@mcp-z/client 2.2.4 → 2.3.0

package/dist/cjs/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/types.ts"],"sourcesContent":["/**\n * Shared types for OAuth and DCR authentication\n */\n\n/**\n * OAuth callback result from authorization server\n */\nexport interface CallbackResult {\n  /** Authorization code from OAuth server */\n  code: string;\n  /** State parameter for CSRF protection */\n  state?: string;\n  /** Issuer identifier of the authorization server that minted the response (RFC 9207) */\n  iss?: string;\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)\n * Used to secure OAuth 2.0 authorization code flow for public clients\n */\nexport interface PkceParams {\n  /** Code verifier - cryptographically random string (43-128 characters) */\n  codeVerifier: string;\n  /** Code challenge - derived from code verifier using challenge method */\n  codeChallenge: string;\n  /** Code challenge method - S256 (SHA-256) or plain */\n  codeChallengeMethod: 'S256' | 'plain';\n}\n\n/**\n * OAuth token set with access and refresh tokens\n */\nexport interface TokenSet {\n  /** Access token for API requests */\n  accessToken: string;\n  /** Refresh token for obtaining new access tokens */\n  refreshToken: string;\n  /** Timestamp when access token expires (milliseconds since epoch) */\n  expiresAt: number;\n  /** Scopes granted for this token set */\n  scopes?: string[];\n  /** Client ID used for DCR registration (stored for future use) */\n  clientId?: string;\n  /** Client secret used for DCR registration (stored for future use) */\n  clientSecret?: string;\n  /** Issuer identifier of the authorization server these credentials belong to (SEP-2352) */\n  issuer?: string;\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728)\n * Response from .well-known/oauth-protected-resource endpoint\n */\nexport interface ProtectedResourceMetadata {\n  /** The protected resource identifier */\n  resource: string;\n  /** List of authorization server URLs that can issue tokens for this resource */\n  authorization_servers: string[];\n  /** Optional list of scopes supported by this resource */\n  scopes_supported?: string[];\n  /** Optional list of bearer token methods supported (header, query, body) */\n  bearer_methods_supported?: string[];\n}\n\n/**\n * OAuth 2.0 Authorization Server Metadata (RFC 8414)\n * Response from .well-known/oauth-authorization-server endpoint\n */\nexport interface AuthorizationServerMetadata {\n  /** The authorization server's issuer identifier */\n  issuer?: string;\n  /** URL of the authorization endpoint */\n  authorization_endpoint?: string;\n  /** URL of the token endpoint */\n  token_endpoint?: string;\n  /** URL of the client registration endpoint (DCR - RFC 7591) */\n  registration_endpoint?: string;\n  /** URL of the token introspection endpoint */\n  introspection_endpoint?: string;\n  /** List of OAuth scopes supported by the authorization server */\n  scopes_supported?: string[];\n  /** Response types supported (code, token, etc.) */\n  response_types_supported?: string[];\n  /** Grant types supported (authorization_code, refresh_token, etc.) */\n  grant_types_supported?: string[];\n  /** Token endpoint authentication methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorization_response_iss_parameter_supported?: boolean;\n}\n\n/**\n * OAuth server capabilities discovered from .well-known endpoint\n */\nexport interface AuthCapabilities {\n  /** Whether the server supports Dynamic Client Registration (RFC 7591) */\n  supportsDcr: boolean;\n  /** Issuer identifier from the authorization server metadata (RFC 8414) */\n  issuer?: string;\n  /**\n   * The protected resource's canonical identifier, from the RFC 9728 metadata\n   * document's `resource` field. This is what an RFC 8707 `resource` indicator\n   * must carry, and it is the resource server's own statement of its identity -\n   * not the URL we happened to dial, and never the base URL discovery was\n   * performed against, which has any `/mcp` segment stripped off it.\n   *\n   * Absent when no protected-resource metadata was published and the\n   * authorization server was reached by direct RFC 8414 discovery instead.\n   */\n  resource?: string;\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** DCR client registration endpoint */\n  registrationEndpoint?: string;\n  /** OAuth authorization endpoint */\n  authorizationEndpoint?: string;\n  /** OAuth token endpoint */\n  tokenEndpoint?: string;\n  /** Token introspection endpoint */\n  introspectionEndpoint?: string;\n  /** Supported OAuth scopes */\n  scopes?: string[];\n}\n\n/**\n * Client credentials from DCR registration\n */\nexport interface ClientCredentials {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret */\n  clientSecret: string;\n  /** Timestamp when client was registered */\n  issuedAt?: number;\n}\n\n/**\n * Options for DCR client registration\n */\nexport interface DcrRegistrationOptions {\n  /** Redirect URI for OAuth callback, from the loopback listener the caller has already bound (RFC 8252) */\n  redirectUri: string;\n  /** Client name to register */\n  clientName?: string;\n  /**\n   * Loopback trust grant for the registration_endpoint fetch (SSRF\n   * mitigation - see `src/auth/discovery-fetch.ts`). Compute this from the\n   * MCP server the caller is actually talking to, never from\n   * `registrationEndpoint` itself (which is typically sourced from\n   * remote-controlled AS metadata). Defaults to `false`.