@mcp-z/client 2.2.4 → 2.3.0

package/dist/esm/auth/discovery-fetch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/discovery-fetch.ts"],"sourcesContent":["/**\n * Hardened fetch for OAuth discovery URLs, which the remote MCP server\n * controls (SSRF mitigation). See ARCHITECTURE.md's \"SSRF mitigation\" section for the threat model.\n */\nimport dns from 'node:dns';\nimport http from 'node:http';\nimport https from 'node:https';\nimport { isIP, type LookupFunction } from 'node:net';\nimport ipaddr from 'ipaddr.js';\n\nexport class DiscoveryFetchError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'DiscoveryFetchError';\n  }\n}\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst MAX_REDIRECTS = 5;\nconst MAX_BODY_BYTES = 1_000_000; // 1 MB - discovery documents are small JSON\n\ntype LookupRecord = { address: string; family: number };\n/** DNS implementation, injectable for deterministic tests. Same contract as `dns.lookup` with `{ all: true, verbatim: true }`. */\ntype Lookup = (hostname: string, options: { all: true; verbatim: true }, callback: (error: NodeJS.ErrnoException | null, addresses: LookupRecord[]) => void) => void;\n\nfunction stripBrackets(hostname: string): string {\n  return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n}\n\n/** True for the literal hostname `localhost` or an IP literal in the loopback range. */\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = stripBrackets(hostname).toLowerCase();\n  if (host === 'localhost') return true;\n  if (isIP(host)) {\n    try {\n      return ipaddr.process(host).range() === 'loopback';\n    } catch {\n      return false;\n    }\n  }\n  return false;\n}\n\n/**\n * True if `rawUrl`'s host is loopback, used to decide `allowLoopback` grants\n * from the URL the caller configured, not remote-supplied data. Fails closed on an unparseable URL.\n */\nexport function isLoopbackUrl(rawUrl: string): boolean {\n  try {\n    return isLoopbackHost(new URL(rawUrl).hostname);\n  } catch {\n    return false;\n  }\n}\n\n/** True when the address is anything other than ordinary public unicast space. */\nfunction isBlockedAddress(address: string): boolean {\n  try {\n    // ipaddr.process() normalizes IPv4-mapped IPv6 (::ffff:a.b.c.d) to IPv4 first.\n    return ipaddr.process(address).range() !== 'unicast';\n  } catch {\n    return true; // unparseable - fail closed\n  }\n}\n\nfunction isLoopbackAddress(address: string): boolean {\n  try {\n    return ipaddr.process(address).range() === 'loopback';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Validates scheme and, for literal-IP hosts, address range. `allowLoopback`\n * reflects trust in the calling server, never in `rawUrl` itself.\n */\nfunction assertSafeUrl(rawUrl: string, context: string, allowLoopback: boolean): URL {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: invalid URL`);\n  }\n\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: unsupported scheme`);\n  }\n\n  const host = stripBrackets(url.hostname);\n  const trustedLoopback = allowLoopback && isLoopbackHost(host);\n  if (trustedLoopback) return url; // this call's own grant covers it, regardless of scheme\n\n  if (url.protocol === 'http:') {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: http:// is only allowed for a trusted loopback origin`);\n  }\n\n  if (isIP(host) && isBlockedAddress(host)) {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: address is not publicly routable`);\n  }\n\n  return url;\n}\n\nfunction lookupAll(hostname: string, lookup: Lookup, timeoutMs: number): Promise<LookupRecord[]> {\n  return new Promise((resolve, reject) => {\n    let settled = false;\n    const deadline = setTimeout(() => {\n      if (!settled) {\n        settled = true;\n        reject(new Error('DNS resolution timed out'));\n      }\n    }, timeoutMs);\n    try {\n      lookup(hostname, { all: true, verbatim: true }, (error, addresses) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(deadline);\n        if (error || addresses.length === 0) reject(new Error('DNS resolution failed'));\n        else resolve(addresses);\n      });\n    } catch {\n      if (!settled) {\n        settled = true;\n        clearTimeout(deadline);\n        reject(new Error('DNS resolution failed'));\n      }\n    }\n  });\n}\n\n/**\n * Resolves the hostname once, rejects it unless every returned address is\n * acceptable, and returns the validated set. The set is pinned into the\n * request itself (see `requestOnce`), which is what closes the DNS-rebinding\n * TOCTOU: the transport can only dial addresses that were already validated,\n * and it never resolves the hostname a second time.\n */\nasync function resolveSafeAddresses(url: URL, context: string, allowLoopback: boolean, lookup: Lookup, timeoutMs: number): Promise<LookupRecord[]> {\n  const host = stripBrackets(url.hostname);\n  if (isIP(host)) return [{ address: host, family: host.includes(':') ? 6 : 4 }]; // literal IP already fully checked in assertSafeUrl\n\n  // Literal `localhost` under a trusted-loopback grant: still resolved, and the\n  // answers must be loopback - the grant covers loopback, not \"wherever\n  // localhost happens to point\".\n  const loopbackGrant = allowLoopback && isLoopbackHost(host);\n\n  let addresses: LookupRecord[];\n  try {\n    addresses = await lookupAll(host, lookup, timeoutMs);\n  } catch {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: host could not be resolved`);\n  }\n\n  if (loopbackGrant) {\n    if (!addresses.every((record) => isLoopbackAddress(record.address))) {\n      throw new DiscoveryFetchError(`Refusing to fetch ${context}: host does not resolve to a loopback address`);\n    }\n  } else if (addresses.some((record) => isBlockedAddress(record.address))) {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: host resolves to an address that is not publicly routable`);\n  }\n\n  return addresses;\n}\n\n/**\n * A `net` lookup that can only ever answer with `addresses` - the set already\n * validated for this URL. The request is built against the original URL (so\n * SNI and certificate verification still see the hostname), but the\n * connection can only land on a validated address.\n */\nfunction pinnedLookup(addresses: LookupRecord[]): LookupFunction {\n  return (_hostname, options, callback) => {\n    if (typeof options === 'object' && options.all === true) {\n      callback(null, addresses);\n      return;\n    }\n    const first = addresses[0];\n    if (!first) {\n      callback(Object.assign(new Error('no validated address'), { code: 'ENOTFOUND' }) as NodeJS.ErrnoException, '', 0);\n      return;\n    }\n    callback(null, first.address, first.family);\n  };\n}\n\nfunction toRequestHeaders(init: RequestInit): Record<string, string> {\n  const headers = new Headers(init.headers);\n  const out: Record<string, string> = {};\n  for (const [name, value] of headers) out[name] = value;\n  return out;\n}\n\nasync function toRequestBody(body: RequestInit['body']): Promise<Buffer | undefined> {\n  if (body === undefined || body === null) return undefined;\n  if (typeof body === 'string') return Buffer.from(body);\n  if (body instanceof URLSearchParams) return Buffer.from(body.toString());\n  if (body instanceof Blob) return Buffer.from(await body.arrayBuffer());\n  if (body instanceof ArrayBuffer) return Buffer.from(body);\n  if (ArrayBuffer.isView(body)) return Buffer.from(body.buffer, body.byteOffset, body.byteLength);\n  if (typeof ReadableStream !== 'undefined' && body instanceof ReadableStream) {\n    const reader = body.getReader();\n    const chunks: Uint8Array[] = [];\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        if (value) chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock();\n    }\n    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)));\n  }\n  throw new Error('unsupported request body');\n}\n\nfunction toResponse(status: number, statusText: string, headers: http.IncomingHttpHeaders, body: Buffer): Response {\n  const responseHeaders = new Headers();\n  for (const [name, value] of Object.entries(headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) {\n      for (const entry of value) responseHeaders.append(name, entry);\n    } else {\n      responseHeaders.append(name, value);\n    }\n  }\n  // The fetch spec gives these statuses a null body, and the Response\n  // constructor rejects a body for them.\n  const nullBody = status === 204 || status === 205 || status === 304;\n  return new Response(nullBody ? null : body, { status, statusText, headers: responseHeaders });\n}\n\nasync function requestOnce(url: URL, init: RequestInit, context: string, addresses: LookupRecord[], timeoutMs: number): Promise<Response> {\n  let body: Buffer | undefined;\n  try {\n    body = await toRequestBody(init.body);\n  } catch {\n    throw new DiscoveryFetchError(`Failed to fetch ${context}`);\n  }\n\n  const transport = url.protocol === 'https:' ? https : http;\n  const options: http.RequestOptions = { method: (init.method ?? 'GET').toUpperCase(), headers: toRequestHeaders(init), agent: false, lookup: pinnedLookup(addresses) };\n\n  return new Promise<Response>((resolve, reject) => {\n    let settled = false;\n    let req: http.ClientRequest | undefined;\n    let res: http.IncomingMessage | undefined;\n    const fail = (message: string): void => {\n      if (!settled) {\n        settled = true;\n        clearTimeout(deadline);\n        reject(new DiscoveryFetchError(message));\n      }\n    };\n    const deadline = setTimeout(() => {\n      res?.destroy();\n      req?.destroy();\n      fail(`Failed to fetch ${context}`);\n    }, timeoutMs);\n\n    try {\n      req = transport.request(url, options, (response) => {\n        res = response;\n        const status = response.statusCode;\n        const statusText = response.statusMessage ?? '';\n        if (status === undefined || status < 200 || status > 599) {\n          response.destroy();\n          fail(`Failed to fetch ${context}`);\n          return;\n        }\n        const chunks: Buffer[] = [];\n        let total = 0;\n        response.on('data', (chunk: Buffer) => {\n          total += chunk.length;\n          if (total > MAX_BODY_BYTES) {\n            response.destroy();\n            fail(`Refusing to read ${context}: response too large`);\n            return;\n          }\n          chunks.push(chunk);\n        });\n        response.once('error', () => fail(`Failed to fetch ${context}`));\n        response.once('end', () => {\n          if (settled) return;\n          settled = true;\n          clearTimeout(deadline);\n          resolve(toResponse(status, statusText, response.headers, Buffer.concat(chunks)));\n        });\n      });\n    } catch {\n      fail(`Failed to fetch ${context}`);\n      return;\n    }\n\n    req.once('error', () => fail(`Failed to fetch ${context}`));\n    req.end(body);\n  });\n}\n\nasync function fetchOnce(url: URL, init: RequestInit, context: string, allowLoopback: boolean, timeoutMs: number, lookup: Lookup): Promise<Response> {\n  const addresses = await resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs);\n  return requestOnce(url, init, context, addresses, timeoutMs);\n}\n\nexport interface DiscoveryFetchOptions {\n  /**\n   * Loopback trust grant for this fetch, computed from the server the caller\n   * is actually talking to - never from the URL being fetched. Defaults to `false`.\n   */\n  allowLoopback?: boolean;\n  /**\n   * Per-hop timeout in ms, applied to both the DNS resolution and the request.\n   * Defaults to `DEFAULT_TIMEOUT_MS`; overridable so tests can bound slow-failure cases.\n   */\n  timeoutMs?: number;\n  /**\n   * DNS implementation used for the pre-request resolution, injectable for\n   * deterministic tests. Defaults to `dns.lookup`.\n   */\n  lookup?: Lookup;\n}\n\n/**\n * Fetches an OAuth-discovery URL with SSRF mitigations applied to the\n * initial URL and every redirect hop; redirects are validated, not auto-followed.\n *\n * The hostname is resolved once, every returned address is validated, and the\n * validated set is pinned into the request through a custom `lookup`, so the\n * request cannot resolve the hostname a second time and cannot be steered to\n * a different address by a DNS-rebinding answer.\n *\n * @param rawUrl - URL to fetch; may be remote-server-supplied (the threat this guards against).\n * @param init - Standard fetch options; `redirect` is always forced to `'manual'`.\n * @param context - Short label used only in error messages, never echoing the URL.\n * @param options - See `DiscoveryFetchOptions`.\n */\nexport async function discoveryFetch(rawUrl: string, init: RequestInit = {}, context = 'discovery URL', options: DiscoveryFetchOptions = {}): Promise<Response> {\n  const { allowLoopback = false, timeoutMs = DEFAULT_TIMEOUT_MS, lookup = dns.lookup as unknown as Lookup } = options;\n\n  let url = assertSafeUrl(rawUrl, context, allowLoopback);\n  let response = await fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup);\n\n  let redirectsLeft = MAX_REDIRECTS;\n  while (response.status >= 300 && response.status < 400) {\n    const location = response.headers.get('location');\n    if (!location) break;\n    if (redirectsLeft <= 0) {\n      throw new DiscoveryFetchError(`Refusing to fetch ${context}: too many redirects`);\n    }\n    redirectsLeft -= 1;\n\n    let nextUrl: URL;\n    try {\n      nextUrl = new URL(location, url);\n    } catch {\n      throw new DiscoveryFetchError(`Refusing to fetch ${context}: invalid redirect target`);\n    }\n    url = assertSafeUrl(nextUrl.toString(), context, allowLoopback);\n    response = await fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup);\n  }\n\n  return response;\n}\n\n/**\n * Parse a `discoveryFetch` response body as JSON, enforcing `MAX_BODY_BYTES`\n * while reading (not after buffering the whole thing).