@mcp-z/client 2.2.3 → 2.3.0

package/dist/cjs/connection/wait-for-http-ready.js

@@ -46,6 +46,12 @@ function _async_to_generator(fn) {
         });
     };
 }
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -146,7 +152,7 @@ function _ts_generator(thisArg, body) {
     }
 }
 function waitForHttpReady(url) {
-    var timeoutMs = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : 30000;
+    var timeoutMs = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : 30000, signal = arguments.length > 2 ? arguments[2] : void 0;
     return _async_to_generator(function() {
         var start, maxRetries, i, response, _error, elapsed;
         return _ts_generator(this, function(_state) {
@@ -161,6 +167,7 @@ function waitForHttpReady(url) {
                         3,
                         8
                     ];
+                    throwIfAborted(signal);
                     _state.label = 2;
                 case 2:
                     _state.trys.push([
@@ -171,13 +178,13 @@ function waitForHttpReady(url) {
                     ]);
                     return [
                         4,
-                        fetch(url, {
+                        awaitWithSignal(fetch(url, {
                             method: 'HEAD',
                             headers: {
                                 Connection: 'close'
                             },
                             signal: AbortSignal.timeout(500)
-                        })
+                        }), signal)
                     ];
                 case 3:
                     response = _state.sent();
@@ -207,9 +214,9 @@ function waitForHttpReady(url) {
                     // Wait before retry
                     return [
                         4,
-                        new Promise(function(resolve) {
+                        awaitWithSignal(new Promise(function(resolve) {
                             return setTimeout(resolve, 100);
-                        })
+                        }), signal)
                     ];
                 case 6:
                     _state.sent();
@@ -226,4 +233,22 @@ function waitForHttpReady(url) {
         });
     })();
 }
+function throwIfAborted(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted) throw _instanceof(signal.reason, Error) ? signal.reason : new Error('HTTP readiness check was cancelled');
+}
+function awaitWithSignal(promise, signal) {
+    if (!signal) return promise;
+    if (signal.aborted) return Promise.reject(_instanceof(signal.reason, Error) ? signal.reason : new Error('HTTP readiness check was cancelled'));
+    return new Promise(function(resolve, reject) {
+        var onAbort = function onAbort() {
+            return reject(_instanceof(signal.reason, Error) ? signal.reason : new Error('HTTP readiness check was cancelled'));
+        };
+        signal.addEventListener('abort', onAbort, {
+            once: true
+        });
+        promise.then(resolve, reject).finally(function() {
+            return signal.removeEventListener('abort', onAbort);
+        });
+    });
+}
 /* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/connection/wait-for-http-ready.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/connection/wait-for-http-ready.ts"],"sourcesContent":["/**\n * wait-for-http-ready.ts\n *\n * Utility for waiting for HTTP servers to become ready.\n */\n\n/**\n * Wait for HTTP server to be ready by checking endpoint accessibility.\n * Used to handle HTTP servers that need time to start listening.\n *\n * @param url - URL to check for server readiness\n * @param timeoutMs - Maximum time to wait in milliseconds (default: 30000)\n * @returns Promise that resolves when server is ready\n * @throws Error if server doesn't become ready within timeout\n */\nexport async function waitForHttpReady(url: string, timeoutMs = 30000): Promise<void> {\n  const start = Date.now();\n  const maxRetries = Math.ceil(timeoutMs / 100); // Check every 100ms\n\n  for (let i = 0; i < maxRetries; i++) {\n    try {\n      // Use HEAD request to check server is responding\n      const response = await fetch(url, {\n        method: 'HEAD',\n        headers: { Connection: 'close' },\n        signal: AbortSignal.timeout(500), // 500ms per attempt\n      });\n\n      // Server is responding if we get any HTTP status\n      if (response.status >= 200 && response.status < 500) {\n        return;\n      }\n\n      // Server error (5xx) - keep trying as it might still be starting\n    } catch (_error) {\n      // Connection refused, timeout, or network error\n      // Server not ready yet, continue polling\n      if (i === maxRetries - 1) {\n        const elapsed = Date.now() - start;\n        throw new Error(`HTTP server ${url} not ready after ${elapsed}ms`);\n      }\n    }\n\n    // Wait before retry\n    await new Promise((resolve) => setTimeout(resolve, 100));\n  }\n\n  throw new Error(`HTTP server ${url} not ready after ${timeoutMs}ms`);\n}\n"],"names":["waitForHttpReady","url","timeoutMs","start","maxRetries","i","response","_error","elapsed","Date","now","Math","ceil","fetch","method","headers","Connection","signal","AbortSignal","timeout","status","Error","Promise","resolve","setTimeout"],"mappings":"AAAA;;;;CAIC,GAED;;;;;;;;CAQC;;;;+BACqBA;;;eAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAf,SAAeA,iBAAiBC,GAAW;QAAEC,YAAAA,iEAAY;;YACxDC,OACAC,YAEGC,GAGCC,UAYCC,QAICC;;;;oBAtBNL,QAAQM,KAAKC,GAAG;oBAChBN,aAAaO,KAAKC,IAAI,CAACV,YAAY,MAAM,oBAAoB;oBAE1DG,IAAI;;;yBAAGA,CAAAA,IAAID,UAAS;;;;;;;;;;;;oBAGR;;wBAAMS,MAAMZ,KAAK;4BAChCa,QAAQ;4BACRC,SAAS;gCAAEC,YAAY;4BAAQ;4BAC/BC,QAAQC,YAAYC,OAAO,CAAC;wBAC9B;;;oBAJMb,WAAW;oBAMjB,iDAAiD;oBACjD,IAAIA,SAASc,MAAM,IAAI,OAAOd,SAASc,MAAM,GAAG,KAAK;wBACnD;;;oBACF;;;;;;oBAGOb;oBACP,gDAAgD;oBAChD,yCAAyC;oBACzC,IAAIF,MAAMD,aAAa,GAAG;wBAClBI,UAAUC,KAAKC,GAAG,KAAKP;wBAC7B,MAAM,IAAIkB,MAAM,AAAC,eAAqCb,OAAvBP,KAAI,qBAA2B,OAARO,SAAQ;oBAChE;;;;;;oBAGF,oBAAoB;oBACpB;;wBAAM,IAAIc,QAAQ,SAACC;mCAAYC,WAAWD,SAAS;;;;oBAAnD;;;oBAzB8BlB;;;;;;oBA4BhC,MAAM,IAAIgB,MAAM,AAAC,eAAqCnB,OAAvBD,KAAI,qBAA6B,OAAVC,WAAU;;;IAClE"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/connection/wait-for-http-ready.ts"],"sourcesContent":["/**\n * wait-for-http-ready.ts\n *\n * Utility for waiting for HTTP servers to become ready.\n */\n\n/**\n * Wait for HTTP server to be ready by checking endpoint accessibility.\n * Used to handle HTTP servers that need time to start listening.\n *\n * @param url - URL to check for server readiness\n * @param timeoutMs - Maximum time to wait in milliseconds (default: 30000)\n * @returns Promise that resolves when server is ready\n * @throws Error if server doesn't become ready within timeout\n */\nexport async function waitForHttpReady(url: string, timeoutMs = 30000, signal?: AbortSignal): Promise<void> {\n  const start = Date.now();\n  const maxRetries = Math.ceil(timeoutMs / 100); // Check every 100ms\n\n  for (let i = 0; i < maxRetries; i++) {\n    throwIfAborted(signal);\n    try {\n      // Use HEAD request to check server is responding\n      const response = await awaitWithSignal(\n        fetch(url, {\n          method: 'HEAD',\n          headers: { Connection: 'close' },\n          signal: AbortSignal.timeout(500), // 500ms per attempt\n        }),\n        signal\n      );\n\n      // Server is responding if we get any HTTP status\n      if (response.status >= 200 && response.status < 500) {\n        return;\n      }\n\n      // Server error (5xx) - keep trying as it might still be starting\n    } catch (_error) {\n      // Connection refused, timeout, or network error\n      // Server not ready yet, continue polling\n      if (i === maxRetries - 1) {\n        const elapsed = Date.now() - start;\n        throw new Error(`HTTP server ${url} not ready after ${elapsed}ms`);\n      }\n    }\n\n    // Wait before retry\n    await awaitWithSignal(new Promise<void>((resolve) => setTimeout(resolve, 100)), signal);\n  }\n\n  throw new Error(`HTTP server ${url} not ready after ${timeoutMs}ms`);\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('HTTP readiness check was cancelled');\n}\n\nfunction awaitWithSignal<T>(promise: Promise<T>, signal?: AbortSignal): Promise<T> {\n  if (!signal) return promise;\n  if (signal.aborted) return Promise.reject(signal.reason instanceof Error ? signal.reason : new Error('HTTP readiness check was cancelled'));\n  return new Promise<T>((resolve, reject) => {\n    const onAbort = () => reject(signal.reason instanceof Error ? signal.reason : new Error('HTTP readiness check was cancelled'));\n    signal.addEventListener('abort', onAbort, { once: true });\n    promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));\n  });\n}\n"],"names":["waitForHttpReady","url","timeoutMs","signal","start","maxRetries","i","response","_error","elapsed","Date","now","Math","ceil","throwIfAborted","awaitWithSignal","fetch","method","headers","Connection","AbortSignal","timeout","status","Error","Promise","resolve","setTimeout","aborted","reason","promise","reject","onAbort","addEventListener","once","then","finally","removeEventListener"],"mappings":"AAAA;;;;CAIC,GAED;;;;;;;;CAQC;;;;+BACqBA;;;eAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAf,SAAeA,iBAAiBC,GAAW;QAAEC,YAAAA,iEAAY,OAAOC;;YAC/DC,OACAC,YAEGC,GAICC,UAeCC,QAICC;;;;oBA1BNL,QAAQM,KAAKC,GAAG;oBAChBN,aAAaO,KAAKC,IAAI,CAACX,YAAY,MAAM,oBAAoB;oBAE1DI,IAAI;;;yBAAGA,CAAAA,IAAID,UAAS;;;;oBAC3BS,eAAeX;;;;;;;;;oBAGI;;wBAAMY,gBACrBC,MAAMf,KAAK;4BACTgB,QAAQ;4BACRC,SAAS;gCAAEC,YAAY;4BAAQ;4BAC/BhB,QAAQiB,YAAYC,OAAO,CAAC;wBAC9B,IACAlB;;;oBANII,WAAW;oBASjB,iDAAiD;oBACjD,IAAIA,SAASe,MAAM,IAAI,OAAOf,SAASe,MAAM,GAAG,KAAK;wBACnD;;;oBACF;;;;;;oBAGOd;oBACP,gDAAgD;oBAChD,yCAAyC;oBACzC,IAAIF,MAAMD,aAAa,GAAG;wBAClBI,UAAUC,KAAKC,GAAG,KAAKP;wBAC7B,MAAM,IAAImB,MAAM,AAAC,eAAqCd,OAAvBR,KAAI,qBAA2B,OAARQ,SAAQ;oBAChE;;;;;;oBAGF,oBAAoB;oBACpB;;wBAAMM,gBAAgB,IAAIS,QAAc,SAACC;mCAAYC,WAAWD,SAAS;4BAAOtB;;;oBAAhF;;;oBA7B8BG;;;;;;oBAgChC,MAAM,IAAIiB,MAAM,AAAC,eAAqCrB,OAAvBD,KAAI,qBAA6B,OAAVC,WAAU;;;IAClE;;AAEA,SAASY,eAAeX,MAAoB;IAC1C,IAAIA,mBAAAA,6BAAAA,OAAQwB,OAAO,EAAE,MAAMxB,AAAa,YAAbA,OAAOyB,MAAM,EAAYL,SAAQpB,OAAOyB,MAAM,GAAG,IAAIL,MAAM;AACxF;AAEA,SAASR,gBAAmBc,OAAmB,EAAE1B,MAAoB;IACnE,IAAI,CAACA,QAAQ,OAAO0B;IACpB,IAAI1B,OAAOwB,OAAO,EAAE,OAAOH,QAAQM,MAAM,CAAC3B,AAAa,YAAbA,OAAOyB,MAAM,EAAYL,SAAQpB,OAAOyB,MAAM,GAAG,IAAIL,MAAM;IACrG,OAAO,IAAIC,QAAW,SAACC,SAASK;QAC9B,IAAMC,UAAU;mBAAMD,OAAO3B,AAAa,YAAbA,OAAOyB,MAAM,EAAYL,SAAQpB,OAAOyB,MAAM,GAAG,IAAIL,MAAM;;QACxFpB,OAAO6B,gBAAgB,CAAC,SAASD,SAAS;YAAEE,MAAM;QAAK;QACvDJ,QAAQK,IAAI,CAACT,SAASK,QAAQK,OAAO,CAAC;mBAAMhC,OAAOiC,mBAAmB,CAAC,SAASL;;IAClF;AACF"}

package/dist/cjs/dcr/dcr-authenticator.d.cts

@@ -54,7 +54,7 @@ export declare class DcrAuthenticator {
      *   capabilities
      * );
      */
-    ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet>;
+    ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities, signal?: AbortSignal): Promise<TokenSet>;
     /**
      * The three things a server URL is used for here, kept apart on purpose.
      *

package/dist/cjs/dcr/dcr-authenticator.d.ts

@@ -54,7 +54,7 @@ export declare class DcrAuthenticator {
      *   capabilities
      * );
      */
-    ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet>;
+    ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities, signal?: AbortSignal): Promise<TokenSet>;
     /**
      * The three things a server URL is used for here, kept apart on purpose.
      *

