@mcp-z/client 2.2.4 → 2.3.0

package/README.md

@@ -86,13 +86,24 @@ const registry = createServerRegistry(
     api: {
       type: 'http',
       url: 'http://localhost:3000/mcp',
-      start: { command: 'node', args: ['server.js'] }
+      start: {
+        command: 'node',
+        args: ['server.js'],
+        stop: {
+          command: 'node',
+          args: ['request-server-stop.js', 'http://localhost:3000/admin/shutdown']
+        }
+      }
     }
   },
   { dialects: ['start'] }
 );
 ```
 
+`start.stop` is an optional application-specific cooperative shutdown command for a server started by this registry. It runs once during `registry.close()`, before the registry waits for the owned process to close. The stop command must use a mechanism implemented by that server; MCP HTTP has no server shutdown operation. Commands use argument arrays without a shell. `timeoutMs` bounds each cooperative wait for the stop command and owned process (five seconds by default); emergency termination has its own bounded wait. Without a stop command there is no portable HTTP shutdown protocol: POSIX requests the configured signal, while Windows waits for the direct child and then uses emergency termination. External HTTP servers and client lease closure do not run the stop command.
+
+Stdio shutdown sends EOF to the owned process first. If it remains open, POSIX sends the requested signal and waits again; Windows proceeds to bounded termination of the direct child. POSIX shutdown tracks the detached process group. Windows descendant ownership is not verified, so a wrapper that exits while leaving descendants may leave those processes running. `timedOut` reports a missed cooperative window, and `killedCount` counts direct-child or process-group emergency terminations.
+
 ## API overview
 
 ### Registry

package/dist/cjs/auth/capability-discovery.d.cts

@@ -3,4 +3,6 @@
  * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata
  */
 import type { AuthCapabilities } from './types.js';
-export declare function probeAuthCapabilities(baseUrl: string): Promise<AuthCapabilities>;
+export declare function probeAuthCapabilities(baseUrl: string, options?: {
+    signal?: AbortSignal;
+}): Promise<AuthCapabilities>;

package/dist/cjs/auth/capability-discovery.d.ts

@@ -3,4 +3,6 @@
  * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata
  */
 import type { AuthCapabilities } from './types.js';
-export declare function probeAuthCapabilities(baseUrl: string): Promise<AuthCapabilities>;
+export declare function probeAuthCapabilities(baseUrl: string, options?: {
+    signal?: AbortSignal;
+}): Promise<AuthCapabilities>;

package/dist/cjs/auth/capability-discovery.js

@@ -205,7 +205,7 @@ function _ts_generator(thisArg, body) {
     }
     return capabilities;
 }
-function resolveCapabilitiesFromAuthorizationServer(authServerUrl, scopes, allowLoopback, resource) {
+function resolveCapabilitiesFromAuthorizationServer(authServerUrl, scopes, allowLoopback, resource, signal) {
     return _async_to_generator(function() {
         var metadata;
         return _ts_generator(this, function(_state) {
@@ -214,7 +214,8 @@ function resolveCapabilitiesFromAuthorizationServer(authServerUrl, scopes, allow
                     return [
                         4,
                         (0, _rfc9728discoveryts.discoverAuthorizationServerMetadata)(authServerUrl, {
-                            allowLoopback: allowLoopback
+                            allowLoopback: allowLoopback,
+                            signal: signal
                         })
                     ];
                 case 1:
@@ -231,31 +232,39 @@ function resolveCapabilitiesFromAuthorizationServer(authServerUrl, scopes, allow
         });
     })();
 }
-function probeAuthCapabilities(baseUrl) {
-    return _async_to_generator(function() {
-        var normalizedBaseUrl, allowLoopback, resourceMetadata, authServerUrl, capabilities, issuer, issuerCapabilities, issuer1, issuerCapabilities1, origin, originCapabilities, _error;
+function probeAuthCapabilities(_0) {
+    return _async_to_generator(function(baseUrl) {
+        var options, signal, normalizedBaseUrl, allowLoopback, resourceMetadata, authServerUrl, capabilities, issuer, issuerCapabilities, issuer1, issuerCapabilities1, origin, originCapabilities, _error;
+        var _arguments = arguments;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    options = _arguments.length > 1 && _arguments[1] !== void 0 ? _arguments[1] : {};
+                    signal = options.signal;
+                    _state.label = 1;
+                case 1:
                     _state.trys.push([
-                        0,
-                        10,
+                        1,
+                        11,
                         ,
-                        11
+                        12
                     ]);
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     normalizedBaseUrl = (0, _urlutilsts.normalizeUrl)(baseUrl);
                     // Trust signal for every authorization-server fetch below: whether the
                     // configured MCP server is itself loopback, never a remote-supplied URL.