\n */\nexport async function readDiscoveryJson<T>(response: Response, context: string): Promise<T> {\n  const text = await readLimited(response, context, MAX_BODY_BYTES);\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new DiscoveryFetchError(`Refusing to parse ${context}: invalid JSON`);\n  }\n}\n\nasync function readLimited(response: Response, context: string, maxBytes: number): Promise<string> {\n  const contentLength = response.headers.get('content-length');\n  if (contentLength && Number(contentLength) > maxBytes) {\n    throw new DiscoveryFetchError(`Refusing to read ${context}: response too large`);\n  }\n\n  const reader = response.body?.getReader();\n  if (!reader) {\n    const text = await response.text();\n    if (Buffer.byteLength(text, 'utf8') > maxBytes) {\n      throw new DiscoveryFetchError(`Refusing to read ${context}: response too large`);\n    }\n    return text;\n  }\n\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  try {\n    for (;;) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!value) continue;\n      total += value.byteLength;\n      if (total > maxBytes) {\n        throw new DiscoveryFetchError(`Refusing to read ${context}: response too large`);\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n\n  return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString('utf8');\n}\n"],"names":["dns","http","https","isIP","ipaddr","DiscoveryFetchError","Error","message","name","DEFAULT_TIMEOUT_MS","MAX_REDIRECTS","MAX_BODY_BYTES","stripBrackets","hostname","startsWith","endsWith","slice","isLoopbackHost","host","toLowerCase","process","range","isLoopbackUrl","rawUrl","URL","isBlockedAddress","address","isLoopbackAddress","assertSafeUrl","context","allowLoopback","url","protocol","trustedLoopback","lookupAll","lookup","timeoutMs","Promise","resolve","reject","settled","deadline","setTimeout","all","verbatim","error","addresses","clearTimeout","length","resolveSafeAddresses","family","includes","loopbackGrant","every","record","some","pinnedLookup","_hostname","options","callback","first","Object","assign","code","toRequestHeaders","init","headers","Headers","out","value","toRequestBody","body","undefined","Buffer","from","URLSearchParams","toString","Blob","arrayBuffer","ArrayBuffer","isView","buffer","byteOffset","byteLength","ReadableStream","reader","getReader","chunks","done","read","push","releaseLock","concat","map","chunk","toResponse","status","statusText","responseHeaders","entries","Array","isArray","entry","append","nullBody","Response","requestOnce","transport","method","toUpperCase","agent","req","res","fail","destroy","request","response","statusCode","statusMessage","total","on","once","end","fetchOnce","discoveryFetch","redirectsLeft","location","get","nextUrl","readDiscoveryJson","text","readLimited","JSON","parse","maxBytes","contentLength","Number"],"mappings":"AAAA;;;CAGC,GACD,OAAOA,SAAS,WAAW;AAC3B,OAAOC,UAAU,YAAY;AAC7B,OAAOC,WAAW,aAAa;AAC/B,SAASC,IAAI,QAA6B,WAAW;AACrD,OAAOC,YAAY,YAAY;AAE/B,OAAO,MAAMC,4BAA4BC;IACvC,YAAYC,OAAe,CAAE;QAC3B,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,MAAMC,qBAAqB;AAC3B,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB,SAAW,4CAA4C;AAM9E,SAASC,cAAcC,QAAgB;IACrC,OAAOA,SAASC,UAAU,CAAC,QAAQD,SAASE,QAAQ,CAAC,OAAOF,SAASG,KAAK,CAAC,GAAG,CAAC,KAAKH;AACtF;AAEA,sFAAsF,GACtF,SAASI,eAAeJ,QAAgB;IACtC,MAAMK,OAAON,cAAcC,UAAUM,WAAW;IAChD,IAAID,SAAS,aAAa,OAAO;IACjC,IAAIf,KAAKe,OAAO;QACd,IAAI;YACF,OAAOd,OAAOgB,OAAO,CAACF,MAAMG,KAAK,OAAO;QAC1C,EAAE,OAAM;YACN,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA;;;CAGC,GACD,OAAO,SAASC,cAAcC,MAAc;IAC1C,IAAI;QACF,OAAON,eAAe,IAAIO,IAAID,QAAQV,QAAQ;IAChD,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,gFAAgF,GAChF,SAASY,iBAAiBC,OAAe;IACvC,IAAI;QACF,+EAA+E;QAC/E,OAAOtB,OAAOgB,OAAO,CAACM,SAASL,KAAK,OAAO;IAC7C,EAAE,OAAM;QACN,OAAO,MAAM,4BAA4B;IAC3C;AACF;AAEA,SAASM,kBAAkBD,OAAe;IACxC,IAAI;QACF,OAAOtB,OAAOgB,OAAO,CAACM,SAASL,KAAK,OAAO;IAC7C,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;CAGC,GACD,SAASO,cAAcL,MAAc,EAAEM,OAAe,EAAEC,aAAsB;IAC5E,IAAIC;IACJ,IAAI;QACFA,MAAM,IAAIP,IAAID;IAChB,EAAE,OAAM;QACN,MAAM,IAAIlB,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,aAAa,CAAC;IAC3E;IAEA,IAAIE,IAAIC,QAAQ,KAAK,YAAYD,IAAIC,QAAQ,KAAK,SAAS;QACzD,MAAM,IAAI3B,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,oBAAoB,CAAC;IAClF;IAEA,MAAMX,OAAON,cAAcmB,IAAIlB,QAAQ;IACvC,MAAMoB,kBAAkBH,iBAAiBb,eAAeC;IACxD,IAAIe,iBAAiB,OAAOF,KAAK,wDAAwD;IAEzF,IAAIA,IAAIC,QAAQ,KAAK,SAAS;QAC5B,MAAM,IAAI3B,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,uDAAuD,CAAC;IACrH;IAEA,IAAI1B,KAAKe,SAASO,iBAAiBP,OAAO;QACxC,MAAM,IAAIb,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,kCAAkC,CAAC;IAChG;IAEA,OAAOE;AACT;AAEA,SAASG,UAAUrB,QAAgB,EAAEsB,MAAc,EAAEC,SAAiB;IACpE,OAAO,IAAIC,QAAQ,CAACC,SAASC;QAC3B,IAAIC,UAAU;QACd,MAAMC,WAAWC,WAAW;YAC1B,IAAI,CAACF,SAAS;gBACZA,UAAU;gBACVD,OAAO,IAAIjC,MAAM;YACnB;QACF,GAAG8B;QACH,IAAI;YACFD,OAAOtB,UAAU;gBAAE8B,KAAK;gBAAMC,UAAU;YAAK,GAAG,CAACC,OAAOC;gBACtD,IAAIN,SAAS;gBACbA,UAAU;gBACVO,aAAaN;gBACb,IAAII,SAASC,UAAUE,MAAM,KAAK,GAAGT,OAAO,IAAIjC,MAAM;qBACjDgC,QAAQQ;YACf;QACF,EAAE,OAAM;YACN,IAAI,CAACN,SAAS;gBACZA,UAAU;gBACVO,aAAaN;gBACbF,OAAO,IAAIjC,MAAM;YACnB;QACF;IACF;AACF;AAEA;;;;;;CAMC,GACD,eAAe2C,qBAAqBlB,GAAQ,EAAEF,OAAe,EAAEC,aAAsB,EAAEK,MAAc,EAAEC,SAAiB;IACtH,MAAMlB,OAAON,cAAcmB,IAAIlB,QAAQ;IACvC,IAAIV,KAAKe,OAAO,OAAO;QAAC;YAAEQ,SAASR;YAAMgC,QAAQhC,KAAKiC,QAAQ,CAAC,OAAO,IAAI;QAAE;KAAE,EAAE,oDAAoD;IAEpI,8EAA8E;IAC9E,sEAAsE;IACtE,+BAA+B;IAC/B,MAAMC,gBAAgBtB,iBAAiBb,eAAeC;IAEtD,IAAI4B;IACJ,IAAI;QACFA,YAAY,MAAMZ,UAAUhB,MAAMiB,QAAQC;IAC5C,EAAE,OAAM;QACN,MAAM,IAAI/B,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,4BAA4B,CAAC;IAC1F;IAEA,IAAIuB,eAAe;QACjB,IAAI,CAACN,UAAUO,KAAK,CAAC,CAACC,SAAW3B,kBAAkB2B,OAAO5B,OAAO,IAAI;YACnE,MAAM,IAAIrB,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,6CAA6C,CAAC;QAC3G;IACF,OAAO,IAAIiB,UAAUS,IAAI,CAAC,CAACD,SAAW7B,iBAAiB6B,OAAO5B,OAAO,IAAI;QACvE,MAAM,IAAIrB,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,2DAA2D,CAAC;IACzH;IAEA,OAAOiB;AACT;AAEA;;;;;CAKC,GACD,SAASU,aAAaV,SAAyB;IAC7C,OAAO,CAACW,WAAWC,SAASC;QAC1B,IAAI,OAAOD,YAAY,YAAYA,QAAQf,GAAG,KAAK,MAAM;YACvDgB,SAAS,MAAMb;YACf;QACF;QACA,MAAMc,QAAQd,SAAS,CAAC,EAAE;QAC1B,IAAI,CAACc,OAAO;YACVD,SAASE,OAAOC,MAAM,CAAC,IAAIxD,MAAM,yBAAyB;gBAAEyD,MAAM;YAAY,IAA6B,IAAI;YAC/G;QACF;QACAJ,SAAS,MAAMC,MAAMlC,OAAO,EAAEkC,MAAMV,MAAM;IAC5C;AACF;AAEA,SAASc,iBAAiBC,IAAiB;IACzC,MAAMC,UAAU,IAAIC,QAAQF,KAAKC,OAAO;IACxC,MAAME,MAA8B,CAAC;IACrC,KAAK,MAAM,CAAC5D,MAAM6D,MAAM,IAAIH,QAASE,GAAG,CAAC5D,KAAK,GAAG6D;IACjD,OAAOD;AACT;AAEA,eAAeE,cAAcC,IAAyB;IACpD,IAAIA,SAASC,aAAaD,SAAS,MAAM,OAAOC;IAChD,IAAI,OAAOD,SAAS,UAAU,OAAOE,OAAOC,IAAI,CAACH;IACjD,IAAIA,gBAAgBI,iBAAiB,OAAOF,OAAOC,IAAI,CAACH,KAAKK,QAAQ;IACrE,IAAIL,gBAAgBM,MAAM,OAAOJ,OAAOC,IAAI,CAAC,MAAMH,KAAKO,WAAW;IACnE,IAAIP,gBAAgBQ,aAAa,OAAON,OAAOC,IAAI,CAACH;IACpD,IAAIQ,YAAYC,MAAM,CAACT,OAAO,OAAOE,OAAOC,IAAI,CAACH,KAAKU,MAAM,EAAEV,KAAKW,UAAU,EAAEX,KAAKY,UAAU;IAC9F,IAAI,OAAOC,mBAAmB,eAAeb,gBAAgBa,gBAAgB;QAC3E,MAAMC,SAASd,KAAKe,SAAS;QAC7B,MAAMC,SAAuB,EAAE;QAC/B,IAAI;YACF,OAAS;gBACP,MAAM,EAAEC,IAAI,EAAEnB,KAAK,EAAE,GAAG,MAAMgB,OAAOI,IAAI;gBACzC,IAAID,MAAM;gBACV,IAAInB,OAAOkB,OAAOG,IAAI,CAACrB;YACzB;QACF,SAAU;YACRgB,OAAOM,WAAW;QACpB;QACA,OAAOlB,OAAOmB,MAAM,CAACL,OAAOM,GAAG,CAAC,CAACC,QAAUrB,OAAOC,IAAI,CAACoB;IACzD;IACA,MAAM,IAAIxF,MAAM;AAClB;AAEA,SAASyF,WAAWC,MAAc,EAAEC,UAAkB,EAAE/B,OAAiC,EAAEK,IAAY;IACrG,MAAM2B,kBAAkB,IAAI/B;IAC5B,KAAK,MAAM,CAAC3D,MAAM6D,MAAM,IAAIR,OAAOsC,OAAO,CAACjC,SAAU;QACnD,IAAIG,UAAUG,WAAW;QACzB,IAAI4B,MAAMC,OAAO,CAAChC,QAAQ;YACxB,KAAK,MAAMiC,SAASjC,MAAO6B,gBAAgBK,MAAM,CAAC/F,MAAM8F;QAC1D,OAAO;YACLJ,gBAAgBK,MAAM,CAAC/F,MAAM6D;QAC/B;IACF;IACA,oEAAoE;IACpE,uCAAuC;IACvC,MAAMmC,WAAWR,WAAW,OAAOA,WAAW,OAAOA,WAAW;IAChE,OAAO,IAAIS,SAASD,WAAW,OAAOjC,MAAM;QAAEyB;QAAQC;QAAY/B,SAASgC;IAAgB;AAC7F;AAEA,eAAeQ,YAAY3E,GAAQ,EAAEkC,IAAiB,EAAEpC,OAAe,EAAEiB,SAAyB,EAAEV,SAAiB;QASnE6B;IARhD,IAAIM;IACJ,IAAI;QACFA,OAAO,MAAMD,cAAcL,KAAKM,IAAI;IACtC,EAAE,OAAM;QACN,MAAM,IAAIlE,oBAAoB,CAAC,gBAAgB,EAAEwB,SAAS;IAC5D;IAEA,MAAM8E,YAAY5E,IAAIC,QAAQ,KAAK,WAAW9B,QAAQD;IACtD,MAAMyD,UAA+B;QAAEkD,QAAQ,EAAC3C,eAAAA,KAAK2C,MAAM,cAAX3C,0BAAAA,eAAe,OAAO4C,WAAW;QAAI3C,SAASF,iBAAiBC;QAAO6C,OAAO;QAAO3E,QAAQqB,aAAaV;IAAW;IAEpK,OAAO,IAAIT,QAAkB,CAACC,SAASC;QACrC,IAAIC,UAAU;QACd,IAAIuE;QACJ,IAAIC;QACJ,MAAMC,OAAO,CAAC1G;YACZ,IAAI,CAACiC,SAAS;gBACZA,UAAU;gBACVO,aAAaN;gBACbF,OAAO,IAAIlC,oBAAoBE;YACjC;QACF;QACA,MAAMkC,WAAWC,WAAW;YAC1BsE,gBAAAA,0BAAAA,IAAKE,OAAO;YACZH,gBAAAA,0BAAAA,IAAKG,OAAO;YACZD,KAAK,CAAC,gBAAgB,EAAEpF,SAAS;QACnC,GAAGO;QAEH,IAAI;YACF2E,MAAMJ,UAAUQ,OAAO,CAACpF,KAAK2B,SAAS,CAAC0D;oBAGlBA;gBAFnBJ,MAAMI;gBACN,MAAMpB,SAASoB,SAASC,UAAU;gBAClC,MAAMpB,cAAamB,0BAAAA,SAASE,aAAa,cAAtBF,qCAAAA,0BAA0B;gBAC7C,IAAIpB,WAAWxB,aAAawB,SAAS,OAAOA,SAAS,KAAK;oBACxDoB,SAASF,OAAO;oBAChBD,KAAK,CAAC,gBAAgB,EAAEpF,SAAS;oBACjC;gBACF;gBACA,MAAM0D,SAAmB,EAAE;gBAC3B,IAAIgC,QAAQ;gBACZH,SAASI,EAAE,CAAC,QAAQ,CAAC1B;oBACnByB,SAASzB,MAAM9C,MAAM;oBACrB,IAAIuE,QAAQ5G,gBAAgB;wBAC1ByG,SAASF,OAAO;wBAChBD,KAAK,CAAC,iBAAiB,EAAEpF,QAAQ,oBAAoB,CAAC;wBACtD;oBACF;oBACA0D,OAAOG,IAAI,CAACI;gBACd;gBACAsB,SAASK,IAAI,CAAC,SAAS,IAAMR,KAAK,CAAC,gBAAgB,EAAEpF,SAAS;gBAC9DuF,SAASK,IAAI,CAAC,OAAO;oBACnB,IAAIjF,SAAS;oBACbA,UAAU;oBACVO,aAAaN;oBACbH,QAAQyD,WAAWC,QAAQC,YAAYmB,SAASlD,OAAO,EAAEO,OAAOmB,MAAM,CAACL;gBACzE;YACF;QACF,EAAE,OAAM;YACN0B,KAAK,CAAC,gBAAgB,EAAEpF,SAAS;YACjC;QACF;QAEAkF,IAAIU,IAAI,CAAC,SAAS,IAAMR,KAAK,CAAC,gBAAgB,EAAEpF,SAAS;QACzDkF,IAAIW,GAAG,CAACnD;IACV;AACF;AAEA,eAAeoD,UAAU5F,GAAQ,EAAEkC,IAAiB,EAAEpC,OAAe,EAAEC,aAAsB,EAAEM,SAAiB,EAAED,MAAc;IAC9H,MAAMW,YAAY,MAAMG,qBAAqBlB,KAAKF,SAASC,eAAeK,QAAQC;IAClF,OAAOsE,YAAY3E,KAAKkC,MAAMpC,SAASiB,WAAWV;AACpD;AAoBA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAewF,eAAerG,MAAc,EAAE0C,OAAoB,CAAC,CAAC,EAAEpC,UAAU,eAAe,EAAE6B,UAAiC,CAAC,CAAC;IACzI,MAAM,EAAE5B,gBAAgB,KAAK,EAAEM,YAAY3B,kBAAkB,EAAE0B,SAASnC,IAAImC,MAAM,AAAqB,EAAE,GAAGuB;IAE5G,IAAI3B,MAAMH,cAAcL,QAAQM,SAASC;IACzC,IAAIsF,WAAW,MAAMO,UAAU5F,KAAKkC,MAAMpC,SAASC,eAAeM,WAAWD;IAE7E,IAAI0F,gBAAgBnH;IACpB,MAAO0G,SAASpB,MAAM,IAAI,OAAOoB,SAASpB,MAAM,GAAG,IAAK;QACtD,MAAM8B,WAAWV,SAASlD,OAAO,CAAC6D,GAAG,CAAC;QACtC,IAAI,CAACD,UAAU;QACf,IAAID,iBAAiB,GAAG;YACtB,MAAM,IAAIxH,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,oBAAoB,CAAC;QAClF;QACAgG,iBAAiB;QAEjB,IAAIG;QACJ,IAAI;YACFA,UAAU,IAAIxG,IAAIsG,UAAU/F;QAC9B,EAAE,OAAM;YACN,MAAM,IAAI1B,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,yBAAyB,CAAC;QACvF;QACAE,MAAMH,cAAcoG,QAAQpD,QAAQ,IAAI/C,SAASC;QACjDsF,WAAW,MAAMO,UAAU5F,KAAKkC,MAAMpC,SAASC,eAAeM,WAAWD;IAC3E;IAEA,OAAOiF;AACT;AAEA;;;CAGC,GACD,OAAO,eAAea,kBAAqBb,QAAkB,EAAEvF,OAAe;IAC5E,MAAMqG,OAAO,MAAMC,YAAYf,UAAUvF,SAASlB;IAClD,IAAI;QACF,OAAOyH,KAAKC,KAAK,CAACH;IACpB,EAAE,OAAM;QACN,MAAM,IAAI7H,oBAAoB,CAAC,kBAAkB,EAAEwB,QAAQ,cAAc,CAAC;IAC5E;AACF;AAEA,eAAesG,YAAYf,QAAkB,EAAEvF,OAAe,EAAEyG,QAAgB;QAM/DlB;IALf,MAAMmB,gBAAgBnB,SAASlD,OAAO,CAAC6D,GAAG,CAAC;IAC3C,IAAIQ,iBAAiBC,OAAOD,iBAAiBD,UAAU;QACrD,MAAM,IAAIjI,oBAAoB,CAAC,iBAAiB,EAAEwB,QAAQ,oBAAoB,CAAC;IACjF;IAEA,MAAMwD,UAAS+B,iBAAAA,SAAS7C,IAAI,cAAb6C,qCAAAA,eAAe9B,SAAS;IACvC,IAAI,CAACD,QAAQ;QACX,MAAM6C,OAAO,MAAMd,SAASc,IAAI;QAChC,IAAIzD,OAAOU,UAAU,CAAC+C,MAAM,UAAUI,UAAU;YAC9C,MAAM,IAAIjI,oBAAoB,CAAC,iBAAiB,EAAEwB,QAAQ,oBAAoB,CAAC;QACjF;QACA,OAAOqG;IACT;IAEA,MAAM3C,SAAuB,EAAE;IAC/B,IAAIgC,QAAQ;IACZ,IAAI;QACF,OAAS;YACP,MAAM,EAAE/B,IAAI,EAAEnB,KAAK,EAAE,GAAG,MAAMgB,OAAOI,IAAI;YACzC,IAAID,MAAM;YACV,IAAI,CAACnB,OAAO;YACZkD,SAASlD,MAAMc,UAAU;YACzB,IAAIoC,QAAQe,UAAU;gBACpB,MAAM,IAAIjI,oBAAoB,CAAC,iBAAiB,EAAEwB,QAAQ,oBAAoB,CAAC;YACjF;YACA0D,OAAOG,IAAI,CAACrB;QACd;IACF,SAAU;QACRgB,OAAOM,WAAW;IACpB;IAEA,OAAOlB,OAAOmB,MAAM,CAACL,OAAOM,GAAG,CAAC,CAACC,QAAUrB,OAAOC,IAAI,CAACoB,SAASlB,QAAQ,CAAC;AAC3E"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/discovery-fetch.ts"],"sourcesContent":["/**\n * Hardened fetch for OAuth discovery URLs, which the remote MCP server\n * controls (SSRF mitigation). See ARCHITECTURE.md's \"SSRF mitigation\" section for the threat model.\n */\nimport dns from 'node:dns';\nimport http from 'node:http';\nimport https from 'node:https';\nimport { isIP, type LookupFunction } from 'node:net';\nimport ipaddr from 'ipaddr.js';\n\nexport class DiscoveryFetchError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'DiscoveryFetchError';\n  }\n}\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst MAX_REDIRECTS = 5;\nconst MAX_BODY_BYTES = 1_000_000; // 1 MB - discovery documents are small JSON\n\n/** Preserve cancellation while discovery falls back across endpoints. */\nexport function throwIfAborted(signal?: AbortSignal | null): void {\n  signal?.throwIfAborted();\n}\n\ntype LookupRecord = { address: string; family: number };\n/** DNS implementation, injectable for deterministic tests. Same contract as `dns.lookup` with `{ all: true, verbatim: true }`. */\ntype Lookup = (hostname: string, options: { all: true; verbatim: true }, callback: (error: NodeJS.ErrnoException | null, addresses: LookupRecord[]) => void) => void;\n\nfunction stripBrackets(hostname: string): string {\n  return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n}\n\n/** True for the literal hostname `localhost` or an IP literal in the loopback range. */\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = stripBrackets(hostname).toLowerCase();\n  if (host === 'localhost') return true;\n  if (isIP(host)) {\n    try {\n      return ipaddr.process(host).range() === 'loopback';\n    } catch {\n      return false;\n    }\n  }\n  return false;\n}\n\n/**\n * True if `rawUrl`'s host is loopback, used to decide `allowLoopback` grants\n * from the URL the caller configured, not remote-supplied data. Fails closed on an unparseable URL.