package/dist/cjs/dcr/dcr-authenticator.js

@@ -516,12 +516,13 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
    *   'https://example.com/mcp',
    *   capabilities
    * );
-   */ _proto.ensureAuthenticated = function ensureAuthenticated(mcpServerUrl, capabilities) {
+   */ _proto.ensureAuthenticated = function ensureAuthenticated(mcpServerUrl, capabilities, signal) {
         return _async_to_generator(function() {
             var isSelfHosted;
             return _ts_generator(this, function(_state) {
                 switch(_state.label){
                     case 0:
+                        throwIfAborted(signal);
                         return [
                             4,
                             this.detectSelfHostedMode(mcpServerUrl)
@@ -531,12 +532,12 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
                         if (isSelfHosted) {
                             return [
                                 2,
-                                this.ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities)
+                                this.ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities, signal)
                             ];
                         }
                         return [
                             2,
-                            this.ensureAuthenticatedExternal(mcpServerUrl, capabilities)
+                            this.ensureAuthenticatedExternal(mcpServerUrl, capabilities, signal)
                         ];
                 }
             });
@@ -571,7 +572,7 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
     /**
    * Handle authentication for self-hosted DCR servers
    * Self-hosted servers manage their own token storage via /oauth/verify
-   */ _proto.ensureAuthenticatedSelfHosted = function ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities) {
+   */ _proto.ensureAuthenticatedSelfHosted = function ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities, signal) {
         return _async_to_generator(function() {
             var allowLoopback, issuer, _this_resolveUrls, serverBaseUrl, resource, storeKey, dcrTokenKey, tokens, verifyUrl, verifyResponse, verifyData, _error, port, client, flowOptions, verifyUrl1, verifyResponse1, verifyData1, error;
             return _ts_generator(this, function(_state) {
@@ -608,7 +609,8 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
                                 headers: {
                                     Authorization: "Bearer ".concat(tokens.accessToken),
                                     Connection: 'close'
-                                }
+                                },
+                                signal: signal
                             })
                         ];
                     case 3:
@@ -666,13 +668,14 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
                             4,
                             this.dcrClient.registerClient(capabilities.registrationEndpoint, {
                                 redirectUri: this.redirectUri,
-                                allowLoopback: allowLoopback
+                                allowLoopback: allowLoopback,
+                                signal: signal
                             })
                         ];
                     case 10:
                         client = _state.sent();
                         // Perform OAuth authorization flow with PKCE (RFC 7636)
-                        flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);
+                        flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback, signal);
                         return [
                             4,
                             this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions)
@@ -694,7 +697,8 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
                                 headers: {
                                     Authorization: "Bearer ".concat(tokens.accessToken),
                                     Connection: 'close'
-                                }
+                                },
+                                signal: signal
                             })
                         ];
                     case 13:
@@ -739,7 +743,7 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
             });
         }).call(this);
     };
-    /** Handles authentication for external (non-self-hosted) OAuth providers. */ _proto.ensureAuthenticatedExternal = function ensureAuthenticatedExternal(mcpServerUrl, capabilities) {
+    /** Handles authentication for external (non-self-hosted) OAuth providers. */ _proto.ensureAuthenticatedExternal = function ensureAuthenticatedExternal(mcpServerUrl, capabilities, signal) {
         return _async_to_generator(function() {
             var allowLoopback, issuer, _this_resolveUrls, resource, storeKey, tokenKey, tokens, _error, port, client, flowOptions;
             return _ts_generator(this, function(_state) {
@@ -775,7 +779,7 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
                         ]);
                         return [
                             4,
-                            this.refreshTokens(tokens, capabilities.tokenEndpoint, resource, allowLoopback)
+                            this.refreshTokens(tokens, capabilities.tokenEndpoint, resource, allowLoopback, signal)
                         ];
                     case 3:
                         tokens = _state.sent();
@@ -829,13 +833,14 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
                             4,
                             this.dcrClient.registerClient(capabilities.registrationEndpoint, {
                                 redirectUri: this.redirectUri,
-                                allowLoopback: allowLoopback
+                                allowLoopback: allowLoopback,
+                                signal: signal
                             })
                         ];
                     case 9:
                         client = _state.sent();
                         // Perform OAuth authorization flow with PKCE (RFC 7636)
-                        flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);
+                        flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback, signal);
                         return [
                             4,
                             this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions)
@@ -865,7 +870,7 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
    * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).
    * @param allowLoopback - Loopback trust grant computed from the server actually being talked to (SSRF mitigation, see discovery-fetch.ts). Defaults to `false`.
    */ _proto.refreshTokens = function refreshTokens(tokens, tokenEndpoint, resource) {
-        var allowLoopback = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : false;
+        var allowLoopback = arguments.length > 3 && arguments[3] !== void 0 ? arguments[3] : false, signal = arguments.length > 4 ? arguments[4] : void 0;
         return _async_to_generator(function() {
             return _ts_generator(this, function(_state) {
                 switch(_state.label){
@@ -881,7 +886,7 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
                         }
                         return [
                             4,
-                            this.oauthFlow.refreshTokens(tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret, resource, allowLoopback)
+                            this.oauthFlow.refreshTokens(tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret, resource, allowLoopback, signal)
                         ];
                     case 1:
                         return [
@@ -1041,9 +1046,9 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
             });
         }).call(this);
     };
-    _proto.buildFlowOptions = function buildFlowOptions(port, capabilities, issuer, resource, allowLoopback) {
+    _proto.buildFlowOptions = function buildFlowOptions(port, capabilities, issuer, resource, allowLoopback, signal) {
         var _capabilities_authorizationResponseIssSupported;
-        var flowOptions = {
+        var flowOptions = _object_spread_props(_object_spread({
             port: port,
             issuer: issuer,
             resource: resource,
@@ -1051,9 +1056,12 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
             redirectUri: this.redirectUri,
             pkce: true,
             logger: this.logger,
-            allowLoopback: allowLoopback,
+            allowLoopback: allowLoopback
+        }, signal && {
+            signal: signal
+        }), {
             authorizationResponseIssSupported: (_capabilities_authorizationResponseIssSupported = capabilities.authorizationResponseIssSupported) !== null && _capabilities_authorizationResponseIssSupported !== void 0 ? _capabilities_authorizationResponseIssSupported : false
-        };
+        });
         if (capabilities.scopes) {
             flowOptions.scopes = capabilities.scopes;
         }
@@ -1061,4 +1069,7 @@ var DcrAuthenticator = /*#__PURE__*/ function() {
     };
     return DcrAuthenticator;
 }();
+function throwIfAborted(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted) throw _instanceof(signal.reason, Error) ? signal.reason : new Error('Authentication was cancelled');
+}
 /* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/dcr/dcr-authenticator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/dcr/dcr-authenticator.ts"],"sourcesContent":["/**\n * DCR Authenticator\n * Consolidates DCR and OAuth flow logic for MCP HTTP servers\n */\n\nimport path from 'node:path';\nimport * as fs from 'fs';\nimport Keyv from 'keyv';\nimport { KeyvFile } from 'keyv-file';\nimport { isLoopbackUrl } from '../auth/discovery-fetch.ts';\nimport { InteractiveOAuthFlow } from '../auth/interactive-oauth-flow.ts';\nimport type { AuthCapabilities, OAuthFlowOptions, TokenSet } from '../auth/types.ts';\nimport { extractBaseUrl, normalizeUrl } from '../lib/url-utils.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { DynamicClientRegistrar } from './dynamic-client-registrar.ts';\n\n/**\n * DcrAuthenticator configuration options\n */\nexport interface DcrAuthenticatorOptions {\n  /** Custom Keyv store (for testing) - if not provided, uses default ~/.mcpeasy/tokens.json */\n  tokenStore?: Keyv;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Required redirect URI for OAuth callback */\n  redirectUri: string;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * Buffer time before token expiry to trigger proactive refresh (5 minutes)\n */\nconst REFRESH_BUFFER_MS = 5 * 60 * 1000;\n\n/** Raised when a credential cannot be bound to, or looked up by, an issuer. */\nclass CredentialBindingError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'CredentialBindingError';\n  }\n}\n\n/**\n * The issuer credentials are keyed by, so they can never be presented to a\n * different authorization server even when the resource keeps its URL (SEP-2352).