token set ready to use\n   *\n   * @throws Error if authentication fails\n   *\n   * @example\n   * const authenticator = new DcrAuthenticator({ redirectUri: 'http://localhost:3000/callback' });\n   * const tokens = await authenticator.ensureAuthenticated(\n   *   'https://example.com',\n   *   capabilities\n   * );\n   */\n  async ensureAuthenticated(baseUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // Auto-detect server mode\n    const isSelfHosted = await this.detectSelfHostedMode(baseUrl);\n\n    if (isSelfHosted) {\n      return this.ensureAuthenticatedSelfHosted(baseUrl, capabilities);\n    }\n    return this.ensureAuthenticatedExternal(baseUrl, capabilities);\n  }\n\n  /**\n   * Handle authentication for self-hosted DCR servers\n   * Self-hosted servers manage their own token storage via /oauth/verify\n   */\n  private async ensureAuthenticatedSelfHosted(baseUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // Loopback trust for every discovery-derived fetch below, computed from\n    // the server we're talking to, never from capabilities' endpoints (see discovery-fetch.ts).\n    const allowLoopback = isLoopbackUrl(baseUrl);\n    const issuer = requireIssuer(capabilities);\n    const resource = normalizeUrl(baseUrl);\n    const dcrTokenKey = `dcr-tokens:${issuer}:${resource}`;\n\n    // 1. Check for existing DCR tokens (different from external tokens)\n    let tokens = await this.loadTokens(dcrTokenKey, issuer);\n\n    if (tokens) {\n      // 2. Verify token is still valid by calling /oauth/verify\n      try {\n        const verifyUrl = `${baseUrl}/oauth/verify`;\n        const verifyResponse = await fetch(verifyUrl, {\n          headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n        });\n\n        if (verifyResponse.ok) {\n          const verifyData = (await verifyResponse.json()) as { token?: string };\n          if (verifyData.token === tokens.accessToken) {\n            // Token is still valid with the self-hosted server\n            return tokens;\n          }\n        }\n      } catch (_error) {\n        // Token verification failed - need to re-authenticate\n      }\n\n      // Token is expired or invalid\n      await this.tokenStore.delete(dcrTokenKey);\n      tokens = undefined;\n    }\n\n    // 3. No valid tokens - perform full DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting self-hosted DCR authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client with self-hosted server...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // For self-hosted mode, verify the token works with /oauth/verify immediately\n    try {\n      const verifyUrl = `${baseUrl}/oauth/verify`;\n      const verifyResponse = await fetch(verifyUrl, {\n        headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n      });\n\n      if (!verifyResponse.ok) {\n        throw new Error(`DCR token verification failed after authentication: ${verifyResponse.status}`);\n      }\n\n      const verifyData = (await verifyResponse.json()) as { token?: string };\n      if (verifyData.token !== tokens.accessToken) {\n        throw new Error('DCR server returned different token in verification');\n      }\n\n      this.logger.debug('✅ DCR token verified with self-hosted server');\n    } catch (error) {\n      this.logger.error('❌ DCR token verification failed:', error instanceof Error ? error.message : String(error));\n      throw new Error('Self-hosted DCR authentication completed but token verification failed');\n    }\n\n    // Save tokens for future use\n    await this.tokenStore.set(dcrTokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Self-hosted DCR authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /** Handles authentication for external (non-self-hosted) OAuth providers. */\n  private async ensureAuthenticatedExternal(baseUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // See ensureAuthenticatedSelfHosted - same loopback trust rule.\n    const allowLoopback = isLoopbackUrl(baseUrl);\n    const issuer = requireIssuer(capabilities);\n    const resource = normalizeUrl(baseUrl);\n    const tokenKey = `tokens:${issuer}:${resource}`;\n\n    // 1. Check for existing tokens\n    let tokens = await this.loadTokens(tokenKey, issuer);\n\n    if (tokens) {\n      // 2. Proactive refresh if token expires within 5 minutes\n      if (tokens.expiresAt < Date.now() + REFRESH_BUFFER_MS) {\n        this.logger.debug('🔄 Refreshing access token...');\n\n        try {\n          tokens = await this.refreshTokens(tokens, capabilities.tokenEndpoint, resource, allowLoopback);\n          await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n          this.logger.debug('✅ Token refreshed successfully');\n        } catch (_error) {\n          // Refresh failed - clear tokens and re-authenticate\n          this.logger.warn('⚠️  Token refresh failed, re-authenticating...');\n          await this.tokenStore.delete(tokenKey);\n          tokens = undefined;\n        }\n      }\n\n      if (tokens) {\n        return tokens;\n      }\n    }\n\n    // 3. No valid tokens - perform DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting external OAuth authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // Save tokens for future use\n    await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /**\n   * Refreshes an access token using a refresh token.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed from the server actually being talked to (SSRF mitigation, see discovery-fetch.ts). Defaults to `false`.