\n */\nexport function isLoopbackUrl(rawUrl: string): boolean {\n  try {\n    return isLoopbackHost(new URL(rawUrl).hostname);\n  } catch {\n    return false;\n  }\n}\n\n/** True when the address is anything other than ordinary public unicast space. */\nfunction isBlockedAddress(address: string): boolean {\n  try {\n    // ipaddr.process() normalizes IPv4-mapped IPv6 (::ffff:a.b.c.d) to IPv4 first.\n    return ipaddr.process(address).range() !== 'unicast';\n  } catch {\n    return true; // unparseable - fail closed\n  }\n}\n\nfunction isLoopbackAddress(address: string): boolean {\n  try {\n    return ipaddr.process(address).range() === 'loopback';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Validates scheme and, for literal-IP hosts, address range. `allowLoopback`\n * reflects trust in the calling server, never in `rawUrl` itself.\n */\nfunction assertSafeUrl(rawUrl: string, context: string, allowLoopback: boolean): URL {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: invalid URL`);\n  }\n\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: unsupported scheme`);\n  }\n\n  const host = stripBrackets(url.hostname);\n  const trustedLoopback = allowLoopback && isLoopbackHost(host);\n  if (trustedLoopback) return url; // this call's own grant covers it, regardless of scheme\n\n  if (url.protocol === 'http:') {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: http:// is only allowed for a trusted loopback origin`);\n  }\n\n  if (isIP(host) && isBlockedAddress(host)) {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: address is not publicly routable`);\n  }\n\n  return url;\n}\n\nfunction lookupAll(hostname: string, lookup: Lookup, timeoutMs: number, signal?: AbortSignal | null): Promise<LookupRecord[]> {\n  return new Promise((resolve, reject) => {\n    let settled = false;\n    const finish = (complete: () => void): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(deadline);\n      signal?.removeEventListener('abort', onAbort);\n      complete();\n    };\n    const onAbort = (): void => finish(() => reject(signal?.reason));\n    const deadline = setTimeout(() => {\n      finish(() => reject(new Error('DNS resolution timed out')));\n    }, timeoutMs);\n    signal?.addEventListener('abort', onAbort, { once: true });\n    if (signal?.aborted) {\n      onAbort();\n      return;\n    }\n    try {\n      lookup(hostname, { all: true, verbatim: true }, (error, addresses) => {\n        finish(() => {\n          if (error || addresses.length === 0) reject(new Error('DNS resolution failed'));\n          else resolve(addresses);\n        });\n      });\n    } catch {\n      finish(() => reject(new Error('DNS resolution failed')));\n    }\n  });\n}\n\n/**\n * Resolves the hostname once, rejects it unless every returned address is\n * acceptable, and returns the validated set. The set is pinned into the\n * request itself (see `requestOnce`), which is what closes the DNS-rebinding\n * TOCTOU: the transport can only dial addresses that were already validated,\n * and it never resolves the hostname a second time.\n */\nasync function resolveSafeAddresses(url: URL, context: string, allowLoopback: boolean, lookup: Lookup, timeoutMs: number, signal?: AbortSignal | null): Promise<LookupRecord[]> {\n  throwIfAborted(signal);\n  const host = stripBrackets(url.hostname);\n  if (isIP(host)) return [{ address: host, family: host.includes(':') ? 6 : 4 }]; // literal IP already fully checked in assertSafeUrl\n\n  // Literal `localhost` under a trusted-loopback grant: still resolved, and the\n  // answers must be loopback - the grant covers loopback, not \"wherever\n  // localhost happens to point\".\n  const loopbackGrant = allowLoopback && isLoopbackHost(host);\n\n  let addresses: LookupRecord[];\n  try {\n    addresses = await lookupAll(host, lookup, timeoutMs, signal);\n  } catch (_error) {\n    throwIfAborted(signal);\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: host could not be resolved`);\n  }\n\n  if (loopbackGrant) {\n    if (!addresses.every((record) => isLoopbackAddress(record.address))) {\n      throw new DiscoveryFetchError(`Refusing to fetch ${context}: host does not resolve to a loopback address`);\n    }\n  } else if (addresses.some((record) => isBlockedAddress(record.address))) {\n    throw new DiscoveryFetchError(`Refusing to fetch ${context}: host resolves to an address that is not publicly routable`);\n  }\n\n  return addresses;\n}\n\n/**\n * A `net` lookup that can only ever answer with `addresses` - the set already\n * validated for this URL. The request is built against the original URL (so\n * SNI and certificate verification still see the hostname), but the\n * connection can only land on a validated address.\n */\nfunction pinnedLookup(addresses: LookupRecord[]): LookupFunction {\n  return (_hostname, options, callback) => {\n    if (typeof options === 'object' && options.all === true) {\n      callback(null, addresses);\n      return;\n    }\n    const first = addresses[0];\n    if (!first) {\n      callback(Object.assign(new Error('no validated address'), { code: 'ENOTFOUND' }) as NodeJS.ErrnoException, '', 0);\n      return;\n    }\n    callback(null, first.address, first.family);\n  };\n}\n\nfunction toRequestHeaders(init: RequestInit): Record<string, string> {\n  const headers = new Headers(init.headers);\n  const out: Record<string, string> = {};\n  for (const [name, value] of headers) out[name] = value;\n  return out;\n}\n\nasync function toRequestBody(body: RequestInit['body']): Promise<Buffer | undefined> {\n  if (body === undefined || body === null) return undefined;\n  if (typeof body === 'string') return Buffer.from(body);\n  if (body instanceof URLSearchParams) return Buffer.from(body.toString());\n  if (body instanceof Blob) return Buffer.from(await body.arrayBuffer());\n  if (body instanceof ArrayBuffer) return Buffer.from(body);\n  if (ArrayBuffer.isView(body)) return Buffer.from(body.buffer, body.byteOffset, body.byteLength);\n  if (typeof ReadableStream !== 'undefined' && body instanceof ReadableStream) {\n    const reader = body.getReader();\n    const chunks: Uint8Array[] = [];\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        if (value) chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock();\n    }\n    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)));\n  }\n  throw new Error('unsupported request body');\n}\n\nfunction toResponse(status: number, statusText: string, headers: http.IncomingHttpHeaders, body: Buffer): Response {\n  const responseHeaders = new Headers();\n  for (const [name, value] of Object.entries(headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) {\n      for (const entry of value) responseHeaders.append(name, entry);\n    } else {\n      responseHeaders.append(name, value);\n    }\n  }\n  // The fetch spec gives these statuses a null body, and the Response\n  // constructor rejects a body for them.\n  const nullBody = status === 204 || status === 205 || status === 304;\n  return new Response(nullBody ? null : body, { status, statusText, headers: responseHeaders });\n}\n\nasync function requestOnce(url: URL, init: RequestInit, context: string, addresses: LookupRecord[], timeoutMs: number): Promise<Response> {\n  throwIfAborted(init.signal);\n  let body: Buffer | undefined;\n  try {\n    body = await toRequestBody(init.body);\n  } catch {\n    throw new DiscoveryFetchError(`Failed to fetch ${context}`);\n  }\n\n  const transport = url.protocol === 'https:' ? https : http;\n  const options: http.RequestOptions = { method: (init.method ?? 'GET').toUpperCase(), headers: toRequestHeaders(init), agent: false, lookup: pinnedLookup(addresses), signal: init.signal ?? undefined };\n\n  return new Promise<Response>((resolve, reject) => {\n    let settled = false;\n    let req: http.ClientRequest | undefined;\n    let res: http.IncomingMessage | undefined;\n    const signal = init.signal ?? undefined;\n    const cleanup = (): void => {\n      clearTimeout(deadline);\n      signal?.removeEventListener('abort', onAbort);\n    };\n    const fail = (message: string): void => {\n      if (!settled) {\n        settled = true;\n        cleanup();\n        reject(new DiscoveryFetchError(message));\n      }\n    };\n    const failWith = (error: unknown): void => {\n      if (!settled) {\n        settled = true;\n        cleanup();\n        reject(error);\n      }\n    };\n    const deadline = setTimeout(() => {\n      res?.destroy();\n      req?.destroy();\n      fail(`Failed to fetch ${context}`);\n    }, timeoutMs);\n    const onAbort = (): void => {\n      res?.destroy();\n      req?.destroy();\n      failWith(signal?.reason);\n    };\n    signal?.addEventListener('abort', onAbort, { once: true });\n    if (signal?.aborted) {\n      onAbort();\n      return;\n    }\n\n    try {\n      req = transport.request(url, options, (response) => {\n        res = response;\n        const status = response.statusCode;\n        const statusText = response.statusMessage ?? '';\n        if (status === undefined || status < 200 || status > 599) {\n          response.destroy();\n          fail(`Failed to fetch ${context}`);\n          return;\n        }\n        const chunks: Buffer[] = [];\n        let total = 0;\n        response.on('data', (chunk: Buffer) => {\n          total += chunk.length;\n          if (total > MAX_BODY_BYTES) {\n            response.destroy();\n            fail(`Refusing to read ${context}: response too large`);\n            return;\n          }\n          chunks.push(chunk);\n        });\n        response.once('error', () => fail(`Failed to fetch ${context}`));\n        response.once('end', () => {\n          if (settled) return;\n          settled = true;\n          cleanup();\n          resolve(toResponse(status, statusText, response.headers, Buffer.concat(chunks)));\n        });\n      });\n    } catch {\n      fail(`Failed to fetch ${context}`);\n      return;\n    }\n\n    req.once('error', () => fail(`Failed to fetch ${context}`));\n    req.end(body);\n  });\n}\n\nasync function fetchOnce(url: URL, init: RequestInit, context: string, allowLoopback: boolean, timeoutMs: number, lookup: Lookup): Promise<Response> {\n  throwIfAborted(init.signal);\n  const addresses = await resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs, init.signal);\n  return requestOnce(url, init, context, addresses, timeoutMs);\n}\n\nexport interface DiscoveryFetchOptions {\n  /**\n   * Loopback trust grant for this fetch, computed from the server the caller\n   * is actually talking to - never from the URL being fetched. Defaults to `false`.\n   */\n  allowLoopback?: boolean;\n  /**\n   * Per-hop timeout in ms, applied to both the DNS resolution and the request.\n   * Defaults to `DEFAULT_TIMEOUT_MS`; overridable so tests can bound slow-failure cases.\n   */\n  timeoutMs?: number;\n  /**\n   * DNS implementation used for the pre-request resolution, injectable for\n   * deterministic tests. Defaults to `dns.lookup`.\n   */\n  lookup?: Lookup;\n}\n\n/**\n * Fetches an OAuth-discovery URL with SSRF mitigations applied to the\n * initial URL and every redirect hop; redirects are validated, not auto-followed.\n *\n * The hostname is resolved once, every returned address is validated, and the\n * validated set is pinned into the request through a custom `lookup`, so the\n * request cannot resolve the hostname a second time and cannot be steered to\n * a different address by a DNS-rebinding answer.\n *\n * @param rawUrl - URL to fetch; may be remote-server-supplied (the threat this guards against).\n * @param init - Standard fetch options; `redirect` is always forced to `'manual'`.\n * @param context - Short label used only in error messages, never echoing the URL.\n * @param options - See `DiscoveryFetchOptions`.\n */\nexport async function discoveryFetch(rawUrl: string, init: RequestInit = {}, context = 'discovery URL', options: DiscoveryFetchOptions = {}): Promise<Response> {\n  throwIfAborted(init.signal);\n  const { allowLoopback = false, timeoutMs = DEFAULT_TIMEOUT_MS, lookup = dns.lookup as unknown as Lookup } = options;\n\n  let url = assertSafeUrl(rawUrl, context, allowLoopback);\n  let response = await fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup);\n\n  let redirectsLeft = MAX_REDIRECTS;\n  while (response.status >= 300 && response.status < 400) {\n    const location = response.headers.get('location');\n    if (!location) break;\n    if (redirectsLeft <= 0) {\n      throw new DiscoveryFetchError(`Refusing to fetch ${context}: too many redirects`);\n    }\n    redirectsLeft -= 1;\n\n    let nextUrl: URL;\n    try {\n      nextUrl = new URL(location, url);\n    } catch {\n      throw new DiscoveryFetchError(`Refusing to fetch ${context}: invalid redirect target`);\n    }\n    url = assertSafeUrl(nextUrl.toString(), context, allowLoopback);\n    response = await fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup);\n  }\n\n  return response;\n}\n\n/**\n * Parse a `discoveryFetch` response body as JSON, enforcing `MAX_BODY_BYTES`\n * while reading (not after buffering the whole thing).