                     allowLoopback = (0, _discoveryfetchts.isLoopbackUrl)(normalizedBaseUrl);
                     return [
                         4,
-                        (0, _rfc9728discoveryts.discoverProtectedResourceMetadata)(normalizedBaseUrl)
+                        (0, _rfc9728discoveryts.discoverProtectedResourceMetadata)(normalizedBaseUrl, {
+                            signal: signal
+                        })
                     ];
-                case 1:
+                case 2:
                     resourceMetadata = _state.sent();
                     if (!(resourceMetadata && resourceMetadata.authorization_servers.length > 0)) return [
                         3,
-                        5
+                        6
                     ];
                     // Found protected resource metadata with authorization servers
                     // Discover the authorization server's metadata (RFC 8414)
@@ -271,9 +280,9 @@ function probeAuthCapabilities(baseUrl) {
                     }
                     return [
                         4,
-                        resolveCapabilitiesFromAuthorizationServer(authServerUrl, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource)
+                        resolveCapabilitiesFromAuthorizationServer(authServerUrl, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource, signal)
                     ];
-                case 2:
+                case 3:
                     capabilities = _state.sent();
                     if (capabilities) {
                         return [
@@ -283,56 +292,60 @@ function probeAuthCapabilities(baseUrl) {
                     }
                     return [
                         4,
-                        (0, _rfc9728discoveryts.discoverAuthorizationServerIssuer)(baseUrl)
+                        (0, _rfc9728discoveryts.discoverAuthorizationServerIssuer)(baseUrl, {
+                            signal: signal
+                        })
                     ];
-                case 3:
+                case 4:
                     issuer = _state.sent();
                     if (!issuer) return [
                         3,
-                        5
+                        6
                     ];
                     return [
                         4,
-                        resolveCapabilitiesFromAuthorizationServer(issuer, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource)
+                        resolveCapabilitiesFromAuthorizationServer(issuer, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource, signal)
                     ];
-                case 4:
+                case 5:
                     issuerCapabilities = _state.sent();
                     if (issuerCapabilities) return [
                         2,
                         issuerCapabilities
                     ];
-                    _state.label = 5;
-                case 5:
+                    _state.label = 6;
+                case 6:
                     return [
                         4,
-                        (0, _rfc9728discoveryts.discoverAuthorizationServerIssuer)(normalizedBaseUrl)
+                        (0, _rfc9728discoveryts.discoverAuthorizationServerIssuer)(normalizedBaseUrl, {
+                            signal: signal
+                        })
                     ];
-                case 6:
+                case 7:
                     issuer1 = _state.sent();
                     if (!issuer1) return [
                         3,
-                        8
+                        9
                     ];
                     return [
                         4,
-                        resolveCapabilitiesFromAuthorizationServer(issuer1, undefined, allowLoopback)
+                        resolveCapabilitiesFromAuthorizationServer(issuer1, undefined, allowLoopback, undefined, signal)
                     ];
-                case 7:
+                case 8:
                     issuerCapabilities1 = _state.sent();
                     if (issuerCapabilities1) return [
                         2,
                         issuerCapabilities1
                     ];
-                    _state.label = 8;
-                case 8:
+                    _state.label = 9;
+                case 9:
                     // Strategy 2: Fall back to direct RFC 8414 discovery at resource origin
                     // This handles same-domain OAuth (traditional setup)
                     origin = getOrigin(normalizedBaseUrl);
                     return [
                         4,
-                        resolveCapabilitiesFromAuthorizationServer(origin, undefined, allowLoopback)
+                        resolveCapabilitiesFromAuthorizationServer(origin, undefined, allowLoopback, undefined, signal)
                     ];
-                case 9:
+                case 10:
                     originCapabilities = _state.sent();
                     if (originCapabilities) return [
                         2,
@@ -345,8 +358,9 @@ function probeAuthCapabilities(baseUrl) {
                             supportsDcr: false
                         }
                     ];
-                case 10:
+                case 11:
                     _error = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     // Network error, invalid JSON, or other fetch failure
                     // Gracefully degrade - assume no DCR support
                     return [
@@ -355,12 +369,12 @@ function probeAuthCapabilities(baseUrl) {
                             supportsDcr: false
                         }
                     ];
-                case 11:
+                case 12:
                     return [
                         2
                     ];
             }
         });
-    })();
+    }).apply(this, arguments);
 }
 /* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/auth/capability-discovery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/capability-discovery.ts"],"sourcesContent":["/**\n * OAuth Server Capability Discovery\n * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata\n */\n\nimport { normalizeUrl } from '../lib/url-utils.ts';\nimport { isLoopbackUrl } from './discovery-fetch.ts';\nimport { discoverAuthorizationServerIssuer, discoverAuthorizationServerMetadata, discoverProtectedResourceMetadata } from './rfc9728-discovery.ts';\nimport type { AuthCapabilities, AuthorizationServerMetadata } from './types.ts';\n\n/**\n * Extract origin (protocol + host) from a URL\n * @param url - Full URL that may include a path\n * @returns Origin (e.g., \"https://example.com\") or original string if invalid URL\n *\n * @example\n * getOrigin('https://example.com/mcp') // → 'https://example.com'\n * getOrigin('http://localhost:9999/api/v1/mcp') // → 'http://localhost:9999'\n */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    // Invalid URL - return as-is for graceful degradation\n    return url;\n  }\n}\n\n/**\n * Probe OAuth server capabilities using RFC 9728 → RFC 8414 discovery chain\n * Returns capabilities including DCR support detection\n *\n * Discovery Strategy:\n * 1. Try RFC 9728 Protected Resource Metadata (supports cross-domain OAuth)\n * 2. If found, use first authorization_server to discover RFC 8414 Authorization Server Metadata\n * 3. Fall back to direct RFC 8414 discovery at resource origin\n *\n * @param baseUrl - Base URL of the protected resource (e.g., https://ai.todoist.net/mcp)\n * @returns AuthCapabilities object with discovered endpoints and features\n *\n * @example\n * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com\n * const caps = await probeAuthCapabilities('https://ai.todoist.net/mcp');\n * if (caps.supportsDcr) {\n *   console.log('Registration endpoint:', caps.registrationEndpoint);\n * }\n */\nfunction buildCapabilities(metadata: AuthorizationServerMetadata, scopes?: string[], resource?: string): AuthCapabilities {\n  const supportsDcr = !!metadata.registration_endpoint;\n  const capabilities: AuthCapabilities = { supportsDcr, authorizationResponseIssSupported: metadata.authorization_response_iss_parameter_supported === true };\n\n  if (metadata.issuer) {\n    capabilities.issuer = metadata.issuer;\n  }\n\n  // Carried from the RFC 9728 document, not from the URL we were given: the\n  // resource server names itself, and that name is what RFC 8707 audience-binds\n  // a token to.\n  if (resource) {\n    capabilities.resource = resource;\n  }\n\n  if (metadata.registration_endpoint) {\n    capabilities.registrationEndpoint = metadata.registration_endpoint;\n  }\n  if (metadata.authorization_endpoint) {\n    capabilities.authorizationEndpoint = metadata.authorization_endpoint;\n  }\n  if (metadata.token_endpoint) capabilities.tokenEndpoint = metadata.token_endpoint;\n  if (metadata.introspection_endpoint) {\n    capabilities.introspectionEndpoint = metadata.introspection_endpoint;\n  }\n\n  if (scopes && scopes.length > 0) {\n    capabilities.scopes = scopes;\n  } else if (metadata.scopes_supported) {\n    capabilities.scopes = metadata.scopes_supported;\n  }\n\n  return capabilities;\n}\n\nasync function resolveCapabilitiesFromAuthorizationServer(authServerUrl: string, scopes: string[] | undefined, allowLoopback: boolean, resource?: string): Promise<AuthCapabilities | null> {\n  const metadata = await discoverAuthorizationServerMetadata(authServerUrl, { allowLoopback });\n  if (!metadata) return null;\n  return buildCapabilities(metadata, scopes, resource);\n}\n\nexport async function probeAuthCapabilities(baseUrl: string): Promise<AuthCapabilities> {\n  try {\n    const normalizedBaseUrl = normalizeUrl(baseUrl);\n    // Trust signal for every authorization-server fetch below: whether the\n    // configured MCP server is itself loopback, never a remote-supplied URL.