\n   */\n  private async refreshTokens(tokens: TokenSet, tokenEndpoint: string | undefined, resource: string, allowLoopback = false): Promise<TokenSet> {\n    if (!tokenEndpoint) {\n      throw new Error('Token endpoint not available for refresh');\n    }\n\n    if (!tokens.refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    if (!tokens.clientId || !tokens.clientSecret) {\n      throw new Error('Client credentials not available for refresh');\n    }\n\n    return await this.oauthFlow.refreshTokens(tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret, resource, allowLoopback);\n  }\n\n  /**\n   * Deletes both stored token families for a server, across every issuer they were bound to.\n   * @throws CredentialBindingError if the configured store cannot enumerate keys.\n   */\n  async deleteTokens(baseUrl: string): Promise<void> {\n    const suffix = `:${normalizeUrl(baseUrl)}`;\n    if (!this.tokenStore.iterator) {\n      throw new CredentialBindingError('Token store does not support key enumeration, which issuer-keyed credentials require');\n    }\n\n    for await (const [key] of this.tokenStore.iterator(this.tokenStore.namespace)) {\n      if (typeof key === 'string' && (key.startsWith('tokens:') || key.startsWith('dcr-tokens:')) && key.endsWith(suffix)) {\n        await this.tokenStore.delete(key);\n      }\n    }\n    this.logger.debug(`🗑️  Deleted tokens for ${baseUrl}`);\n  }\n\n  /** Discards a stored credential that is not bound to `issuer` (SEP-2352), including one stored before issuer binding existed. */\n  private async loadTokens(key: string, issuer: string): Promise<TokenSet | undefined> {\n    const tokens = (await this.tokenStore.get(key)) as TokenSet | undefined;\n    if (!tokens) return undefined;\n    if (tokens.issuer === issuer) return tokens;\n\n    this.logger.debug('🔑 Stored credential is not bound to the discovered issuer, re-authorizing');\n    await this.tokenStore.delete(key);\n    return undefined;\n  }\n\n  private buildFlowOptions(port: number, capabilities: AuthCapabilities, issuer: string, resource: string, allowLoopback: boolean): OAuthFlowOptions {\n    const flowOptions: OAuthFlowOptions = {\n      port,\n      issuer,\n      resource,\n      headless: this.headless,\n      redirectUri: this.redirectUri,\n      pkce: true,\n      logger: this.logger,\n      allowLoopback,\n      authorizationResponseIssSupported: capabilities.authorizationResponseIssSupported ?? false,\n    };\n    if (capabilities.scopes) {\n      flowOptions.scopes = capabilities.scopes;\n    }\n    return flowOptions;\n  }\n}\n"],"names":["path","fs","Keyv","KeyvFile","isLoopbackUrl","InteractiveOAuthFlow","normalizeUrl","logger","defaultLogger","DynamicClientRegistrar","REFRESH_BUFFER_MS","CredentialBindingError","Error","message","name","requireIssuer","capabilities","issuer","DcrAuthenticator","detectSelfHostedMode","baseUrl","includes","_error","ensureAuthenticated","isSelfHosted","ensureAuthenticatedSelfHosted","ensureAuthenticatedExternal","allowLoopback","resource","dcrTokenKey","tokens","loadTokens","verifyUrl","verifyResponse","fetch","headers","Authorization","accessToken","Connection","ok","verifyData","json","token","tokenStore","delete","undefined","registrationEndpoint","authorizationEndpoint","tokenEndpoint","debug","port","parseInt","URL","redirectUri","startsWith","client","dcrClient","registerClient","flowOptions","buildFlowOptions","oauthFlow","performAuthFlow","clientId","clientSecret","status","error","String","set","tokenKey","expiresAt","Date","now","refreshTokens","warn","refreshToken","deleteTokens","suffix","iterator","key","namespace","endsWith","get","headless","pkce","authorizationResponseIssSupported","scopes","options","storePath","join","process","cwd","mkdirSync","dirname","recursive","store","filename"],"mappings":"AAAA;;;CAGC,GAED,OAAOA,UAAU,YAAY;AAC7B,YAAYC,QAAQ,KAAK;AACzB,OAAOC,UAAU,OAAO;AACxB,SAASC,QAAQ,QAAQ,YAAY;AACrC,SAASC,aAAa,QAAQ,6BAA6B;AAC3D,SAASC,oBAAoB,QAAQ,oCAAoC;AAEzE,SAASC,YAAY,QAAQ,sBAAsB;AACnD,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAC1E,SAASC,sBAAsB,QAAQ,gCAAgC;AAgBvE;;CAEC,GACD,MAAMC,oBAAoB,IAAI,KAAK;AAEnC,6EAA6E,GAC7E,IAAA,AAAMC,yBAAN,MAAMA,+BAA+BC;IACnC,YAAYC,OAAe,CAAE;QAC3B,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA;;;CAGC,GACD,SAASC,cAAcC,YAA8B;IACnD,IAAI,CAACA,aAAaC,MAAM,EAAE;QACxB,MAAM,IAAIN,uBAAuB;IACnC;IACA,OAAOK,aAAaC,MAAM;AAC5B;AAEA;;;CAGC,GACD,OAAO,MAAMC;IA6BX;;;GAGC,GACD,MAAcC,qBAAqBC,OAAe,EAAoB;QACpE,IAAI;YACF,+DAA+D;YAC/D,oEAAoE;YACpE,2EAA2E;YAC3E,qDAAqD;YACrD,OAAOA,QAAQC,QAAQ,CAAC,gBAAgBD,QAAQC,QAAQ,CAAC;QAC3D,EAAE,OAAOC,QAAQ;YACf,OAAO,OAAO,0CAA0C;QAC1D;IACF;IAEA;;;;;;;;;;;;;;;;GAgBC,GACD,MAAMC,oBAAoBH,OAAe,EAAEJ,YAA8B,EAAqB;QAC5F,0BAA0B;QAC1B,MAAMQ,eAAe,MAAM,IAAI,CAACL,oBAAoB,CAACC;QAErD,IAAII,cAAc;YAChB,OAAO,IAAI,CAACC,6BAA6B,CAACL,SAASJ;QACrD;QACA,OAAO,IAAI,CAACU,2BAA2B,CAACN,SAASJ;IACnD;IAEA;;;GAGC,GACD,MAAcS,8BAA8BL,OAAe,EAAEJ,YAA8B,EAAqB;QAC9G,wEAAwE;QACxE,4FAA4F;QAC5F,MAAMW,gBAAgBvB,cAAcgB;QACpC,MAAMH,SAASF,cAAcC;QAC7B,MAAMY,WAAWtB,aAAac;QAC9B,MAAMS,cAAc,CAAC,WAAW,EAAEZ,OAAO,CAAC,EAAEW,UAAU;QAEtD,oEAAoE;QACpE,IAAIE,SAAS,MAAM,IAAI,CAACC,UAAU,CAACF,aAAaZ;QAEhD,IAAIa,QAAQ;YACV,0DAA0D;YAC1D,IAAI;gBACF,MAAME,YAAY,GAAGZ,QAAQ,aAAa,CAAC;gBAC3C,MAAMa,iBAAiB,MAAMC,MAAMF,WAAW;oBAC5CG,SAAS;wBAAEC,eAAe,CAAC,OAAO,EAAEN,OAAOO,WAAW,EAAE;wBAAEC,YAAY;oBAAQ;gBAChF;gBAEA,IAAIL,eAAeM,EAAE,EAAE;oBACrB,MAAMC,aAAc,MAAMP,eAAeQ,IAAI;oBAC7C,IAAID,WAAWE,KAAK,KAAKZ,OAAOO,WAAW,EAAE;wBAC3C,mDAAmD;wBACnD,OAAOP;oBACT;gBACF;YACF,EAAE,OAAOR,QAAQ;YACf,sDAAsD;YACxD;YAEA,8BAA8B;YAC9B,MAAM,IAAI,CAACqB,UAAU,CAACC,MAAM,CAACf;YAC7BC,SAASe;QACX;QAEA,qDAAqD;QACrD,IAAI,CAAC7B,aAAa8B,oBAAoB,IAAI,CAAC9B,aAAa+B,qBAAqB,IAAI,CAAC/B,aAAagC,aAAa,EAAE;YAC5G,MAAM,IAAIpC,MAAM;QAClB;QAEA,IAAI,CAACL,MAAM,CAAC0C,KAAK,CAAC;QAElB,6CAA6C;QAC7C,MAAMC,OAAOC,SAAS,IAAIC,IAAI,IAAI,CAACC,WAAW,EAAEH,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACG,WAAW,CAACC,UAAU,CAAC,YAAY,MAAM,EAAC;QAE7G,gCAAgC;QAChC,IAAI,CAAC/C,MAAM,CAAC0C,KAAK,CAAC;QAClB,MAAMM,SAAS,MAAM,IAAI,CAACC,SAAS,CAACC,cAAc,CAACzC,aAAa8B,oBAAoB,EAAE;YACpFO,aAAa,IAAI,CAACA,WAAW;YAC7B1B;QACF;QAEA,wDAAwD;QACxD,MAAM+B,cAAc,IAAI,CAACC,gBAAgB,CAACT,MAAMlC,cAAcC,QAAQW,UAAUD;QAEhFG,SAAS,MAAM,IAAI,CAAC8B,SAAS,CAACC,eAAe,CAAC7C,aAAa+B,qBAAqB,EAAE/B,aAAagC,aAAa,EAAEO,OAAOO,QAAQ,EAAEP,OAAOQ,YAAY,EAAEL;QAEpJ,8EAA8E;QAC9E,IAAI;YACF,MAAM1B,YAAY,GAAGZ,QAAQ,aAAa,CAAC;YAC3C,MAAMa,iBAAiB,MAAMC,MAAMF,WAAW;gBAC5CG,SAAS;oBAAEC,eAAe,CAAC,OAAO,EAAEN,OAAOO,WAAW,EAAE;oBAAEC,YAAY;gBAAQ;YAChF;YAEA,IAAI,CAACL,eAAeM,EAAE,EAAE;gBACtB,MAAM,IAAI3B,MAAM,CAAC,oDAAoD,EAAEqB,eAAe+B,MAAM,EAAE;YAChG;YAEA,MAAMxB,aAAc,MAAMP,eAAeQ,IAAI;YAC7C,IAAID,WAAWE,KAAK,KAAKZ,OAAOO,WAAW,EAAE;gBAC3C,MAAM,IAAIzB,MAAM;YAClB;YAEA,IAAI,CAACL,MAAM,CAAC0C,KAAK,CAAC;QACpB,EAAE,OAAOgB,OAAO;YACd,IAAI,CAAC1D,MAAM,CAAC0D,KAAK,CAAC,oCAAoCA,iBAAiBrD,QAAQqD,MAAMpD,OAAO,GAAGqD,OAAOD;YACtG,MAAM,IAAIrD,MAAM;QAClB;QAEA,6BAA6B;QAC7B,MAAM,IAAI,CAAC+B,UAAU,CAACwB,GAAG,CAACtC,aAAa;YAAE,GAAGC,MAAM;YAAEb;QAAO;QAC3D,IAAI,CAACV,MAAM,CAAC0C,KAAK,CAAC;QAElB,OAAOnB;IACT;IAEA,2EAA2E,GAC3E,MAAcJ,4BAA4BN,OAAe,EAAEJ,YAA8B,EAAqB;QAC5G,gEAAgE;QAChE,MAAMW,gBAAgBvB,cAAcgB;QACpC,MAAMH,SAASF,cAAcC;QAC7B,MAAMY,WAAWtB,aAAac;QAC9B,MAAMgD,WAAW,CAAC,OAAO,EAAEnD,OAAO,CAAC,EAAEW,UAAU;QAE/C,+BAA+B;QAC/B,IAAIE,SAAS,MAAM,IAAI,CAACC,UAAU,CAACqC,UAAUnD;QAE7C,IAAIa,QAAQ;YACV,yDAAyD;YACzD,IAAIA,OAAOuC,SAAS,GAAGC,KAAKC,GAAG,KAAK7D,mBAAmB;gBACrD,IAAI,CAACH,MAAM,CAAC0C,KAAK,CAAC;gBAElB,IAAI;oBACFnB,SAAS,MAAM,IAAI,CAAC0C,aAAa,CAAC1C,QAAQd,aAAagC,aAAa,EAAEpB,UAAUD;oBAChF,MAAM,IAAI,CAACgB,UAAU,CAACwB,GAAG,CAACC,UAAU;wBAAE,GAAGtC,MAAM;wBAAEb;oBAAO;oBACxD,IAAI,CAACV,MAAM,CAAC0C,KAAK,CAAC;gBACpB,EAAE,OAAO3B,QAAQ;oBACf,oDAAoD;oBACpD,IAAI,CAACf,MAAM,CAACkE,IAAI,CAAC;oBACjB,MAAM,IAAI,CAAC9B,UAAU,CAACC,MAAM,CAACwB;oBAC7BtC,SAASe;gBACX;YACF;YAEA,IAAIf,QAAQ;gBACV,OAAOA;YACT;QACF;QAEA,gDAAgD;QAChD,IAAI,CAACd,aAAa8B,oBAAoB,IAAI,CAAC9B,aAAa+B,qBAAqB,IAAI,CAAC/B,aAAagC,aAAa,EAAE;YAC5G,MAAM,IAAIpC,MAAM;QAClB;QAEA,IAAI,CAACL,MAAM,CAAC0C,KAAK,CAAC;QAElB,6CAA6C;QAC7C,MAAMC,OAAOC,SAAS,IAAIC,IAAI,IAAI,CAACC,WAAW,EAAEH,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACG,WAAW,CAACC,UAAU,CAAC,YAAY,MAAM,EAAC;QAE7G,gCAAgC;QAChC,IAAI,CAAC/C,MAAM,CAAC0C,KAAK,CAAC;QAClB,MAAMM,SAAS,MAAM,IAAI,CAACC,SAAS,CAACC,cAAc,CAACzC,aAAa8B,oBAAoB,EAAE;YACpFO,aAAa,IAAI,CAACA,WAAW;YAC7B1B;QACF;QAEA,wDAAwD;QACxD,MAAM+B,cAAc,IAAI,CAACC,gBAAgB,CAACT,MAAMlC,cAAcC,QAAQW,UAAUD;QAEhFG,SAAS,MAAM,IAAI,CAAC8B,SAAS,CAACC,eAAe,CAAC7C,aAAa+B,qBAAqB,EAAE/B,aAAagC,aAAa,EAAEO,OAAOO,QAAQ,EAAEP,OAAOQ,YAAY,EAAEL;QAEpJ,6BAA6B;QAC7B,MAAM,IAAI,CAACf,UAAU,CAACwB,GAAG,CAACC,UAAU;YAAE,GAAGtC,MAAM;YAAEb;QAAO;QACxD,IAAI,CAACV,MAAM,CAAC0C,KAAK,CAAC;QAElB,OAAOnB;IACT;IAEA;;;;GAIC,GACD,MAAc0C,cAAc1C,MAAgB,EAAEkB,aAAiC,EAAEpB,QAAgB,EAAED,gBAAgB,KAAK,EAAqB;QAC3I,IAAI,CAACqB,eAAe;YAClB,MAAM,IAAIpC,MAAM;QAClB;QAEA,IAAI,CAACkB,OAAO4C,YAAY,EAAE;YACxB,MAAM,IAAI9D,MAAM;QAClB;QAEA,IAAI,CAACkB,OAAOgC,QAAQ,IAAI,CAAChC,OAAOiC,YAAY,EAAE;YAC5C,MAAM,IAAInD,MAAM;QAClB;QAEA,OAAO,MAAM,IAAI,CAACgD,SAAS,CAACY,aAAa,CAACxB,eAAelB,OAAO4C,YAAY,EAAE5C,OAAOgC,QAAQ,EAAEhC,OAAOiC,YAAY,EAAEnC,UAAUD;IAChI;IAEA;;;GAGC,GACD,MAAMgD,aAAavD,OAAe,EAAiB;QACjD,MAAMwD,SAAS,CAAC,CAAC,EAAEtE,aAAac,UAAU;QAC1C,IAAI,CAAC,IAAI,CAACuB,UAAU,CAACkC,QAAQ,EAAE;YAC7B,MAAM,IAAIlE,uBAAuB;QACnC;QAEA,WAAW,MAAM,CAACmE,IAAI,IAAI,IAAI,CAACnC,UAAU,CAACkC,QAAQ,CAAC,IAAI,CAAClC,UAAU,CAACoC,SAAS,EAAG;YAC7E,IAAI,OAAOD,QAAQ,YAAaA,CAAAA,IAAIxB,UAAU,CAAC,cAAcwB,IAAIxB,UAAU,CAAC,cAAa,KAAMwB,IAAIE,QAAQ,CAACJ,SAAS;gBACnH,MAAM,IAAI,CAACjC,UAAU,CAACC,MAAM,CAACkC;YAC/B;QACF;QACA,IAAI,CAACvE,MAAM,CAAC0C,KAAK,CAAC,CAAC,wBAAwB,EAAE7B,SAAS;IACxD;IAEA,+HAA+H,GAC/H,MAAcW,WAAW+C,GAAW,EAAE7D,MAAc,EAAiC;QACnF,MAAMa,SAAU,MAAM,IAAI,CAACa,UAAU,CAACsC,GAAG,CAACH;QAC1C,IAAI,CAAChD,QAAQ,OAAOe;QACpB,IAAIf,OAAOb,MAAM,KAAKA,QAAQ,OAAOa;QAErC,IAAI,CAACvB,MAAM,CAAC0C,KAAK,CAAC;QAClB,MAAM,IAAI,CAACN,UAAU,CAACC,MAAM,CAACkC;QAC7B,OAAOjC;IACT;IAEQc,iBAAiBT,IAAY,EAAElC,YAA8B,EAAEC,MAAc,EAAEW,QAAgB,EAAED,aAAsB,EAAoB;YAU5GX;QATrC,MAAM0C,cAAgC;YACpCR;YACAjC;YACAW;YACAsD,UAAU,IAAI,CAACA,QAAQ;YACvB7B,aAAa,IAAI,CAACA,WAAW;YAC7B8B,MAAM;YACN5E,QAAQ,IAAI,CAACA,MAAM;YACnBoB;YACAyD,iCAAiC,GAAEpE,kDAAAA,aAAaoE,iCAAiC,cAA9CpE,6DAAAA,kDAAkD;QACvF;QACA,IAAIA,aAAaqE,MAAM,EAAE;YACvB3B,YAAY2B,MAAM,GAAGrE,aAAaqE,MAAM;QAC1C;QACA,OAAO3B;IACT;IA1RA,YAAY4B,OAAgC,CAAE;YAkB9BA;QAjBd,IAAIA,QAAQ3C,UAAU,EAAE;YACtB,IAAI,CAACA,UAAU,GAAG2C,QAAQ3C,UAAU;QACtC,OAAO;YACL,sDAAsD;YACtD,MAAM4C,YAAYvF,KAAKwF,IAAI,CAACC,QAAQC,GAAG,IAAI,UAAU;YAErD,gDAAgD;YAChDzF,GAAG0F,SAAS,CAAC3F,KAAK4F,OAAO,CAACL,YAAY;gBAAEM,WAAW;YAAK;YAExD,IAAI,CAAClD,UAAU,GAAG,IAAIzC,KAAK;gBACzB4F,OAAO,IAAI3F,SAAS;oBAAE4F,UAAUR;gBAAU;YAC5C;QACF;QACA,IAAI,CAAC/B,SAAS,GAAG,IAAI/C;QACrB,IAAI,CAACmD,SAAS,GAAG,IAAIvD;QACrB,IAAI,CAAC6E,QAAQ,GAAGI,QAAQJ,QAAQ,IAAI;QACpC,IAAI,CAAC7B,WAAW,GAAGiC,QAAQjC,WAAW;QACtC,IAAI,CAAC9C,MAAM,IAAG+E,kBAAAA,QAAQ/E,MAAM,cAAd+E,6BAAAA,kBAAkB9E;IAClC;AAwQF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/dcr/dcr-authenticator.ts"],"sourcesContent":["/**\n * DCR Authenticator\n * Consolidates DCR and OAuth flow logic for MCP HTTP servers\n */\n\nimport path from 'node:path';\nimport * as fs from 'fs';\nimport Keyv from 'keyv';\nimport { KeyvFile } from 'keyv-file';\nimport { isLoopbackUrl } from '../auth/discovery-fetch.ts';\nimport { InteractiveOAuthFlow } from '../auth/interactive-oauth-flow.ts';\nimport type { AuthCapabilities, OAuthFlowOptions, TokenSet } from '../auth/types.ts';\nimport { extractBaseUrl, normalizeUrl } from '../lib/url-utils.