\n */\nexport async function readDiscoveryJson<T>(response: Response, context: string): Promise<T> {\n  const text = await readLimited(response, context, MAX_BODY_BYTES);\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new DiscoveryFetchError(`Refusing to parse ${context}: invalid JSON`);\n  }\n}\n\nasync function readLimited(response: Response, context: string, maxBytes: number): Promise<string> {\n  const contentLength = response.headers.get('content-length');\n  if (contentLength && Number(contentLength) > maxBytes) {\n    throw new DiscoveryFetchError(`Refusing to read ${context}: response too large`);\n  }\n\n  const reader = response.body?.getReader();\n  if (!reader) {\n    const text = await response.text();\n    if (Buffer.byteLength(text, 'utf8') > maxBytes) {\n      throw new DiscoveryFetchError(`Refusing to read ${context}: response too large`);\n    }\n    return text;\n  }\n\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  try {\n    for (;;) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!value) continue;\n      total += value.byteLength;\n      if (total > maxBytes) {\n        throw new DiscoveryFetchError(`Refusing to read ${context}: response too large`);\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n\n  return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString('utf8');\n}\n"],"names":["dns","http","https","isIP","ipaddr","DiscoveryFetchError","Error","message","name","DEFAULT_TIMEOUT_MS","MAX_REDIRECTS","MAX_BODY_BYTES","throwIfAborted","signal","stripBrackets","hostname","startsWith","endsWith","slice","isLoopbackHost","host","toLowerCase","process","range","isLoopbackUrl","rawUrl","URL","isBlockedAddress","address","isLoopbackAddress","assertSafeUrl","context","allowLoopback","url","protocol","trustedLoopback","lookupAll","lookup","timeoutMs","Promise","resolve","reject","settled","finish","complete","clearTimeout","deadline","removeEventListener","onAbort","reason","setTimeout","addEventListener","once","aborted","all","verbatim","error","addresses","length","resolveSafeAddresses","family","includes","loopbackGrant","_error","every","record","some","pinnedLookup","_hostname","options","callback","first","Object","assign","code","toRequestHeaders","init","headers","Headers","out","value","toRequestBody","body","undefined","Buffer","from","URLSearchParams","toString","Blob","arrayBuffer","ArrayBuffer","isView","buffer","byteOffset","byteLength","ReadableStream","reader","getReader","chunks","done","read","push","releaseLock","concat","map","chunk","toResponse","status","statusText","responseHeaders","entries","Array","isArray","entry","append","nullBody","Response","requestOnce","transport","method","toUpperCase","agent","req","res","cleanup","fail","failWith","destroy","request","response","statusCode","statusMessage","total","on","end","fetchOnce","discoveryFetch","redirectsLeft","location","get","nextUrl","readDiscoveryJson","text","readLimited","JSON","parse","maxBytes","contentLength","Number"],"mappings":"AAAA;;;CAGC,GACD,OAAOA,SAAS,WAAW;AAC3B,OAAOC,UAAU,YAAY;AAC7B,OAAOC,WAAW,aAAa;AAC/B,SAASC,IAAI,QAA6B,WAAW;AACrD,OAAOC,YAAY,YAAY;AAE/B,OAAO,MAAMC,4BAA4BC;IACvC,YAAYC,OAAe,CAAE;QAC3B,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,MAAMC,qBAAqB;AAC3B,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB,SAAW,4CAA4C;AAE9E,uEAAuE,GACvE,OAAO,SAASC,eAAeC,MAA2B;IACxDA,mBAAAA,6BAAAA,OAAQD,cAAc;AACxB;AAMA,SAASE,cAAcC,QAAgB;IACrC,OAAOA,SAASC,UAAU,CAAC,QAAQD,SAASE,QAAQ,CAAC,OAAOF,SAASG,KAAK,CAAC,GAAG,CAAC,KAAKH;AACtF;AAEA,sFAAsF,GACtF,SAASI,eAAeJ,QAAgB;IACtC,MAAMK,OAAON,cAAcC,UAAUM,WAAW;IAChD,IAAID,SAAS,aAAa,OAAO;IACjC,IAAIjB,KAAKiB,OAAO;QACd,IAAI;YACF,OAAOhB,OAAOkB,OAAO,CAACF,MAAMG,KAAK,OAAO;QAC1C,EAAE,OAAM;YACN,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA;;;CAGC,GACD,OAAO,SAASC,cAAcC,MAAc;IAC1C,IAAI;QACF,OAAON,eAAe,IAAIO,IAAID,QAAQV,QAAQ;IAChD,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,gFAAgF,GAChF,SAASY,iBAAiBC,OAAe;IACvC,IAAI;QACF,+EAA+E;QAC/E,OAAOxB,OAAOkB,OAAO,CAACM,SAASL,KAAK,OAAO;IAC7C,EAAE,OAAM;QACN,OAAO,MAAM,4BAA4B;IAC3C;AACF;AAEA,SAASM,kBAAkBD,OAAe;IACxC,IAAI;QACF,OAAOxB,OAAOkB,OAAO,CAACM,SAASL,KAAK,OAAO;IAC7C,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;CAGC,GACD,SAASO,cAAcL,MAAc,EAAEM,OAAe,EAAEC,aAAsB;IAC5E,IAAIC;IACJ,IAAI;QACFA,MAAM,IAAIP,IAAID;IAChB,EAAE,OAAM;QACN,MAAM,IAAIpB,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,aAAa,CAAC;IAC3E;IAEA,IAAIE,IAAIC,QAAQ,KAAK,YAAYD,IAAIC,QAAQ,KAAK,SAAS;QACzD,MAAM,IAAI7B,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,oBAAoB,CAAC;IAClF;IAEA,MAAMX,OAAON,cAAcmB,IAAIlB,QAAQ;IACvC,MAAMoB,kBAAkBH,iBAAiBb,eAAeC;IACxD,IAAIe,iBAAiB,OAAOF,KAAK,wDAAwD;IAEzF,IAAIA,IAAIC,QAAQ,KAAK,SAAS;QAC5B,MAAM,IAAI7B,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,uDAAuD,CAAC;IACrH;IAEA,IAAI5B,KAAKiB,SAASO,iBAAiBP,OAAO;QACxC,MAAM,IAAIf,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,kCAAkC,CAAC;IAChG;IAEA,OAAOE;AACT;AAEA,SAASG,UAAUrB,QAAgB,EAAEsB,MAAc,EAAEC,SAAiB,EAAEzB,MAA2B;IACjG,OAAO,IAAI0B,QAAQ,CAACC,SAASC;QAC3B,IAAIC,UAAU;QACd,MAAMC,SAAS,CAACC;YACd,IAAIF,SAAS;YACbA,UAAU;YACVG,aAAaC;YACbjC,mBAAAA,6BAAAA,OAAQkC,mBAAmB,CAAC,SAASC;YACrCJ;QACF;QACA,MAAMI,UAAU,IAAYL,OAAO,IAAMF,OAAO5B,mBAAAA,6BAAAA,OAAQoC,MAAM;QAC9D,MAAMH,WAAWI,WAAW;YAC1BP,OAAO,IAAMF,OAAO,IAAInC,MAAM;QAChC,GAAGgC;QACHzB,mBAAAA,6BAAAA,OAAQsC,gBAAgB,CAAC,SAASH,SAAS;YAAEI,MAAM;QAAK;QACxD,IAAIvC,mBAAAA,6BAAAA,OAAQwC,OAAO,EAAE;YACnBL;YACA;QACF;QACA,IAAI;YACFX,OAAOtB,UAAU;gBAAEuC,KAAK;gBAAMC,UAAU;YAAK,GAAG,CAACC,OAAOC;gBACtDd,OAAO;oBACL,IAAIa,SAASC,UAAUC,MAAM,KAAK,GAAGjB,OAAO,IAAInC,MAAM;yBACjDkC,QAAQiB;gBACf;YACF;QACF,EAAE,OAAM;YACNd,OAAO,IAAMF,OAAO,IAAInC,MAAM;QAChC;IACF;AACF;AAEA;;;;;;CAMC,GACD,eAAeqD,qBAAqB1B,GAAQ,EAAEF,OAAe,EAAEC,aAAsB,EAAEK,MAAc,EAAEC,SAAiB,EAAEzB,MAA2B;IACnJD,eAAeC;IACf,MAAMO,OAAON,cAAcmB,IAAIlB,QAAQ;IACvC,IAAIZ,KAAKiB,OAAO,OAAO;QAAC;YAAEQ,SAASR;YAAMwC,QAAQxC,KAAKyC,QAAQ,CAAC,OAAO,IAAI;QAAE;KAAE,EAAE,oDAAoD;IAEpI,8EAA8E;IAC9E,sEAAsE;IACtE,+BAA+B;IAC/B,MAAMC,gBAAgB9B,iBAAiBb,eAAeC;IAEtD,IAAIqC;IACJ,IAAI;QACFA,YAAY,MAAMrB,UAAUhB,MAAMiB,QAAQC,WAAWzB;IACvD,EAAE,OAAOkD,QAAQ;QACfnD,eAAeC;QACf,MAAM,IAAIR,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,4BAA4B,CAAC;IAC1F;IAEA,IAAI+B,eAAe;QACjB,IAAI,CAACL,UAAUO,KAAK,CAAC,CAACC,SAAWpC,kBAAkBoC,OAAOrC,OAAO,IAAI;YACnE,MAAM,IAAIvB,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,6CAA6C,CAAC;QAC3G;IACF,OAAO,IAAI0B,UAAUS,IAAI,CAAC,CAACD,SAAWtC,iBAAiBsC,OAAOrC,OAAO,IAAI;QACvE,MAAM,IAAIvB,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,2DAA2D,CAAC;IACzH;IAEA,OAAO0B;AACT;AAEA;;;;;CAKC,GACD,SAASU,aAAaV,SAAyB;IAC7C,OAAO,CAACW,WAAWC,SAASC;QAC1B,IAAI,OAAOD,YAAY,YAAYA,QAAQf,GAAG,KAAK,MAAM;YACvDgB,SAAS,MAAMb;YACf;QACF;QACA,MAAMc,QAAQd,SAAS,CAAC,EAAE;QAC1B,IAAI,CAACc,OAAO;YACVD,SAASE,OAAOC,MAAM,CAAC,IAAInE,MAAM,yBAAyB;gBAAEoE,MAAM;YAAY,IAA6B,IAAI;YAC/G;QACF;QACAJ,SAAS,MAAMC,MAAM3C,OAAO,EAAE2C,MAAMX,MAAM;IAC5C;AACF;AAEA,SAASe,iBAAiBC,IAAiB;IACzC,MAAMC,UAAU,IAAIC,QAAQF,KAAKC,OAAO;IACxC,MAAME,MAA8B,CAAC;IACrC,KAAK,MAAM,CAACvE,MAAMwE,MAAM,IAAIH,QAASE,GAAG,CAACvE,KAAK,GAAGwE;IACjD,OAAOD;AACT;AAEA,eAAeE,cAAcC,IAAyB;IACpD,IAAIA,SAASC,aAAaD,SAAS,MAAM,OAAOC;IAChD,IAAI,OAAOD,SAAS,UAAU,OAAOE,OAAOC,IAAI,CAACH;IACjD,IAAIA,gBAAgBI,iBAAiB,OAAOF,OAAOC,IAAI,CAACH,KAAKK,QAAQ;IACrE,IAAIL,gBAAgBM,MAAM,OAAOJ,OAAOC,IAAI,CAAC,MAAMH,KAAKO,WAAW;IACnE,IAAIP,gBAAgBQ,aAAa,OAAON,OAAOC,IAAI,CAACH;IACpD,IAAIQ,YAAYC,MAAM,CAACT,OAAO,OAAOE,OAAOC,IAAI,CAACH,KAAKU,MAAM,EAAEV,KAAKW,UAAU,EAAEX,KAAKY,UAAU;IAC9F,IAAI,OAAOC,mBAAmB,eAAeb,gBAAgBa,gBAAgB;QAC3E,MAAMC,SAASd,KAAKe,SAAS;QAC7B,MAAMC,SAAuB,EAAE;QAC/B,IAAI;YACF,OAAS;gBACP,MAAM,EAAEC,IAAI,EAAEnB,KAAK,EAAE,GAAG,MAAMgB,OAAOI,IAAI;gBACzC,IAAID,MAAM;gBACV,IAAInB,OAAOkB,OAAOG,IAAI,CAACrB;YACzB;QACF,SAAU;YACRgB,OAAOM,WAAW;QACpB;QACA,OAAOlB,OAAOmB,MAAM,CAACL,OAAOM,GAAG,CAAC,CAACC,QAAUrB,OAAOC,IAAI,CAACoB;IACzD;IACA,MAAM,IAAInG,MAAM;AAClB;AAEA,SAASoG,WAAWC,MAAc,EAAEC,UAAkB,EAAE/B,OAAiC,EAAEK,IAAY;IACrG,MAAM2B,kBAAkB,IAAI/B;IAC5B,KAAK,MAAM,CAACtE,MAAMwE,MAAM,IAAIR,OAAOsC,OAAO,CAACjC,SAAU;QACnD,IAAIG,UAAUG,WAAW;QACzB,IAAI4B,MAAMC,OAAO,CAAChC,QAAQ;YACxB,KAAK,MAAMiC,SAASjC,MAAO6B,gBAAgBK,MAAM,CAAC1G,MAAMyG;QAC1D,OAAO;YACLJ,gBAAgBK,MAAM,CAAC1G,MAAMwE;QAC/B;IACF;IACA,oEAAoE;IACpE,uCAAuC;IACvC,MAAMmC,WAAWR,WAAW,OAAOA,WAAW,OAAOA,WAAW;IAChE,OAAO,IAAIS,SAASD,WAAW,OAAOjC,MAAM;QAAEyB;QAAQC;QAAY/B,SAASgC;IAAgB;AAC7F;AAEA,eAAeQ,YAAYpF,GAAQ,EAAE2C,IAAiB,EAAE7C,OAAe,EAAE0B,SAAyB,EAAEnB,SAAiB;QAUnEsC,cAA6HA;IAT7KhE,eAAegE,KAAK/D,MAAM;IAC1B,IAAIqE;IACJ,IAAI;QACFA,OAAO,MAAMD,cAAcL,KAAKM,IAAI;IACtC,EAAE,OAAM;QACN,MAAM,IAAI7E,oBAAoB,CAAC,gBAAgB,EAAE0B,SAAS;IAC5D;IAEA,MAAMuF,YAAYrF,IAAIC,QAAQ,KAAK,WAAWhC,QAAQD;IACtD,MAAMoE,UAA+B;QAAEkD,QAAQ,EAAC3C,eAAAA,KAAK2C,MAAM,cAAX3C,0BAAAA,eAAe,OAAO4C,WAAW;QAAI3C,SAASF,iBAAiBC;QAAO6C,OAAO;QAAOpF,QAAQ8B,aAAaV;QAAY5C,MAAM,GAAE+D,eAAAA,KAAK/D,MAAM,cAAX+D,0BAAAA,eAAeO;IAAU;IAEtM,OAAO,IAAI5C,QAAkB,CAACC,SAASC;YAItBmC;QAHf,IAAIlC,UAAU;QACd,IAAIgF;QACJ,IAAIC;QACJ,MAAM9G,UAAS+D,eAAAA,KAAK/D,MAAM,cAAX+D,0BAAAA,eAAeO;QAC9B,MAAMyC,UAAU;YACd/E,aAAaC;YACbjC,mBAAAA,6BAAAA,OAAQkC,mBAAmB,CAAC,SAASC;QACvC;QACA,MAAM6E,OAAO,CAACtH;YACZ,IAAI,CAACmC,SAAS;gBACZA,UAAU;gBACVkF;gBACAnF,OAAO,IAAIpC,oBAAoBE;YACjC;QACF;QACA,MAAMuH,WAAW,CAACtE;YAChB,IAAI,CAACd,SAAS;gBACZA,UAAU;gBACVkF;gBACAnF,OAAOe;YACT;QACF;QACA,MAAMV,WAAWI,WAAW;YAC1ByE,gBAAAA,0BAAAA,IAAKI,OAAO;YACZL,gBAAAA,0BAAAA,IAAKK,OAAO;YACZF,KAAK,CAAC,gBAAgB,EAAE9F,SAAS;QACnC,GAAGO;QACH,MAAMU,UAAU;YACd2E,gBAAAA,0BAAAA,IAAKI,OAAO;YACZL,gBAAAA,0BAAAA,IAAKK,OAAO;YACZD,SAASjH,mBAAAA,6BAAAA,OAAQoC,MAAM;QACzB;QACApC,mBAAAA,6BAAAA,OAAQsC,gBAAgB,CAAC,SAASH,SAAS;YAAEI,MAAM;QAAK;QACxD,IAAIvC,mBAAAA,6BAAAA,OAAQwC,OAAO,EAAE;YACnBL;YACA;QACF;QAEA,IAAI;YACF0E,MAAMJ,UAAUU,OAAO,CAAC/F,KAAKoC,SAAS,CAAC4D;oBAGlBA;gBAFnBN,MAAMM;gBACN,MAAMtB,SAASsB,SAASC,UAAU;gBAClC,MAAMtB,cAAaqB,0BAAAA,SAASE,aAAa,cAAtBF,qCAAAA,0BAA0B;gBAC7C,IAAItB,WAAWxB,aAAawB,SAAS,OAAOA,SAAS,KAAK;oBACxDsB,SAASF,OAAO;oBAChBF,KAAK,CAAC,gBAAgB,EAAE9F,SAAS;oBACjC;gBACF;gBACA,MAAMmE,SAAmB,EAAE;gBAC3B,IAAIkC,QAAQ;gBACZH,SAASI,EAAE,CAAC,QAAQ,CAAC5B;oBACnB2B,SAAS3B,MAAM/C,MAAM;oBACrB,IAAI0E,QAAQzH,gBAAgB;wBAC1BsH,SAASF,OAAO;wBAChBF,KAAK,CAAC,iBAAiB,EAAE9F,QAAQ,oBAAoB,CAAC;wBACtD;oBACF;oBACAmE,OAAOG,IAAI,CAACI;gBACd;gBACAwB,SAAS7E,IAAI,CAAC,SAAS,IAAMyE,KAAK,CAAC,gBAAgB,EAAE9F,SAAS;gBAC9DkG,SAAS7E,IAAI,CAAC,OAAO;oBACnB,IAAIV,SAAS;oBACbA,UAAU;oBACVkF;oBACApF,QAAQkE,WAAWC,QAAQC,YAAYqB,SAASpD,OAAO,EAAEO,OAAOmB,MAAM,CAACL;gBACzE;YACF;QACF,EAAE,OAAM;YACN2B,KAAK,CAAC,gBAAgB,EAAE9F,SAAS;YACjC;QACF;QAEA2F,IAAItE,IAAI,CAAC,SAAS,IAAMyE,KAAK,CAAC,gBAAgB,EAAE9F,SAAS;QACzD2F,IAAIY,GAAG,CAACpD;IACV;AACF;AAEA,eAAeqD,UAAUtG,GAAQ,EAAE2C,IAAiB,EAAE7C,OAAe,EAAEC,aAAsB,EAAEM,SAAiB,EAAED,MAAc;IAC9HzB,eAAegE,KAAK/D,MAAM;IAC1B,MAAM4C,YAAY,MAAME,qBAAqB1B,KAAKF,SAASC,eAAeK,QAAQC,WAAWsC,KAAK/D,MAAM;IACxG,OAAOwG,YAAYpF,KAAK2C,MAAM7C,SAAS0B,WAAWnB;AACpD;AAoBA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAekG,eAAe/G,MAAc,EAAEmD,OAAoB,CAAC,CAAC,EAAE7C,UAAU,eAAe,EAAEsC,UAAiC,CAAC,CAAC;IACzIzD,eAAegE,KAAK/D,MAAM;IAC1B,MAAM,EAAEmB,gBAAgB,KAAK,EAAEM,YAAY7B,kBAAkB,EAAE4B,SAASrC,IAAIqC,MAAM,AAAqB,EAAE,GAAGgC;IAE5G,IAAIpC,MAAMH,cAAcL,QAAQM,SAASC;IACzC,IAAIiG,WAAW,MAAMM,UAAUtG,KAAK2C,MAAM7C,SAASC,eAAeM,WAAWD;IAE7E,IAAIoG,gBAAgB/H;IACpB,MAAOuH,SAAStB,MAAM,IAAI,OAAOsB,SAAStB,MAAM,GAAG,IAAK;QACtD,MAAM+B,WAAWT,SAASpD,OAAO,CAAC8D,GAAG,CAAC;QACtC,IAAI,CAACD,UAAU;QACf,IAAID,iBAAiB,GAAG;YACtB,MAAM,IAAIpI,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,oBAAoB,CAAC;QAClF;QACA0G,iBAAiB;QAEjB,IAAIG;QACJ,IAAI;YACFA,UAAU,IAAIlH,IAAIgH,UAAUzG;QAC9B,EAAE,OAAM;YACN,MAAM,IAAI5B,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,yBAAyB,CAAC;QACvF;QACAE,MAAMH,cAAc8G,QAAQrD,QAAQ,IAAIxD,SAASC;QACjDiG,WAAW,MAAMM,UAAUtG,KAAK2C,MAAM7C,SAASC,eAAeM,WAAWD;IAC3E;IAEA,OAAO4F;AACT;AAEA;;;CAGC,GACD,OAAO,eAAeY,kBAAqBZ,QAAkB,EAAElG,OAAe;IAC5E,MAAM+G,OAAO,MAAMC,YAAYd,UAAUlG,SAASpB;IAClD,IAAI;QACF,OAAOqI,KAAKC,KAAK,CAACH;IACpB,EAAE,OAAM;QACN,MAAM,IAAIzI,oBAAoB,CAAC,kBAAkB,EAAE0B,QAAQ,cAAc,CAAC;IAC5E;AACF;AAEA,eAAegH,YAAYd,QAAkB,EAAElG,OAAe,EAAEmH,QAAgB;QAM/DjB;IALf,MAAMkB,gBAAgBlB,SAASpD,OAAO,CAAC8D,GAAG,CAAC;IAC3C,IAAIQ,iBAAiBC,OAAOD,iBAAiBD,UAAU;QACrD,MAAM,IAAI7I,oBAAoB,CAAC,iBAAiB,EAAE0B,QAAQ,oBAAoB,CAAC;IACjF;IAEA,MAAMiE,UAASiC,iBAAAA,SAAS/C,IAAI,cAAb+C,qCAAAA,eAAehC,SAAS;IACvC,IAAI,CAACD,QAAQ;QACX,MAAM8C,OAAO,MAAMb,SAASa,IAAI;QAChC,IAAI1D,OAAOU,UAAU,CAACgD,MAAM,UAAUI,UAAU;YAC9C,MAAM,IAAI7I,oBAAoB,CAAC,iBAAiB,EAAE0B,QAAQ,oBAAoB,CAAC;QACjF;QACA,OAAO+G;IACT;IAEA,MAAM5C,SAAuB,EAAE;IAC/B,IAAIkC,QAAQ;IACZ,IAAI;QACF,OAAS;YACP,MAAM,EAAEjC,IAAI,EAAEnB,KAAK,EAAE,GAAG,MAAMgB,OAAOI,IAAI;YACzC,IAAID,MAAM;YACV,IAAI,CAACnB,OAAO;YACZoD,SAASpD,MAAMc,UAAU;YACzB,IAAIsC,QAAQc,UAAU;gBACpB,MAAM,IAAI7I,oBAAoB,CAAC,iBAAiB,EAAE0B,QAAQ,oBAAoB,CAAC;YACjF;YACAmE,OAAOG,IAAI,CAACrB;QACd;IACF,SAAU;QACRgB,OAAOM,WAAW;IACpB;IAEA,OAAOlB,OAAOmB,MAAM,CAACL,OAAOM,GAAG,CAAC,CAACC,QAAUrB,OAAOC,IAAI,CAACoB,SAASlB,QAAQ,CAAC;AAC3E"}

package/dist/esm/auth/interactive-oauth-flow.d.ts

@@ -56,7 +56,7 @@ export declare class InteractiveOAuthFlow {
      * @returns New token set with a refreshed access token.
      * @throws Error if refresh fails.