\n */\nfunction requireIssuer(capabilities: AuthCapabilities): string {\n  if (!capabilities.issuer) {\n    throw new CredentialBindingError('Authorization server metadata has no issuer - credentials cannot be bound to an authorization server (RFC 8414 requires issuer)');\n  }\n  return capabilities.issuer;\n}\n\n/**\n * DcrAuthenticator manages authentication for MCP HTTP servers\n * Handles DCR registration, OAuth flows, and token management\n */\nexport class DcrAuthenticator {\n  private tokenStore: Keyv;\n  private dcrClient: DynamicClientRegistrar;\n  private oauthFlow: InteractiveOAuthFlow;\n  private headless: boolean;\n  private redirectUri: string;\n  private logger: Logger;\n\n  constructor(options: DcrAuthenticatorOptions) {\n    if (options.tokenStore) {\n      this.tokenStore = options.tokenStore;\n    } else {\n      // Default CLI store in .mcp-z directory (per-project)\n      const storePath = path.join(process.cwd(), '.mcp-z', 'tokens.json');\n\n      // Ensure directory exists before creating store\n      fs.mkdirSync(path.dirname(storePath), { recursive: true });\n\n      this.tokenStore = new Keyv({\n        store: new KeyvFile({ filename: storePath }),\n      });\n    }\n    this.dcrClient = new DynamicClientRegistrar();\n    this.oauthFlow = new InteractiveOAuthFlow();\n    this.headless = options.headless || false;\n    this.redirectUri = options.redirectUri;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Detect if server is self-hosted DCR (vs external OAuth provider)\n   * Self-hosted servers have their own OAuth endpoints and manage token storage\n   */\n  private async detectSelfHostedMode(mcpServerUrl: string): Promise<boolean> {\n    try {\n      // Self-hosted DCR servers typically run their own OAuth server\n      // Check if this is a self-hosted instance by testing OAuth metadata\n      // For now, assume self-hosted if the URL matches common localhost patterns\n      // TODO: Implement proper self-hosted detection logic\n      return mcpServerUrl.includes('localhost') || mcpServerUrl.includes('127.0.0.1');\n    } catch (_error) {\n      return false; // Assume external mode if detection fails\n    }\n  }\n\n  /**\n   * Ensure server is authenticated, performing DCR and OAuth if needed\n   * Proactively refreshes tokens if they're within 5 minutes of expiry\n   *\n   * @param mcpServerUrl - The MCP server's canonical URL, exactly as configured,\n   *   with its path intact (`https://example.com/mcp`). Not a deployment root:\n   *   the path is what identifies the resource an issued token is bound to.\n   * @param capabilities - Auth capabilities from .well-known endpoint\n   * @returns Valid token set ready to use\n   *\n   * @throws Error if authentication fails\n   *\n   * @example\n   * const authenticator = new DcrAuthenticator({ redirectUri: 'http://localhost:3000/callback' });\n   * const tokens = await authenticator.ensureAuthenticated(\n   *   'https://example.com/mcp',\n   *   capabilities\n   * );\n   */\n  async ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // Auto-detect server mode\n    const isSelfHosted = await this.detectSelfHostedMode(mcpServerUrl);\n\n    if (isSelfHosted) {\n      return this.ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities);\n    }\n    return this.ensureAuthenticatedExternal(mcpServerUrl, capabilities);\n  }\n\n  /**\n   * The three things a server URL is used for here, kept apart on purpose.\n   *\n   * They were one value once, and collapsing them is what sent an authorization\n   * server the wrong audience: `resource` was derived from the deployment root,\n   * so a server at `https://host/mcp` was asked to mint a token for\n   * `https://host`, and any server that validates the indicator answered\n   * `invalid_target`.\n   *\n   * - `serverBaseUrl` builds the server's own endpoints (`/oauth/verify`), so a\n   *   trailing `/mcp` comes off.\n   * - `resource` is the RFC 8707 audience. The resource server names itself in\n   *   its RFC 9728 metadata; that name wins. Only when no such document exists\n   *   do we fall back to the URL we were configured with.\n   * - `storeKey` identifies the credential locally. It stays the configured URL\n   *   rather than the discovered `resource`, so it can be computed without a\n   *   network round trip - `deleteTokens` has only the URL to work from.\n   */\n  private resolveUrls(mcpServerUrl: string, capabilities: AuthCapabilities): { serverBaseUrl: string; resource: string; storeKey: string } {\n    const storeKey = normalizeUrl(mcpServerUrl);\n    return { serverBaseUrl: extractBaseUrl(mcpServerUrl), resource: capabilities.resource ?? storeKey, storeKey };\n  }\n\n  /**\n   * Handle authentication for self-hosted DCR servers\n   * Self-hosted servers manage their own token storage via /oauth/verify\n   */\n  private async ensureAuthenticatedSelfHosted(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // Loopback trust for every discovery-derived fetch below, computed from\n    // the server we're talking to, never from capabilities' endpoints (see discovery-fetch.ts).\n    const allowLoopback = isLoopbackUrl(mcpServerUrl);\n    const issuer = requireIssuer(capabilities);\n    const { serverBaseUrl, resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);\n    const dcrTokenKey = `dcr-tokens:${issuer}:${storeKey}`;\n\n    // 1. Check for existing DCR tokens (different from external tokens)\n    let tokens = await this.loadTokens(dcrTokenKey, issuer);\n\n    if (tokens) {\n      // 2. Verify token is still valid by calling /oauth/verify\n      try {\n        const verifyUrl = `${serverBaseUrl}/oauth/verify`;\n        const verifyResponse = await fetch(verifyUrl, {\n          headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n        });\n\n        if (verifyResponse.ok) {\n          const verifyData = (await verifyResponse.json()) as { token?: string };\n          if (verifyData.token === tokens.accessToken) {\n            // Token is still valid with the self-hosted server\n            return tokens;\n          }\n        }\n      } catch (_error) {\n        // Token verification failed - need to re-authenticate\n      }\n\n      // Token is expired or invalid\n      await this.tokenStore.delete(dcrTokenKey);\n      tokens = undefined;\n    }\n\n    // 3. No valid tokens - perform full DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting self-hosted DCR authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client with self-hosted server...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // For self-hosted mode, verify the token works with /oauth/verify immediately\n    try {\n      const verifyUrl = `${serverBaseUrl}/oauth/verify`;\n      const verifyResponse = await fetch(verifyUrl, {\n        headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n      });\n\n      if (!verifyResponse.ok) {\n        throw new Error(`DCR token verification failed after authentication: ${verifyResponse.status}`);\n      }\n\n      const verifyData = (await verifyResponse.json()) as { token?: string };\n      if (verifyData.token !== tokens.accessToken) {\n        throw new Error('DCR server returned different token in verification');\n      }\n\n      this.logger.debug('✅ DCR token verified with self-hosted server');\n    } catch (error) {\n      this.logger.error('❌ DCR token verification failed:', error instanceof Error ? error.message : String(error));\n      throw new Error('Self-hosted DCR authentication completed but token verification failed');\n    }\n\n    // Save tokens for future use\n    await this.tokenStore.set(dcrTokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Self-hosted DCR authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /** Handles authentication for external (non-self-hosted) OAuth providers. */\n  private async ensureAuthenticatedExternal(mcpServerUrl: string, capabilities: AuthCapabilities): Promise<TokenSet> {\n    // See ensureAuthenticatedSelfHosted - same loopback trust rule.\n    const allowLoopback = isLoopbackUrl(mcpServerUrl);\n    const issuer = requireIssuer(capabilities);\n    const { resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);\n    const tokenKey = `tokens:${issuer}:${storeKey}`;\n\n    // 1. Check for existing tokens\n    let tokens = await this.loadTokens(tokenKey, issuer);\n\n    if (tokens) {\n      // 2. Proactive refresh if token expires within 5 minutes\n      if (tokens.expiresAt < Date.now() + REFRESH_BUFFER_MS) {\n        this.logger.debug('🔄 Refreshing access token...');\n\n        try {\n          tokens = await this.refreshTokens(tokens, capabilities.tokenEndpoint, resource, allowLoopback);\n          await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n          this.logger.debug('✅ Token refreshed successfully');\n        } catch (_error) {\n          // Refresh failed - clear tokens and re-authenticate\n          this.logger.warn('⚠️  Token refresh failed, re-authenticating...');\n          await this.tokenStore.delete(tokenKey);\n          tokens = undefined;\n        }\n      }\n\n      if (tokens) {\n        return tokens;\n      }\n    }\n\n    // 3. No valid tokens - perform DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting external OAuth authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // Save tokens for future use\n    await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /**\n   * Refreshes an access token using a refresh token.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed from the server actually being talked to (SSRF mitigation, see discovery-fetch.ts). Defaults to `false`.\n   */\n  private async refreshTokens(tokens: TokenSet, tokenEndpoint: string | undefined, resource: string, allowLoopback = false): Promise<TokenSet> {\n    if (!tokenEndpoint) {\n      throw new Error('Token endpoint not available for refresh');\n    }\n\n    if (!tokens.refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    if (!tokens.clientId || !tokens.clientSecret) {\n      throw new Error('Client credentials not available for refresh');\n    }\n\n    return await this.oauthFlow.refreshTokens(tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret, resource, allowLoopback);\n  }\n\n  /**\n   * Deletes both stored token families for a server, across every issuer they were bound to.\n   *\n   * Takes the same `mcpServerUrl` that {@link DcrAuthenticator.ensureAuthenticated}\n   * was given - keys are built from the configured URL, never from the discovered\n   * RFC 8707 resource, precisely so this can find them without doing discovery.\n   *\n   * @throws CredentialBindingError if the configured store cannot enumerate keys.