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { DynamicClientRegistrar } from './dynamic-client-registrar.ts';\n\n/**\n * DcrAuthenticator configuration options\n */\nexport interface DcrAuthenticatorOptions {\n  /** Custom Keyv store (for testing) - if not provided, uses default ~/.mcpeasy/tokens.json */\n  tokenStore?: Keyv;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Required redirect URI for OAuth callback */\n  redirectUri: string;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * Buffer time before token expiry to trigger proactive refresh (5 minutes)\n */\nconst REFRESH_BUFFER_MS = 5 * 60 * 1000;\n\n/** Raised when a credential cannot be bound to, or looked up by, an issuer. */\nclass CredentialBindingError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'CredentialBindingError';\n  }\n}\n\n/**\n * The issuer credentials are keyed by, so they can never be presented to a\n * different authorization server even when the resource keeps its URL (SEP-2352).\n */\nfunction requireIssuer(capabilities: AuthCapabilities): string {\n  if (!capabilities.issuer) {\n    throw new CredentialBindingError('Authorization server metadata has no issuer - credentials cannot be bound to an authorization server (RFC 8414 requires issuer)');\n  }\n  return capabilities.issuer;\n}\n\n/**\n * DcrAuthenticator manages authentication for MCP HTTP servers\n * Handles DCR registration, OAuth flows, and token management\n */\nexport class DcrAuthenticator {\n  private tokenStore: Keyv;\n  private dcrClient: DynamicClientRegistrar;\n  private oauthFlow: InteractiveOAuthFlow;\n  private headless: boolean;\n  private redirectUri: string;\n  private logger: Logger;\n\n  constructor(options: DcrAuthenticatorOptions) {\n    if (options.tokenStore) {\n      this.tokenStore = options.tokenStore;\n    } else {\n      // Default CLI store in .mcp-z directory (per-project)\n      const storePath = path.join(process.cwd(), '.mcp-z', 'tokens.json');\n\n      // Ensure directory exists before creating store\n      fs.mkdirSync(path.dirname(storePath), { recursive: true });\n\n      this.tokenStore = new Keyv({\n        store: new KeyvFile({ filename: storePath }),\n      });\n    }\n    this.dcrClient = new DynamicClientRegistrar();\n    this.oauthFlow = new InteractiveOAuthFlow();\n    this.headless = options.headless || false;\n    this.redirectUri = options.redirectUri;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Detect if server is self-hosted DCR (vs external OAuth provider)\n   * Self-hosted servers have their own OAuth endpoints and manage token storage\n   */\n  private async detectSelfHostedMode(mcpServerUrl: string): Promise<boolean> {\n    try {\n      // Self-hosted DCR servers typically run their own OAuth server\n      // Check if this is a self-hosted instance by testing OAuth metadata\n      // For now, assume self-hosted if the URL matches common localhost patterns\n      // TODO: Implement proper self-hosted detection logic\n      return mcpServerUrl.includes('localhost') || mcpServerUrl.includes('127.0.0.1');\n    } catch (_error) {\n      return false; // Assume external mode if detection fails\n    }\n  }\n\n  /**\n   * Ensure server is authenticated, performing DCR and OAuth if needed\n   * Proactively refreshes tokens if they're within 5 minutes of expiry\n   *\n   * @param mcpServerUrl - The MCP server's canonical URL, exactly as configured,\n   *   with its path intact (`https://example.com/mcp`). Not a deployment root:\n   *   the path is what identifies the resource an issued token is bound to.\n   * @param capabilities - Auth capabilities from .well-known endpoint\n   * @returns Valid token set ready to use\n   *\n   * @throws Error if authentication fails\n   *\n   * @example\n   * const authenticator = new DcrAuthenticator({ redirectUri: 'http://localhost:3000/callback' });\n   * const tokens = await authenticator.ensureAuthenticated(\n   *   'https://example.com/mcp',\n   *   capabilities\n   * );\n   */\n  async ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // Auto-detect server mode\n    const isSelfHosted = await this.detectSelfHostedMode(mcpServerUrl);\n\n    if (isSelfHosted) {\n      return this.ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities);\n    }\n    return this.ensureAuthenticatedExternal(mcpServerUrl, capabilities);\n  }\n\n  /**\n   * The three things a server URL is used for here, kept apart on purpose.\n   *\n   * They were one value once, and collapsing them is what sent an authorization\n   * server the wrong audience: `resource` was derived from the deployment root,\n   * so a server at `https://host/mcp` was asked to mint a token for\n   * `https://host`, and any server that validates the indicator answered\n   * `invalid_target`.\n   *\n   * - `serverBaseUrl` builds the server's own endpoints (`/oauth/verify`), so a\n   *   trailing `/mcp` comes off.\n   * - `resource` is the RFC 8707 audience. The resource server names itself in\n   *   its RFC 9728 metadata; that name wins. Only when no such document exists\n   *   do we fall back to the URL we were configured with.\n   * - `storeKey` identifies the credential locally. It stays the configured URL\n   *   rather than the discovered `resource`, so it can be computed without a\n   *   network round trip - `deleteTokens` has only the URL to work from.\n   */\n  private resolveUrls(mcpServerUrl: string, capabilities: AuthCapabilities): { serverBaseUrl: string; resource: string; storeKey: string } {\n    const storeKey = normalizeUrl(mcpServerUrl);\n    return { serverBaseUrl: extractBaseUrl(mcpServerUrl), resource: capabilities.resource ?? storeKey, storeKey };\n  }\n\n  /**\n   * Handle authentication for self-hosted DCR servers\n   * Self-hosted servers manage their own token storage via /oauth/verify\n   */\n  private async ensureAuthenticatedSelfHosted(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // Loopback trust for every discovery-derived fetch below, computed from\n    // the server we're talking to, never from capabilities' endpoints (see discovery-fetch.ts).