\n    const allowLoopback = isLoopbackUrl(normalizedBaseUrl);\n    // Strategy 1: Try RFC 9728 Protected Resource Metadata discovery\n    // This handles cross-domain OAuth (e.g., Todoist: ai.todoist.net/mcp → todoist.com)\n    const resourceMetadata = await discoverProtectedResourceMetadata(normalizedBaseUrl);\n\n    if (resourceMetadata && resourceMetadata.authorization_servers.length > 0) {\n      // Found protected resource metadata with authorization servers\n      // Discover the authorization server's metadata (RFC 8414)\n      const authServerUrl = resourceMetadata.authorization_servers[0];\n      if (!authServerUrl) {\n        // Array has length > 0 but first element is undefined/null - skip this path\n        return { supportsDcr: false };\n      }\n      const capabilities = await resolveCapabilitiesFromAuthorizationServer(authServerUrl, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource);\n      if (capabilities) {\n        return capabilities;\n      }\n\n      const issuer = await discoverAuthorizationServerIssuer(baseUrl);\n      if (issuer) {\n        const issuerCapabilities = await resolveCapabilitiesFromAuthorizationServer(issuer, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource);\n        if (issuerCapabilities) return issuerCapabilities;\n      }\n    }\n\n    const issuer = await discoverAuthorizationServerIssuer(normalizedBaseUrl);\n    if (issuer) {\n      const issuerCapabilities = await resolveCapabilitiesFromAuthorizationServer(issuer, undefined, allowLoopback);\n      if (issuerCapabilities) return issuerCapabilities;\n    }\n\n    // Strategy 2: Fall back to direct RFC 8414 discovery at resource origin\n    // This handles same-domain OAuth (traditional setup)\n    const origin = getOrigin(normalizedBaseUrl);\n    const originCapabilities = await resolveCapabilitiesFromAuthorizationServer(origin, undefined, allowLoopback);\n    if (originCapabilities) return originCapabilities;\n\n    // No OAuth metadata found\n    return { supportsDcr: false };\n  } catch (_error) {\n    // Network error, invalid JSON, or other fetch failure\n    // Gracefully degrade - assume no DCR support\n    return { supportsDcr: false };\n  }\n}\n"],"names":["probeAuthCapabilities","getOrigin","url","URL","origin","buildCapabilities","metadata","scopes","resource","supportsDcr","registration_endpoint","capabilities","authorizationResponseIssSupported","authorization_response_iss_parameter_supported","issuer","registrationEndpoint","authorization_endpoint","authorizationEndpoint","token_endpoint","tokenEndpoint","introspection_endpoint","introspectionEndpoint","length","scopes_supported","resolveCapabilitiesFromAuthorizationServer","authServerUrl","allowLoopback","discoverAuthorizationServerMetadata","baseUrl","normalizedBaseUrl","resourceMetadata","issuerCapabilities","originCapabilities","_error","normalizeUrl","isLoopbackUrl","discoverProtectedResourceMetadata","authorization_servers","discoverAuthorizationServerIssuer","undefined"],"mappings":"AAAA;;;CAGC;;;;+BAqFqBA;;;eAAAA;;;0BAnFO;gCACC;kCAC4F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAG1H;;;;;;;;CAQC,GACD,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,sDAAsD;QACtD,OAAOF;IACT;AACF;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,SAASG,kBAAkBC,QAAqC,EAAEC,MAAiB,EAAEC,QAAiB;IACpG,IAAMC,cAAc,CAAC,CAACH,SAASI,qBAAqB;IACpD,IAAMC,eAAiC;QAAEF,aAAAA;QAAaG,mCAAmCN,SAASO,8CAA8C,KAAK;IAAK;IAE1J,IAAIP,SAASQ,MAAM,EAAE;QACnBH,aAAaG,MAAM,GAAGR,SAASQ,MAAM;IACvC;IAEA,0EAA0E;IAC1E,8EAA8E;IAC9E,cAAc;IACd,IAAIN,UAAU;QACZG,aAAaH,QAAQ,GAAGA;IAC1B;IAEA,IAAIF,SAASI,qBAAqB,EAAE;QAClCC,aAAaI,oBAAoB,GAAGT,SAASI,qBAAqB;IACpE;IACA,IAAIJ,SAASU,sBAAsB,EAAE;QACnCL,aAAaM,qBAAqB,GAAGX,SAASU,sBAAsB;IACtE;IACA,IAAIV,SAASY,cAAc,EAAEP,aAAaQ,aAAa,GAAGb,SAASY,cAAc;IACjF,IAAIZ,SAASc,sBAAsB,EAAE;QACnCT,aAAaU,qBAAqB,GAAGf,SAASc,sBAAsB;IACtE;IAEA,IAAIb,UAAUA,OAAOe,MAAM,GAAG,GAAG;QAC/BX,aAAaJ,MAAM,GAAGA;IACxB,OAAO,IAAID,SAASiB,gBAAgB,EAAE;QACpCZ,aAAaJ,MAAM,GAAGD,SAASiB,gBAAgB;IACjD;IAEA,OAAOZ;AACT;AAEA,SAAea,2CAA2CC,aAAqB,EAAElB,MAA4B,EAAEmB,aAAsB,EAAElB,QAAiB;;YAChJF;;;;oBAAW;;wBAAMqB,IAAAA,uDAAmC,EAACF,eAAe;4BAAEC,eAAAA;wBAAc;;;oBAApFpB,WAAW;oBACjB,IAAI,CAACA,UAAU;;wBAAO;;oBACtB;;wBAAOD,kBAAkBC,UAAUC,QAAQC;;;;IAC7C;;AAEO,SAAeR,sBAAsB4B,OAAe;;YAEjDC,mBAGAH,eAGAI,kBAKEL,eAKAd,cAKAG,QAEEiB,oBAKJjB,SAEEiB,qBAMF3B,QACA4B,oBAKCC;;;;;;;;;;oBA1CDJ,oBAAoBK,IAAAA,wBAAY,EAACN;oBACvC,uEAAuE;oBACvE,yEAAyE;oBACnEF,gBAAgBS,IAAAA,+BAAa,EAACN;oBAGX;;wBAAMO,IAAAA,qDAAiC,EAACP;;;oBAA3DC,mBAAmB;yBAErBA,CAAAA,oBAAoBA,iBAAiBO,qBAAqB,CAACf,MAAM,GAAG,CAAA,GAApEQ;;;;oBACF,+DAA+D;oBAC/D,0DAA0D;oBACpDL,gBAAgBK,iBAAiBO,qBAAqB,CAAC,EAAE;oBAC/D,IAAI,CAACZ,eAAe;wBAClB,4EAA4E;wBAC5E;;4BAAO;gCAAEhB,aAAa;4BAAM;;oBAC9B;oBACqB;;wBAAMe,2CAA2CC,eAAeK,iBAAiBP,gBAAgB,EAAEG,eAAeI,iBAAiBtB,QAAQ;;;oBAA1JG,eAAe;oBACrB,IAAIA,cAAc;wBAChB;;4BAAOA;;oBACT;oBAEe;;wBAAM2B,IAAAA,qDAAiC,EAACV;;;oBAAjDd,SAAS;yBACXA,QAAAA;;;;oBACyB;;wBAAMU,2CAA2CV,QAAQgB,iBAAiBP,gBAAgB,EAAEG,eAAeI,iBAAiBtB,QAAQ;;;oBAAzJuB,qBAAqB;oBAC3B,IAAIA,oBAAoB;;wBAAOA;;;;oBAIpB;;wBAAMO,IAAAA,qDAAiC,EAACT;;;oBAAjDf,UAAS;yBACXA,SAAAA;;;;oBACyB;;wBAAMU,2CAA2CV,SAAQyB,WAAWb;;;oBAAzFK,sBAAqB;oBAC3B,IAAIA,qBAAoB;;wBAAOA;;;;oBAGjC,wEAAwE;oBACxE,qDAAqD;oBAC/C3B,SAASH,UAAU4B;oBACE;;wBAAML,2CAA2CpB,QAAQmC,WAAWb;;;oBAAzFM,qBAAqB;oBAC3B,IAAIA,oBAAoB;;wBAAOA;;oBAE/B,0BAA0B;oBAC1B;;wBAAO;4BAAEvB,aAAa;wBAAM;;;oBACrBwB;oBACP,sDAAsD;oBACtD,6CAA6C;oBAC7C;;wBAAO;4BAAExB,aAAa;wBAAM;;;;;;;;IAEhC"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/capability-discovery.ts"],"sourcesContent":["/**\n * OAuth Server Capability Discovery\n * Probes RFC 9728 (Protected Resource) and RFC 8414 (Authorization Server) metadata\n */\n\nimport { normalizeUrl } from '../lib/url-utils.ts';\nimport { isLoopbackUrl, throwIfAborted } from './discovery-fetch.ts';\nimport { discoverAuthorizationServerIssuer, discoverAuthorizationServerMetadata, discoverProtectedResourceMetadata } from './rfc9728-discovery.ts';\nimport type { AuthCapabilities, AuthorizationServerMetadata } from './types.ts';\n\n/**\n * Extract origin (protocol + host) from a URL\n * @param url - Full URL that may include a path\n * @returns Origin (e.g., \"https://example.com\") or original string if invalid URL\n *\n * @example\n * getOrigin('https://example.com/mcp') // → 'https://example.com'\n * getOrigin('http://localhost:9999/api/v1/mcp') // → 'http://localhost:9999'\n */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    // Invalid URL - return as-is for graceful degradation\n    return url;\n  }\n}\n\n/**\n * Probe OAuth server capabilities using RFC 9728 → RFC 8414 discovery chain\n * Returns capabilities including DCR support detection\n *\n * Discovery Strategy:\n * 1. Try RFC 9728 Protected Resource Metadata (supports cross-domain OAuth)\n * 2. If found, use first authorization_server to discover RFC 8414 Authorization Server Metadata\n * 3. Fall back to direct RFC 8414 discovery at resource origin\n *\n * @param baseUrl - Base URL of the protected resource (e.g., https://ai.todoist.net/mcp)\n * @returns AuthCapabilities object with discovered endpoints and features\n *\n * @example\n * // Todoist case: MCP at ai.todoist.net/mcp, OAuth at todoist.com\n * const caps = await probeAuthCapabilities('https://ai.todoist.net/mcp');\n * if (caps.supportsDcr) {\n *   console.log('Registration endpoint:', caps.registrationEndpoint);\n * }\n */\nfunction buildCapabilities(metadata: AuthorizationServerMetadata, scopes?: string[], resource?: string): AuthCapabilities {\n  const supportsDcr = !!metadata.registration_endpoint;\n  const capabilities: AuthCapabilities = { supportsDcr, authorizationResponseIssSupported: metadata.authorization_response_iss_parameter_supported === true };\n\n  if (metadata.issuer) {\n    capabilities.issuer = metadata.issuer;\n  }\n\n  // Carried from the RFC 9728 document, not from the URL we were given: the\n  // resource server names itself, and that name is what RFC 8707 audience-binds\n  // a token to.\n  if (resource) {\n    capabilities.resource = resource;\n  }\n\n  if (metadata.registration_endpoint) {\n    capabilities.registrationEndpoint = metadata.registration_endpoint;\n  }\n  if (metadata.authorization_endpoint) {\n    capabilities.authorizationEndpoint = metadata.authorization_endpoint;\n  }\n  if (metadata.token_endpoint) capabilities.tokenEndpoint = metadata.token_endpoint;\n  if (metadata.introspection_endpoint) {\n    capabilities.introspectionEndpoint = metadata.introspection_endpoint;\n  }\n\n  if (scopes && scopes.length > 0) {\n    capabilities.scopes = scopes;\n  } else if (metadata.scopes_supported) {\n    capabilities.scopes = metadata.scopes_supported;\n  }\n\n  return capabilities;\n}\n\nasync function resolveCapabilitiesFromAuthorizationServer(authServerUrl: string, scopes: string[] | undefined, allowLoopback: boolean, resource?: string, signal?: AbortSignal): Promise<AuthCapabilities | null> {\n  const metadata = await discoverAuthorizationServerMetadata(authServerUrl, { allowLoopback, signal });\n  if (!metadata) return null;\n  return buildCapabilities(metadata, scopes, resource);\n}\n\nexport async function probeAuthCapabilities(baseUrl: string, options: { signal?: AbortSignal } = {}): Promise<AuthCapabilities> {\n  const { signal } = options;\n  try {\n    throwIfAborted(signal);\n    const normalizedBaseUrl = normalizeUrl(baseUrl);\n    // Trust signal for every authorization-server fetch below: whether the\n    // configured MCP server is itself loopback, never a remote-supplied URL.