\n   */\n  async deleteTokens(mcpServerUrl: string): Promise<void> {\n    const suffix = `:${normalizeUrl(mcpServerUrl)}`;\n    if (!this.tokenStore.iterator) {\n      throw new CredentialBindingError('Token store does not support key enumeration, which issuer-keyed credentials require');\n    }\n\n    for await (const [key] of this.tokenStore.iterator(this.tokenStore.namespace)) {\n      if (typeof key === 'string' && (key.startsWith('tokens:') || key.startsWith('dcr-tokens:')) && key.endsWith(suffix)) {\n        await this.tokenStore.delete(key);\n      }\n    }\n    this.logger.debug(`🗑️  Deleted tokens for ${mcpServerUrl}`);\n  }\n\n  /** Discards a stored credential that is not bound to `issuer` (SEP-2352), including one stored before issuer binding existed. */\n  private async loadTokens(key: string, issuer: string): Promise<TokenSet | undefined> {\n    const tokens = (await this.tokenStore.get(key)) as TokenSet | undefined;\n    if (!tokens) return undefined;\n    if (tokens.issuer === issuer) return tokens;\n\n    this.logger.debug('🔑 Stored credential is not bound to the discovered issuer, re-authorizing');\n    await this.tokenStore.delete(key);\n    return undefined;\n  }\n\n  private buildFlowOptions(port: number, capabilities: AuthCapabilities, issuer: string, resource: string, allowLoopback: boolean): OAuthFlowOptions {\n    const flowOptions: OAuthFlowOptions = {\n      port,\n      issuer,\n      resource,\n      headless: this.headless,\n      redirectUri: this.redirectUri,\n      pkce: true,\n      logger: this.logger,\n      allowLoopback,\n      authorizationResponseIssSupported: capabilities.authorizationResponseIssSupported ?? false,\n    };\n    if (capabilities.scopes) {\n      flowOptions.scopes = capabilities.scopes;\n    }\n    return flowOptions;\n  }\n}\n"],"names":["DcrAuthenticator","REFRESH_BUFFER_MS","CredentialBindingError","message","name","Error","requireIssuer","capabilities","issuer","options","tokenStore","storePath","path","join","process","cwd","fs","mkdirSync","dirname","recursive","Keyv","store","KeyvFile","filename","dcrClient","DynamicClientRegistrar","oauthFlow","InteractiveOAuthFlow","headless","redirectUri","logger","defaultLogger","detectSelfHostedMode","mcpServerUrl","includes","_error","ensureAuthenticated","isSelfHosted","ensureAuthenticatedSelfHosted","ensureAuthenticatedExternal","resolveUrls","storeKey","normalizeUrl","serverBaseUrl","extractBaseUrl","resource","allowLoopback","dcrTokenKey","tokens","verifyUrl","verifyResponse","verifyData","port","client","flowOptions","error","isLoopbackUrl","loadTokens","fetch","headers","Authorization","accessToken","Connection","ok","json","token","delete","undefined","registrationEndpoint","authorizationEndpoint","tokenEndpoint","debug","parseInt","URL","startsWith","registerClient","buildFlowOptions","performAuthFlow","clientId","clientSecret","status","String","set","tokenKey","expiresAt","Date","now","refreshTokens","warn","refreshToken","deleteTokens","suffix","key","iterator","namespace","endsWith","get","pkce","authorizationResponseIssSupported","scopes"],"mappings":"AAAA;;;CAGC;;;;+BAuDYA;;;eAAAA;;;+DArDI;0DACG;2DACH;wBACQ;gCACK;sCACO;0BAEQ;wBACQ;wCACd;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBvC;;CAEC,GACD,IAAMC,oBAAoB,IAAI,KAAK;AAEnC,6EAA6E,GAC7E,IAAA,AAAMC,uCAAN;;cAAMA;aAAAA,uBACQC,OAAe;gCADvBD;;gBAEF,kBAFEA;YAEIC;;QACN,MAAKC,IAAI,GAAG;;;WAHVF;qBAA+BG;AAOrC;;;CAGC,GACD,SAASC,cAAcC,YAA8B;IACnD,IAAI,CAACA,aAAaC,MAAM,EAAE;QACxB,MAAM,IAAIN,uBAAuB;IACnC;IACA,OAAOK,aAAaC,MAAM;AAC5B;AAMO,IAAA,AAAMR,iCAAN;;aAAMA,iBAQCS,OAAgC;gCARjCT;YA0BKS;QAjBd,IAAIA,QAAQC,UAAU,EAAE;YACtB,IAAI,CAACA,UAAU,GAAGD,QAAQC,UAAU;QACtC,OAAO;YACL,sDAAsD;YACtD,IAAMC,YAAYC,iBAAI,CAACC,IAAI,CAACC,QAAQC,GAAG,IAAI,UAAU;YAErD,gDAAgD;YAChDC,IAAGC,SAAS,CAACL,iBAAI,CAACM,OAAO,CAACP,YAAY;gBAAEQ,WAAW;YAAK;YAExD,IAAI,CAACT,UAAU,GAAG,IAAIU,aAAI,CAAC;gBACzBC,OAAO,IAAIC,kBAAQ,CAAC;oBAAEC,UAAUZ;gBAAU;YAC5C;QACF;QACA,IAAI,CAACa,SAAS,GAAG,IAAIC,gDAAsB;QAC3C,IAAI,CAACC,SAAS,GAAG,IAAIC,4CAAoB;QACzC,IAAI,CAACC,QAAQ,GAAGnB,QAAQmB,QAAQ,IAAI;QACpC,IAAI,CAACC,WAAW,GAAGpB,QAAQoB,WAAW;QACtC,IAAI,CAACC,MAAM,IAAGrB,kBAAAA,QAAQqB,MAAM,cAAdrB,6BAAAA,kBAAkBsB,gBAAa;;iBA1BpC/B;IA6BX;;;GAGC,GACD,OAAcgC,oBAUb,GAVD,SAAcA,qBAAqBC,YAAoB;;;gBACrD,IAAI;oBACF,+DAA+D;oBAC/D,oEAAoE;oBACpE,2EAA2E;oBAC3E,qDAAqD;oBACrD;;wBAAOA,aAAaC,QAAQ,CAAC,gBAAgBD,aAAaC,QAAQ,CAAC;;gBACrE,EAAE,OAAOC,QAAQ;oBACf;;wBAAO;uBAAO,0CAA0C;gBAC1D;;;;;QACF;;IAEA;;;;;;;;;;;;;;;;;;GAkBC,GACD,OAAMC,mBAQL,GARD,SAAMA,oBAAoBH,YAAoB,EAAE1B,YAA8B;;gBAEtE8B;;;;wBAAe;;4BAAM,IAAI,CAACL,oBAAoB,CAACC;;;wBAA/CI,eAAe;wBAErB,IAAIA,cAAc;4BAChB;;gCAAO,IAAI,CAACC,6BAA6B,CAACL,cAAc1B;;wBAC1D;wBACA;;4BAAO,IAAI,CAACgC,2BAA2B,CAACN,cAAc1B;;;;QACxD;;IAEA;;;;;;;;;;;;;;;;;GAiBC,GACD,OAAQiC,WAGP,GAHD,SAAQA,YAAYP,YAAoB,EAAE1B,YAA8B;YAENA;QADhE,IAAMkC,WAAWC,IAAAA,wBAAY,EAACT;QAC9B,OAAO;YAAEU,eAAeC,IAAAA,0BAAc,EAACX;YAAeY,QAAQ,GAAEtC,yBAAAA,aAAasC,QAAQ,cAArBtC,oCAAAA,yBAAyBkC;YAAUA,UAAAA;QAAS;IAC9G;IAEA;;;GAGC,GACD,OAAcH,6BAoFb,GApFD,SAAcA,8BAA8BL,YAAoB,EAAE1B,YAA8B;;gBAGxFuC,eACAtC,QACwC,mBAAtCmC,eAAeE,UAAUJ,UAC3BM,aAGFC,QAKMC,WACAC,gBAKEC,YAMDhB,QAiBLiB,MAIAC,QAMAC,aAMEL,YACAC,iBAQAC,aAMCI;;;;wBAzET,wEAAwE;wBACxE,4FAA4F;wBACtFT,gBAAgBU,IAAAA,+BAAa,EAACvB;wBAC9BzB,SAASF,cAAcC;wBACiB,oBAAA,IAAI,CAACiC,WAAW,CAACP,cAAc1B,eAArEoC,gBAAsC,kBAAtCA,eAAeE,WAAuB,kBAAvBA,UAAUJ,WAAa,kBAAbA;wBAC3BM,cAAc,AAAC,cAAuBN,OAAVjC,QAAO,KAAY,OAATiC;wBAG/B;;4BAAM,IAAI,CAACgB,UAAU,CAACV,aAAavC;;;wBAA5CwC,SAAS;6BAETA,QAAAA;;;;;;;;;;;;wBAGMC,YAAY,AAAC,GAAgB,OAAdN,eAAc;wBACZ;;4BAAMe,MAAMT,WAAW;gCAC5CU,SAAS;oCAAEC,eAAe,AAAC,UAA4B,OAAnBZ,OAAOa,WAAW;oCAAIC,YAAY;gCAAQ;4BAChF;;;wBAFMZ,iBAAiB;6BAInBA,eAAea,EAAE,EAAjBb;;;;wBACkB;;4BAAMA,eAAec,IAAI;;;wBAAvCb,aAAc;wBACpB,IAAIA,WAAWc,KAAK,KAAKjB,OAAOa,WAAW,EAAE;4BAC3C,mDAAmD;4BACnD;;gCAAOb;;wBACT;;;;;;;;wBAEKb;;;;;;wBAIT,8BAA8B;wBAC9B;;4BAAM,IAAI,CAACzB,UAAU,CAACwD,MAAM,CAACnB;;;wBAA7B;wBACAC,SAASmB;;;wBAGX,qDAAqD;wBACrD,IAAI,CAAC5D,aAAa6D,oBAAoB,IAAI,CAAC7D,aAAa8D,qBAAqB,IAAI,CAAC9D,aAAa+D,aAAa,EAAE;4BAC5G,MAAM,IAAIjE,MAAM;wBAClB;wBAEA,IAAI,CAACyB,MAAM,CAACyC,KAAK,CAAC;wBAElB,6CAA6C;wBACvCnB,OAAOoB,SAAS,IAAIC,IAAI,IAAI,CAAC5C,WAAW,EAAEuB,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACvB,WAAW,CAAC6C,UAAU,CAAC,YAAY,MAAM,EAAC;wBAE7G,gCAAgC;wBAChC,IAAI,CAAC5C,MAAM,CAACyC,KAAK,CAAC;wBACH;;4BAAM,IAAI,CAAC/C,SAAS,CAACmD,cAAc,CAACpE,aAAa6D,oBAAoB,EAAE;gCACpFvC,aAAa,IAAI,CAACA,WAAW;gCAC7BiB,eAAAA;4BACF;;;wBAHMO,SAAS;wBAKf,wDAAwD;wBAClDC,cAAc,IAAI,CAACsB,gBAAgB,CAACxB,MAAM7C,cAAcC,QAAQqC,UAAUC;wBAEvE;;4BAAM,IAAI,CAACpB,SAAS,CAACmD,eAAe,CAACtE,aAAa8D,qBAAqB,EAAE9D,aAAa+D,aAAa,EAAEjB,OAAOyB,QAAQ,EAAEzB,OAAO0B,YAAY,EAAEzB;;;wBAApJN,SAAS;;;;;;;;;wBAIDC,aAAY,AAAC,GAAgB,OAAdN,eAAc;wBACZ;;4BAAMe,MAAMT,YAAW;gCAC5CU,SAAS;oCAAEC,eAAe,AAAC,UAA4B,OAAnBZ,OAAOa,WAAW;oCAAIC,YAAY;gCAAQ;4BAChF;;;wBAFMZ,kBAAiB;wBAIvB,IAAI,CAACA,gBAAea,EAAE,EAAE;4BACtB,MAAM,IAAI1D,MAAM,AAAC,uDAA4E,OAAtB6C,gBAAe8B,MAAM;wBAC9F;wBAEoB;;4BAAM9B,gBAAec,IAAI;;;wBAAvCb,cAAc;wBACpB,IAAIA,YAAWc,KAAK,KAAKjB,OAAOa,WAAW,EAAE;4BAC3C,MAAM,IAAIxD,MAAM;wBAClB;wBAEA,IAAI,CAACyB,MAAM,CAACyC,KAAK,CAAC;;;;;;wBACXhB;wBACP,IAAI,CAACzB,MAAM,CAACyB,KAAK,CAAC,oCAAoCA,AAAK,YAALA,OAAiBlD,SAAQkD,MAAMpD,OAAO,GAAG8E,OAAO1B;wBACtG,MAAM,IAAIlD,MAAM;;wBAGlB,6BAA6B;wBAC7B;;4BAAM,IAAI,CAACK,UAAU,CAACwE,GAAG,CAACnC,aAAa,wCAAKC;gCAAQxC,QAAAA;;;;wBAApD;wBACA,IAAI,CAACsB,MAAM,CAACyC,KAAK,CAAC;wBAElB;;4BAAOvB;;;;QACT;;IAEA,2EAA2E,GAC3E,OAAcT,2BA2Db,GA3DD,SAAcA,4BAA4BN,YAAoB,EAAE1B,YAA8B;;gBAEtFuC,eACAtC,QACyB,mBAAvBqC,UAAUJ,UACZ0C,UAGFnC,QAWSb,QAqBPiB,MAIAC,QAMAC;;;;wBAjDN,gEAAgE;wBAC1DR,gBAAgBU,IAAAA,+BAAa,EAACvB;wBAC9BzB,SAASF,cAAcC;wBACE,oBAAA,IAAI,CAACiC,WAAW,CAACP,cAAc1B,eAAtDsC,WAAuB,kBAAvBA,UAAUJ,WAAa,kBAAbA;wBACZ0C,WAAW,AAAC,UAAmB1C,OAAVjC,QAAO,KAAY,OAATiC;wBAGxB;;4BAAM,IAAI,CAACgB,UAAU,CAAC0B,UAAU3E;;;wBAAzCwC,SAAS;6BAETA,QAAAA;;;;6BAEEA,CAAAA,OAAOoC,SAAS,GAAGC,KAAKC,GAAG,KAAKrF,iBAAgB,GAAhD+C;;;;wBACF,IAAI,CAAClB,MAAM,CAACyC,KAAK,CAAC;;;;;;;;;wBAGP;;4BAAM,IAAI,CAACgB,aAAa,CAACvC,QAAQzC,aAAa+D,aAAa,EAAEzB,UAAUC;;;wBAAhFE,SAAS;wBACT;;4BAAM,IAAI,CAACtC,UAAU,CAACwE,GAAG,CAACC,UAAU,wCAAKnC;gCAAQxC,QAAAA;;;;wBAAjD;wBACA,IAAI,CAACsB,MAAM,CAACyC,KAAK,CAAC;;;;;;wBACXpC;wBACP,oDAAoD;wBACpD,IAAI,CAACL,MAAM,CAAC0D,IAAI,CAAC;wBACjB;;4BAAM,IAAI,CAAC9E,UAAU,CAACwD,MAAM,CAACiB;;;wBAA7B;wBACAnC,SAASmB;;;;;;wBAIb,IAAInB,QAAQ;4BACV;;gCAAOA;;wBACT;;;wBAGF,gDAAgD;wBAChD,IAAI,CAACzC,aAAa6D,oBAAoB,IAAI,CAAC7D,aAAa8D,qBAAqB,IAAI,CAAC9D,aAAa+D,aAAa,EAAE;4BAC5G,MAAM,IAAIjE,MAAM;wBAClB;wBAEA,IAAI,CAACyB,MAAM,CAACyC,KAAK,CAAC;wBAElB,6CAA6C;wBACvCnB,OAAOoB,SAAS,IAAIC,IAAI,IAAI,CAAC5C,WAAW,EAAEuB,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACvB,WAAW,CAAC6C,UAAU,CAAC,YAAY,MAAM,EAAC;wBAE7G,gCAAgC;wBAChC,IAAI,CAAC5C,MAAM,CAACyC,KAAK,CAAC;wBACH;;4BAAM,IAAI,CAAC/C,SAAS,CAACmD,cAAc,CAACpE,aAAa6D,oBAAoB,EAAE;gCACpFvC,aAAa,IAAI,CAACA,WAAW;gCAC7BiB,eAAAA;4BACF;;;wBAHMO,SAAS;wBAKf,wDAAwD;wBAClDC,cAAc,IAAI,CAACsB,gBAAgB,CAACxB,MAAM7C,cAAcC,QAAQqC,UAAUC;wBAEvE;;4BAAM,IAAI,CAACpB,SAAS,CAACmD,eAAe,CAACtE,aAAa8D,qBAAqB,EAAE9D,aAAa+D,aAAa,EAAEjB,OAAOyB,QAAQ,EAAEzB,OAAO0B,YAAY,EAAEzB;;;wBAApJN,SAAS;wBAET,6BAA6B;wBAC7B;;4BAAM,IAAI,CAACtC,UAAU,CAACwE,GAAG,CAACC,UAAU,wCAAKnC;gCAAQxC,QAAAA;;;;wBAAjD;wBACA,IAAI,CAACsB,MAAM,CAACyC,KAAK,CAAC;wBAElB;;4BAAOvB;;;;QACT;;IAEA;;;;GAIC,GACD,OAAcuC,aAcb,GAdD,SAAcA,cAAcvC,MAAgB,EAAEsB,aAAiC,EAAEzB,QAAgB;YAAEC,gBAAAA,iEAAgB;;;;;wBACjH,IAAI,CAACwB,eAAe;4BAClB,MAAM,IAAIjE,MAAM;wBAClB;wBAEA,IAAI,CAAC2C,OAAOyC,YAAY,EAAE;4BACxB,MAAM,IAAIpF,MAAM;wBAClB;wBAEA,IAAI,CAAC2C,OAAO8B,QAAQ,IAAI,CAAC9B,OAAO+B,YAAY,EAAE;4BAC5C,MAAM,IAAI1E,MAAM;wBAClB;wBAEO;;4BAAM,IAAI,CAACqB,SAAS,CAAC6D,aAAa,CAACjB,eAAetB,OAAOyC,YAAY,EAAEzC,OAAO8B,QAAQ,EAAE9B,OAAO+B,YAAY,EAAElC,UAAUC;;;wBAA9H;;4BAAO;;;;QACT;;IAEA;;;;;;;;GAQC,GACD,OAAM4C,YAYL,GAZD,SAAMA,aAAazD,YAAoB;;gBAC/B0D,yGAKYC;;;;wBALZD,SAAS,AAAC,IAA8B,OAA3BjD,IAAAA,wBAAY,EAACT;wBAChC,IAAI,CAAC,IAAI,CAACvB,UAAU,CAACmF,QAAQ,EAAE;4BAC7B,MAAM,IAAI3F,uBAAuB;wBACnC;;;;;;;;;;oDAE0B,IAAI,CAACQ,UAAU,CAACmF,QAAQ,CAAC,IAAI,CAACnF,UAAU,CAACoF,SAAS;;;;;;;;;;;;;+DAA1DF;6BACZ,CAAA,OAAOA,QAAQ,YAAaA,CAAAA,IAAIlB,UAAU,CAAC,cAAckB,IAAIlB,UAAU,CAAC,cAAa,KAAMkB,IAAIG,QAAQ,CAACJ,OAAM,GAA9G;;;;wBACF;;4BAAM,IAAI,CAACjF,UAAU,CAACwD,MAAM,CAAC0B;;;wBAA7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAGJ,IAAI,CAAC9D,MAAM,CAACyC,KAAK,CAAC,AAAC,qCAAuC,OAAbtC;;;;;;QAC/C;;IAEA,+HAA+H,GAC/H,OAAcwB,UAQb,GARD,SAAcA,WAAWmC,GAAW,EAAEpF,MAAc;;gBAC5CwC;;;;wBAAU;;4BAAM,IAAI,CAACtC,UAAU,CAACsF,GAAG,CAACJ;;;wBAApC5C,SAAU;wBAChB,IAAI,CAACA,QAAQ;;4BAAOmB;;wBACpB,IAAInB,OAAOxC,MAAM,KAAKA,QAAQ;;4BAAOwC;;wBAErC,IAAI,CAAClB,MAAM,CAACyC,KAAK,CAAC;wBAClB;;4BAAM,IAAI,CAAC7D,UAAU,CAACwD,MAAM,CAAC0B;;;wBAA7B;wBACA;;4BAAOzB;;;;QACT;;IAEA,OAAQS,gBAgBP,GAhBD,SAAQA,iBAAiBxB,IAAY,EAAE7C,YAA8B,EAAEC,MAAc,EAAEqC,QAAgB,EAAEC,aAAsB;YAUxFvC;QATrC,IAAM+C,cAAgC;YACpCF,MAAAA;YACA5C,QAAAA;YACAqC,UAAAA;YACAjB,UAAU,IAAI,CAACA,QAAQ;YACvBC,aAAa,IAAI,CAACA,WAAW;YAC7BoE,MAAM;YACNnE,QAAQ,IAAI,CAACA,MAAM;YACnBgB,eAAAA;YACAoD,iCAAiC,GAAE3F,kDAAAA,aAAa2F,iCAAiC,cAA9C3F,6DAAAA,kDAAkD;QACvF;QACA,IAAIA,aAAa4F,MAAM,EAAE;YACvB7C,YAAY6C,MAAM,GAAG5F,aAAa4F,MAAM;QAC1C;QACA,OAAO7C;IACT;WAhUWtD"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/dcr/dcr-authenticator.ts"],"sourcesContent":["/**\n * DCR Authenticator\n * Consolidates DCR and OAuth flow logic for MCP HTTP servers\n */\n\nimport path from 'node:path';\nimport * as fs from 'fs';\nimport Keyv from 'keyv';\nimport { KeyvFile } from 'keyv-file';\nimport { isLoopbackUrl } from '../auth/discovery-fetch.ts';\nimport { InteractiveOAuthFlow } from '../auth/interactive-oauth-flow.ts';\nimport type { AuthCapabilities, OAuthFlowOptions, TokenSet } from '../auth/types.ts';\nimport { extractBaseUrl, normalizeUrl } from '../lib/url-utils.ts';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { DynamicClientRegistrar } from './dynamic-client-registrar.ts';\n\n/**\n * DcrAuthenticator configuration options\n */\nexport interface DcrAuthenticatorOptions {\n  /** Custom Keyv store (for testing) - if not provided, uses default ~/.mcpeasy/tokens.json */\n  tokenStore?: Keyv;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Required redirect URI for OAuth callback */\n  redirectUri: string;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * Buffer time before token expiry to trigger proactive refresh (5 minutes)\n */\nconst REFRESH_BUFFER_MS = 5 * 60 * 1000;\n\n/** Raised when a credential cannot be bound to, or looked up by, an issuer. */\nclass CredentialBindingError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'CredentialBindingError';\n  }\n}\n\n/**\n * The issuer credentials are keyed by, so they can never be presented to a\n * different authorization server even when the resource keeps its URL (SEP-2352).