\n    const allowLoopback = isLoopbackUrl(mcpServerUrl);\n    const issuer = requireIssuer(capabilities);\n    const { serverBaseUrl, resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);\n    const dcrTokenKey = `dcr-tokens:${issuer}:${storeKey}`;\n\n    // 1. Check for existing DCR tokens (different from external tokens)\n    let tokens = await this.loadTokens(dcrTokenKey, issuer);\n\n    if (tokens) {\n      // 2. Verify token is still valid by calling /oauth/verify\n      try {\n        const verifyUrl = `${serverBaseUrl}/oauth/verify`;\n        const verifyResponse = await fetch(verifyUrl, {\n          headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n        });\n\n        if (verifyResponse.ok) {\n          const verifyData = (await verifyResponse.json()) as { token?: string };\n          if (verifyData.token === tokens.accessToken) {\n            // Token is still valid with the self-hosted server\n            return tokens;\n          }\n        }\n      } catch (_error) {\n        // Token verification failed - need to re-authenticate\n      }\n\n      // Token is expired or invalid\n      await this.tokenStore.delete(dcrTokenKey);\n      tokens = undefined;\n    }\n\n    // 3. No valid tokens - perform full DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting self-hosted DCR authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client with self-hosted server...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // For self-hosted mode, verify the token works with /oauth/verify immediately\n    try {\n      const verifyUrl = `${serverBaseUrl}/oauth/verify`;\n      const verifyResponse = await fetch(verifyUrl, {\n        headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n      });\n\n      if (!verifyResponse.ok) {\n        throw new Error(`DCR token verification failed after authentication: ${verifyResponse.status}`);\n      }\n\n      const verifyData = (await verifyResponse.json()) as { token?: string };\n      if (verifyData.token !== tokens.accessToken) {\n        throw new Error('DCR server returned different token in verification');\n      }\n\n      this.logger.debug('✅ DCR token verified with self-hosted server');\n    } catch (error) {\n      this.logger.error('❌ DCR token verification failed:', error instanceof Error ? error.message : String(error));\n      throw new Error('Self-hosted DCR authentication completed but token verification failed');\n    }\n\n    // Save tokens for future use\n    await this.tokenStore.set(dcrTokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Self-hosted DCR authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /** Handles authentication for external (non-self-hosted) OAuth providers. */\n  private async ensureAuthenticatedExternal(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // See ensureAuthenticatedSelfHosted - same loopback trust rule.\n    const allowLoopback = isLoopbackUrl(mcpServerUrl);\n    const issuer = requireIssuer(capabilities);\n    const { resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);\n    const tokenKey = `tokens:${issuer}:${storeKey}`;\n\n    // 1. Check for existing tokens\n    let tokens = await this.loadTokens(tokenKey, issuer);\n\n    if (tokens) {\n      // 2. Proactive refresh if token expires within 5 minutes\n      if (tokens.expiresAt < Date.now() + REFRESH_BUFFER_MS) {\n        this.logger.debug('🔄 Refreshing access token...');\n\n        try {\n          tokens = await this.refreshTokens(tokens, capabilities.tokenEndpoint, resource, allowLoopback);\n          await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n          this.logger.debug('✅ Token refreshed successfully');\n        } catch (_error) {\n          // Refresh failed - clear tokens and re-authenticate\n          this.logger.warn('⚠️  Token refresh failed, re-authenticating...');\n          await this.tokenStore.delete(tokenKey);\n          tokens = undefined;\n        }\n      }\n\n      if (tokens) {\n        return tokens;\n      }\n    }\n\n    // 3. No valid tokens - perform DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting external OAuth authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // Save tokens for future use\n    await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /**\n   * Refreshes an access token using a refresh token.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed from the server actually being talked to (SSRF mitigation, see discovery-fetch.ts). Defaults to `false`.\n   */\n  private async refreshTokens(tokens: TokenSet, tokenEndpoint: string | undefined, resource: string, allowLoopback = false): Promise<TokenSet> {\n    if (!tokenEndpoint) {\n      throw new Error('Token endpoint not available for refresh');\n    }\n\n    if (!tokens.refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    if (!tokens.clientId || !tokens.clientSecret) {\n      throw new Error('Client credentials not available for refresh');\n    }\n\n    return await this.oauthFlow.refreshTokens(tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret, resource, allowLoopback);\n  }\n\n  /**\n   * Deletes both stored token families for a server, across every issuer they were bound to.\n   *\n   * Takes the same `mcpServerUrl` that {@link DcrAuthenticator.ensureAuthenticated}\n   * was given - keys are built from the configured URL, never from the discovered\n   * RFC 8707 resource, precisely so this can find them without doing discovery.\n   *\n   * @throws CredentialBindingError if the configured store cannot enumerate keys.