      */
-    refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string, resource: string, allowLoopback?: boolean): Promise<TokenSet>;
+    refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string, resource: string, allowLoopback?: boolean, signal?: AbortSignal): Promise<TokenSet>;
     /**
      * Open browser to authorization URL
      * Uses platform-specific command to open default browser

package/dist/esm/auth/interactive-oauth-flow.js

@@ -40,6 +40,7 @@ import { generatePkce } from './pkce.js';
             port: options.port,
             logger
         });
+        throwIfAborted(options.signal);
         // Generate PKCE parameters if requested (RFC 7636)
         let pkce;
         if (options.pkce) {
@@ -77,12 +78,13 @@ import { generatePkce } from './pkce.js';
                 // Try to open browser (requires 'open' package or native command)
                 await this.openBrowser(authUrl.toString());
             }
+            throwIfAborted(options.signal);
             // Wait for callback with timeout
             const timeout = options.timeout || (options.headless ? 60000 : 300000);
-            const result = await callbackListener.waitForCallback(timeout);
+            const result = await callbackListener.waitForCallback(timeout, options.signal);
             this.assertResponseIssuer(result.iss, options, logger);
             // Exchange authorization code for tokens (with PKCE verifier if used)
-            const tokens = await this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, options.resource, (_options_allowLoopback = options.allowLoopback) !== null && _options_allowLoopback !== void 0 ? _options_allowLoopback : false, pkce === null || pkce === void 0 ? void 0 : pkce.codeVerifier);
+            const tokens = await this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, options.resource, (_options_allowLoopback = options.allowLoopback) !== null && _options_allowLoopback !== void 0 ? _options_allowLoopback : false, pkce === null || pkce === void 0 ? void 0 : pkce.codeVerifier, options.signal);
             return tokens;
         } catch (error) {
             logger.error('❌ OAuth flow failed:', error instanceof Error ? error.message : String(error));
@@ -112,7 +114,7 @@ import { generatePkce } from './pkce.js';
    * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).
    * @param allowLoopback - Loopback trust grant computed by the caller from the server it is actually talking to, never from `tokenEndpoint`.
    * @param codeVerifier - Optional PKCE code verifier (RFC 7636).
-   */ async exchangeCodeForTokens(tokenEndpoint, code, clientId, clientSecret, redirectUri, resource, allowLoopback, codeVerifier) {
+   */ async exchangeCodeForTokens(tokenEndpoint, code, clientId, clientSecret, redirectUri, resource, allowLoopback, codeVerifier, signal) {
         const params = new URLSearchParams({
             grant_type: 'authorization_code',
             code,
@@ -134,7 +136,8 @@ import { generatePkce } from './pkce.js';
                 Accept: 'application/json',
                 Connection: 'close'
             },
-            body: params
+            body: params,
+            signal
         }, 'token endpoint', {
             allowLoopback
         });
@@ -168,7 +171,7 @@ import { generatePkce } from './pkce.js';
    * @param allowLoopback - Loopback trust grant computed by the caller from the server it is actually talking to, never from `tokenEndpoint`. Defaults to `false`.
    * @returns New token set with a refreshed access token.
    * @throws Error if refresh fails.
-   */ async refreshTokens(tokenEndpoint, refreshToken, clientId, clientSecret, resource, allowLoopback = false) {
+   */ async refreshTokens(tokenEndpoint, refreshToken, clientId, clientSecret, resource, allowLoopback = false, signal) {
         // See exchangeCodeForTokens - tokenEndpoint is remote-controlled discovery data.
         const response = await discoveryFetch(tokenEndpoint, {
             method: 'POST',
@@ -183,7 +186,8 @@ import { generatePkce } from './pkce.js';
                 client_id: clientId,
                 client_secret: clientSecret,
                 resource
-            })
+            }),
+            signal
         }, 'token endpoint', {
             allowLoopback
         });
@@ -242,3 +246,6 @@ import { generatePkce } from './pkce.js';
         child.unref();
     }
 }
+function throwIfAborted(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('OAuth authorization was cancelled');
+}

package/dist/esm/auth/interactive-oauth-flow.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/interactive-oauth-flow.ts"],"sourcesContent":["/**\n * OAuth Authorization Flow Handler\n * Manages browser-based OAuth flows and token exchange with PKCE support\n */\n\nimport * as child_process from 'node:child_process';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { discoveryFetch } from './discovery-fetch.ts';\nimport { OAuthCallbackListener } from './oauth-callback-listener.ts';\nimport { generatePkce } from './pkce.ts';\nimport type { OAuthFlowOptions, PkceParams, TokenSet } from './types.ts';\n\n/**\n * OAuth token response from token endpoint\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * InteractiveOAuthFlow manages the complete OAuth authorization code flow\n */\nexport class InteractiveOAuthFlow {\n  /**\n   * Perform OAuth authorization code flow\n   *\n   * @param authorizationEndpoint - OAuth authorization endpoint URL\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @param options - Flow options (port is required - use get-port to find available port)\n   * @returns Token set with access and refresh tokens\n   *\n   * @throws Error if flow fails or times out\n   *\n   * @example\n   * import getPort from 'get-port';\n   *\n   * const flow = new InteractiveOAuthFlow();\n   * const port = await getPort();\n   * const tokens = await flow.performAuthFlow(\n   *   'https://example.com/oauth/authorize',\n   *   'https://example.com/oauth/token',\n   *   'client-id',\n   *   'client-secret',\n   *   { port, issuer: 'https://example.com', resource: 'https://example.com/mcp', scopes: ['read', 'write'] }\n   * );\n   */\n  async performAuthFlow(authorizationEndpoint: string, tokenEndpoint: string, clientId: string, clientSecret: string, options: OAuthFlowOptions): Promise<TokenSet> {\n    const logger = options.logger ?? defaultLogger;\n    const callbackListener = new OAuthCallbackListener({ port: options.port, logger });\n\n    // Generate PKCE parameters if requested (RFC 7636)\n    let pkce: PkceParams | undefined;\n    if (options.pkce) {\n      logger.debug('🔐 Generating PKCE parameters...');\n      pkce = await generatePkce();\n    }\n\n    try {\n      // Start callback server\n      await callbackListener.start();\n\n      // Build redirect URI\n      const redirectUri = options.redirectUri || `http://localhost:${options.port}/callback`;\n\n      // Build authorization URL\n      const authUrl = new URL(authorizationEndpoint);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('redirect_uri', redirectUri);\n      authUrl.searchParams.set('response_type', 'code');\n\n      if (options.scopes && options.scopes.length > 0) {\n        authUrl.searchParams.set('scope', options.scopes.join(' '));\n      }\n\n      // Audience-bind the request to the resource server (RFC 8707)\n      authUrl.searchParams.set('resource', options.resource);\n\n      // Add PKCE parameters if generated (RFC 7636)\n      if (pkce) {\n        authUrl.searchParams.set('code_challenge', pkce.codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);\n      }\n\n      // Open browser or print URL for headless mode\n      if (options.headless) {\n        logger.info('🔗 Please visit this URL to authorize:');\n        logger.info(authUrl.toString());\n        logger.info('Waiting for callback...');\n      } else {\n        logger.debug('🌐 Opening browser for OAuth authorization...');\n        // Try to open browser (requires 'open' package or native command)\n        await this.openBrowser(authUrl.toString());\n      }\n\n      // Wait for callback with timeout\n      const timeout = options.timeout || (options.headless ? 60000 : 300000);\n      const result = await callbackListener.waitForCallback(timeout);\n\n      this.assertResponseIssuer(result.iss, options, logger);\n\n      // Exchange authorization code for tokens (with PKCE verifier if used)\n      const tokens = await this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, options.resource, options.allowLoopback ?? false, pkce?.codeVerifier);\n\n      return tokens;\n    } catch (error) {\n      logger.error('❌ OAuth flow failed:', error instanceof Error ? error.message : String(error));\n      throw error;\n    } finally {\n      // Always close callback server\n      await callbackListener.stop();\n    }\n  }\n\n  /**\n   * Rejects an authorization response that was not minted by the issuer\n   * discovered before the flow started (RFC 9207 authorization-server mix-up).\n   */\n  private assertResponseIssuer(iss: string | undefined, options: OAuthFlowOptions, logger: Logger): void {\n    if (iss !== undefined) {\n      if (iss !== options.issuer) {\n        throw new Error(`Authorization response issuer mismatch: got '${iss}', expected '${options.issuer}' - refusing to redeem the authorization code`);\n      }\n      return;\n    }\n\n    if (options.authorizationResponseIssSupported) {\n      throw new Error(`Authorization server '${options.issuer}' advertises authorization_response_iss_parameter_supported but omitted 'iss' - refusing to redeem the authorization code`);\n    }\n\n    logger.debug(`⚠️  Authorization response carried no 'iss' and '${options.issuer}' does not advertise support for it (RFC 9207)`);\n  }\n\n  /**\n   * Exchanges an authorization code for access and refresh tokens.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed by the caller from the server it is actually talking to, never from `tokenEndpoint`.\n   * @param codeVerifier - Optional PKCE code verifier (RFC 7636).\n   */\n  private async exchangeCodeForTokens(tokenEndpoint: string, code: string, clientId: string, clientSecret: string, redirectUri: string, resource: string, allowLoopback: boolean, codeVerifier?: string): Promise<TokenSet> {\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      client_secret: clientSecret,\n      resource,\n    });\n\n    // Add PKCE code verifier if provided (RFC 7636)\n    if (codeVerifier) {\n      params.set('code_verifier', codeVerifier);\n    }\n\n    // tokenEndpoint is remote-controlled discovery data; discoveryFetch blocks\n    // a private/internal target before the client secret is sent to it.\n    const response = await discoveryFetch(\n      tokenEndpoint,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Accept: 'application/json',\n          Connection: 'close',\n        },\n        body: params,\n      },\n      'token endpoint',\n      { allowLoopback }\n    );\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || '',\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Refreshes an access token using a refresh token.\n   * @param tokenEndpoint - OAuth token endpoint URL.\n   * @param refreshToken - Refresh token from a previous token set.\n   * @param clientId - OAuth client ID.\n   * @param clientSecret - OAuth client secret.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed by the caller from the server it is actually talking to, never from `tokenEndpoint`. Defaults to `false`.\n   * @returns New token set with a refreshed access token.\n   * @throws Error if refresh fails.\n   */\n  async refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string, resource: string, allowLoopback = false): Promise<TokenSet> {\n    // See exchangeCodeForTokens - tokenEndpoint is remote-controlled discovery data.\n    const response = await discoveryFetch(\n      tokenEndpoint,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Accept: 'application/json',\n          Connection: 'close',\n        },\n        body: new URLSearchParams({\n          grant_type: 'refresh_token',\n          refresh_token: refreshToken,\n          client_id: clientId,\n          client_secret: clientSecret,\n          resource,\n        }),\n      },\n      'token endpoint',\n      { allowLoopback }\n    );\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token refresh response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || refreshToken, // Reuse old refresh token if not provided\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Open browser to authorization URL\n   * Uses platform-specific command to open default browser\n   */\n  private async openBrowser(url: string): Promise<void> {\n    // Determine platform-specific command\n    const platform = process.platform;\n    let command: string;\n    let args: string[];\n\n    if (platform === 'darwin') {\n      command = 'open';\n      args = [url];\n    } else if (platform === 'win32') {\n      command = 'cmd';\n      args = ['/c', 'start', url];\n    } else {\n      // Linux and others\n      command = 'xdg-open';\n      args = [url];\n    }\n\n    // Spawn browser process\n    const child = child_process.spawn(command, args, {\n      detached: true,\n      stdio: 'ignore',\n    });\n\n    child.unref();\n  }\n}\n"],"names":["child_process","logger","defaultLogger","discoveryFetch","OAuthCallbackListener","generatePkce","InteractiveOAuthFlow","performAuthFlow","authorizationEndpoint","tokenEndpoint","clientId","clientSecret","options","callbackListener","port","pkce","debug","start","redirectUri","authUrl","URL","searchParams","set","scopes","length","join","resource","codeChallenge","codeChallengeMethod","headless","info","toString","openBrowser","timeout","result","waitForCallback","assertResponseIssuer","iss","tokens","exchangeCodeForTokens","code","allowLoopback","codeVerifier","error","Error","message","String","stop","undefined","issuer","authorizationResponseIssSupported","params","URLSearchParams","grant_type","redirect_uri","client_id","client_secret","response","method","headers","Accept","Connection","body","ok","errorText","text","status","data","json","access_token","tokenSet","accessToken","refreshToken","refresh_token","expiresAt","Date","now","expires_in","scope","split","refreshTokens","url","platform","process","command","args","child","spawn","detached","stdio","unref"],"mappings":"AAAA;;;CAGC,GAED,YAAYA,mBAAmB,qBAAqB;AACpD,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAC1E,SAASC,cAAc,QAAQ,uBAAuB;AACtD,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,YAAY,QAAQ,YAAY;AAczC;;CAEC,GACD,OAAO,MAAMC;IACX;;;;;;;;;;;;;;;;;;;;;;;;GAwBC,GACD,MAAMC,gBAAgBC,qBAA6B,EAAEC,aAAqB,EAAEC,QAAgB,EAAEC,YAAoB,EAAEC,OAAyB,EAAqB;YACjJA;QAAf,MAAMX,UAASW,kBAAAA,QAAQX,MAAM,cAAdW,6BAAAA,kBAAkBV;QACjC,MAAMW,mBAAmB,IAAIT,sBAAsB;YAAEU,MAAMF,QAAQE,IAAI;YAAEb;QAAO;QAEhF,mDAAmD;QACnD,IAAIc;QACJ,IAAIH,QAAQG,IAAI,EAAE;YAChBd,OAAOe,KAAK,CAAC;YACbD,OAAO,MAAMV;QACf;QAEA,IAAI;gBA4CiIO;YA3CnI,wBAAwB;YACxB,MAAMC,iBAAiBI,KAAK;YAE5B,qBAAqB;YACrB,MAAMC,cAAcN,QAAQM,WAAW,IAAI,CAAC,iBAAiB,EAAEN,QAAQE,IAAI,CAAC,SAAS,CAAC;YAEtF,0BAA0B;YAC1B,MAAMK,UAAU,IAAIC,IAAIZ;YACxBW,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAaZ;YACtCS,QAAQE,YAAY,CAACC,GAAG,CAAC,gBAAgBJ;YACzCC,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAE1C,IAAIV,QAAQW,MAAM,IAAIX,QAAQW,MAAM,CAACC,MAAM,GAAG,GAAG;gBAC/CL,QAAQE,YAAY,CAACC,GAAG,CAAC,SAASV,QAAQW,MAAM,CAACE,IAAI,CAAC;YACxD;YAEA,8DAA8D;YAC9DN,QAAQE,YAAY,CAACC,GAAG,CAAC,YAAYV,QAAQc,QAAQ;YAErD,8CAA8C;YAC9C,IAAIX,MAAM;gBACRI,QAAQE,YAAY,CAACC,GAAG,CAAC,kBAAkBP,KAAKY,aAAa;gBAC7DR,QAAQE,YAAY,CAACC,GAAG,CAAC,yBAAyBP,KAAKa,mBAAmB;YAC5E;YAEA,8CAA8C;YAC9C,IAAIhB,QAAQiB,QAAQ,EAAE;gBACpB5B,OAAO6B,IAAI,CAAC;gBACZ7B,OAAO6B,IAAI,CAACX,QAAQY,QAAQ;gBAC5B9B,OAAO6B,IAAI,CAAC;YACd,OAAO;gBACL7B,OAAOe,KAAK,CAAC;gBACb,kEAAkE;gBAClE,MAAM,IAAI,CAACgB,WAAW,CAACb,QAAQY,QAAQ;YACzC;YAEA,iCAAiC;YACjC,MAAME,UAAUrB,QAAQqB,OAAO,IAAKrB,CAAAA,QAAQiB,QAAQ,GAAG,QAAQ,MAAK;YACpE,MAAMK,SAAS,MAAMrB,iBAAiBsB,eAAe,CAACF;YAEtD,IAAI,CAACG,oBAAoB,CAACF,OAAOG,GAAG,EAAEzB,SAASX;YAE/C,sEAAsE;YACtE,MAAMqC,SAAS,MAAM,IAAI,CAACC,qBAAqB,CAAC9B,eAAeyB,OAAOM,IAAI,EAAE9B,UAAUC,cAAcO,aAAaN,QAAQc,QAAQ,GAAEd,yBAAAA,QAAQ6B,aAAa,cAArB7B,oCAAAA,yBAAyB,OAAOG,iBAAAA,2BAAAA,KAAM2B,YAAY;YAErL,OAAOJ;QACT,EAAE,OAAOK,OAAO;YACd1C,OAAO0C,KAAK,CAAC,wBAAwBA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;YACrF,MAAMA;QACR,SAAU;YACR,+BAA+B;YAC/B,MAAM9B,iBAAiBkC,IAAI;QAC7B;IACF;IAEA;;;GAGC,GACD,AAAQX,qBAAqBC,GAAuB,EAAEzB,OAAyB,EAAEX,MAAc,EAAQ;QACrG,IAAIoC,QAAQW,WAAW;YACrB,IAAIX,QAAQzB,QAAQqC,MAAM,EAAE;gBAC1B,MAAM,IAAIL,MAAM,CAAC,6CAA6C,EAAEP,IAAI,aAAa,EAAEzB,QAAQqC,MAAM,CAAC,6CAA6C,CAAC;YAClJ;YACA;QACF;QAEA,IAAIrC,QAAQsC,iCAAiC,EAAE;YAC7C,MAAM,IAAIN,MAAM,CAAC,sBAAsB,EAAEhC,QAAQqC,MAAM,CAAC,yHAAyH,CAAC;QACpL;QAEAhD,OAAOe,KAAK,CAAC,CAAC,iDAAiD,EAAEJ,QAAQqC,MAAM,CAAC,8CAA8C,CAAC;IACjI;IAEA;;;;;GAKC,GACD,MAAcV,sBAAsB9B,aAAqB,EAAE+B,IAAY,EAAE9B,QAAgB,EAAEC,YAAoB,EAAEO,WAAmB,EAAEQ,QAAgB,EAAEe,aAAsB,EAAEC,YAAqB,EAAqB;QACxN,MAAMS,SAAS,IAAIC,gBAAgB;YACjCC,YAAY;YACZb;YACAc,cAAcpC;YACdqC,WAAW7C;YACX8C,eAAe7C;YACfe;QACF;QAEA,gDAAgD;QAChD,IAAIgB,cAAc;YAChBS,OAAO7B,GAAG,CAAC,iBAAiBoB;QAC9B;QAEA,2EAA2E;QAC3E,oEAAoE;QACpE,MAAMe,WAAW,MAAMtD,eACrBM,eACA;YACEiD,QAAQ;YACRC,SAAS;gBACP,gBAAgB;gBAChBC,QAAQ;gBACRC,YAAY;YACd;YACAC,MAAMX;QACR,GACA,kBACA;YAAEV;QAAc;QAGlB,IAAI,CAACgB,SAASM,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAMP,SAASQ,IAAI;YACrC,MAAM,IAAIrB,MAAM,CAAC,uBAAuB,EAAEa,SAASS,MAAM,CAAC,GAAG,EAAEF,WAAW;QAC5E;QAEA,MAAMG,OAAQ,MAAMV,SAASW,IAAI;QAEjC,IAAI,CAACD,KAAKE,YAAY,EAAE;YACtB,MAAM,IAAIzB,MAAM;QAClB;QAEA,MAAM0B,WAAqB;YACzBC,aAAaJ,KAAKE,YAAY;YAC9BG,cAAcL,KAAKM,aAAa,IAAI;YACpCC,WAAWC,KAAKC,GAAG,KAAKT,KAAKU,UAAU,GAAG;YAC1CnE;YACAC;QACF;QAEA,IAAIwD,KAAKW,KAAK,EAAE;YACdR,SAAS/C,MAAM,GAAG4C,KAAKW,KAAK,CAACC,KAAK,CAAC;QACrC;QAEA,OAAOT;IACT;IAEA;;;;;;;;;;GAUC,GACD,MAAMU,cAAcvE,aAAqB,EAAE+D,YAAoB,EAAE9D,QAAgB,EAAEC,YAAoB,EAAEe,QAAgB,EAAEe,gBAAgB,KAAK,EAAqB;QACnK,iFAAiF;QACjF,MAAMgB,WAAW,MAAMtD,eACrBM,eACA;YACEiD,QAAQ;YACRC,SAAS;gBACP,gBAAgB;gBAChBC,QAAQ;gBACRC,YAAY;YACd;YACAC,MAAM,IAAIV,gBAAgB;gBACxBC,YAAY;gBACZoB,eAAeD;gBACfjB,WAAW7C;gBACX8C,eAAe7C;gBACfe;YACF;QACF,GACA,kBACA;YAAEe;QAAc;QAGlB,IAAI,CAACgB,SAASM,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAMP,SAASQ,IAAI;YACrC,MAAM,IAAIrB,MAAM,CAAC,sBAAsB,EAAEa,SAASS,MAAM,CAAC,GAAG,EAAEF,WAAW;QAC3E;QAEA,MAAMG,OAAQ,MAAMV,SAASW,IAAI;QAEjC,IAAI,CAACD,KAAKE,YAAY,EAAE;YACtB,MAAM,IAAIzB,MAAM;QAClB;QAEA,MAAM0B,WAAqB;YACzBC,aAAaJ,KAAKE,YAAY;YAC9BG,cAAcL,KAAKM,aAAa,IAAID;YACpCE,WAAWC,KAAKC,GAAG,KAAKT,KAAKU,UAAU,GAAG;YAC1CnE;YACAC;QACF;QAEA,IAAIwD,KAAKW,KAAK,EAAE;YACdR,SAAS/C,MAAM,GAAG4C,KAAKW,KAAK,CAACC,KAAK,CAAC;QACrC;QAEA,OAAOT;IACT;IAEA;;;GAGC,GACD,MAActC,YAAYiD,GAAW,EAAiB;QACpD,sCAAsC;QACtC,MAAMC,WAAWC,QAAQD,QAAQ;QACjC,IAAIE;QACJ,IAAIC;QAEJ,IAAIH,aAAa,UAAU;YACzBE,UAAU;YACVC,OAAO;gBAACJ;aAAI;QACd,OAAO,IAAIC,aAAa,SAAS;YAC/BE,UAAU;YACVC,OAAO;gBAAC;gBAAM;gBAASJ;aAAI;QAC7B,OAAO;YACL,mBAAmB;YACnBG,UAAU;YACVC,OAAO;gBAACJ;aAAI;QACd;QAEA,wBAAwB;QACxB,MAAMK,QAAQtF,cAAcuF,KAAK,CAACH,SAASC,MAAM;YAC/CG,UAAU;YACVC,OAAO;QACT;QAEAH,MAAMI,KAAK;IACb;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/interactive-oauth-flow.ts"],"sourcesContent":["/**\n * OAuth Authorization Flow Handler\n * Manages browser-based OAuth flows and token exchange with PKCE support\n */\n\nimport * as child_process from 'node:child_process';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport { discoveryFetch } from './discovery-fetch.ts';\nimport { OAuthCallbackListener } from './oauth-callback-listener.ts';\nimport { generatePkce } from './pkce.ts';\nimport type { OAuthFlowOptions, PkceParams, TokenSet } from './types.ts';\n\n/**\n * OAuth token response from token endpoint\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * InteractiveOAuthFlow manages the complete OAuth authorization code flow\n */\nexport class InteractiveOAuthFlow {\n  /**\n   * Perform OAuth authorization code flow\n   *\n   * @param authorizationEndpoint - OAuth authorization endpoint URL\n   * @param tokenEndpoint - OAuth token endpoint URL\n   * @param clientId - OAuth client ID\n   * @param clientSecret - OAuth client secret\n   * @param options - Flow options (port is required - use get-port to find available port)\n   * @returns Token set with access and refresh tokens\n   *\n   * @throws Error if flow fails or times out\n   *\n   * @example\n   * import getPort from 'get-port';\n   *\n   * const flow = new InteractiveOAuthFlow();\n   * const port = await getPort();\n   * const tokens = await flow.performAuthFlow(\n   *   'https://example.com/oauth/authorize',\n   *   'https://example.com/oauth/token',\n   *   'client-id',\n   *   'client-secret',\n   *   { port, issuer: 'https://example.com', resource: 'https://example.com/mcp', scopes: ['read', 'write'] }\n   * );\n   */\n  async performAuthFlow(authorizationEndpoint: string, tokenEndpoint: string, clientId: string, clientSecret: string, options: OAuthFlowOptions): Promise<TokenSet> {\n    const logger = options.logger ?? defaultLogger;\n    const callbackListener = new OAuthCallbackListener({ port: options.port, logger });\n    throwIfAborted(options.signal);\n\n    // Generate PKCE parameters if requested (RFC 7636)\n    let pkce: PkceParams | undefined;\n    if (options.pkce) {\n      logger.debug('🔐 Generating PKCE parameters...');\n      pkce = await generatePkce();\n    }\n\n    try {\n      // Start callback server\n      await callbackListener.start();\n\n      // Build redirect URI\n      const redirectUri = options.redirectUri || `http://localhost:${options.port}/callback`;\n\n      // Build authorization URL\n      const authUrl = new URL(authorizationEndpoint);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('redirect_uri', redirectUri);\n      authUrl.searchParams.set('response_type', 'code');\n\n      if (options.scopes && options.scopes.length > 0) {\n        authUrl.searchParams.set('scope', options.scopes.join(' '));\n      }\n\n      // Audience-bind the request to the resource server (RFC 8707)\n      authUrl.searchParams.set('resource', options.resource);\n\n      // Add PKCE parameters if generated (RFC 7636)\n      if (pkce) {\n        authUrl.searchParams.set('code_challenge', pkce.codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);\n      }\n\n      // Open browser or print URL for headless mode\n      if (options.headless) {\n        logger.info('🔗 Please visit this URL to authorize:');\n        logger.info(authUrl.toString());\n        logger.info('Waiting for callback...');\n      } else {\n        logger.debug('🌐 Opening browser for OAuth authorization...');\n        // Try to open browser (requires 'open' package or native command)\n        await this.openBrowser(authUrl.toString());\n      }\n      throwIfAborted(options.signal);\n\n      // Wait for callback with timeout\n      const timeout = options.timeout || (options.headless ? 60000 : 300000);\n      const result = await callbackListener.waitForCallback(timeout, options.signal);\n\n      this.assertResponseIssuer(result.iss, options, logger);\n\n      // Exchange authorization code for tokens (with PKCE verifier if used)\n      const tokens = await this.exchangeCodeForTokens(tokenEndpoint, result.code, clientId, clientSecret, redirectUri, options.resource, options.allowLoopback ?? false, pkce?.codeVerifier, options.signal);\n\n      return tokens;\n    } catch (error) {\n      logger.error('❌ OAuth flow failed:', error instanceof Error ? error.message : String(error));\n      throw error;\n    } finally {\n      // Always close callback server\n      await callbackListener.stop();\n    }\n  }\n\n  /**\n   * Rejects an authorization response that was not minted by the issuer\n   * discovered before the flow started (RFC 9207 authorization-server mix-up).\n   */\n  private assertResponseIssuer(iss: string | undefined, options: OAuthFlowOptions, logger: Logger): void {\n    if (iss !== undefined) {\n      if (iss !== options.issuer) {\n        throw new Error(`Authorization response issuer mismatch: got '${iss}', expected '${options.issuer}' - refusing to redeem the authorization code`);\n      }\n      return;\n    }\n\n    if (options.authorizationResponseIssSupported) {\n      throw new Error(`Authorization server '${options.issuer}' advertises authorization_response_iss_parameter_supported but omitted 'iss' - refusing to redeem the authorization code`);\n    }\n\n    logger.debug(`⚠️  Authorization response carried no 'iss' and '${options.issuer}' does not advertise support for it (RFC 9207)`);\n  }\n\n  /**\n   * Exchanges an authorization code for access and refresh tokens.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed by the caller from the server it is actually talking to, never from `tokenEndpoint`.\n   * @param codeVerifier - Optional PKCE code verifier (RFC 7636).\n   */\n  private async exchangeCodeForTokens(tokenEndpoint: string, code: string, clientId: string, clientSecret: string, redirectUri: string, resource: string, allowLoopback: boolean, codeVerifier?: string, signal?: AbortSignal): Promise<TokenSet> {\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri,\n      client_id: clientId,\n      client_secret: clientSecret,\n      resource,\n    });\n\n    // Add PKCE code verifier if provided (RFC 7636)\n    if (codeVerifier) {\n      params.set('code_verifier', codeVerifier);\n    }\n\n    // tokenEndpoint is remote-controlled discovery data; discoveryFetch blocks\n    // a private/internal target before the client secret is sent to it.\n    const response = await discoveryFetch(\n      tokenEndpoint,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Accept: 'application/json',\n          Connection: 'close',\n        },\n        body: params,\n        signal,\n      },\n      'token endpoint',\n      { allowLoopback }\n    );\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || '',\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Refreshes an access token using a refresh token.\n   * @param tokenEndpoint - OAuth token endpoint URL.\n   * @param refreshToken - Refresh token from a previous token set.\n   * @param clientId - OAuth client ID.\n   * @param clientSecret - OAuth client secret.\n   * @param resource - Canonical resource server URI, audience-binding the token (RFC 8707).\n   * @param allowLoopback - Loopback trust grant computed by the caller from the server it is actually talking to, never from `tokenEndpoint`. Defaults to `false`.\n   * @returns New token set with a refreshed access token.\n   * @throws Error if refresh fails.\n   */\n  async refreshTokens(tokenEndpoint: string, refreshToken: string, clientId: string, clientSecret: string, resource: string, allowLoopback = false, signal?: AbortSignal): Promise<TokenSet> {\n    // See exchangeCodeForTokens - tokenEndpoint is remote-controlled discovery data.\n    const response = await discoveryFetch(\n      tokenEndpoint,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n          Accept: 'application/json',\n          Connection: 'close',\n        },\n        body: new URLSearchParams({\n          grant_type: 'refresh_token',\n          refresh_token: refreshToken,\n          client_id: clientId,\n          client_secret: clientSecret,\n          resource,\n        }),\n        signal,\n      },\n      'token endpoint',\n      { allowLoopback }\n    );\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed (${response.status}): ${errorText}`);\n    }\n\n    const data = (await response.json()) as TokenResponse;\n\n    if (!data.access_token) {\n      throw new Error('Token refresh response missing access_token');\n    }\n\n    const tokenSet: TokenSet = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token || refreshToken, // Reuse old refresh token if not provided\n      expiresAt: Date.now() + data.expires_in * 1000,\n      clientId,\n      clientSecret,\n    };\n\n    if (data.scope) {\n      tokenSet.scopes = data.scope.split(' ');\n    }\n\n    return tokenSet;\n  }\n\n  /**\n   * Open browser to authorization URL\n   * Uses platform-specific command to open default browser\n   */\n  private async openBrowser(url: string): Promise<void> {\n    // Determine platform-specific command\n    const platform = process.platform;\n    let command: string;\n    let args: string[];\n\n    if (platform === 'darwin') {\n      command = 'open';\n      args = [url];\n    } else if (platform === 'win32') {\n      command = 'cmd';\n      args = ['/c', 'start', url];\n    } else {\n      // Linux and others\n      command = 'xdg-open';\n      args = [url];\n    }\n\n    // Spawn browser process\n    const child = child_process.spawn(command, args, {\n      detached: true,\n      stdio: 'ignore',\n    });\n\n    child.unref();\n  }\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error('OAuth authorization was