\n */\nfunction requireIssuer(capabilities: AuthCapabilities): string {\n  if (!capabilities.issuer) {\n    throw new CredentialBindingError('Authorization server metadata has no issuer - credentials cannot be bound to an authorization server (RFC 8414 requires issuer)');\n  }\n  return capabilities.issuer;\n}\n\n/**\n * DcrAuthenticator manages authentication for MCP HTTP servers\n * Handles DCR registration, OAuth flows, and token management\n */\nexport class DcrAuthenticator {\n  private tokenStore: Keyv;\n  private dcrClient: DynamicClientRegistrar;\n  private oauthFlow: InteractiveOAuthFlow;\n  private headless: boolean;\n  private redirectUri: string;\n  private logger: Logger;\n\n  constructor(options: DcrAuthenticatorOptions) {\n    if (options.tokenStore) {\n      this.tokenStore = options.tokenStore;\n    } else {\n      // Default CLI store in .mcp-z directory (per-project)\n      const storePath = path.join(process.cwd(), '.mcp-z', 'tokens.json');\n\n      // Ensure directory exists before creating store\n      fs.mkdirSync(path.dirname(storePath), { recursive: true });\n\n      this.tokenStore = new Keyv({\n        store: new KeyvFile({ filename: storePath }),\n      });\n    }\n    this.dcrClient = new DynamicClientRegistrar();\n    this.oauthFlow = new InteractiveOAuthFlow();\n    this.headless = options.headless || false;\n    this.redirectUri = options.redirectUri;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Detect if server is self-hosted DCR (vs external OAuth provider)\n   * Self-hosted servers have their own OAuth endpoints and manage token storage\n   */\n  private async detectSelfHostedMode(mcpServerUrl: string): Promise<boolean> {\n    try {\n      // Self-hosted DCR servers typically run their own OAuth server\n      // Check if this is a self-hosted instance by testing OAuth metadata\n      // For now, assume self-hosted if the URL matches common localhost patterns\n      // TODO: Implement proper self-hosted detection logic\n      return mcpServerUrl.includes('localhost') || mcpServerUrl.includes('127.0.0.1');\n    } catch (_error) {\n      return false; // Assume external mode if detection fails\n    }\n  }\n\n  /**\n   * Ensure server is authenticated, performing DCR and OAuth if needed\n   * Proactively refreshes tokens if they're within 5 minutes of expiry\n   *\n   * @param mcpServerUrl - The MCP server's canonical URL, exactly as configured,\n   *   with its path intact (`https://example.com/mcp`). Not a deployment root:\n   *   the path is what identifies the resource an issued token is bound to.\n   * @param capabilities - Auth capabilities from .well-known endpoint\n   * @returns Valid token set ready to use\n   *\n   * @throws Error if authentication fails\n   *\n   * @example\n   * const authenticator = new DcrAuthenticator({ redirectUri: 'http://localhost:3000/callback' });\n   * const tokens = await authenticator.ensureAuthenticated(\n   *   'https://example.com/mcp',\n   *   capabilities\n   * );\n   */\n  async ensureAuthenticated(mcpServerUrl: string, capabilities: AuthCapabilities, signal?: AbortSignal): Promise<TokenSet> {\n    throwIfAborted(signal);\n    // Auto-detect server mode\n    const isSelfHosted = await this.detectSelfHostedMode(mcpServerUrl);\n\n    if (isSelfHosted) {\n      return this.ensureAuthenticatedSelfHosted(mcpServerUrl, capabilities, signal);\n    }\n    return this.ensureAuthenticatedExternal(mcpServerUrl, capabilities, signal);\n  }\n\n  /**\n   * The three things a server URL is used for here, kept apart on purpose.\n   *\n   * They were one value once, and collapsing them is what sent an authorization\n   * server the wrong audience: `resource` was derived from the deployment root,\n   * so a server at `https://host/mcp` was asked to mint a token for\n   * `https://host`, and any server that validates the indicator answered\n   * `invalid_target`.\n   *\n   * - `serverBaseUrl` builds the server's own endpoints (`/oauth/verify`), so a\n   *   trailing `/mcp` comes off.\n   * - `resource` is the RFC 8707 audience. The resource server names itself in\n   *   its RFC 9728 metadata; that name wins. Only when no such document exists\n   *   do we fall back to the URL we were configured with.\n   * - `storeKey` identifies the credential locally. It stays the configured URL\n   *   rather than the discovered `resource`, so it can be computed without a\n   *   network round trip - `deleteTokens` has only the URL to work from.\n   */\n  private resolveUrls(mcpServerUrl: string, capabilities: AuthCapabilities): { serverBaseUrl: string; resource: string; storeKey: string } {\n    const storeKey = normalizeUrl(mcpServerUrl);\n    return { serverBaseUrl: extractBaseUrl(mcpServerUrl), resource: capabilities.resource ?? storeKey, storeKey };\n  }\n\n  /**\n   * Handle authentication for self-hosted DCR servers\n   * Self-hosted servers manage their own token storage via /oauth/verify\n   */\n  private async ensureAuthenticatedSelfHosted(mcpServerUrl: string, capabilities: AuthCapabilities, signal?: AbortSignal): Promise<TokenSet> {\n    // Loopback trust for every discovery-derived fetch below, computed from\n    // the server we're talking to, never from capabilities' endpoints (see discovery-fetch.ts).\n    const allowLoopback = isLoopbackUrl(mcpServerUrl);\n    const issuer = requireIssuer(capabilities);\n    const { serverBaseUrl, resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);\n    const dcrTokenKey = `dcr-tokens:${issuer}:${storeKey}`;\n\n    // 1. Check for existing DCR tokens (different from external tokens)\n    let tokens = await this.loadTokens(dcrTokenKey, issuer);\n\n    if (tokens) {\n      // 2. Verify token is still valid by calling /oauth/verify\n      try {\n        const verifyUrl = `${serverBaseUrl}/oauth/verify`;\n        const verifyResponse = await fetch(verifyUrl, {\n          headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n          signal,\n        });\n\n        if (verifyResponse.ok) {\n          const verifyData = (await verifyResponse.json()) as { token?: string };\n          if (verifyData.token === tokens.accessToken) {\n            // Token is still valid with the self-hosted server\n            return tokens;\n          }\n        }\n      } catch (_error) {\n        // Token verification failed - need to re-authenticate\n      }\n\n      // Token is expired or invalid\n      await this.tokenStore.delete(dcrTokenKey);\n      tokens = undefined;\n    }\n\n    // 3. No valid tokens - perform full DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting self-hosted DCR authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client with self-hosted server...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n      signal,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback, signal);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // For self-hosted mode, verify the token works with /oauth/verify immediately\n    try {\n      const verifyUrl = `${serverBaseUrl}/oauth/verify`;\n      const verifyResponse = await fetch(verifyUrl, {\n        headers: { Authorization: `Bearer ${tokens.accessToken}`, Connection: 'close' },\n        signal,\n      });\n\n      if (!verifyResponse.ok) {\n        throw new Error(`DCR token verification failed after authentication: ${verifyResponse.status}`);\n      }\n\n      const verifyData = (await verifyResponse.json()) as { token?: string };\n      if (verifyData.token !== tokens.accessToken) {\n        throw new Error('DCR server returned different token in verification');\n      }\n\n      this.logger.debug('✅ DCR token verified with self-hosted server');\n    } catch (error) {\n      this.logger.error('❌ DCR token verification failed:', error instanceof Error ? error.message : String(error));\n      throw new Error('Self-hosted DCR authentication completed but token verification failed');\n    }\n\n    // Save tokens for future use\n    await this.tokenStore.set(dcrTokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Self-hosted DCR authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /** Handles authentication for external (non-self-hosted) OAuth providers. */\n  private async ensureAuthenticatedExternal(mcpServerUrl: string, capabilities: AuthCapabilities, signal?: AbortSignal): Promise<TokenSet> {\n    // See ensureAuthenticatedSelfHosted - same loopback trust rule.\n    const allowLoopback = isLoopbackUrl(mcpServerUrl);\n    const issuer = requireIssuer(capabilities);\n    const { resource, storeKey } = this.resolveUrls(mcpServerUrl, capabilities);\n    const tokenKey = `tokens:${issuer}:${storeKey}`;\n\n    // 1. Check for existing tokens\n    let tokens = await this.loadTokens(tokenKey, issuer);\n\n    if (tokens) {\n      // 2. Proactive refresh if token expires within 5 minutes\n      if (tokens.expiresAt < Date.now() + REFRESH_BUFFER_MS) {\n        this.logger.debug('🔄 Refreshing access token...');\n\n        try {\n          tokens = await this.refreshTokens(tokens, capabilities.tokenEndpoint, resource, allowLoopback, signal);\n          await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n          this.logger.debug('✅ Token refreshed successfully');\n        } catch (_error) {\n          // Refresh failed - clear tokens and re-authenticate\n          this.logger.warn('⚠️  Token refresh failed, re-authenticating...');\n          await this.tokenStore.delete(tokenKey);\n          tokens = undefined;\n        }\n      }\n\n      if (tokens) {\n        return tokens;\n      }\n    }\n\n    // 3. No valid tokens - perform DCR + OAuth flow\n    if (!capabilities.registrationEndpoint || !capabilities.authorizationEndpoint || !capabilities.tokenEndpoint) {\n      throw new Error('Server does not provide required OAuth endpoints');\n    }\n\n    this.logger.debug('🔐 No valid tokens found, starting external OAuth authentication...');\n\n    // Extract port from pre-resolved redirectUri\n    const port = parseInt(new URL(this.redirectUri).port, 10) || (this.redirectUri.startsWith('https:') ? 443 : 80);\n\n    // Register OAuth client via DCR\n    this.logger.debug('📝 Registering OAuth client...');\n    const client = await this.dcrClient.registerClient(capabilities.registrationEndpoint, {\n      redirectUri: this.redirectUri,\n      allowLoopback,\n      signal,\n    });\n\n    // Perform OAuth authorization flow with PKCE (RFC 7636)\n    const flowOptions = this.buildFlowOptions(port, capabilities, issuer, resource, allowLoopback, signal);\n\n    tokens = await this.oauthFlow.performAuthFlow(capabilities.authorizationEndpoint, capabilities.tokenEndpoint, client.clientId, client.clientSecret, flowOptions);\n\n    // Save tokens for future use\n    await this.tokenStore.set(tokenKey, { ...tokens, issuer });\n    this.logger.debug('✅ Authentication successful, tokens saved');\n\n    return tokens;\n  }\n\n  /**\n   * Refreshes an access token using a refresh token.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed from the server actually being talked to (SSRF mitigation, see discovery-fetch.ts). Defaults to `false`.\n   */\n  private async refreshTokens(tokens: TokenSet, tokenEndpoint: string | undefined, resource: string, allowLoopback = false, signal?: AbortSignal): Promise<TokenSet> {\n    if (!tokenEndpoint) {\n      throw new Error('Token endpoint not available for refresh');\n    }\n\n    if (!tokens.refreshToken) {\n      throw new Error('No refresh token available');\n    }\n\n    if (!tokens.clientId || !tokens.clientSecret) {\n      throw new Error('Client credentials not available for refresh');\n    }\n\n    return await this.oauthFlow.refreshTokens(tokenEndpoint, tokens.refreshToken, tokens.clientId, tokens.clientSecret, resource, allowLoopback, signal);\n  }\n\n  /**\n   * Deletes both stored token families for a server, across every issuer they were bound to.\n   *\n   * Takes the same `mcpServerUrl` that {@link DcrAuthenticator.ensureAuthenticated}\n   * was given - keys are built from the configured URL, never from the discovered\n   * RFC 8707 resource, precisely so this can find them without doing discovery.