\n   */\n  async deleteTokens(mcpServerUrl: string): Promise<void> {\n    const suffix = `:${normalizeUrl(mcpServerUrl)}`;\n    if (!this.tokenStore.iterator) {\n      throw new CredentialBindingError('Token store does not support key enumeration, which issuer-keyed credentials require');\n    }\n\n    for await (const [key] of this.tokenStore.iterator(this.tokenStore.namespace)) {\n      if (typeof key === 'string' && (key.startsWith('tokens:') || key.startsWith('dcr-tokens:')) && key.endsWith(suffix)) {\n        await this.tokenStore.delete(key);\n      }\n    }\n    this.logger.debug(`🗑️  Deleted tokens for ${mcpServerUrl}`);\n  }\n\n  /** Discards a stored credential that is not bound to `issuer` (SEP-2352), including one stored before issuer binding existed. */\n  private async loadTokens(key: string, issuer: string): Promise<TokenSet | undefined> {\n    const tokens = (await this.tokenStore.get(key)) as TokenSet | undefined;\n    if (!tokens) return undefined;\n    if (tokens.issuer === issuer) return tokens;\n\n    this.logger.debug('🔑 Stored credential is not bound to the discovered issuer, re-authorizing');\n    await this.tokenStore.delete(key);\n    return undefined;\n  }\n\n  private buildFlowOptions(port: number, capabilities: AuthCapabilities, issuer: string, resource: string, allowLoopback: boolean): OAuthFlowOptions {\n    const flowOptions: OAuthFlowOptions = {\n      port,\n      issuer,\n      resource,\n      headless: this.headless,\n      redirectUri: this.redirectUri,\n      pkce: true,\n      logger: this.logger,\n      allowLoopback,\n      authorizationResponseIssSupported: capabilities.authorizationResponseIssSupported ?? false,\n    };\n    if (capabilities.scopes) {\n      flowOptions.scopes = capabilities.scopes;\n    }\n    return flowOptions;\n  }\n}\n"],"names":["path","fs","Keyv","KeyvFile","isLoopbackUrl","InteractiveOAuthFlow","extractBaseUrl","normalizeUrl","logger","defaultLogger","DynamicClientRegistrar","REFRESH_BUFFER_MS","CredentialBindingError","Error","message","name","requireIssuer","capabilities","issuer","DcrAuthenticator","detectSelfHostedMode","mcpServerUrl","includes","_error","ensureAuthenticated","isSelfHosted","ensureAuthenticatedSelfHosted","ensureAuthenticatedExternal","resolveUrls","storeKey","serverBaseUrl","resource","allowLoopback","dcrTokenKey","tokens","loadTokens","verifyUrl","verifyResponse","fetch","headers","Authorization","accessToken","Connection","ok","verifyData","json","token","tokenStore","delete","undefined","registrationEndpoint","authorizationEndpoint","tokenEndpoint","debug","port","parseInt","URL","redirectUri","startsWith","client","dcrClient","registerClient","flowOptions","buildFlowOptions","oauthFlow","performAuthFlow","clientId","clientSecret","status","error","String","set","tokenKey","expiresAt","Date","now","refreshTokens","warn","refreshToken","deleteTokens","suffix","iterator","key","namespace","endsWith","get","headless","pkce","authorizationResponseIssSupported","scopes","options","storePath","join","process","cwd","mkdirSync","dirname","recursive","store","filename"],"mappings":"AAAA;;;CAGC,GAED,OAAOA,UAAU,YAAY;AAC7B,YAAYC,QAAQ,KAAK;AACzB,OAAOC,UAAU,OAAO;AACxB,SAASC,QAAQ,QAAQ,YAAY;AACrC,SAASC,aAAa,QAAQ,6BAA6B;AAC3D,SAASC,oBAAoB,QAAQ,oCAAoC;AAEzE,SAASC,cAAc,EAAEC,YAAY,QAAQ,sBAAsB;AACnE,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAC1E,SAASC,sBAAsB,QAAQ,gCAAgC;AAgBvE;;CAEC,GACD,MAAMC,oBAAoB,IAAI,KAAK;AAEnC,6EAA6E,GAC7E,IAAA,AAAMC,yBAAN,MAAMA,+BAA+BC;IACnC,YAAYC,OAAe,CAAE;QAC3B,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA;;;CAGC,GACD,SAASC,cAAcC,YAA8B;IACnD,IAAI,CAACA,aAAaC,MAAM,EAAE;QACxB,MAAM,IAAIN,uBAAuB;IACnC;IACA,OAAOK,aAAaC,MAAM;AAC5B;AAEA;;;CAGC,GACD,OAAO,MAAMC;IA6BX;;;GAGC,GACD,MAAcC,qBAAqBC,YAAoB,EAAoB;QACzE,IAAI;YACF,+DAA+D;YAC/D,oEAAoE;YACpE,2EAA2E;YAC3E,qDAAqD;YACrD,OAAOA,aAAaC,QAAQ,CAAC,gBAAgBD,aAAaC,QAAQ,CAAC;QACrE,EAAE,OAAOC,QAAQ;YACf,OAAO,OAAO,0CAA0C;QAC1D;IACF;IAEA;;;;;;;;;;;;;;;;;;GAkBC,GACD,MAAMC,oBAAoBH,YAAoB,EAAEJ,YAA8B,EAAqB;QACjG,0BAA0B;QAC1B,MAAMQ,eAAe,MAAM,IAAI,CAACL,oBAAoB,CAACC;QAErD,IAAII,cAAc;YAChB,OAAO,IAAI,CAACC,6BAA6B,CAACL,cAAcJ;QAC1D;QACA,OAAO,IAAI,CAACU,2BAA2B,CAACN,cAAcJ;IACxD;IAEA;;;;;;;;;;;;;;;;;GAiBC,GACD,AAAQW,YAAYP,YAAoB,EAAEJ,YAA8B,EAAiE;YAEvEA;QADhE,MAAMY,WAAWtB,aAAac;QAC9B,OAAO;YAAES,eAAexB,eAAee;YAAeU,QAAQ,GAAEd,yBAAAA,aAAac,QAAQ,cAArBd,oCAAAA,yBAAyBY;YAAUA;QAAS;IAC9G;IAEA;;;GAGC,GACD,MAAcH,8BAA8BL,YAAoB,EAAEJ,YAA8B,EAAqB;QACnH,wEAAwE;QACxE,4FAA4F;QAC5F,MAAMe,gBAAgB5B,cAAciB;QACpC,MAAMH,SAASF,cAAcC;QAC7B,MAAM,EAAEa,aAAa,EAAEC,QAAQ,EAAEF,QAAQ,EAAE,GAAG,IAAI,CAACD,WAAW,CAACP,cAAcJ;QAC7E,MAAMgB,cAAc,CAAC,WAAW,EAAEf,OAAO,CAAC,EAAEW,UAAU;QAEtD,oEAAoE;QACpE,IAAIK,SAAS,MAAM,IAAI,CAACC,UAAU,CAACF,aAAaf;QAEhD,IAAIgB,QAAQ;YACV,0DAA0D;YAC1D,IAAI;gBACF,MAAME,YAAY,GAAGN,cAAc,aAAa,CAAC;gBACjD,MAAMO,iBAAiB,MAAMC,MAAMF,WAAW;oBAC5CG,SAAS;wBAAEC,eAAe,CAAC,OAAO,EAAEN,OAAOO,WAAW,EAAE;wBAAEC,YAAY;oBAAQ;gBAChF;gBAEA,IAAIL,eAAeM,EAAE,EAAE;oBACrB,MAAMC,aAAc,MAAMP,eAAeQ,IAAI;oBAC7C,IAAID,WAAWE,KAAK,KAAKZ,OAAOO,WAAW,EAAE;wBAC3C,mDAAmD;wBACnD,OAAOP;oBACT;gBACF;YACF,EAAE,OAAOX,QAAQ;YACf,sDAAsD;YACxD;YAEA,8BAA8B;YAC9B,MAAM,IAAI,CAACwB,UAAU,CAACC,MAAM,CAACf;YAC7BC,SAASe;QACX;QAEA,qDAAqD;QACrD,IAAI,CAAChC,aAAaiC,oBAAoB,IAAI,CAACjC,aAAakC,qBAAqB,IAAI,CAAClC,aAAamC,aAAa,EAAE;YAC5G,MAAM,IAAIvC,MAAM;QAClB;QAEA,IAAI,CAACL,MAAM,CAAC6C,KAAK,CAAC;QAElB,6CAA6C;QAC7C,MAAMC,OAAOC,SAAS,IAAIC,IAAI,IAAI,CAACC,WAAW,EAAEH,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACG,WAAW,CAACC,UAAU,CAAC,YAAY,MAAM,EAAC;QAE7G,gCAAgC;QAChC,IAAI,CAAClD,MAAM,CAAC6C,KAAK,CAAC;QAClB,MAAMM,SAAS,MAAM,IAAI,CAACC,SAAS,CAACC,cAAc,CAAC5C,aAAaiC,oBAAoB,EAAE;YACpFO,aAAa,IAAI,CAACA,WAAW;YAC7BzB;QACF;QAEA,wDAAwD;QACxD,MAAM8B,cAAc,IAAI,CAACC,gBAAgB,CAACT,MAAMrC,cAAcC,QAAQa,UAAUC;QAEhFE,SAAS,MAAM,IAAI,CAAC8B,SAAS,CAACC,eAAe,CAAChD,aAAakC,qBAAqB,EAAElC,aAAamC,aAAa,EAAEO,OAAOO,QAAQ,EAAEP,OAAOQ,YAAY,EAAEL;QAEpJ,8EAA8E;QAC9E,IAAI;YACF,MAAM1B,YAAY,GAAGN,cAAc,aAAa,CAAC;YACjD,MAAMO,iBAAiB,MAAMC,MAAMF,WAAW;gBAC5CG,SAAS;oBAAEC,eAAe,CAAC,OAAO,EAAEN,OAAOO,WAAW,EAAE;oBAAEC,YAAY;gBAAQ;YAChF;YAEA,IAAI,CAACL,eAAeM,EAAE