cancelled');\n}\n"],"names":["child_process","logger","defaultLogger","discoveryFetch","OAuthCallbackListener","generatePkce","InteractiveOAuthFlow","performAuthFlow","authorizationEndpoint","tokenEndpoint","clientId","clientSecret","options","callbackListener","port","throwIfAborted","signal","pkce","debug","start","redirectUri","authUrl","URL","searchParams","set","scopes","length","join","resource","codeChallenge","codeChallengeMethod","headless","info","toString","openBrowser","timeout","result","waitForCallback","assertResponseIssuer","iss","tokens","exchangeCodeForTokens","code","allowLoopback","codeVerifier","error","Error","message","String","stop","undefined","issuer","authorizationResponseIssSupported","params","URLSearchParams","grant_type","redirect_uri","client_id","client_secret","response","method","headers","Accept","Connection","body","ok","errorText","text","status","data","json","access_token","tokenSet","accessToken","refreshToken","refresh_token","expiresAt","Date","now","expires_in","scope","split","refreshTokens","url","platform","process","command","args","child","spawn","detached","stdio","unref","aborted","reason"],"mappings":"AAAA;;;CAGC,GAED,YAAYA,mBAAmB,qBAAqB;AACpD,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAC1E,SAASC,cAAc,QAAQ,uBAAuB;AACtD,SAASC,qBAAqB,QAAQ,+BAA+B;AACrE,SAASC,YAAY,QAAQ,YAAY;AAczC;;CAEC,GACD,OAAO,MAAMC;IACX;;;;;;;;;;;;;;;;;;;;;;;;GAwBC,GACD,MAAMC,gBAAgBC,qBAA6B,EAAEC,aAAqB,EAAEC,QAAgB,EAAEC,YAAoB,EAAEC,OAAyB,EAAqB;YACjJA;QAAf,MAAMX,UAASW,kBAAAA,QAAQX,MAAM,cAAdW,6BAAAA,kBAAkBV;QACjC,MAAMW,mBAAmB,IAAIT,sBAAsB;YAAEU,MAAMF,QAAQE,IAAI;YAAEb;QAAO;QAChFc,eAAeH,QAAQI,MAAM;QAE7B,mDAAmD;QACnD,IAAIC;QACJ,IAAIL,QAAQK,IAAI,EAAE;YAChBhB,OAAOiB,KAAK,CAAC;YACbD,OAAO,MAAMZ;QACf;QAEA,IAAI;gBA6CiIO;YA5CnI,wBAAwB;YACxB,MAAMC,iBAAiBM,KAAK;YAE5B,qBAAqB;YACrB,MAAMC,cAAcR,QAAQQ,WAAW,IAAI,CAAC,iBAAiB,EAAER,QAAQE,IAAI,CAAC,SAAS,CAAC;YAEtF,0BAA0B;YAC1B,MAAMO,UAAU,IAAIC,IAAId;YACxBa,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAad;YACtCW,QAAQE,YAAY,CAACC,GAAG,CAAC,gBAAgBJ;YACzCC,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAE1C,IAAIZ,QAAQa,MAAM,IAAIb,QAAQa,MAAM,CAACC,MAAM,GAAG,GAAG;gBAC/CL,QAAQE,YAAY,CAACC,GAAG,CAAC,SAASZ,QAAQa,MAAM,CAACE,IAAI,CAAC;YACxD;YAEA,8DAA8D;YAC9DN,QAAQE,YAAY,CAACC,GAAG,CAAC,YAAYZ,QAAQgB,QAAQ;YAErD,8CAA8C;YAC9C,IAAIX,MAAM;gBACRI,QAAQE,YAAY,CAACC,GAAG,CAAC,kBAAkBP,KAAKY,aAAa;gBAC7DR,QAAQE,YAAY,CAACC,GAAG,CAAC,yBAAyBP,KAAKa,mBAAmB;YAC5E;YAEA,8CAA8C;YAC9C,IAAIlB,QAAQmB,QAAQ,EAAE;gBACpB9B,OAAO+B,IAAI,CAAC;gBACZ/B,OAAO+B,IAAI,CAACX,QAAQY,QAAQ;gBAC5BhC,OAAO+B,IAAI,CAAC;YACd,OAAO;gBACL/B,OAAOiB,KAAK,CAAC;gBACb,kEAAkE;gBAClE,MAAM,IAAI,CAACgB,WAAW,CAACb,QAAQY,QAAQ;YACzC;YACAlB,eAAeH,QAAQI,MAAM;YAE7B,iCAAiC;YACjC,MAAMmB,UAAUvB,QAAQuB,OAAO,IAAKvB,CAAAA,QAAQmB,QAAQ,GAAG,QAAQ,MAAK;YACpE,MAAMK,SAAS,MAAMvB,iBAAiBwB,eAAe,CAACF,SAASvB,QAAQI,MAAM;YAE7E,IAAI,CAACsB,oBAAoB,CAACF,OAAOG,GAAG,EAAE3B,SAASX;YAE/C,sEAAsE;YACtE,MAAMuC,SAAS,MAAM,IAAI,CAACC,qBAAqB,CAAChC,eAAe2B,OAAOM,IAAI,EAAEhC,UAAUC,cAAcS,aAAaR,QAAQgB,QAAQ,GAAEhB,yBAAAA,QAAQ+B,aAAa,cAArB/B,oCAAAA,yBAAyB,OAAOK,iBAAAA,2BAAAA,KAAM2B,YAAY,EAAEhC,QAAQI,MAAM;YAErM,OAAOwB;QACT,EAAE,OAAOK,OAAO;YACd5C,OAAO4C,KAAK,CAAC,wBAAwBA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;YACrF,MAAMA;QACR,SAAU;YACR,+BAA+B;YAC/B,MAAMhC,iBAAiBoC,IAAI;QAC7B;IACF;IAEA;;;GAGC,GACD,AAAQX,qBAAqBC,GAAuB,EAAE3B,OAAyB,EAAEX,MAAc,EAAQ;QACrG,IAAIsC,QAAQW,WAAW;YACrB,IAAIX,QAAQ3B,QAAQuC,MAAM,EAAE;gBAC1B,MAAM,IAAIL,MAAM,CAAC,6CAA6C,EAAEP,IAAI,aAAa,EAAE3B,QAAQuC,MAAM,CAAC,6CAA6C,CAAC;YAClJ;YACA;QACF;QAEA,IAAIvC,QAAQwC,iCAAiC,EAAE;YAC7C,MAAM,IAAIN,MAAM,CAAC,sBAAsB,EAAElC,QAAQuC,MAAM,CAAC,yHAAyH,CAAC;QACpL;QAEAlD,OAAOiB,KAAK,CAAC,CAAC,iDAAiD,EAAEN,QAAQuC,MAAM,CAAC,8CAA8C,CAAC;IACjI;IAEA;;;;;GAKC,GACD,MAAcV,sBAAsBhC,aAAqB,EAAEiC,IAAY,EAAEhC,QAAgB,EAAEC,YAAoB,EAAES,WAAmB,EAAEQ,QAAgB,EAAEe,aAAsB,EAAEC,YAAqB,EAAE5B,MAAoB,EAAqB;QAC9O,MAAMqC,SAAS,IAAIC,gBAAgB;YACjCC,YAAY;YACZb;YACAc,cAAcpC;YACdqC,WAAW/C;YACXgD,eAAe/C;YACfiB;QACF;QAEA,gDAAgD;QAChD,IAAIgB,cAAc;YAChBS,OAAO7B,GAAG,CAAC,iBAAiBoB;QAC9B;QAEA,2EAA2E;QAC3E,oEAAoE;QACpE,MAAMe,WAAW,MAAMxD,eACrBM,eACA;YACEmD,QAAQ;YACRC,SAAS;gBACP,gBAAgB;gBAChBC,QAAQ;gBACRC,YAAY;YACd;YACAC,MAAMX;YACNrC;QACF,GACA,kBACA;YAAE2B;QAAc;QAGlB,IAAI,CAACgB,SAASM,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAMP,SAASQ,IAAI;YACrC,MAAM,IAAIrB,MAAM,CAAC,uBAAuB,EAAEa,SAASS,MAAM,CAAC,GAAG,EAAEF,WAAW;QAC5E;QAEA,MAAMG,OAAQ,MAAMV,SAASW,IAAI;QAEjC,IAAI,CAACD,KAAKE,YAAY,EAAE;YACtB,MAAM,IAAIzB,MAAM;QAClB;QAEA,MAAM0B,WAAqB;YACzBC,aAAaJ,KAAKE,YAAY;YAC9BG,cAAcL,KAAKM,aAAa,IAAI;YACpCC,WAAWC,KAAKC,GAAG,KAAKT,KAAKU,UAAU,GAAG;YAC1CrE;YACAC;QACF;QAEA,IAAI0D,KAAKW,KAAK,EAAE;YACdR,SAAS/C,MAAM,GAAG4C,KAAKW,KAAK,CAACC,KAAK,CAAC;QACrC;QAEA,OAAOT;IACT;IAEA;;;;;;;;;;GAUC,GACD,MAAMU,cAAczE,aAAqB,EAAEiE,YAAoB,EAAEhE,QAAgB,EAAEC,YAAoB,EAAEiB,QAAgB,EAAEe,gBAAgB,KAAK,EAAE3B,MAAoB,EAAqB;QACzL,iFAAiF;QACjF,MAAM2C,WAAW,MAAMxD,eACrBM,eACA;YACEmD,QAAQ;YACRC,SAAS;gBACP,gBAAgB;gBAChBC,QAAQ;gBACRC,YAAY;YACd;YACAC,MAAM,IAAIV,gBAAgB;gBACxBC,YAAY;gBACZoB,eAAeD;gBACfjB,WAAW/C;gBACXgD,eAAe/C;gBACfiB;YACF;YACAZ;QACF,GACA,kBACA;YAAE2B;QAAc;QAGlB,IAAI,CAACgB,SAASM,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAMP,SAASQ,IAAI;YACrC,MAAM,IAAIrB,MAAM,CAAC,sBAAsB,EAAEa,SAASS,MAAM,CAAC,GAAG,EAAEF,WAAW;QAC3E;QAEA,MAAMG,OAAQ,MAAMV,SAASW,IAAI;QAEjC,IAAI,CAACD,KAAKE,YAAY,EAAE;YACtB,MAAM,IAAIzB,MAAM;QAClB;QAEA,MAAM0B,WAAqB;YACzBC,aAAaJ,KAAKE,YAAY;YAC9BG,cAAcL,KAAKM,aAAa,IAAID;YACpCE,WAAWC,KAAKC,GAAG,KAAKT,KAAKU,UAAU,GAAG;YAC1CrE;YACAC;QACF;QAEA,IAAI0D,KAAKW,KAAK,EAAE;YACdR,SAAS/C,MAAM,GAAG4C,KAAKW,KAAK,CAACC,KAAK,CAAC;QACrC;QAEA,OAAOT;IACT;IAEA;;;GAGC,GACD,MAActC,YAAYiD,GAAW,EAAiB;QACpD,sCAAsC;QACtC,MAAMC,WAAWC,QAAQD,QAAQ;QACjC,IAAIE;QACJ,IAAIC;QAEJ,IAAIH,aAAa,UAAU;YACzBE,UAAU;YACVC,OAAO;gBAACJ;aAAI;QACd,OAAO,IAAIC,aAAa,SAAS;YAC/BE,UAAU;YACVC,OAAO;gBAAC;gBAAM;gBAASJ;aAAI;QAC7B,OAAO;YACL,mBAAmB;YACnBG,UAAU;YACVC,OAAO;gBAACJ;aAAI;QACd;QAEA,wBAAwB;QACxB,MAAMK,QAAQxF,cAAcyF,KAAK,CAACH,SAASC,MAAM;YAC/CG,UAAU;YACVC,OAAO;QACT;QAEAH,MAAMI,KAAK;IACb;AACF;AAEA,SAAS7E,eAAeC,MAAoB;IAC1C,IAAIA,mBAAAA,6BAAAA,OAAQ6E,OAAO,EAAE,MAAM7E,OAAO8E,MAAM,YAAYhD,QAAQ9B,OAAO8E,MAAM,GAAG,IAAIhD,MAAM;AACxF"}

package/dist/esm/auth/oauth-callback-listener.d.ts

@@ -44,7 +44,7 @@ export declare class OAuthCallbackListener {
     /**
      * Wait for OAuth callback with timeout
      */
-    waitForCallback(timeoutMs?: number): Promise<CallbackResult>;
+    waitForCallback(timeoutMs?: number, signal?: AbortSignal): Promise<CallbackResult>;
     /**
      * Stop the callback server and close
      */

package/dist/esm/auth/oauth-callback-listener.js

@@ -123,15 +123,45 @@ import { logger as defaultLogger } from '../utils/logger.js';
     }
     /**
    * Wait for OAuth callback with timeout
-   */ async waitForCallback(timeoutMs = 300000) {
+   */ async waitForCallback(timeoutMs = 300000, signal) {
         return new Promise((resolve, reject)=>{
+            if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+                reject(signal.reason instanceof Error ? signal.reason : new Error('OAuth authorization was cancelled'));
+                return;
+            }
             this.resolveCallback = resolve;
             this.rejectCallback = reject;
+            const onAbort = ()=>{
+                var _this_rejectCallback, _this;
+                return (_this_rejectCallback = (_this = this).rejectCallback) === null || _this_rejectCallback === void 0 ? void 0 : _this_rejectCallback.call(_this, (signal === null || signal === void 0 ? void 0 : signal.reason) instanceof Error ? signal.reason : new Error('OAuth authorization was cancelled'));
+            };
+            signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, {
+                once: true
+            });
             // Set timeout to prevent hanging forever
             this.timeout = setTimeout(()=>{
-                reject(new Error(`Authorization timeout - no callback received within ${timeoutMs / 1000} seconds`));
+                var _this_rejectCallback, _this;
+                (_this_rejectCallback = (_this = this).rejectCallback) === null || _this_rejectCallback === void 0 ? void 0 : _this_rejectCallback.call(_this, new Error(`Authorization timeout - no callback received within ${timeoutMs / 1000} seconds`));
                 this.stop();
             }, timeoutMs);
+            const cleanup = ()=>{
+                signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+                if (this.timeout) {
+                    clearTimeout(this.timeout);
+                    this.timeout = undefined;
+                }
+            };
+            // Promise settlement can originate from callback, abort, or timeout.
+            const originalResolve = this.resolveCallback;
+            const originalReject = this.rejectCallback;
+            this.resolveCallback = (result)=>{
+                cleanup();
+                originalResolve === null || originalResolve === void 0 ? void 0 : originalResolve(result);
+            };
+            this.rejectCallback = (error)=>{
+                cleanup();
+                originalReject === null || originalReject === void 0 ? void 0 : originalReject(error);
+            };
         });
     }
     /**

package/dist/esm/auth/oauth-callback-listener.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/oauth-callback-listener.ts"],"sourcesContent":["/**\n * OAuth Callback Server for CLI Authentication\n * Listens for OAuth authorization callbacks and captures authorization code\n */\n\nimport http from 'node:http';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport type { CallbackResult } from './types.ts';\n\nexport interface OAuthCallbackListenerOptions {\n  /** Port to listen on (required - use get-port package to find available port) */\n  port: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * OAuthCallbackListener handles OAuth redirect callbacks\n * Starts a temporary HTTP server to receive authorization code\n *\n * Note: Caller is responsible for finding an available port using get-port package\n */\nexport class OAuthCallbackListener {\n  private server: http.Server | undefined;\n  private resolveCallback?: (result: CallbackResult) => void;\n  private rejectCallback?: (error: Error) => void;\n  private timeout: NodeJS.Timeout | undefined;\n  private port: number;\n  private logger: Logger;\n\n  constructor(options: OAuthCallbackListenerOptions) {\n    this.port = options.port;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Start the callback server\n   * Fails fast if port is already in use - caller should use get-port to find available port\n   */\n  async start(): Promise<void> {\n    await this.listen(this.port);\n    this.logger.debug(`✅ Callback server listening on http://localhost:${this.port}/callback`);\n  }\n\n  /**\n   * Listen on a specific port\n   */\n  private listen(port: number): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.server = http.createServer((req, res) => {\n        this.handleRequest(req, res);\n      });\n\n      this.server.on('error', (error) => {\n        reject(error);\n      });\n\n      this.server.listen(port, 'localhost', () => {\n        resolve();\n      });\n    });\n  }\n\n  /**\n   * Handle incoming HTTP requests\n   */\n  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {\n    const url = new URL(req.url || '', `http://localhost:${this.port}`);\n\n    if (url.pathname === '/callback') {\n      this.handleCallback(url, res);\n    } else {\n      res.writeHead(404, { 'Content-Type': 'text/plain' });\n      res.end('Not Found');\n    }\n  }\n\n  /**\n   * Handle OAuth callback\n   */\n  private handleCallback(url: URL, res: http.ServerResponse): void {\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const iss = url.searchParams.get('iss');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n\n    // Handle OAuth errors\n    if (error) {\n      const errorMessage = errorDescription ? `${error}: ${errorDescription}` : error;\n\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Authorization Failed</h1>\n            <p>The authorization provider returned an error.</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error(errorMessage));\n      }\n      return;\n    }\n\n    // Validate code parameter\n    if (!code) {\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Invalid Callback</h1>\n            <p>Missing authorization code</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error('Missing authorization code'));\n      }\n      return;\n    }\n\n    // Success - send confirmation page\n    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n      <html>\n        <head>\n          <meta charset=\"UTF-8\">\n        </head>\n        <body>\n          <h1>Authorization Successful</h1>\n          <p>You can close this window and return to the terminal.</p>\n          <script>setTimeout(() => window.close(), 2000);</script>\n        </body>\n      </html>\n    `);\n\n    // Resolve the promise with authorization code\n    if (this.resolveCallback) {\n      const result: CallbackResult = { code };\n      if (state) {\n        result.state = state;\n      }\n      if (iss) {\n        result.iss = iss;\n      }\n      this.resolveCallback(result);\n    }\n  }\n\n  /**\n   * Wait for OAuth callback with timeout\n   */\n  async waitForCallback(timeoutMs = 300000): Promise<CallbackResult> {\n    return new Promise((resolve, reject) => {\n      this.resolveCallback = resolve;\n      this.rejectCallback = reject;\n\n      // Set timeout to prevent hanging forever\n      this.timeout = setTimeout(() => {\n        reject(new Error(`Authorization timeout - no callback received within ${timeoutMs / 1000} seconds`));\n        this.stop();\n      }, timeoutMs);\n    });\n  }\n\n  /**\n   * Stop the callback server and close\n   */\n  async stop(): Promise<void> {\n    // Clear the timeout\n    if (this.timeout) {\n      clearTimeout(this.timeout);\n      this.timeout = undefined;\n    }\n\n    // Close the server\n    if (this.server) {\n      await new Promise<void>((resolve) => {\n        this.server?.close(() => {\n          this.logger.debug('🔒 Callback server closed');\n          resolve();\n        });\n      });\n      this.server = undefined;\n    }\n  }\n\n  /**\n   * Get the callback URL for this server\n   */\n  getCallbackUrl(): string {\n    if (!this.port) {\n      throw new Error('Server not started - call start() first');\n    }\n    return `http://localhost:${this.port}/callback`;\n  }\n}\n"],"names":["http","logger","defaultLogger","OAuthCallbackListener","start","listen","port","debug","Promise","resolve","reject","server","createServer","req","res","handleRequest","on","error","url","URL","pathname","handleCallback","writeHead","end","code","searchParams","get","state","iss","errorDescription","errorMessage","rejectCallback","Error","resolveCallback","result","waitForCallback","timeoutMs","timeout","setTimeout","stop","clearTimeout","undefined","close","getCallbackUrl","options"],"mappings":"AAAA;;;CAGC,GAED,OAAOA,UAAU,YAAY;AAC7B,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAU1E;;;;;CAKC,GACD,OAAO,MAAMC;IAaX;;;GAGC,GACD,MAAMC,QAAuB;QAC3B,MAAM,IAAI,CAACC,MAAM,CAAC,IAAI,CAACC,IAAI;QAC3B,IAAI,CAACL,MAAM,CAACM,KAAK,CAAC,CAAC,gDAAgD,EAAE,IAAI,CAACD,IAAI,CAAC,SAAS,CAAC;IAC3F;IAEA;;GAEC,GACD,AAAQD,OAAOC,IAAY,EAAiB;QAC1C,OAAO,IAAIE,QAAQ,CAACC,SAASC;YAC3B,IAAI,CAACC,MAAM,GAAGX,KAAKY,YAAY,CAAC,CAACC,KAAKC;gBACpC,IAAI,CAACC,aAAa,CAACF,KAAKC;YAC1B;YAEA,IAAI,CAACH,MAAM,CAACK,EAAE,CAAC,SAAS,CAACC;gBACvBP,OAAOO;YACT;YAEA,IAAI,CAACN,MAAM,CAACN,MAAM,CAACC,MAAM,aAAa;gBACpCG;YACF;QACF;IACF;IAEA;;GAEC,GACD,AAAQM,cAAcF,GAAyB,EAAEC,GAAwB,EAAQ;QAC/E,MAAMI,MAAM,IAAIC,IAAIN,IAAIK,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAACZ,IAAI,EAAE;QAElE,IAAIY,IAAIE,QAAQ,KAAK,aAAa;YAChC,IAAI,CAACC,cAAc,CAACH,KAAKJ;QAC3B,OAAO;YACLA,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAa;YAClDR,IAAIS,GAAG,CAAC;QACV;IACF;IAEA;;GAEC,GACD,AAAQF,eAAeH,GAAQ,EAAEJ,GAAwB,EAAQ;QAC/D,MAAMU,OAAON,IAAIO,YAAY,CAACC,GAAG,CAAC;QAClC,MAAMC,QAAQT,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,MAAME,MAAMV,IAAIO,YAAY,CAACC,GAAG,CAAC;QACjC,MAAMT,QAAQC,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,MAAMG,mBAAmBX,IAAIO,YAAY,CAACC,GAAG,CAAC;QAE9C,sBAAsB;QACtB,IAAIT,OAAO;YACT,MAAMa,eAAeD,mBAAmB,GAAGZ,MAAM,EAAE,EAAEY,kBAAkB,GAAGZ;YAE1EH,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC,CAAC;;;;;;;;MAQT,CAAC;YAED,IAAI,IAAI,CAACQ,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAMF;YAChC;YACA;QACF;QAEA,0BAA0B;QAC1B,IAAI,CAACN,MAAM;YACTV,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC,CAAC;;;;;;;;MAQT,CAAC;YAED,IAAI,IAAI,CAACQ,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAM;YAChC;YACA;QACF;QAEA,mCAAmC;QACnClB,IAAIQ,SAAS,CAAC,KAAK;YAAE,gBAAgB;QAA2B;QAChER,IAAIS,GAAG,CAAC,CAAC;;;;;;;;;;;IAWT,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAACU,eAAe,EAAE;YACxB,MAAMC,SAAyB;gBAAEV;YAAK;YACtC,IAAIG,OAAO;gBACTO,OAAOP,KAAK,GAAGA;YACjB;YACA,IAAIC,KAAK;gBACPM,OAAON,GAAG,GAAGA;YACf;YACA,IAAI,CAACK,eAAe,CAACC;QACvB;IACF;IAEA;;GAEC,GACD,MAAMC,gBAAgBC,YAAY,MAAM,EAA2B;QACjE,OAAO,IAAI5B,QAAQ,CAACC,SAASC;YAC3B,IAAI,CAACuB,eAAe,GAAGxB;YACvB,IAAI,CAACsB,cAAc,GAAGrB;YAEtB,yCAAyC;YACzC,IAAI,CAAC2B,OAAO,GAAGC,WAAW;gBACxB5B,OAAO,IAAIsB,MAAM,CAAC,oDAAoD,EAAEI,YAAY,KAAK,QAAQ,CAAC;gBAClG,IAAI,CAACG,IAAI;YACX,GAAGH;QACL;IACF;IAEA;;GAEC,GACD,MAAMG,OAAsB;QAC1B,oBAAoB;QACpB,IAAI,IAAI,CAACF,OAAO,EAAE;YAChBG,aAAa,IAAI,CAACH,OAAO;YACzB,IAAI,CAACA,OAAO,GAAGI;QACjB;QAEA,mBAAmB;QACnB,IAAI,IAAI,CAAC9B,MAAM,EAAE;YACf,MAAM,IAAIH,QAAc,CAACC;oBACvB;iBAAA,eAAA,IAAI,CAACE,MAAM,cAAX,mCAAA,aAAa+B,KAAK,CAAC;oBACjB,IAAI,CAACzC,MAAM,CAACM,KAAK,CAAC;oBAClBE;gBACF;YACF;YACA,IAAI,CAACE,MAAM,GAAG8B;QAChB;IACF;IAEA;;GAEC,GACDE,iBAAyB;QACvB,IAAI,CAAC,IAAI,CAACrC,IAAI,EAAE;YACd,MAAM,IAAI0B,MAAM;QAClB;QACA,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC1B,IAAI,CAAC,SAAS,CAAC;IACjD;IA3KA,YAAYsC,OAAqC,CAAE;YAEnCA;QADd,IAAI,CAACtC,IAAI,GAAGsC,QAAQtC,IAAI;QACxB,IAAI,CAACL,MAAM,IAAG2C,kBAAAA,QAAQ3C,MAAM,cAAd2C,6BAAAA,kBAAkB1C;IAClC;AAyKF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/oauth-callback-listener.ts"],"sourcesContent":["/**\n * OAuth Callback Server for CLI Authentication\n * Listens for OAuth authorization callbacks and captures authorization code\n */\n\nimport http from 'node:http';\nimport { logger as defaultLogger, type Logger } from '../utils/logger.ts';\nimport type { CallbackResult } from './types.ts';\n\nexport interface OAuthCallbackListenerOptions {\n  /** Port to listen on (required - use get-port package to find available port) */\n  port: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: Logger;\n}\n\n/**\n * OAuthCallbackListener handles OAuth redirect callbacks\n * Starts a temporary HTTP server to receive authorization code\n *\n * Note: Caller is responsible for finding an available port using get-port package\n */\nexport class OAuthCallbackListener {\n  private server: http.Server | undefined;\n  private resolveCallback?: (result: CallbackResult) => void;\n  private rejectCallback?: (error: Error) => void;\n  private timeout: NodeJS.Timeout | undefined;\n  private port: number;\n  private logger: Logger;\n\n  constructor(options: OAuthCallbackListenerOptions) {\n    this.port = options.port;\n    this.logger = options.logger ?? defaultLogger;\n  }\n\n  /**\n   * Start the callback server\n   * Fails fast if port is already in use - caller should use get-port to find available port\n   */\n  async start(): Promise<void> {\n    await this.listen(this.port);\n    this.logger.debug(`✅ Callback server listening on http://localhost:${this.port}/callback`);\n  }\n\n  /**\n   * Listen on a specific port\n   */\n  private listen(port: number): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.server = http.createServer((req, res) => {\n        this.handleRequest(req, res);\n      });\n\n      this.server.on('error', (error) => {\n        reject(error);\n      });\n\n      this.server.listen(port, 'localhost', () => {\n        resolve();\n      });\n    });\n  }\n\n  /**\n   * Handle incoming HTTP requests\n   */\n  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {\n    const url = new URL(req.url || '', `http://localhost:${this.port}`);\n\n    if (url.pathname === '/callback') {\n      this.handleCallback(url, res);\n    } else {\n      res.writeHead(404, { 'Content-Type': 'text/plain' });\n      res.end('Not Found');\n    }\n  }\n\n  /**\n   * Handle OAuth callback\n   */\n  private handleCallback(url: URL, res: http.ServerResponse): void {\n    const code = url.searchParams.get('code');\n    const state = url.searchParams.get('state');\n    const iss = url.searchParams.get('iss');\n    const error = url.searchParams.get('error');\n    const errorDescription = url.searchParams.get('error_description');\n\n    // Handle OAuth errors\n    if (error) {\n      const errorMessage = errorDescription ? `${error}: ${errorDescription}` : error;\n\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Authorization Failed</h1>\n            <p>The authorization provider returned an error.</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error(errorMessage));\n      }\n      return;\n    }\n\n    // Validate code parameter\n    if (!code) {\n      res.writeHead(400, { 'Content-Type': 'text/html' });\n      res.end(`\n        <html>\n          <body>\n            <h1>Invalid Callback</h1>\n            <p>Missing authorization code</p>\n            <script>setTimeout(() => window.close(), 3000);</script>\n          </body>\n        </html>\n      `);\n\n      if (this.rejectCallback) {\n        this.rejectCallback(new Error('Missing authorization code'));\n      }\n      return;\n    }\n\n    // Success - send confirmation page\n    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });\n    res.end(`\n      <html>\n        <head>\n          <meta charset=\"UTF-8\">\n        </head>\n        <body>\n          <h1>Authorization Successful</h1>\n          <p>You can close this window and return to the terminal.</p>\n          <script>setTimeout(() => window.close(), 2000);</script>\n        </body>\n      </html>\n    `);\n\n    // Resolve the promise with authorization code\n    if (this.resolveCallback) {\n      const result: CallbackResult = { code };\n      if (state) {\n        result.state = state;\n      }\n      if (iss) {\n        result.iss = iss;\n      }\n      this.resolveCallback(result);\n    }\n  }\n\n  /**\n   * Wait for OAuth callback with timeout\n   */\n  async waitForCallback(timeoutMs = 300000, signal?: AbortSignal): Promise<CallbackResult> {\n    return new Promise((resolve, reject) => {\n      if (signal?.aborted) {\n        reject(signal.reason instanceof Error ? signal.reason : new Error('OAuth authorization was cancelled'));\n        return;\n      }\n      this.resolveCallback = resolve;\n      this.rejectCallback = reject;\n\n      const onAbort = () => this.rejectCallback?.(signal?.reason instanceof Error ? signal.reason : new Error('OAuth authorization was cancelled'));\n      signal?.addEventListener('abort', onAbort, { once: true });\n\n      // Set timeout to prevent hanging forever\n      this.timeout = setTimeout(() => {\n        this.rejectCallback?.(new Error(`Authorization timeout - no callback received within ${timeoutMs / 1000} seconds`));\n        this.stop();\n      }, timeoutMs);\n\n      const cleanup = () => {\n        signal?.removeEventListener('abort', onAbort);\n        if (this.timeout) {\n          clearTimeout(this.timeout);\n          this.timeout = undefined;\n        }\n      };\n      // Promise settlement can originate from callback, abort, or timeout.\n      const originalResolve = this.resolveCallback;\n      const originalReject = this.rejectCallback;\n      this.resolveCallback = (result) => {\n        cleanup();\n        originalResolve?.(result);\n      };\n      this.rejectCallback = (error) => {\n        cleanup();\n        originalReject?.(error);\n      };\n    });\n  }\n\n  /**\n   * Stop the callback server and close\n   */\n  async stop(): Promise<void> {\n    // Clear the timeout\n    if (this.timeout) {\n      clearTimeout(this.timeout);\n      this.timeout = undefined;\n    }\n\n    // Close the server\n    if (this.server) {\n      await new Promise<void>((resolve) => {\n        this.server?.close(() => {\n          this.logger.debug('🔒 Callback server closed');\n          resolve();\n        });\n      });\n      this.server = undefined;\n    }\n  }\n\n  /**\n   * Get the callback URL for this server\n   */\n  getCallbackUrl(): string {\n    if (!this.port) {\n      throw new Error('Server not started - call start() first');\n    }\n    return `http://localhost:${this.port}/callback`;\n  }\n}\n"],"names":["http","logger","defaultLogger","OAuthCallbackListener","start","listen","port","debug","Promise","resolve","reject","server","createServer","req","res","handleRequest","on","error","url","URL","pathname","handleCallback","writeHead","end","code","searchParams","get","state","iss","errorDescription","errorMessage","rejectCallback","Error","resolveCallback","result","waitForCallback","timeoutMs","signal","aborted","reason","onAbort","addEventListener","once","timeout","setTimeout","stop","cleanup","removeEventListener","clearTimeout","undefined","originalResolve","originalReject","close","getCallbackUrl","options"],"mappings":"AAAA;;;CAGC,GAED,OAAOA,UAAU,YAAY;AAC7B,SAASC,UAAUC,aAAa,QAAqB,qBAAqB;AAU1E;;;;;CAKC,GACD,OAAO,MAAMC;IAaX;;;GAGC,GACD,MAAMC,QAAuB;QAC3B,MAAM,IAAI,CAACC,MAAM,CAAC,IAAI,CAACC,IAAI;QAC3B,IAAI,CAACL,MAAM,CAACM,KAAK,CAAC,CAAC,gDAAgD,EAAE,IAAI,CAACD,IAAI,CAAC,SAAS,CAAC;IAC3F;IAEA;;GAEC,GACD,AAAQD,OAAOC,IAAY,EAAiB;QAC1C,OAAO,IAAIE,QAAQ,CAACC,SAASC;YAC3B,IAAI,CAACC,MAAM,GAAGX,KAAKY,YAAY,CAAC,CAACC,KAAKC;gBACpC,IAAI,CAACC,aAAa,CAACF,KAAKC;YAC1B;YAEA,IAAI,CAACH,MAAM,CAACK,EAAE,CAAC,SAAS,CAACC;gBACvBP,OAAOO;YACT;YAEA,IAAI,CAACN,MAAM,CAACN,MAAM,CAACC,MAAM,aAAa;gBACpCG;YACF;QACF;IACF;IAEA;;GAEC,GACD,AAAQM,cAAcF,GAAyB,EAAEC,GAAwB,EAAQ;QAC/E,MAAMI,MAAM,IAAIC,IAAIN,IAAIK,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAACZ,IAAI,EAAE;QAElE,IAAIY,IAAIE,QAAQ,KAAK,aAAa;YAChC,IAAI,CAACC,cAAc,CAACH,KAAKJ;QAC3B,OAAO;YACLA,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAa;YAClDR,IAAIS,GAAG,CAAC;QACV;IACF;IAEA;;GAEC,GACD,AAAQF,eAAeH,GAAQ,EAAEJ,GAAwB,EAAQ;QAC/D,MAAMU,OAAON,IAAIO,YAAY,CAACC,GAAG,CAAC;QAClC,MAAMC,QAAQT,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,MAAME,MAAMV,IAAIO,YAAY,CAACC,GAAG,CAAC;QACjC,MAAMT,QAAQC,IAAIO,YAAY,CAACC,GAAG,CAAC;QACnC,MAAMG,mBAAmBX,IAAIO,YAAY,CAACC,GAAG,CAAC;QAE9C,sBAAsB;QACtB,IAAIT,OAAO;YACT,MAAMa,eAAeD,mBAAmB,GAAGZ,MAAM,EAAE,EAAEY,kBAAkB,GAAGZ;YAE1EH,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC,CAAC;;;;;;;;MAQT,CAAC;YAED,IAAI,IAAI,CAACQ,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAMF;YAChC;YACA;QACF;QAEA,0BAA0B;QAC1B,IAAI,CAACN,MAAM;YACTV,IAAIQ,SAAS,CAAC,KAAK;gBAAE,gBAAgB;YAAY;YACjDR,IAAIS,GAAG,CAAC,CAAC;;;;;;;;MAQT,CAAC;YAED,IAAI,IAAI,CAACQ,cAAc,EAAE;gBACvB,IAAI,CAACA,cAAc,CAAC,IAAIC,MAAM;YAChC;YACA;QACF;QAEA,mCAAmC;QACnClB,IAAIQ,SAAS,CAAC,KAAK;YAAE,gBAAgB;QAA2B;QAChER,IAAIS,GAAG,CAAC,CAAC;;;;;;;;;;;IAWT,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAACU,eAAe,EAAE;YACxB,MAAMC,SAAyB;gBAAEV;YAAK;YACtC,IAAIG,OAAO;gBACTO,OAAOP,KAAK,GAAGA;YACjB;YACA,IAAIC,KAAK;gBACPM,OAAON,GAAG,GAAGA;YACf;YACA,IAAI,CAACK,eAAe,CAACC;QACvB;IACF;IAEA;;GAEC,GACD,MAAMC,gBAAgBC,YAAY,MAAM,EAAEC,MAAoB,EAA2B;QACvF,OAAO,IAAI7B,QAAQ,CAACC,SAASC;YAC3B,IAAI2B,mBAAAA,6BAAAA,OAAQC,OAAO,EAAE;gBACnB5B,OAAO2B,OAAOE,MAAM,YAAYP,QAAQK,OAAOE,MAAM,GAAG,IAAIP,MAAM;gBAClE;YACF;YACA,IAAI,CAACC,eAAe,GAAGxB;YACvB,IAAI,CAACsB,cAAc,GAAGrB;YAEtB,MAAM8B,UAAU;oBAAM,sBAAA;wBAAA,uBAAA,CAAA,QAAA,IAAI,EAACT,cAAc,cAAnB,2CAAA,0BAAA,OAAsBM,CAAAA,mBAAAA,6BAAAA,OAAQE,MAAM,aAAYP,QAAQK,OAAOE,MAAM,GAAG,IAAIP,MAAM;;YACxGK,mBAAAA,6BAAAA,OAAQI,gBAAgB,CAAC,SAASD,SAAS;gBAAEE,MAAM;YAAK;YAExD,yCAAyC;YACzC,IAAI,CAACC,OAAO,GAAGC,WAAW;oBACxB,sBAAA;iBAAA,uBAAA,CAAA,QAAA,IAAI,EAACb,cAAc,cAAnB,2CAAA,0BAAA,OAAsB,IAAIC,MAAM,CAAC,oDAAoD,EAAEI,YAAY,KAAK,QAAQ,CAAC;gBACjH,IAAI,CAACS,IAAI;YACX,GAAGT;YAEH,MAAMU,UAAU;gBACdT,mBAAAA,6BAAAA,OAAQU,mBAAmB,CAAC,SAASP;gBACrC,IAAI,IAAI,CAACG,OAAO,EAAE;oBAChBK,aAAa,IAAI,CAACL,OAAO;oBACzB,IAAI,CAACA,OAAO,GAAGM;gBACjB;YACF;YACA,qEAAqE;YACrE,MAAMC,kBAAkB,IAAI,CAACjB,eAAe;YAC5C,MAAMkB,iBAAiB,IAAI,CAACpB,cAAc;YAC1C,IAAI,CAACE,eAAe,GAAG,CAACC;gBACtBY;gBACAI,4BAAAA,sCAAAA,gBAAkBhB;YACpB;YACA,IAAI,CAACH,cAAc,GAAG,CAACd;gBACrB6B;gBACAK,2BAAAA,qCAAAA,eAAiBlC;YACnB;QACF;IACF;IAEA;;GAEC,GACD,MAAM4B,OAAsB;QAC1B,oBAAoB;QACpB,IAAI,IAAI,CAACF,OAAO,EAAE;YAChBK,aAAa,IAAI,CAACL,OAAO;YACzB,IAAI,CAACA,OAAO,GAAGM;QACjB;QAEA,mBAAmB;QACnB,IAAI,IAAI,CAACtC,MAAM,EAAE;YACf,MAAM,IAAIH,QAAc,CAACC;oBACvB;iBAAA,eAAA,IAAI,CAACE,MAAM,cAAX,mCAAA,aAAayC,KAAK,CAAC;oBACjB,IAAI,CAACnD,MAAM,CAACM,KAAK,CAAC;oBAClBE;gBACF;YACF;YACA,IAAI,CAACE,MAAM,GAAGsC;QAChB;IACF;IAEA;;GAEC,GACDI,iBAAyB;QACvB,IAAI,CAAC,IAAI,CAAC/C,IAAI,EAAE;YACd,MAAM,IAAI0B,MAAM;QAClB;QACA,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC1B,IAAI,CAAC,SAAS,CAAC;IACjD;IArMA,YAAYgD,OAAqC,CAAE;YAEnCA;QADd,IAAI,CAAChD,IAAI,GAAGgD,QAAQhD,IAAI;QACxB,IAAI,CAACL,MAAM,IAAGqD,kBAAAA,QAAQrD,MAAM,cAAdqD,6BAAAA,kBAAkBpD;IAClC;AAmMF"}

package/dist/esm/auth/rfc9728-discovery.d.ts

@@ -10,7 +10,9 @@ import type { AuthorizationServerMetadata, ProtectedResourceMetadata } from './t
  * @param resourceUrl - URL of the protected resource (e.g. `https://ai.todoist.net/mcp`).
  * @returns Discovered metadata, or `null` if none is found.
  */
-export declare function discoverProtectedResourceMetadata(resourceUrl: string): Promise<ProtectedResourceMetadata | null>;
+export declare function discoverProtectedResourceMetadata(resourceUrl: string, options?: {
+    signal?: AbortSignal;
+}): Promise<ProtectedResourceMetadata | null>;
 /**
  * Discovers RFC 8414 Authorization Server Metadata at
  * `.well-known/oauth-authorization-server`, path-local variant first.
@@ -21,6 +23,7 @@ export declare function discoverProtectedResourceMetadata(resourceUrl: string):
  */
 export declare function discoverAuthorizationServerMetadata(authServerUrl: string, options?: {
     allowLoopback?: boolean;
+    signal?: AbortSignal;
 }): Promise<AuthorizationServerMetadata | null>;
 /**
  * Discover OAuth Authorization Server Issuer from resource response (RFC 9207)
@@ -28,4 +31,6 @@ export declare function discoverAuthorizationServerMetadata(authServerUrl: strin
  * @param resourceUrl - URL of the protected resource
  * @returns Issuer URL if present in WWW-Authenticate header, null otherwise
  */
-export declare function discoverAuthorizationServerIssuer(resourceUrl: string): Promise<string | null>;
+export declare function discoverAuthorizationServerIssuer(resourceUrl: string, options?: {
+    signal?: AbortSignal;
+}): Promise<string | null>;