\n   *\n   * @throws CredentialBindingError if the configured store cannot enumerate keys.\n   */\n  async deleteTokens(mcpServerUrl: string): Promise<void> {\n    const suffix = `:${normalizeUrl(mcpServerUrl)}`;\n    if (!this.tokenStore.iterator) {\n      throw new CredentialBindingError('Token store does not support key enumeration, which issuer-keyed credentials require');\n    }\n\n    for await (const [key] of this.tokenStore.iterator(this.tokenStore.namespace)) {\n      if (typeof key === 'string' && (key.startsWith('tokens:') || key.startsWith('dcr-tokens:')) && key.endsWith(suffix)) {\n        await this.tokenStore.delete(key);\n      }\n    }\n    this.logger.debug(`🗑️  Deleted tokens for ${mcpServerUrl}`);\n  }\n\n  /** Discards a stored credential that is not bound to `issuer` (SEP-2352), including one stored before issuer binding existed. */\n  private async loadTokens(key: string, issuer: string): Promise<TokenSet | undefined> {\n    const tokens = (await this.tokenStore.get(key)) as TokenSet | undefined;\n    if (!tokens) return undefined;\n    if (tokens.issuer === issuer) return tokens;\n\n    this.logger.debug('🔑 Stored credential is not bound to the discovered issuer, re-authorizing');\n    await this.tokenStore.delete(key);\n    return undefined;\n  }\n\n  private buildFlowOptions(port: number, capabilities: AuthCapabilities, issuer: string, resource: string, allowLoopback: boolean, signal?: AbortSignal): OAuthFlowOptions {\n    const flowOptions: OAuthFlowOptions = {\n      port,\n      issuer,\n      resource,\n      headless: this.headless,\n      redirectUri: this.redirectUri,\n      pkce: true,\n      logger: this.logger,\n      allowLoopback,\n      ...(signal && { signal }),\n      authorizationResponseIssSupported: capabilities.authorizationResponseIssSupported ?? false,\n    };\n    if (capabilities.scopes) {\n      flowOptions.scopes = capabilities.scopes;\n    }\n    return flowOptions;\n  }\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('Authentication was cancelled');\n}\n"],"names":["DcrAuthenticator","REFRESH_BUFFER_MS","CredentialBindingError","message","name","Error","requireIssuer","capabilities","issuer","options","tokenStore","storePath","path","join","process","cwd","fs","mkdirSync","dirname","recursive","Keyv","store","KeyvFile","filename","dcrClient","DynamicClientRegistrar","oauthFlow","InteractiveOAuthFlow","headless","redirectUri","logger","defaultLogger","detectSelfHostedMode","mcpServerUrl","includes","_error","ensureAuthenticated","signal","isSelfHosted","throwIfAborted","ensureAuthenticatedSelfHosted","ensureAuthenticatedExternal","resolveUrls","storeKey","normalizeUrl","serverBaseUrl","extractBaseUrl","resource","allowLoopback","dcrTokenKey","tokens","verifyUrl","verifyResponse","verifyData","port","client","flowOptions","error","isLoopbackUrl","loadTokens","fetch","headers","Authorization","accessToken","Connection","ok","json","token","delete","undefined","registrationEndpoint","authorizationEndpoint","tokenEndpoint","debug","parseInt","URL","startsWith","registerClient","buildFlowOptions","performAuthFlow","clientId","clientSecret","status","String","set","tokenKey","expiresAt","Date","now","refreshTokens","warn","refreshToken","deleteTokens","suffix","key","iterator","namespace","endsWith","get","pkce","authorizationResponseIssSupported","scopes","aborted","reason"],"mappings":"AAAA;;;CAGC;;;;+BAuDYA;;;eAAAA;;;+DArDI;0DACG;2DACH;wBACQ;gCACK;sCACO;0BAEQ;wBACQ;wCACd;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBvC;;CAEC,GACD,IAAMC,oBAAoB,IAAI,KAAK;AAEnC,6EAA6E,GAC7E,IAAA,AAAMC,uCAAN;;cAAMA;aAAAA,uBACQC,OAAe;gCADvBD;;gBAEF,kBAFEA;YAEIC;;QACN,MAAKC,IAAI,GAAG;;;WAHVF;qBAA+BG;AAOrC;;;CAGC,GACD,SAASC,cAAcC,YAA8B;IACnD,IAAI,CAACA,aAAaC,MAAM,EAAE;QACxB,MAAM,IAAIN,uBAAuB;IACnC;IACA,OAAOK,aAAaC,MAAM;AAC5B;AAMO,IAAA,AAAMR,iCAAN;;aAAMA,iBAQCS,OAAgC;gCARjCT;YA0BKS;QAjBd,IAAIA,QAAQC,UAAU,EAAE;YACtB,IAAI,CAACA,UAAU,GAAGD,QAAQC,UAAU;QACtC,OAAO;YACL,sDAAsD;YACtD,IAAMC,YAAYC,iBAAI,CAACC,IAAI,CAACC,QAAQC,GAAG,IAAI,UAAU;YAErD,gDAAgD;YAChDC,IAAGC,SAAS,CAACL,iBAAI,CAACM,OAAO,CAACP,YAAY;gBAAEQ,WAAW;YAAK;YAExD,IAAI,CAACT,UAAU,GAAG,IAAIU,aAAI,CAAC;gBACzBC,OAAO,IAAIC,kBAAQ,CAAC;oBAAEC,UAAUZ;gBAAU;YAC5C;QACF;QACA,IAAI,CAACa,SAAS,GAAG,IAAIC,gDAAsB;QAC3C,IAAI,CAACC,SAAS,GAAG,IAAIC,4CAAoB;QACzC,IAAI,CAACC,QAAQ,GAAGnB,QAAQmB,QAAQ,IAAI;QACpC,IAAI,CAACC,WAAW,GAAGpB,QAAQoB,WAAW;QACtC,IAAI,CAACC,MAAM,IAAGrB,kBAAAA,QAAQqB,MAAM,cAAdrB,6BAAAA,kBAAkBsB,gBAAa;;iBA1BpC/B;IA6BX;;;GAGC,GACD,OAAcgC,oBAUb,GAVD,SAAcA,qBAAqBC,YAAoB;;;gBACrD,IAAI;oBACF,+DAA+D;oBAC/D,oEAAoE;oBACpE,2EAA2E;oBAC3E,qDAAqD;oBACrD;;wBAAOA,aAAaC,QAAQ,CAAC,gBAAgBD,aAAaC,QAAQ,CAAC;;gBACrE,EAAE,OAAOC,QAAQ;oBACf;;wBAAO;uBAAO,0CAA0C;gBAC1D;;;;;QACF;;IAEA;;;;;;;;;;;;;;;;;;GAkBC,GACD,OAAMC,mBASL,GATD,SAAMA,oBAAoBH,YAAoB,EAAE1B,YAA8B,EAAE8B,MAAoB;;gBAG5FC;;;;wBAFNC,eAAeF;wBAEM;;4BAAM,IAAI,CAACL,oBAAoB,CAACC;;;wBAA/CK,eAAe;wBAErB,IAAIA,cAAc;4BAChB;;gCAAO,IAAI,CAACE,6BAA6B,CAACP,cAAc1B,cAAc8B;;wBACxE;wBACA;;4BAAO,IAAI,CAACI,2BAA2B,CAACR,cAAc1B,cAAc8B;;;;QACtE;;IAEA;;;;;;;;;;;;;;;;;GAiBC,GACD,OAAQK,WAGP,GAHD,SAAQA,YAAYT,YAAoB,EAAE1B,YAA8B;YAENA;QADhE,IAAMoC,WAAWC,IAAAA,wBAAY,EAACX;QAC9B,OAAO;YAAEY,eAAeC,IAAAA,0BAAc,EAACb;YAAec,QAAQ,GAAExC,yBAAAA,aAAawC,QAAQ,cAArBxC,oCAAAA,yBAAyBoC;YAAUA,UAAAA;QAAS;IAC9G;IAEA;;;GAGC,GACD,OAAcH,6BAuFb,GAvFD,SAAcA,8BAA8BP,YAAoB,EAAE1B,YAA8B,EAAE8B,MAAoB;;gBAG9GW,eACAxC,QACwC,mBAAtCqC,eAAeE,UAAUJ,UAC3BM,aAGFC,QAKMC,WACAC,gBAMEC,YAMDlB,QAiBLmB,MAIAC,QAOAC,aAMEL,YACAC,iBASAC,aAMCI;;;;wBA5ET,wEAAwE;wBACxE,4FAA4F;wBACtFT,gBAAgBU,IAAAA,+BAAa,EAACzB;wBAC9BzB,SAASF,cAAcC;wBACiB,oBAAA,IAAI,CAACmC,WAAW,CAACT,cAAc1B,eAArEsC,gBAAsC,kBAAtCA,eAAeE,WAAuB,kBAAvBA,UAAUJ,WAAa,kBAAbA;wBAC3BM,cAAc,AAAC,cAAuBN,OAAVnC,QAAO,KAAY,OAATmC;wBAG/B;;4BAAM,IAAI,CAACgB,UAAU,CAACV,aAAazC;;;wBAA5C0C,SAAS;6BAETA,QAAAA;;;;;;;;;;;;wBAGMC,YAAY,AAAC,GAAgB,OAAdN,eAAc;wBACZ;;4BAAMe,MAAMT,WAAW;gCAC5CU,SAAS;oCAAEC,eAAe,AAAC,UAA4B,OAAnBZ,OAAOa,WAAW;oCAAIC,YAAY;gCAAQ;gCAC9E3B,QAAAA;4BACF;;;wBAHMe,iBAAiB;6BAKnBA,eAAea,EAAE,EAAjBb;;;;wBACkB;;4BAAMA,eAAec,IAAI;;;wBAAvCb,aAAc;wBACpB,IAAIA,WAAWc,KAAK,KAAKjB,OAAOa,WAAW,EAAE;4BAC3C,mDAAmD;4BACnD;;gCAAOb;;wBACT;;;;;;;;wBAEKf;;;;;;wBAIT,8BAA8B;wBAC9B;;4BAAM,IAAI,CAACzB,UAAU,CAAC0D,MAAM,CAACnB;;;wBAA7B;wBACAC,SAASmB;;;wBAGX,qDAAqD;wBACrD,IAAI,CAAC9D,aAAa+D,oBAAoB,IAAI,CAAC/D,aAAagE,qBAAqB,IAAI,CAAChE,aAAaiE,aAAa,EAAE;4BAC5G,MAAM,IAAInE,MAAM;wBAClB;wBAEA,IAAI,CAACyB,MAAM,CAAC2C,KAAK,CAAC;wBAElB,6CAA6C;wBACvCnB,OAAOoB,SAAS,IAAIC,IAAI,IAAI,CAAC9C,WAAW,EAAEyB,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACzB,WAAW,CAAC+C,UAAU,CAAC,YAAY,MAAM,EAAC;wBAE7G,gCAAgC;wBAChC,IAAI,CAAC9C,MAAM,CAAC2C,KAAK,CAAC;wBACH;;4BAAM,IAAI,CAACjD,SAAS,CAACqD,cAAc,CAACtE,aAAa+D,oBAAoB,EAAE;gCACpFzC,aAAa,IAAI,CAACA,WAAW;gCAC7BmB,eAAAA;gCACAX,QAAAA;4BACF;;;wBAJMkB,SAAS;wBAMf,wDAAwD;wBAClDC,cAAc,IAAI,CAACsB,gBAAgB,CAACxB,MAAM/C,cAAcC,QAAQuC,UAAUC,eAAeX;wBAEtF;;4BAAM,IAAI,CAACX,SAAS,CAACqD,eAAe,CAACxE,aAAagE,qBAAqB,EAAEhE,aAAaiE,aAAa,EAAEjB,OAAOyB,QAAQ,EAAEzB,OAAO0B,YAAY,EAAEzB;;;wBAApJN,SAAS;;;;;;;;;wBAIDC,aAAY,AAAC,GAAgB,OAAdN,eAAc;wBACZ;;4BAAMe,MAAMT,YAAW;gCAC5CU,SAAS;oCAAEC,eAAe,AAAC,UAA4B,OAAnBZ,OAAOa,WAAW;oCAAIC,YAAY;gCAAQ;gCAC9E3B,QAAAA;4BACF;;;wBAHMe,kBAAiB;wBAKvB,IAAI,CAACA,gBAAea,EAAE,EAAE;4BACtB,MAAM,IAAI5D,MAAM,AAAC,uDAA4E,OAAtB+C,gBAAe8B,MAAM;wBAC9F;wBAEoB;;4BAAM9B,gBAAec,IAAI;;;wBAAvCb,cAAc;wBACpB,IAAIA,YAAWc,KAAK,KAAKjB,OAAOa,WAAW,EAAE;4BAC3C,MAAM,IAAI1D,MAAM;wBAClB;wBAEA,IAAI,CAACyB,MAAM,CAAC2C,KAAK,CAAC;;;;;;wBACXhB;wBACP,IAAI,CAAC3B,MAAM,CAAC2B,KAAK,CAAC,oCAAoCA,AAAK,YAALA,OAAiBpD,SAAQoD,MAAMtD,OAAO,GAAGgF,OAAO1B;wBACtG,MAAM,IAAIpD,MAAM;;wBAGlB,6BAA6B;wBAC7B;;4BAAM,IAAI,CAACK,UAAU,CAAC0E,GAAG,CAACnC,aAAa,wCAAKC;gCAAQ1C,QAAAA;;;;wBAApD;wBACA,IAAI,CAACsB,MAAM,CAAC2C,KAAK,CAAC;wBAElB;;4BAAOvB;;;;QACT;;IAEA,2EAA2E,GAC3E,OAAcT,2BA4Db,GA5DD,SAAcA,4BAA4BR,YAAoB,EAAE1B,YAA8B,EAAE8B,MAAoB;;gBAE5GW,eACAxC,QACyB,mBAAvBuC,UAAUJ,UACZ0C,UAGFnC,QAWSf,QAqBPmB,MAIAC,QAOAC;;;;wBAlDN,gEAAgE;wBAC1DR,gBAAgBU,IAAAA,+BAAa,EAACzB;wBAC9BzB,SAASF,cAAcC;wBACE,oBAAA,IAAI,CAACmC,WAAW,CAACT,cAAc1B,eAAtDwC,WAAuB,kBAAvBA,UAAUJ,WAAa,kBAAbA;wBACZ0C,WAAW,AAAC,UAAmB1C,OAAVnC,QAAO,KAAY,OAATmC;wBAGxB;;4BAAM,IAAI,CAACgB,UAAU,CAAC0B,UAAU7E;;;wBAAzC0C,SAAS;6BAETA,QAAAA;;;;6BAEEA,CAAAA,OAAOoC,SAAS,GAAGC,KAAKC,GAAG,KAAKvF,iBAAgB,GAAhDiD;;;;wBACF,IAAI,CAACpB,MAAM,CAAC2C,KAAK,CAAC;;;;;;;;;wBAGP;;4BAAM,IAAI,CAACgB,aAAa,CAACvC,QAAQ3C,aAAaiE,aAAa,EAAEzB,UAAUC,eAAeX;;;wBAA/Fa,SAAS;wBACT;;4BAAM,IAAI,CAACxC,UAAU,CAAC0E,GAAG,CAACC,UAAU,wCAAKnC;gCAAQ1C,QAAAA;;;;wBAAjD;wBACA,IAAI,CAACsB,MAAM,CAAC2C,KAAK,CAAC;;;;;;wBACXtC;wBACP,oDAAoD;wBACpD,IAAI,CAACL,MAAM,CAAC4D,IAAI,CAAC;wBACjB;;4BAAM,IAAI,CAAChF,UAAU,CAAC0D,MAAM,CAACiB;;;wBAA7B;wBACAnC,SAASmB;;;;;;wBAIb,IAAInB,QAAQ;4BACV;;gCAAOA;;wBACT;;;wBAGF,gDAAgD;wBAChD,IAAI,CAAC3C,aAAa+D,oBAAoB,IAAI,CAAC/D,aAAagE,qBAAqB,IAAI,CAAChE,aAAaiE,aAAa,EAAE;4BAC5G,MAAM,IAAInE,MAAM;wBAClB;wBAEA,IAAI,CAACyB,MAAM,CAAC2C,KAAK,CAAC;wBAElB,6CAA6C;wBACvCnB,OAAOoB,SAAS,IAAIC,IAAI,IAAI,CAAC9C,WAAW,EAAEyB,IAAI,EAAE,OAAQ,CAAA,IAAI,CAACzB,WAAW,CAAC+C,UAAU,CAAC,YAAY,MAAM,EAAC;wBAE7G,gCAAgC;wBAChC,IAAI,CAAC9C,MAAM,CAAC2C,KAAK,CAAC;wBACH;;4BAAM,IAAI,CAACjD,SAAS,CAACqD,cAAc,CAACtE,aAAa+D,oBAAoB,EAAE;gCACpFzC,aAAa,IAAI,CAACA,WAAW;gCAC7BmB,eAAAA;gCACAX,QAAAA;4BACF;;;wBAJMkB,SAAS;wBAMf,wDAAwD;wBAClDC,cAAc,IAAI,CAACsB,gBAAgB,CAACxB,MAAM/C,cAAcC,QAAQuC,UAAUC,eAAeX;wBAEtF;;4BAAM,IAAI,CAACX,SAAS,CAACqD,eAAe,CAACxE,aAAagE,qBAAqB,EAAEhE,aAAaiE,aAAa,EAAEjB,OAAOyB,QAAQ,EAAEzB,OAAO0B,YAAY,EAAEzB;;;wBAApJN,SAAS;wBAET,6BAA6B;wBAC7B;;4BAAM,IAAI,CAACxC,UAAU,CAAC0E,GAAG,CAACC,UAAU,wCAAKnC;gCAAQ1C,QAAAA;;;;wBAAjD;wBACA,IAAI,CAACsB,MAAM,CAAC2C,KAAK,CAAC;wBAElB;;4BAAOvB;;;;QACT;;IAEA;;;;GAIC,GACD,OAAcuC,aAcb,GAdD,SAAcA,cAAcvC,MAAgB,EAAEsB,aAAiC,EAAEzB,QAAgB;YAAEC,gBAAAA,iEAAgB,OAAOX;;;;;wBACxH,IAAI,CAACmC,eAAe;4BAClB,MAAM,IAAInE,MAAM;wBAClB;wBAEA,IAAI,CAAC6C,OAAOyC,YAAY,EAAE;4BACxB,MAAM,IAAItF,MAAM;wBAClB;wBAEA,IAAI,CAAC6C,OAAO8B,QAAQ,IAAI,CAAC9B,OAAO+B,YAAY,EAAE;4BAC5C,MAAM,IAAI5E,MAAM;wBAClB;wBAEO;;4BAAM,IAAI,CAACqB,SAAS,CAAC+D,aAAa,CAACjB,eAAetB,OAAOyC,YAAY,EAAEzC,OAAO8B,QAAQ,EAAE9B,OAAO+B,YAAY,EAAElC,UAAUC,eAAeX;;;wBAA7I;;4BAAO;;;;QACT;;IAEA;;;;;;;;GAQC,GACD,OAAMuD,YAYL,GAZD,SAAMA,aAAa3D,YAAoB;;gBAC/B4D,yGAKYC;;;;wBALZD,SAAS,AAAC,IAA8B,OAA3BjD,IAAAA,wBAAY,EAACX;wBAChC,IAAI,CAAC,IAAI,CAACvB,UAAU,CAACqF,QAAQ,EAAE;4BAC7B,MAAM,IAAI7F,uBAAuB;wBACnC;;;;;;;;;;oDAE0B,IAAI,CAACQ,UAAU,CAACqF,QAAQ,CAAC,IAAI,CAACrF,UAAU,CAACsF,SAAS;;;;;;;;;;;;;+DAA1DF;6BACZ,CAAA,OAAOA,QAAQ,YAAaA,CAAAA,IAAIlB,UAAU,CAAC,cAAckB,IAAIlB,UAAU,CAAC,cAAa,KAAMkB,IAAIG,QAAQ,CAACJ,OAAM,GAA9G;;;;wBACF;;4BAAM,IAAI,CAACnF,UAAU,CAAC0D,MAAM,CAAC0B;;;wBAA7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAGJ,IAAI,CAAChE,MAAM,CAAC2C,KAAK,CAAC,AAAC,qCAAuC,OAAbxC;;;;;;QAC/C;;IAEA,+HAA+H,GAC/H,OAAc0B,UAQb,GARD,SAAcA,WAAWmC,GAAW,EAAEtF,MAAc;;gBAC5C0C;;;;wBAAU;;4BAAM,IAAI,CAACxC,UAAU,CAACwF,GAAG,CAACJ;;;wBAApC5C,SAAU;wBAChB,IAAI,CAACA,QAAQ;;4BAAOmB;;wBACpB,IAAInB,OAAO1C,MAAM,KAAKA,QAAQ;;4BAAO0C;;wBAErC,IAAI,CAACpB,MAAM,CAAC2C,KAAK,CAAC;wBAClB;;4BAAM,IAAI,CAAC/D,UAAU,CAAC0D,MAAM,CAAC0B;;;wBAA7B;wBACA;;4BAAOzB;;;;QACT;;IAEA,OAAQS,gBAiBP,GAjBD,SAAQA,iBAAiBxB,IAAY,EAAE/C,YAA8B,EAAEC,MAAc,EAAEuC,QAAgB,EAAEC,aAAsB,EAAEX,MAAoB;YAW9G9B;QAVrC,IAAMiD,cAAgC;YACpCF,MAAAA;YACA9C,QAAAA;YACAuC,UAAAA;YACAnB,UAAU,IAAI,CAACA,QAAQ;YACvBC,aAAa,IAAI,CAACA,WAAW;YAC7BsE,MAAM;YACNrE,QAAQ,IAAI,CAACA,MAAM;YACnBkB,eAAAA;WACIX,UAAU;YAAEA,QAAAA;QAAO;YACvB+D,iCAAiC,GAAE7F,kDAAAA,aAAa6F,iCAAiC,cAA9C7F,6DAAAA,kDAAkD;;QAEvF,IAAIA,aAAa8F,MAAM,EAAE;YACvB7C,YAAY6C,MAAM,GAAG9F,aAAa8F,MAAM;QAC1C;QACA,OAAO7C;IACT;WAtUWxD;;AAyUb,SAASuC,eAAeF,MAAoB;IAC1C,IAAIA,mBAAAA,6BAAAA,OAAQiE,OAAO,EAAE,MAAMjE,AAAa,YAAbA,OAAOkE,MAAM,EAAYlG,SAAQgC,OAAOkE,MAAM,GAAG,IAAIlG,MAAM;AACxF"}