\n    const allowLoopback = isLoopbackUrl(normalizedBaseUrl);\n    // Strategy 1: Try RFC 9728 Protected Resource Metadata discovery\n    // This handles cross-domain OAuth (e.g., Todoist: ai.todoist.net/mcp → todoist.com)\n    const resourceMetadata = await discoverProtectedResourceMetadata(normalizedBaseUrl, { signal });\n\n    if (resourceMetadata && resourceMetadata.authorization_servers.length > 0) {\n      // Found protected resource metadata with authorization servers\n      // Discover the authorization server's metadata (RFC 8414)\n      const authServerUrl = resourceMetadata.authorization_servers[0];\n      if (!authServerUrl) {\n        // Array has length > 0 but first element is undefined/null - skip this path\n        return { supportsDcr: false };\n      }\n      const capabilities = await resolveCapabilitiesFromAuthorizationServer(authServerUrl, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource, signal);\n      if (capabilities) {\n        return capabilities;\n      }\n\n      const issuer = await discoverAuthorizationServerIssuer(baseUrl, { signal });\n      if (issuer) {\n        const issuerCapabilities = await resolveCapabilitiesFromAuthorizationServer(issuer, resourceMetadata.scopes_supported, allowLoopback, resourceMetadata.resource, signal);\n        if (issuerCapabilities) return issuerCapabilities;\n      }\n    }\n\n    const issuer = await discoverAuthorizationServerIssuer(normalizedBaseUrl, { signal });\n    if (issuer) {\n      const issuerCapabilities = await resolveCapabilitiesFromAuthorizationServer(issuer, undefined, allowLoopback, undefined, signal);\n      if (issuerCapabilities) return issuerCapabilities;\n    }\n\n    // Strategy 2: Fall back to direct RFC 8414 discovery at resource origin\n    // This handles same-domain OAuth (traditional setup)\n    const origin = getOrigin(normalizedBaseUrl);\n    const originCapabilities = await resolveCapabilitiesFromAuthorizationServer(origin, undefined, allowLoopback, undefined, signal);\n    if (originCapabilities) return originCapabilities;\n\n    // No OAuth metadata found\n    return { supportsDcr: false };\n  } catch (_error) {\n    throwIfAborted(signal);\n    // Network error, invalid JSON, or other fetch failure\n    // Gracefully degrade - assume no DCR support\n    return { supportsDcr: false };\n  }\n}\n"],"names":["probeAuthCapabilities","getOrigin","url","URL","origin","buildCapabilities","metadata","scopes","resource","supportsDcr","registration_endpoint","capabilities","authorizationResponseIssSupported","authorization_response_iss_parameter_supported","issuer","registrationEndpoint","authorization_endpoint","authorizationEndpoint","token_endpoint","tokenEndpoint","introspection_endpoint","introspectionEndpoint","length","scopes_supported","resolveCapabilitiesFromAuthorizationServer","authServerUrl","allowLoopback","signal","discoverAuthorizationServerMetadata","baseUrl","options","normalizedBaseUrl","resourceMetadata","issuerCapabilities","originCapabilities","_error","throwIfAborted","normalizeUrl","isLoopbackUrl","discoverProtectedResourceMetadata","authorization_servers","discoverAuthorizationServerIssuer","undefined"],"mappings":"AAAA;;;CAGC;;;;+BAqFqBA;;;eAAAA;;;0BAnFO;gCACiB;kCAC4E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAG1H;;;;;;;;CAQC,GACD,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,sDAAsD;QACtD,OAAOF;IACT;AACF;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,SAASG,kBAAkBC,QAAqC,EAAEC,MAAiB,EAAEC,QAAiB;IACpG,IAAMC,cAAc,CAAC,CAACH,SAASI,qBAAqB;IACpD,IAAMC,eAAiC;QAAEF,aAAAA;QAAaG,mCAAmCN,SAASO,8CAA8C,KAAK;IAAK;IAE1J,IAAIP,SAASQ,MAAM,EAAE;QACnBH,aAAaG,MAAM,GAAGR,SAASQ,MAAM;IACvC;IAEA,0EAA0E;IAC1E,8EAA8E;IAC9E,cAAc;IACd,IAAIN,UAAU;QACZG,aAAaH,QAAQ,GAAGA;IAC1B;IAEA,IAAIF,SAASI,qBAAqB,EAAE;QAClCC,aAAaI,oBAAoB,GAAGT,SAASI,qBAAqB;IACpE;IACA,IAAIJ,SAASU,sBAAsB,EAAE;QACnCL,aAAaM,qBAAqB,GAAGX,SAASU,sBAAsB;IACtE;IACA,IAAIV,SAASY,cAAc,EAAEP,aAAaQ,aAAa,GAAGb,SAASY,cAAc;IACjF,IAAIZ,SAASc,sBAAsB,EAAE;QACnCT,aAAaU,qBAAqB,GAAGf,SAASc,sBAAsB;IACtE;IAEA,IAAIb,UAAUA,OAAOe,MAAM,GAAG,GAAG;QAC/BX,aAAaJ,MAAM,GAAGA;IACxB,OAAO,IAAID,SAASiB,gBAAgB,EAAE;QACpCZ,aAAaJ,MAAM,GAAGD,SAASiB,gBAAgB;IACjD;IAEA,OAAOZ;AACT;AAEA,SAAea,2CAA2CC,aAAqB,EAAElB,MAA4B,EAAEmB,aAAsB,EAAElB,QAAiB,EAAEmB,MAAoB;;YACtKrB;;;;oBAAW;;wBAAMsB,IAAAA,uDAAmC,EAACH,eAAe;4BAAEC,eAAAA;4BAAeC,QAAAA;wBAAO;;;oBAA5FrB,WAAW;oBACjB,IAAI,CAACA,UAAU;;wBAAO;;oBACtB;;wBAAOD,kBAAkBC,UAAUC,QAAQC;;;;IAC7C;;AAEO,SAAeR;wCAAsB6B,OAAe;YAAEC,SACnDH,QAGAI,mBAGAL,eAGAM,kBAKEP,eAKAd,cAKAG,QAEEmB,oBAKJnB,SAEEmB,qBAMF7B,QACA8B,oBAKCC;;;;;oBA9CkDL,UAAAA,oEAAoC,CAAC;oBACxFH,SAAWG,QAAXH;;;;;;;;;oBAENS,IAAAA,gCAAc,EAACT;oBACTI,oBAAoBM,IAAAA,wBAAY,EAACR;oBACvC,uEAAuE;oBACvE,yEAAyE;oBACnEH,gBAAgBY,IAAAA,+BAAa,EAACP;oBAGX;;wBAAMQ,IAAAA,qDAAiC,EAACR,mBAAmB;4BAAEJ,QAAAA;wBAAO;;;oBAAvFK,mBAAmB;yBAErBA,CAAAA,oBAAoBA,iBAAiBQ,qBAAqB,CAAClB,MAAM,GAAG,CAAA,GAApEU;;;;oBACF,+DAA+D;oBAC/D,0DAA0D;oBACpDP,gBAAgBO,iBAAiBQ,qBAAqB,CAAC,EAAE;oBAC/D,IAAI,CAACf,eAAe;wBAClB,4EAA4E;wBAC5E;;4BAAO;gCAAEhB,aAAa;4BAAM;;oBAC9B;oBACqB;;wBAAMe,2