,EAAE;gBACtB,MAAM,IAAI9B,MAAM,CAAC,oDAAoD,EAAEwB,eAAe+B,MAAM,EAAE;YAChG;YAEA,MAAMxB,aAAc,MAAMP,eAAeQ,IAAI;YAC7C,IAAID,WAAWE,KAAK,KAAKZ,OAAOO,WAAW,EAAE;gBAC3C,MAAM,IAAI5B,MAAM;YAClB;YAEA,IAAI,CAACL,MAAM,CAAC6C,KAAK,CAAC;QACpB,EAAE,OAAOgB,OAAO;YACd,IAAI,CAAC7D,MAAM,CAAC6D,KAAK,CAAC,oCAAoCA,iBAAiBxD,QAAQwD,MAAMvD,OAAO,GAAGwD,OAAOD;YACtG,MAAM,IAAIxD,MAAM;QAClB;QAEA,6BAA6B;QAC7B,MAAM,IAAI,CAACkC,UAAU,CAACwB,GAAG,CAACtC,aAAa;YAAE,GAAGC,MAAM;YAAEhB;QAAO;QAC3D,IAAI,CAACV,MAAM,CAAC6C,KAAK,CAAC;QAElB,OAAOnB;IACT;IAEA,2EAA2E,GAC3E,MAAcP,4BAA4BN,YAAoB,EAAEJ,YAA8B,EAAqB;QACjH,gEAAgE;QAChE,MAAMe,gBAAgB5B,cAAciB;QACpC,MAAMH,SAASF,cAAcC;QAC7B,MAAM,EAAEc,QAAQ,EAAEF,QAAQ,EAAE,GAAG,IAAI,CAACD,WAAW,CAACP,cAAcJ;QAC9D,MAAMuD,WAAW,CAAC,OAAO,EAAEtD,OAAO,CAAC,EAAEW,UAAU;QAE/C,+BAA+B;QAC/B,IAAIK,SAAS,MAAM,IAAI,CAACC,UAAU,CAACqC,UAAUtD;QAE7C,IAAIgB,QAAQ;YACV,yDAAyD;YACzD,IAAIA,OAAOuC,SAAS,GAAGC,KAAKC,GAAG,KAAKhE,mBAAmB;gBACrD,IAAI,CAACH,MAAM,CAAC6C,KAAK,CAAC;gBAElB,IAAI;oBACFnB,SAAS,MAAM,IAAI,CAAC0C,aAAa,CAAC1C,QAAQjB,aAAamC,aAAa,EAAErB,UAAUC;oBAChF,MAAM,IAAI,CAACe,UAAU,CAACwB,GAAG,CAACC,UAAU;wBAAE,GAAGtC,MAAM;wBAAEhB;oBAAO;oBACxD,IAAI,CAACV,MAAM,CAAC6C,KAAK,CAAC;gBACpB,EAAE,OAAO9B,QAAQ;oBACf,oDAAoD;oBACpD,IAAI,CAACf,MAAM,CAACqE,IAAI,CAAC;oBACjB,MAAM,IAAI,CAAC9B,UAAU,CAACC,MAAM,CAACwB;oBAC7BtC,SAASe;gBACX;YACF;YAEA,IAAIf,QAAQ;gBACV,OAAOA;YACT;QACF;QAEA,gDAAgD;QAChD,IAAI,CAACjB,aAAaiC,oBAAoB,IAAI,CAACjC,aAAakC,qBAAqB,IAAI,CAAClC,aAAamC,aAAa,EAAE;YAC5G,MAAM,IAAIvC,MAAM;QAClB;QAEA,IAAI,CAACL,MAAM,CAAC6C,KAAK,CAAC;QAElB,6CAA6C;QAC7C,MAAMC,OAAOC,SAAS,IAAIC,IAAI,IAAI,CAACC,WAAW,EAAEH,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACG,WAAW,CAACC,UAAU,CAAC,YAAY,MAAM,EAAC;QAE7G,gCAAgC;QAChC,IAAI,CAAClD,MAAM,CAAC6C,KAAK,CAAC;QAClB,MAAMM,SAAS,MAAM,IAAI,CAACC,SAAS,CAACC,cAAc,CAAC5C,aAAaiC,oBAAoB,EAAE;YACpFO,aAAa,IAAI,CAACA,WAAW;YAC7BzB;QACF;QAEA,wDAAwD;QACxD,MAAM8B,cAAc,IAAI,CAACC,gBAAgB,CAACT,MAAMrC,cAAcC,QAAQa,UAAUC;QAEhFE,SAAS,MAAM,IAAI,CAAC8B,SAAS,CAACC,eAAe,CAAChD,aAAakC,qBAAqB,EAAElC,aAAamC,aAAa,EAAEO,OAAOO,QAAQ,EAAEP,OAAOQ,YAAY,EAAEL;QAEpJ,6BAA6B;QAC7B,MAAM,IAAI,CAACf,UAAU,CAACwB,GAAG,CAACC,UAAU;YAAE,GAAGtC,MAAM;YAAEhB;QAAO;QACxD,IAAI,CAACV,MAAM,CAAC6C,KAAK,CAAC;QAElB,OAAOnB;IACT;IAEA;;;;GAIC,GACD,MAAc0C,cAAc1C,MAAgB,EAAEkB,aAAiC,EAAErB,QAAgB,EAAEC,gBAAgB,KAAK,EAAqB;QAC3I,IAAI,CAACoB,eAAe;YAClB,MAAM,IAAIvC,MAAM;QAClB;QAEA,IAAI,CAACqB,OAAO4C,YAAY,EAAE;YACxB,MAAM,IAAIjE,MAAM;QAClB;QAEA,IAAI,CAACqB,OAAOgC,QAAQ,IAAI,CAAChC,OAAOiC,YAAY,EAAE;YAC5C,MAAM,IAAItD,MAAM;QAClB;QAEA,OAAO,MAAM,IAAI,CAACmD,SAAS,CAACY,aAAa,CAACxB,eAAelB,OAAO4C,YAAY,EAAE5C,OAAOgC,QAAQ,EAAEhC,OAAOiC,YAAY,EAAEpC,UAAUC;IAChI;IAEA;;;;;;;;GAQC,GACD,MAAM+C,aAAa1D,YAAoB,EAAiB;QACtD,MAAM2D,SAAS,CAAC,CAAC,EAAEzE,aAAac,eAAe;QAC/C,IAAI,CAAC,IAAI,CAAC0B,UAAU,CAACkC,QAAQ,EAAE;YAC7B,MAAM,IAAIrE,uBAAuB;QACnC;QAEA,WAAW,MAAM,CAACsE,IAAI,IAAI,IAAI,CAACnC,UAAU,CAACkC,QAAQ,CAAC,IAAI,CAAClC,UAAU,CAACoC,SAAS,EAAG;YAC7E,IAAI,OAAOD,QAAQ,YAAaA,CAAAA,IAAIxB,UAAU,CAAC,cAAcwB,IAAIxB,UAAU,CAAC,cAAa,KAAMwB,IAAIE,QAAQ,CAACJ,SAAS;gBACnH,MAAM,IAAI,CAACjC,UAAU,CAACC,MAAM,CAACkC;YAC/B;QACF;QACA,IAAI,CAAC1E,MAAM,CAAC6C,KAAK,CAAC,CAAC,wBAAwB,EAAEhC,cAAc;IAC7D;IAEA,+HAA+H,GAC/H,MAAcc,WAAW+C,GAAW,EAAEhE,MAAc,EAAiC;QACnF,MAAMgB,SAAU,MAAM,IAAI,CAACa,UAAU,CAACsC,GAAG,CAACH;QAC1C,IAAI,CAAChD,QAAQ,OAAOe;QACpB,IAAIf,OAAOhB,MAAM,KAAKA,QAAQ,OAAOgB;QAErC,IAAI,CAAC1B,MAAM,CAAC6C,KAAK,CAAC;QAClB,MAAM,IAAI,CAACN,UAAU,CAACC,MAAM,CAACkC;QAC7B,OAAOjC;IACT;IAEQc,iBAAiBT,IAAY,EAAErC,YAA8B,EAAEC,MAAc,EAAEa,QAAgB,EAAEC,aAAsB,EAAoB;YAU5Gf;QATrC,MAAM6C,cAAgC;YACpCR;YACApC;YACAa;YACAuD,UAAU,IAAI,CAACA,QAAQ;YACvB7B,aAAa,IAAI,CAACA,WAAW;YAC7B8B,MAAM;YACN/E,QAAQ,IAAI,CAACA,MAAM;YACnBwB;YACAwD,iCAAiC,GAAEvE,kDAAAA,aAAauE,iCAAiC,cAA9CvE,6DAAAA,kDAAkD;QACvF;QACA,IAAIA,aAAawE,MAAM,EAAE;YACvB3B,YAAY2B,MAAM,GAAGxE,aAAawE,MAAM;QAC1C;QACA,OAAO3B;IACT;IAxTA,YAAY4B,OAAgC,CAAE;YAkB9BA;QAjBd,IAAIA,QAAQ3C,UAAU,EAAE;YACtB,IAAI,CAACA,UAAU,GAAG2C,QAAQ3C,UAAU;QACtC,OAAO;YACL,sDAAsD;YACtD,MAAM4C,YAAY3F,KAAK4F,IAAI,CAACC,QAAQC,GAAG,IAAI,UAAU;YAErD,gDAAgD;YAChD7F,GAAG8F,SAAS,CAAC/F,KAAKgG,OAAO,CAACL,YAAY;gBAAEM,WAAW;YAAK;YAExD,IAAI,CAAClD,UAAU,GAAG,IAAI7C,KAAK;gBACzBgG,OAAO,IAAI/F,SAAS;oBAAEgG,UAAUR;gBAAU;YAC5C;QACF;QACA,IAAI,CAAC/B,SAAS,GAAG,IAAIlD;QACrB,IAAI,CAACsD,SAAS,GAAG,IAAI3D;QACrB,IAAI,CAACiF,QAAQ,GAAGI,QAAQJ,QAAQ,IAAI;QACpC,IAAI,CAAC7B,WAAW,GAAGiC,QAAQjC,WAAW;QACtC,IAAI,CAACjD,MAAM,IAAGkF,kBAAAA,QAAQlF,MAAM,cAAdkF,6BAAAA,kBAAkBjF;IAClC;AAsSF"}

package/dist/esm/lib/url-utils.d.ts

@@ -1,2 +1,19 @@
 export declare function normalizeUrl(input: string): string;
 export declare function joinWellKnown(baseUrl: string, suffix: string): string;
+/**
+ * Extract the "server base" - where a server's own endpoints live, NOT its identity.
+ *
+ * The `/mcp` segment names the protocol endpoint; everything before it is the
+ * deployment root that `/oauth/verify` and friends hang off. Stripping it is
+ * right for building those URLs and wrong for anything that identifies the
+ * server: an RFC 8707 `resource` indicator or a credential store key must use
+ * the full URL, because the stripped form names a different resource (or none).
+ *
+ * Original shape by removing a trailing `/mcp` path segment if present.
+ * Examples:
+ *  - https://example.com/mcp -> https://example.com
+ *  - https://example.com/sheets/mcp -> https://example.com/sheets
+ *  - https://example.com/sheets/mcp/ -> https://example.com/sheets
+ *  - https://example.com/sheets -> https://example.com/sheets
+ */
+export declare function extractBaseUrl(mcpUrl: string): string;

package/dist/esm/lib/url-utils.js

@@ -12,3 +12,35 @@ export function normalizeUrl(input) {
 export function joinWellKnown(baseUrl, suffix) {
     return `${normalizeUrl(baseUrl)}${suffix}`;
 }
+/**
+ * Extract the "server base" - where a server's own endpoints live, NOT its identity.