package/dist/cjs/dcr/dynamic-client-registrar.js

@@ -185,7 +185,8 @@ var DynamicClientRegistrar = /*#__PURE__*/ function() {
                                     Accept: 'application/json',
                                     Connection: 'close'
                                 },
-                                body: JSON.stringify(requestBody)
+                                body: JSON.stringify(requestBody),
+                                signal: options.signal
                             }, 'registration endpoint', {
                                 allowLoopback: (_options_allowLoopback = options.allowLoopback) !== null && _options_allowLoopback !== void 0 ? _options_allowLoopback : false
                             })

package/dist/cjs/dcr/dynamic-client-registrar.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/dcr/dynamic-client-registrar.ts"],"sourcesContent":["/**\n * Dynamic Client Registration (DCR) Client\n * Implements RFC 7591 for OAuth client registration\n */\n\nimport { discoveryFetch } from '../auth/discovery-fetch.ts';\nimport type { ClientCredentials, DcrRegistrationOptions } from '../auth/types.ts';\n\n/** DCR Registration Request (RFC 7591) */\ninterface DcrRegistrationRequest {\n  client_name?: string;\n  redirect_uris?: string[];\n  grant_types?: string[];\n  response_types?: string[];\n  token_endpoint_auth_method?: string;\n  application_type?: string;\n}\n\n/** DCR Registration Response (RFC 7591) */\ninterface DcrRegistrationResponse {\n  client_id: string;\n  client_secret?: string;\n  client_id_issued_at?: number;\n  client_secret_expires_at?: number;\n}\n\n/** Handles Dynamic Client Registration with OAuth servers. */\nexport class DynamicClientRegistrar {\n  /**\n   * Registers a new OAuth client with the authorization server (RFC 7591).\n   *\n   * @param registrationEndpoint - Often sourced from remote-controlled AS metadata; pass `options.allowLoopback` explicitly. Defaults to `false`.\n   * @param options - Registration options (redirect URI, client name, loopback trust).\n   * @returns Client credentials (client ID and secret).\n   * @throws Error if registration fails or the server returns an error.\n   */\n  async registerClient(registrationEndpoint: string, options: DcrRegistrationOptions): Promise<ClientCredentials> {\n    const requestBody: DcrRegistrationRequest = {\n      client_name: options.clientName || '@mcp-z/client',\n      redirect_uris: [options.redirectUri],\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method: 'client_secret_basic',\n      // The callback listener always binds an OS-assigned loopback port, so the\n      // redirect URI is one an authorization server rejects for a web client (SEP-837, RFC 8252).\n      application_type: 'native',\n    };\n\n    // registrationEndpoint is remote-controlled discovery data; allowLoopback\n    // must come from the caller's own trust, never from registrationEndpoint.\n    const response = await discoveryFetch(\n      registrationEndpoint,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Connection: 'close',\n        },\n        body: JSON.stringify(requestBody),\n      },\n      'registration endpoint',\n      { allowLoopback: options.allowLoopback ?? false }\n    );\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`DCR registration failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as DcrRegistrationResponse;\n\n    if (!data.client_id) {\n      throw new Error('DCR registration response missing client_id');\n    }\n\n    const credentials: ClientCredentials = {\n      clientId: data.client_id,\n      clientSecret: data.client_secret || '',\n    };\n\n    if (data.client_id_issued_at) {\n      credentials.issuedAt = data.client_id_issued_at;\n    }\n\n    return credentials;\n  }\n}\n"],"names":["DynamicClientRegistrar","registerClient","registrationEndpoint","options","requestBody","response","errorText","data","credentials","client_name","clientName","redirect_uris","redirectUri","grant_types","response_types","token_endpoint_auth_method","application_type","discoveryFetch","method","headers","Accept","Connection","body","JSON","stringify","allowLoopback","ok","text","Error","status","json","client_id","clientId","clientSecret","client_secret","client_id_issued_at","issuedAt"],"mappings":"AAAA;;;CAGC;;;;+BAwBYA;;;eAAAA;;;gCAtBkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBxB,IAAA,AAAMA,uCAAN;;aAAMA;gCAAAA;;iBAAAA;IACX;;;;;;;GAOC,GACD,OAAMC,cAkDL,GAlDD,SAAMA,eAAeC,oBAA4B,EAAEC,OAA+B;;gBA0B7DA,wBAzBbC,aAaAC,UAgBEC,WAIFC,MAMAC;;;;wBAvCAJ,cAAsC;4BAC1CK,aAAaN,QAAQO,UAAU,IAAI;4BACnCC,aAAa;gCAAGR,QAAQS,WAAW;;4BACnCC,WAAW;gCAAG;gCAAsB;;4BACpCC,cAAc;gCAAG;;4BACjBC,4BAA4B;4BAC5B,0EAA0E;4BAC1E,4FAA4F;4BAC5FC,kBAAkB;wBACpB;wBAIiB;;4BAAMC,IAAAA,gCAAc,EACnCf,sBACA;gCACEgB,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAMC,KAAKC,SAAS,CAACpB;4BACvB,GACA,yBACA;gCAAEqB,aAAa,GAAEtB,yBAAAA,QAAQsB,aAAa,cAArBtB,oCAAAA,yBAAyB;4BAAM;;;wBAZ5CE,WAAW;6BAeb,CAACA,SAASqB,EAAE,EAAZ;;;;wBACgB;;4BAAMrB,SAASsB,IAAI;;;wBAA/BrB,YAAY;wBAClB,MAAM,IAAIsB,MAAM,AAAC,4BAAgDtB,OAArBD,SAASwB,MAAM,EAAC,OAAe,OAAVvB;;wBAGrD;;4BAAMD,SAASyB,IAAI;;;wBAA3BvB,OAAQ;wBAEd,IAAI,CAACA,KAAKwB,SAAS,EAAE;4BACnB,MAAM,IAAIH,MAAM;wBAClB;wBAEMpB,cAAiC;4BACrCwB,UAAUzB,KAAKwB,SAAS;4BACxBE,cAAc1B,KAAK2B,aAAa,IAAI;wBACtC;wBAEA,IAAI3B,KAAK4B,mBAAmB,EAAE;4BAC5B3B,YAAY4B,QAAQ,GAAG7B,KAAK4B,mBAAmB;wBACjD;wBAEA;;4BAAO3B;;;;QACT;;WA3DWR"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/dcr/dynamic-client-registrar.ts"],"sourcesContent":["/**\n * Dynamic Client Registration (DCR) Client\n * Implements RFC 7591 for OAuth client registration\n */\n\nimport { discoveryFetch } from '../auth/discovery-fetch.ts';\nimport type { ClientCredentials, DcrRegistrationOptions } from '../auth/types.ts';\n\n/** DCR Registration Request (RFC 7591) */\ninterface DcrRegistrationRequest {\n  client_name?: string;\n  redirect_uris?: string[];\n  grant_types?: string[];\n  response_types?: string[];\n  token_endpoint_auth_method?: string;\n  application_type?: string;\n}\n\n/** DCR Registration Response (RFC 7591) */\ninterface DcrRegistrationResponse {\n  client_id: string;\n  client_secret?: string;\n  client_id_issued_at?: number;\n  client_secret_expires_at?: number;\n}\n\n/** Handles Dynamic Client Registration with OAuth servers. */\nexport class DynamicClientRegistrar {\n  /**\n   * Registers a new OAuth client with the authorization server (RFC 7591).\n   *\n   * @param registrationEndpoint - Often sourced from remote-controlled AS metadata; pass `options.allowLoopback` explicitly. Defaults to `false`.\n   * @param options - Registration options (redirect URI, client name, loopback trust).\n   * @returns Client credentials (client ID and secret).\n   * @throws Error if registration fails or the server returns an error.\n   */\n  async registerClient(registrationEndpoint: string, options: DcrRegistrationOptions): Promise<ClientCredentials> {\n    const requestBody: DcrRegistrationRequest = {\n      client_name: options.clientName || '@mcp-z/client',\n      redirect_uris: [options.redirectUri],\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method: 'client_secret_basic',\n      // The callback listener always binds an OS-assigned loopback port, so the\n      // redirect URI is one an authorization server rejects for a web client (SEP-837, RFC 8252).\n      application_type: 'native',\n    };\n\n    // registrationEndpoint is remote-controlled discovery data; allowLoopback\n    // must come from the caller's own trust, never from registrationEndpoint.\n    const response = await discoveryFetch(\n      registrationEndpoint,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          Connection: 'close',\n        },\n        body: JSON.stringify(requestBody),\n        signal: options.signal,\n      },\n      'registration endpoint',\n      { allowLoopback: options.allowLoopback ?? false }\n    );\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`DCR registration failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as DcrRegistrationResponse;\n\n    if (!data.client_id) {\n      throw new Error('DCR registration response missing client_id');\n    }\n\n    const credentials: ClientCredentials = {\n      clientId: data.client_id,\n      clientSecret: data.client_secret || '',\n    };\n\n    if (data.client_id_issued_at) {\n      credentials.issuedAt = data.client_id_issued_at;\n    }\n\n    return credentials;\n  }\n}\n"],"names":["DynamicClientRegistrar","registerClient","registrationEndpoint","options","requestBody","response","errorText","data","credentials","client_name","clientName","redirect_uris","redirectUri","grant_types","response_types","token_endpoint_auth_method","application_type","discoveryFetch","method","headers","Accept","Connection","body","JSON","stringify","signal","allowLoopback","ok","text","Error","status","json","client_id","clientId","clientSecret","client_secret","client_id_issued_at","issuedAt"],"mappings":"AAAA;;;CAGC;;;;+BAwBYA;;;eAAAA;;;gCAtBkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBxB,IAAA,AAAMA,uCAAN;;aAAMA;gCAAAA;;iBAAAA;IACX;;;;;;;GAOC,GACD,OAAMC,cAmDL,GAnDD,SAAMA,eAAeC,oBAA4B,EAAEC,OAA+B;;gBA2B7DA,wBA1BbC,aAaAC,UAiBEC,WAIFC,MAMAC;;;;wBAxCAJ,cAAsC;4BAC1CK,aAAaN,QAAQO,UAAU,IAAI;4BACnCC,aAAa;gCAAGR,QAAQS,WAAW;;4BACnCC,WAAW;gCAAG;gCAAsB;;4BACpCC,cAAc;gCAAG;;4BACjBC,4BAA4B;4BAC5B,0EAA0E;4BAC1E,4FAA4F;4BAC5FC,kBAAkB;wBACpB;wBAIiB;;4BAAMC,IAAAA,gCAAc,EACnCf,sBACA;gCACEgB,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;oCAChBC,QAAQ;oCACRC,YAAY;gCACd;gCACAC,MAAMC,KAAKC,SAAS,CAACpB;gCACrBqB,QAAQtB,QAAQsB,MAAM;4BACxB,GACA,yBACA;gCAAEC,aAAa,GAAEvB,yBAAAA,QAAQuB,aAAa,cAArBvB,oCAAAA,yBAAyB;4BAAM;;;wBAb5CE,WAAW;6BAgBb,CAACA,SAASsB,EAAE,EAAZ;;;;wBACgB;;4BAAMtB,SAASuB,IAAI;;;wBAA/BtB,YAAY;wBAClB,MAAM,IAAIuB,MAAM,AAAC,4BAAgDvB,OAArBD,SAASyB,MAAM,EAAC,OAAe,OAAVxB;;wBAGrD;;4BAAMD,SAAS0B,IAAI;;;wBAA3BxB,OAAQ;wBAEd,IAAI,CAACA,KAAKyB,SAAS,EAAE;4BACnB,MAAM,IAAIH,MAAM;wBAClB;wBAEMrB,cAAiC;4BACrCyB,UAAU1B,KAAKyB,SAAS;4BACxBE,cAAc3B,KAAK4B,aAAa,IAAI;wBACtC;wBAEA,IAAI5B,KAAK6B,mBAAmB,EAAE;4BAC5B5B,YAAY6B,QAAQ,GAAG9B,KAAK6B,mBAAmB;wBACjD;wBAEA;;4BAAO5B;;;;QACT;;WA5DWR"}