CAA2CC,eAAeO,iBAAiBT,gBAAgB,EAAEG,eAAeM,iBAAiBxB,QAAQ,EAAEmB;;;oBAA5JhB,eAAe;oBACrB,IAAIA,cAAc;wBAChB;;4BAAOA;;oBACT;oBAEe;;wBAAM8B,IAAAA,qDAAiC,EAACZ,SAAS;4BAAEF,QAAAA;wBAAO;;;oBAAnEb,SAAS;yBACXA,QAAAA;;;;oBACyB;;wBAAMU,2CAA2CV,QAAQkB,iBAAiBT,gBAAgB,EAAEG,eAAeM,iBAAiBxB,QAAQ,EAAEmB;;;oBAA3JM,qBAAqB;oBAC3B,IAAIA,oBAAoB;;wBAAOA;;;;oBAIpB;;wBAAMQ,IAAAA,qDAAiC,EAACV,mBAAmB;4BAAEJ,QAAAA;wBAAO;;;oBAA7Eb,UAAS;yBACXA,SAAAA;;;;oBACyB;;wBAAMU,2CAA2CV,SAAQ4B,WAAWhB,eAAegB,WAAWf;;;oBAAnHM,sBAAqB;oBAC3B,IAAIA,qBAAoB;;wBAAOA;;;;oBAGjC,wEAAwE;oBACxE,qDAAqD;oBAC/C7B,SAASH,UAAU8B;oBACE;;wBAAMP,2CAA2CpB,QAAQsC,WAAWhB,eAAegB,WAAWf;;;oBAAnHO,qBAAqB;oBAC3B,IAAIA,oBAAoB;;wBAAOA;;oBAE/B,0BAA0B;oBAC1B;;wBAAO;4BAAEzB,aAAa;wBAAM;;;oBACrB0B;oBACPC,IAAAA,gCAAc,EAACT;oBACf,sDAAsD;oBACtD,6CAA6C;oBAC7C;;wBAAO;4BAAElB,aAAa;wBAAM;;;;;;;;IAEhC"}

package/dist/cjs/auth/discovery-fetch.d.cts

@@ -1,6 +1,8 @@
 export declare class DiscoveryFetchError extends Error {
     constructor(message: string);
 }
+/** Preserve cancellation while discovery falls back across endpoints. */
+export declare function throwIfAborted(signal?: AbortSignal | null): void;
 type LookupRecord = {
     address: string;
     family: number;

package/dist/cjs/auth/discovery-fetch.d.ts

@@ -1,6 +1,8 @@
 export declare class DiscoveryFetchError extends Error {
     constructor(message: string);
 }
+/** Preserve cancellation while discovery falls back across endpoints. */
+export declare function throwIfAborted(signal?: AbortSignal | null): void;
 type LookupRecord = {
     address: string;
     family: number;

package/dist/cjs/auth/discovery-fetch.js

@@ -23,6 +23,9 @@ _export(exports, {
     },
     get readDiscoveryJson () {
         return readDiscoveryJson;
+    },
+    get throwIfAborted () {
+        return throwIfAborted;
     }
 });
 var _nodedns = /*#__PURE__*/ _interop_require_default(require("node:dns"));
@@ -325,6 +328,9 @@ var DiscoveryFetchError = /*#__PURE__*/ function(Error1) {
 var DEFAULT_TIMEOUT_MS = 10000;
 var MAX_REDIRECTS = 5;
 var MAX_BODY_BYTES = 1000000; // 1 MB - discovery documents are small JSON
+function throwIfAborted(signal) {
+    signal === null || signal === void 0 ? void 0 : signal.throwIfAborted();
+}
 function stripBrackets(hostname) {
     return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
 }
@@ -386,32 +392,47 @@ function isLoopbackAddress(address) {
     }
     return url;
 }
-function lookupAll(hostname, lookup, timeoutMs) {
+function lookupAll(hostname, lookup, timeoutMs, signal) {
     return new Promise(function(resolve, reject) {
         var settled = false;
+        var finish = function finish(complete) {
+            if (settled) return;
+            settled = true;
+            clearTimeout(deadline);
+            signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+            complete();
+        };
+        var onAbort = function onAbort() {
+            return finish(function() {
+                return reject(signal === null || signal === void 0 ? void 0 : signal.reason);
+            });
+        };
         var deadline = setTimeout(function() {
-            if (!settled) {
-                settled = true;
-                reject(new Error('DNS resolution timed out'));
-            }
+            finish(function() {
+                return reject(new Error('DNS resolution timed out'));
+            });
         }, timeoutMs);
+        signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, {
+            once: true
+        });
+        if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+            onAbort();
+            return;
+        }
         try {
             lookup(hostname, {
                 all: true,
                 verbatim: true
             }, function(error, addresses) {
-                if (settled) return;
-                settled = true;
-                clearTimeout(deadline);
-                if (error || addresses.length === 0) reject(new Error('DNS resolution failed'));
-                else resolve(addresses);
+                finish(function() {
+                    if (error || addresses.length === 0) reject(new Error('DNS resolution failed'));
+                    else resolve(addresses);
+                });
             });
         } catch (unused) {
-            if (!settled) {
-                settled = true;
-                clearTimeout(deadline);
-                reject(new Error('DNS resolution failed'));
-            }
+            finish(function() {
+                return reject(new Error('DNS resolution failed'));
+            });
         }
     });
 }
@@ -421,12 +442,13 @@ function lookupAll(hostname, lookup, timeoutMs) {
  * request itself (see `requestOnce`), which is what closes the DNS-rebinding
  * TOCTOU: the transport can only dial addresses that were already validated,
  * and it never resolves the hostname a second time.