+ *
+ * The `/mcp` segment names the protocol endpoint; everything before it is the
+ * deployment root that `/oauth/verify` and friends hang off. Stripping it is
+ * right for building those URLs and wrong for anything that identifies the
+ * server: an RFC 8707 `resource` indicator or a credential store key must use
+ * the full URL, because the stripped form names a different resource (or none).
+ *
+ * Original shape by removing a trailing `/mcp` path segment if present.
+ * Examples:
+ *  - https://example.com/mcp -> https://example.com
+ *  - https://example.com/sheets/mcp -> https://example.com/sheets
+ *  - https://example.com/sheets/mcp/ -> https://example.com/sheets
+ *  - https://example.com/sheets -> https://example.com/sheets
+ */ export function extractBaseUrl(mcpUrl) {
+    const url = new URL(mcpUrl);
+    // Ignore query/hash for base URL purposes
+    url.search = '';
+    url.hash = '';
+    // Normalize path segments (removes empty segments from leading/trailing slashes)
+    const segments = url.pathname.split('/').filter(Boolean);
+    // If last segment is exactly "mcp", drop it
+    if (segments[segments.length - 1] === 'mcp') {
+        segments.pop();
+    }
+    // Rebuild pathname; empty means root
+    url.pathname = segments.length ? `/${segments.join('/')}` : '';
+    // Return without trailing slash (except root origin)
+    const out = url.origin + url.pathname;
+    return out === url.origin ? out : out.replace(/\/+$/, '');
+}

package/dist/esm/lib/url-utils.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/lib/url-utils.ts"],"sourcesContent":["export function normalizeUrl(input: string): string {\n  try {\n    const url = new URL(input);\n    url.search = '';\n    url.hash = '';\n    // Strip after joining: assigning an empty pathname puts the '/' straight back.\n    return (url.origin + url.pathname).replace(/\\/+$/, '');\n  } catch {\n    return input.replace(/\\/+$/, '');\n  }\n}\n\nexport function joinWellKnown(baseUrl: string, suffix: string): string {\n  return `${normalizeUrl(baseUrl)}${suffix}`;\n}\n"],"names":["normalizeUrl","input","url","URL","search","hash","origin","pathname","replace","joinWellKnown","baseUrl","suffix"],"mappings":"AAAA,OAAO,SAASA,aAAaC,KAAa;IACxC,IAAI;QACF,MAAMC,MAAM,IAAIC,IAAIF;QACpBC,IAAIE,MAAM,GAAG;QACbF,IAAIG,IAAI,GAAG;QACX,+EAA+E;QAC/E,OAAO,AAACH,CAAAA,IAAII,MAAM,GAAGJ,IAAIK,QAAQ,AAAD,EAAGC,OAAO,CAAC,QAAQ;IACrD,EAAE,OAAM;QACN,OAAOP,MAAMO,OAAO,CAAC,QAAQ;IAC/B;AACF;AAEA,OAAO,SAASC,cAAcC,OAAe,EAAEC,MAAc;IAC3D,OAAO,GAAGX,aAAaU,WAAWC,QAAQ;AAC5C"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/lib/url-utils.ts"],"sourcesContent":["export function normalizeUrl(input: string): string {\n  try {\n    const url = new URL(input);\n    url.search = '';\n    url.hash = '';\n    // Strip after joining: assigning an empty pathname puts the '/' straight back.\n    return (url.origin + url.pathname).replace(/\\/+$/, '');\n  } catch {\n    return input.replace(/\\/+$/, '');\n  }\n}\n\nexport function joinWellKnown(baseUrl: string, suffix: string): string {\n  return `${normalizeUrl(baseUrl)}${suffix}`;\n}\n\n/**\n * Extract the \"server base\" - where a server's own endpoints live, NOT its identity.\n *\n * The `/mcp` segment names the protocol endpoint; everything before it is the\n * deployment root that `/oauth/verify` and friends hang off. Stripping it is\n * right for building those URLs and wrong for anything that identifies the\n * server: an RFC 8707 `resource` indicator or a credential store key must use\n * the full URL, because the stripped form names a different resource (or none).\n *\n * Original shape by removing a trailing `/mcp` path segment if present.\n * Examples:\n *  - https://example.com/mcp -> https://example.com\n *  - https://example.com/sheets/mcp -> https://example.com/sheets\n *  - https://example.com/sheets/mcp/ -> https://example.com/sheets\n *  - https://example.com/sheets -> https://example.com/sheets\n */\nexport function extractBaseUrl(mcpUrl: string): string {\n  const url = new URL(mcpUrl);\n\n  // Ignore query/hash for base URL purposes\n  url.search = '';\n  url.hash = '';\n\n  // Normalize path segments (removes empty segments from leading/trailing slashes)\n  const segments = url.pathname.split('/').filter(Boolean);\n\n  // If last segment is exactly \"mcp\", drop it\n  if (segments[segments.length - 1] === 'mcp') {\n    segments.pop();\n  }\n\n  // Rebuild pathname; empty means root\n  url.pathname = segments.length ? `/${segments.join('/')}` : '';\n\n  // Return without trailing slash (except root origin)\n  const out = url.origin + url.pathname;\n  return out === url.origin ? out : out.replace(/\\/+$/, '');\n}\n"],"names":["normalizeUrl","input","url","URL","search","hash","origin","pathname","replace","joinWellKnown","baseUrl","suffix","extractBaseUrl","mcpUrl","segments","split","filter","Boolean","length","pop","join","out"],"mappings":"AAAA,OAAO,SAASA,aAAaC,KAAa;IACxC,IAAI;QACF,MAAMC,MAAM,IAAIC,IAAIF;QACpBC,IAAIE,MAAM,GAAG;QACbF,IAAIG,IAAI,GAAG;QACX,+EAA+E;QAC/E,OAAO,AAACH,CAAAA,IAAII,MAAM,GAAGJ,IAAIK,QAAQ,AAAD,EAAGC,OAAO,CAAC,QAAQ;IACrD,EAAE,OAAM;QACN,OAAOP,MAAMO,OAAO,CAAC,QAAQ;IAC/B;AACF;AAEA,OAAO,SAASC,cAAcC,OAAe,EAAEC,MAAc;IAC3D,OAAO,GAAGX,aAAaU,WAAWC,QAAQ;AAC5C;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,eAAeC,MAAc;IAC3C,MAAMX,MAAM,IAAIC,IAAIU;IAEpB,0CAA0C;IAC1CX,IAAIE,MAAM,GAAG;IACbF,IAAIG,IAAI,GAAG;IAEX,iFAAiF;IACjF,MAAMS,WAAWZ,IAAIK,QAAQ,CAACQ,KAAK,CAAC,KAAKC,MAAM,CAACC;IAEhD,4CAA4C;IAC5C,IAAIH,QAAQ,CAACA,SAASI,MAAM,GAAG,EAAE,KAAK,OAAO;QAC3CJ,SAASK,GAAG;IACd;IAEA,qCAAqC;IACrCjB,IAAIK,QAAQ,GAAGO,SAASI,MAAM,GAAG,CAAC,CAAC,EAAEJ,SAASM,IAAI,CAAC,MAAM,GAAG;IAE5D,qDAAqD;IACrD,MAAMC,MAAMnB,IAAII,MAAM,GAAGJ,IAAIK,QAAQ;IACrC,OAAOc,QAAQnB,IAAII,MAAM,GAAGe,MAAMA,IAAIb,OAAO,CAAC,QAAQ;AACxD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-z/client",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Programmatic MCP client library for Node.js - connect, discover, and call tools on Model Context Protocol servers.",
   "keywords": [
     "mcp",
@@ -73,7 +73,6 @@
     "@types/express": "^5.0.6",
     "@types/mocha": "^10.0.10",
     "@types/node": "^26.2.0",
-    "dotenv": "^17.2.3",
     "express": "^5.0.0",
     "json-schema-to-typescript": "^16.0.0",
     "node-version-use": "^2.4.7",