package/dist/cjs/index.d.cts

@@ -3,7 +3,7 @@
  */
 export type { VersionNegotiationOptions } from '@modelcontextprotocol/client';
 export { SdkError, SdkErrorCode } from '@modelcontextprotocol/client';
-export type { McpServerEntry, StartConfig } from '../schemas/servers.d.js';
+export type { McpServerEntry, StartConfig, StopCommandConfig } from '../schemas/servers.d.js';
 export { probeAuthCapabilities } from './auth/capability-discovery.js';
 export { DiscoveryFetchError, isLoopbackUrl } from './auth/discovery-fetch.js';
 export type { AuthCapabilities, CallbackResult, OAuthCallbackListenerOptions, OAuthFlowOptions, TokenSet } from './auth/index.js';

package/dist/cjs/index.d.ts

@@ -3,7 +3,7 @@
  */
 export type { VersionNegotiationOptions } from '@modelcontextprotocol/client';
 export { SdkError, SdkErrorCode } from '@modelcontextprotocol/client';
-export type { McpServerEntry, StartConfig } from '../schemas/servers.d.js';
+export type { McpServerEntry, StartConfig, StopCommandConfig } from '../schemas/servers.d.js';
 export { probeAuthCapabilities } from './auth/capability-discovery.js';
 export { DiscoveryFetchError, isLoopbackUrl } from './auth/discovery-fetch.js';
 export type { AuthCapabilities, CallbackResult, OAuthCallbackListenerOptions, OAuthFlowOptions, TokenSet } from './auth/index.js';

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/index.ts"],"sourcesContent":["/**\n * @mcp-z/client - MCP Client Library\n */\n\nexport type { VersionNegotiationOptions } from '@modelcontextprotocol/client';\n// SDK re-exports for protocol version negotiation: the connect-option type and the typed\n// errors a negotiation can fail with, so callers can handle era mismatch without\n// depending on the SDK themselves.\nexport { SdkError, SdkErrorCode } from '@modelcontextprotocol/client';\n// Config types (from schema)\nexport type { McpServerEntry, StartConfig } from '../schemas/servers.d.ts';\n// Auth - OAuth utilities\nexport { probeAuthCapabilities } from './auth/capability-discovery.ts';\nexport { DiscoveryFetchError, isLoopbackUrl } from './auth/discovery-fetch.ts';\nexport type { AuthCapabilities, CallbackResult, OAuthCallbackListenerOptions, OAuthFlowOptions, TokenSet } from './auth/index.ts';\nexport { InteractiveOAuthFlow } from './auth/interactive-oauth-flow.ts';\nexport { OAuthCallbackListener } from './auth/oauth-callback-listener.ts';\n// Client helpers and lightweight overloads\nexport { decorateClient, type ManagedClient, type PromptArguments, type WrappedCallToolReturn, type WrappedGetPromptReturn, type WrappedReadResourceReturn } from './client-helpers.ts';\n// Config - Configuration validation\nexport { type ValidationResult, validateServers } from './config/validate-config.ts';\n// Connection - MCP client connection utilities (internal helpers exposed for advanced use)\nexport type { JsonValue, PromptArgument, ToolArguments } from './connection/types.ts';\n// DCR - Dynamic Client Registration utilities\nexport { DcrAuthenticator } from './dcr/dcr-authenticator.ts';\nexport { DynamicClientRegistrar } from './dcr/dynamic-client-registrar.ts';\nexport type { ClientCredentials, DcrAuthenticatorOptions, DcrRegistrationOptions } from './dcr/index.ts';\nexport {\n  type JsonValidator,\n  type NativeCallToolResponse,\n  type NativeGetPromptResponse,\n  type NativeReadResourceResponse,\n  PromptResponseError,\n  PromptResponseWrapper,\n  ResourceResponseError,\n  ResourceResponseWrapper,\n  ToolResponseError,\n  ToolResponseWrapper,\n} from './response-wrappers.ts';\nexport type { CapabilityClient, CapabilityIndex, CapabilityType, IndexedCapability, IndexedPrompt, IndexedResource, IndexedTool, SearchField, SearchOptions, SearchResponse, SearchResult } from './search/index.ts';\n// Search - Capability discovery\nexport { buildCapabilityIndex, search, searchCapabilities } from './search/index.ts';\n// Spawn - Server registry (v3 API)\nexport { type CloseResult, type CreateServerRegistryOptions, createServerRegistry, type Dialect, type ServerRegistry, type ServersConfig } from './spawn/spawn-servers.ts';\nexport type { TransportType } from './types.ts';\n// Utils - Shared utilities\nexport { getLogLevel, type Logger, type LogLevel, logger, setLogLevel } from './utils/logger.ts';\nexport { resolveArgsPaths, resolvePath } from './utils/path-utils.ts';\n"],"names":["DcrAuthenticator","DiscoveryFetchError","DynamicClientRegistrar","InteractiveOAuthFlow","OAuthCallbackListener","PromptResponseError","PromptResponseWrapper","ResourceResponseError","ResourceResponseWrapper","SdkError","SdkErrorCode","ToolResponseError","ToolResponseWrapper","buildCapabilityIndex","createServerRegistry","decorateClient","getLogLevel","isLoopbackUrl","logger","probeAuthCapabilities","resolveArgsPaths","resolvePath","search","searchCapabilities","setLogLevel","validateServers"],"mappings":"AAAA;;CAEC;;;;;;;;;;;QAsBQA;eAAAA,oCAAgB;;QAXhBC;eAAAA,qCAAmB;;QAYnBC;eAAAA,gDAAsB;;QAVtBC;eAAAA,4CAAoB;;QACpBC;eAAAA,8CAAqB;;QAgB5BC;eAAAA,uCAAmB;;QACnBC;eAAAA,yCAAqB;;QACrBC;eAAAA,yCAAqB;;QACrBC;eAAAA,2CAAuB;;QA3BhBC;eAAAA,gBAAQ;;QAAEC;eAAAA,oBAAY;;QA4B7BC;eAAAA,qCAAiB;;QACjBC;eAAAA,uCAAmB;;QAIZC;eAAAA,6BAAoB;;QAEgCC;eAAAA,oCAAoB;;QAzBxEC;eAAAA,+BAAc;;QA4BdC;eAAAA,qBAAW;;QAjCUC;eAAAA,+BAAa;;QAiCOC;eAAAA,gBAAM;;QAlC/CC;eAAAA,4CAAqB;;QAmCrBC;eAAAA,6BAAgB;;QAAEC;eAAAA,wBAAW;;QANPC;eAAAA,eAAM;;QAAEC;eAAAA,2BAAkB;;QAKCC;eAAAA,qBAAW;;QA1BrCC;eAAAA,iCAAe;;;sBAZR;qCAID;gCACa;sCAEd;uCACC;+BAE4H;gCAE3G;kCAItB;wCACM;kCAahC;uBAG0D;8BAE+E;wBAGnE;2BAC/B"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/index.ts"],"sourcesContent":["/**\n * @mcp-z/client - MCP Client Library\n */\n\nexport type { VersionNegotiationOptions } from '@modelcontextprotocol/client';\n// SDK re-exports for protocol version negotiation: the connect-option type and the typed\n// errors a negotiation can fail with, so callers can handle era mismatch without\n// depending on the SDK themselves.\nexport { SdkError, SdkErrorCode } from '@modelcontextprotocol/client';\n// Config types (from schema)\nexport type { McpServerEntry, StartConfig, StopCommandConfig } from '../schemas/servers.d.ts';\n// Auth - OAuth utilities\nexport { probeAuthCapabilities } from './auth/capability-discovery.ts';\nexport { DiscoveryFetchError, isLoopbackUrl } from './auth/discovery-fetch.ts';\nexport type { AuthCapabilities, CallbackResult, OAuthCallbackListenerOptions, OAuthFlowOptions, TokenSet } from './auth/index.ts';\nexport { InteractiveOAuthFlow } from './auth/interactive-oauth-flow.ts';\nexport { OAuthCallbackListener } from './auth/oauth-callback-listener.ts';\n// Client helpers and lightweight overloads\nexport { decorateClient, type ManagedClient, type PromptArguments, type WrappedCallToolReturn, type WrappedGetPromptReturn, type WrappedReadResourceReturn } from './client-helpers.ts';\n// Config - Configuration validation\nexport { type ValidationResult, validateServers } from './config/validate-config.ts';\n// Connection - MCP client connection utilities (internal helpers exposed for advanced use)\nexport type { JsonValue, PromptArgument, ToolArguments } from './connection/types.ts';\n// DCR - Dynamic Client Registration utilities\nexport { DcrAuthenticator } from './dcr/dcr-authenticator.ts';\nexport { DynamicClientRegistrar } from './dcr/dynamic-client-registrar.ts';\nexport type { ClientCredentials, DcrAuthenticatorOptions, DcrRegistrationOptions } from './dcr/index.ts';\nexport {\n  type JsonValidator,\n  type NativeCallToolResponse,\n  type NativeGetPromptResponse,\n  type NativeReadResourceResponse,\n  PromptResponseError,\n  PromptResponseWrapper,\n  ResourceResponseError,\n  ResourceResponseWrapper,\n  ToolResponseError,\n  ToolResponseWrapper,\n} from './response-wrappers.ts';\nexport type { CapabilityClient, CapabilityIndex, CapabilityType, IndexedCapability, IndexedPrompt, IndexedResource, IndexedTool, SearchField, SearchOptions, SearchResponse, SearchResult } from './search/index.ts';\n// Search - Capability discovery\nexport { buildCapabilityIndex, search, searchCapabilities } from './search/index.ts';\n// Spawn - Server registry (v3 API)\nexport { type CloseResult, type CreateServerRegistryOptions, createServerRegistry, type Dialect, type ServerRegistry, type ServersConfig } from './spawn/spawn-servers.ts';\nexport type { TransportType } from './types.ts';\n// Utils - Shared utilities\nexport { getLogLevel, type Logger, type LogLevel, logger, setLogLevel } from './utils/logger.ts';\nexport { resolveArgsPaths, resolvePath } from './utils/path-utils.ts';\n"],"names":["DcrAuthenticator","DiscoveryFetchError","DynamicClientRegistrar","InteractiveOAuthFlow","OAuthCallbackListener","PromptResponseError","PromptResponseWrapper","ResourceResponseError","ResourceResponseWrapper","SdkError","SdkErrorCode","ToolResponseError","ToolResponseWrapper","buildCapabilityIndex","createServerRegistry","decorateClient","getLogLevel","isLoopbackUrl","logger","probeAuthCapabilities","resolveArgsPaths","resolvePath","search","searchCapabilities","setLogLevel","validateServers"],"mappings":"AAAA;;CAEC;;;;;;;;;;;QAsBQA;eAAAA,oCAAgB;;QAXhBC;eAAAA,qCAAmB;;QAYnBC;eAAAA,gDAAsB;;QAVtBC;eAAAA,4CAAoB;;QACpBC;eAAAA,8CAAqB;;QAgB5BC;eAAAA,uCAAmB;;QACnBC;eAAAA,yCAAqB;;QACrBC;eAAAA,yCAAqB;;QACrBC;eAAAA,2CAAuB;;QA3BhBC;eAAAA,gBAAQ;;QAAEC;eAAAA,oBAAY;;QA4B7BC;eAAAA,qCAAiB;;QACjBC;eAAAA,uCAAmB;;QAIZC;eAAAA,6BAAoB;;QAEgCC;eAAAA,oCAAoB;;QAzBxEC;eAAAA,+BAAc;;QA4BdC;eAAAA,qBAAW;;QAjCUC;eAAAA,+BAAa;;QAiCOC;eAAAA,gBAAM;;QAlC/CC;eAAAA,4CAAqB;;QAmCrBC;eAAAA,6BAAgB;;QAAEC;eAAAA,wBAAW;;QANPC;eAAAA,eAAM;;QAAEC;eAAAA,2BAAkB;;QAKCC;eAAAA,qBAAW;;QA1BrCC;eAAAA,iCAAe;;;sBAZR;qCAID;gCACa;sCAEd;uCACC;+BAE4H;gCAE3G;kCAItB;wCACM;kCAahC;uBAG0D;8BAE+E;wBAGnE;2BAC/B"}

package/dist/cjs/spawn/owned-process-tree.d.cts

@@ -0,0 +1,12 @@
+interface TerminationResult {
+    killed: boolean;
+    error?: Error;
+}
+/** Tracks the detached process group used for owned processes on POSIX. */
+export declare class OwnedProcessTree {
+    private readonly _rootPid;
+    constructor(rootPid: number);
+    isEmpty(): boolean;
+    terminate(): TerminationResult;
+}
+export {};

package/dist/cjs/spawn/owned-process-tree.d.ts

@@ -0,0 +1,12 @@
+interface TerminationResult {
+    killed: boolean;
+    error?: Error;
+}
+/** Tracks the detached process group used for owned processes on POSIX. */
+export declare class OwnedProcessTree {
+    private readonly _rootPid;
+    constructor(rootPid: number);
+    isEmpty(): boolean;
+    terminate(): TerminationResult;
+}
+export {};