- */ function resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs) {
+ */ function resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs, signal) {
     return _async_to_generator(function() {
-        var host, loopbackGrant, addresses, unused;
+        var host, loopbackGrant, addresses, _error;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    throwIfAborted(signal);
                     host = stripBrackets(url.hostname);
                     if ((0, _nodenet.isIP)(host)) return [
                         2,
@@ -451,7 +473,7 @@ function lookupAll(hostname, lookup, timeoutMs) {
                     ]);
                     return [
                         4,
-                        lookupAll(host, lookup, timeoutMs)
+                        lookupAll(host, lookup, timeoutMs, signal)
                     ];
                 case 2:
                     addresses = _state.sent();
@@ -460,7 +482,8 @@ function lookupAll(hostname, lookup, timeoutMs) {
                         4
                     ];
                 case 3:
-                    unused = _state.sent();
+                    _error = _state.sent();
+                    throwIfAborted(signal);
                     throw new DiscoveryFetchError("Refusing to fetch ".concat(context, ": host could not be resolved"));
                 case 4:
                     if (loopbackGrant) {
@@ -684,55 +707,84 @@ function toResponse(status, statusText, headers, body) {
 }
 function requestOnce(url, init, context, addresses, timeoutMs) {
     return _async_to_generator(function() {
-        var _init_method, body, unused, transport, options;
+        var _init_method, _init_signal, body, unused, transport, options;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    throwIfAborted(init.signal);
+                    _state.label = 1;
+                case 1:
                     _state.trys.push([
-                        0,
-                        2,
+                        1,
+                        3,
                         ,
-                        3
+                        4
                     ]);
                     return [
                         4,
                         toRequestBody(init.body)
                     ];
-                case 1:
+                case 2:
                     body = _state.sent();
                     return [
                         3,
-                        3
+                        4
                     ];
-                case 2:
+                case 3:
                     unused = _state.sent();
                     throw new DiscoveryFetchError("Failed to fetch ".concat(context));
-                case 3:
+                case 4:
                     transport = url.protocol === 'https:' ? _nodehttps.default : _nodehttp.default;
                     options = {
                         method: ((_init_method = init.method) !== null && _init_method !== void 0 ? _init_method : 'GET').toUpperCase(),
                         headers: toRequestHeaders(init),
                         agent: false,
-                        lookup: pinnedLookup(addresses)
+                        lookup: pinnedLookup(addresses),
+                        signal: (_init_signal = init.signal) !== null && _init_signal !== void 0 ? _init_signal : undefined
                     };
                     return [
                         2,
                         new Promise(function(resolve, reject) {
+                            var _init_signal;
                             var settled = false;
                             var req;
                             var res;
+                            var signal = (_init_signal = init.signal) !== null && _init_signal !== void 0 ? _init_signal : undefined;
+                            var cleanup = function cleanup() {
+                                clearTimeout(deadline);
+                                signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+                            };
                             var fail = function fail(message) {
                                 if (!settled) {
                                     settled = true;
-                                    clearTimeout(deadline);
+                                    cleanup();
                                     reject(new DiscoveryFetchError(message));
                                 }
                             };
+                            var failWith = function failWith(error) {
+                                if (!settled) {
+                                    settled = true;
+                                    cleanup();
+                                    reject(error);
+                                }
+                            };
                             var deadline = setTimeout(function() {
                                 res === null || res === void 0 ? void 0 : res.destroy();
                                 req === null || req === void 0 ? void 0 : req.destroy();
                                 fail("Failed to fetch ".concat(context));
                             }, timeoutMs);
+                            var onAbort = function onAbort() {
+                                res === null || res === void 0 ? void 0 : res.destroy();
+                                req === null || req === void 0 ? void 0 : req.destroy();
+                                failWith(signal === null || signal === void 0 ? void 0 : signal.reason);
+                            };
+                            signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, {
+                                once: true
+                            });
+                            if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+                                onAbort();
+                                return;
+                            }
                             try {
                                 req = transport.request(url, options, function(response) {
                                     var _response_statusMessage;
@@ -761,7 +813,7 @@ function requestOnce(url, init, context, addresses, timeoutMs) {
                                     response.once('end', function() {
                                         if (settled) return;
                                         settled = true;
-                                        clearTimeout(deadline);
+                                        cleanup();
                                         resolve(toResponse(status, statusText, response.headers, Buffer.concat(chunks)));
                                     });
                                 });
@@ -785,9 +837,10 @@ function fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup) {
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    throwIfAborted(init.signal);
                     return [
                         4,
-                        resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs)
+                        resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs, init.signal)
                     ];
                 case 1:
                     addresses = _state.sent();
@@ -807,6 +860,7 @@ function discoveryFetch(_0) {
             switch(_state.label){
                 case 0:
                     init = _arguments.length > 1 && _arguments[1] !== void 0 ? _arguments[1] : {}, context = _arguments.length > 2 && _arguments[2] !== void 0 ? _arguments[2] : 'discovery URL', options = _arguments.length > 3 && _arguments[3] !== void 0 ? _arguments[3] : {};
+                    throwIfAborted(init.signal);
                     _options_allowLoopback = options.allowLoopback, allowLoopback = _options_allowLoopback === void 0 ? false : _options_allowLoopback, _options_timeoutMs = options.timeoutMs, timeoutMs = _options_timeoutMs === void 0 ? DEFAULT_TIMEOUT_MS : _options_timeoutMs, _options_lookup = options.lookup, lookup = _options_lookup === void 0 ? _nodedns.default.lookup : _options_lookup;
                     url = assertSafeUrl(rawUrl, context, allowLoopback);
                     return [