\n   */\n  allowLoopback?: boolean;\n}\n\n/**\n * Options for OAuth authorization flow\n */\nexport interface OAuthFlowOptions {\n  /** Port for OAuth callback listener (required - use get-port to find available port) */\n  port: number;\n  /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */\n  issuer: string;\n  /** Canonical resource server URI, sent as `resource` on the authorization, token, and refresh requests (RFC 8707) */\n  resource: string;\n  /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */\n  redirectUri?: string;\n  /** OAuth scopes to request */\n  scopes?: string[];\n  /** Whether the authorization server advertises `authorization_response_iss_parameter_supported` (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */\n  pkce?: boolean;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Timeout for callback (milliseconds) */\n  timeout?: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: import('../utils/logger.ts').Logger;\n  /**\n   * Loopback trust grant for the token endpoint fetch (SSRF mitigation - see\n   * `src/auth/discovery-fetch.ts`). Compute this from the MCP server the\n   * caller is actually talking to, never from `tokenEndpoint` itself (which\n   * is typically sourced from remote-controlled AS metadata). Defaults to\n   * `false`.\n   */\n  allowLoopback?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/types.ts"],"sourcesContent":["/**\n * Shared types for OAuth and DCR authentication\n */\n\n/**\n * OAuth callback result from authorization server\n */\nexport interface CallbackResult {\n  /** Authorization code from OAuth server */\n  code: string;\n  /** State parameter for CSRF protection */\n  state?: string;\n  /** Issuer identifier of the authorization server that minted the response (RFC 9207) */\n  iss?: string;\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) parameters (RFC 7636)\n * Used to secure OAuth 2.0 authorization code flow for public clients\n */\nexport interface PkceParams {\n  /** Code verifier - cryptographically random string (43-128 characters) */\n  codeVerifier: string;\n  /** Code challenge - derived from code verifier using challenge method */\n  codeChallenge: string;\n  /** Code challenge method - S256 (SHA-256) or plain */\n  codeChallengeMethod: 'S256' | 'plain';\n}\n\n/**\n * OAuth token set with access and refresh tokens\n */\nexport interface TokenSet {\n  /** Access token for API requests */\n  accessToken: string;\n  /** Refresh token for obtaining new access tokens */\n  refreshToken: string;\n  /** Timestamp when access token expires (milliseconds since epoch) */\n  expiresAt: number;\n  /** Scopes granted for this token set */\n  scopes?: string[];\n  /** Client ID used for DCR registration (stored for future use) */\n  clientId?: string;\n  /** Client secret used for DCR registration (stored for future use) */\n  clientSecret?: string;\n  /** Issuer identifier of the authorization server these credentials belong to (SEP-2352) */\n  issuer?: string;\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728)\n * Response from .well-known/oauth-protected-resource endpoint\n */\nexport interface ProtectedResourceMetadata {\n  /** The protected resource identifier */\n  resource: string;\n  /** List of authorization server URLs that can issue tokens for this resource */\n  authorization_servers: string[];\n  /** Optional list of scopes supported by this resource */\n  scopes_supported?: string[];\n  /** Optional list of bearer token methods supported (header, query, body) */\n  bearer_methods_supported?: string[];\n}\n\n/**\n * OAuth 2.0 Authorization Server Metadata (RFC 8414)\n * Response from .well-known/oauth-authorization-server endpoint\n */\nexport interface AuthorizationServerMetadata {\n  /** The authorization server's issuer identifier */\n  issuer?: string;\n  /** URL of the authorization endpoint */\n  authorization_endpoint?: string;\n  /** URL of the token endpoint */\n  token_endpoint?: string;\n  /** URL of the client registration endpoint (DCR - RFC 7591) */\n  registration_endpoint?: string;\n  /** URL of the token introspection endpoint */\n  introspection_endpoint?: string;\n  /** List of OAuth scopes supported by the authorization server */\n  scopes_supported?: string[];\n  /** Response types supported (code, token, etc.) */\n  response_types_supported?: string[];\n  /** Grant types supported (authorization_code, refresh_token, etc.) */\n  grant_types_supported?: string[];\n  /** Token endpoint authentication methods supported */\n  token_endpoint_auth_methods_supported?: string[];\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorization_response_iss_parameter_supported?: boolean;\n}\n\n/**\n * OAuth server capabilities discovered from .well-known endpoint\n */\nexport interface AuthCapabilities {\n  /** Whether the server supports Dynamic Client Registration (RFC 7591) */\n  supportsDcr: boolean;\n  /** Issuer identifier from the authorization server metadata (RFC 8414) */\n  issuer?: string;\n  /**\n   * The protected resource's canonical identifier, from the RFC 9728 metadata\n   * document's `resource` field. This is what an RFC 8707 `resource` indicator\n   * must carry, and it is the resource server's own statement of its identity -\n   * not the URL we happened to dial, and never the base URL discovery was\n   * performed against, which has any `/mcp` segment stripped off it.\n   *\n   * Absent when no protected-resource metadata was published and the\n   * authorization server was reached by direct RFC 8414 discovery instead.\n   */\n  resource?: string;\n  /** Whether the authorization response carries an `iss` parameter (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** DCR client registration endpoint */\n  registrationEndpoint?: string;\n  /** OAuth authorization endpoint */\n  authorizationEndpoint?: string;\n  /** OAuth token endpoint */\n  tokenEndpoint?: string;\n  /** Token introspection endpoint */\n  introspectionEndpoint?: string;\n  /** Supported OAuth scopes */\n  scopes?: string[];\n}\n\n/**\n * Client credentials from DCR registration\n */\nexport interface ClientCredentials {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret */\n  clientSecret: string;\n  /** Timestamp when client was registered */\n  issuedAt?: number;\n}\n\n/**\n * Options for DCR client registration\n */\nexport interface DcrRegistrationOptions {\n  /** Redirect URI for OAuth callback, from the loopback listener the caller has already bound (RFC 8252) */\n  redirectUri: string;\n  /** Client name to register */\n  clientName?: string;\n  /**\n   * Loopback trust grant for the registration_endpoint fetch (SSRF\n   * mitigation - see `src/auth/discovery-fetch.ts`). Compute this from the\n   * MCP server the caller is actually talking to, never from\n   * `registrationEndpoint` itself (which is typically sourced from\n   * remote-controlled AS metadata). Defaults to `false`.\n   */\n  allowLoopback?: boolean;\n  /** Cancels an in-progress registration request. */\n  signal?: AbortSignal;\n}\n\n/**\n * Options for OAuth authorization flow\n */\nexport interface OAuthFlowOptions {\n  /** Cancels an in-progress authorization and closes its callback listener. */\n  signal?: AbortSignal;\n  /** Port for OAuth callback listener (required - use get-port to find available port) */\n  port: number;\n  /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */\n  issuer: string;\n  /** Canonical resource server URI, sent as `resource` on the authorization, token, and refresh requests (RFC 8707) */\n  resource: string;\n  /** Redirect URI for OAuth callback (optional - will be built from port if not provided) */\n  redirectUri?: string;\n  /** OAuth scopes to request */\n  scopes?: string[];\n  /** Whether the authorization server advertises `authorization_response_iss_parameter_supported` (RFC 9207) */\n  authorizationResponseIssSupported?: boolean;\n  /** Enable PKCE (RFC 7636) - recommended for all clients, required for public clients */\n  pkce?: boolean;\n  /** Headless mode (don't open browser) */\n  headless?: boolean;\n  /** Timeout for callback (milliseconds) */\n  timeout?: number;\n  /** Optional logger for debug output (defaults to singleton logger) */\n  logger?: import('../utils/logger.ts').Logger;\n  /**\n   * Loopback trust grant for the token endpoint fetch (SSRF mitigation - see\n   * `src/auth/discovery-fetch.ts`). Compute this from the MCP server the\n   * caller is actually talking to, never from `tokenEndpoint` itself (which\n   * is typically sourced from remote-controlled AS metadata). Defaults to\n   * `false`.\n   */\n  allowLoopback?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;CAEC,GAED;;CAEC"}

package/dist/cjs/connection/connect-client.d.cts

@@ -4,7 +4,7 @@
  * Helper to connect MCP SDK clients to servers with intelligent transport inference.
  * Automatically detects transport type from URL protocol or type field.
  */
-import type { VersionNegotiationOptions } from '@modelcontextprotocol/client';
+import type { Transport, VersionNegotiationOptions } from '@modelcontextprotocol/client';
 import { Client } from '@modelcontextprotocol/client';
 import { type DcrAuthenticatorOptions } from '../dcr/index.js';
 import type { ServerProcess } from '../spawn/spawn-server.js';
@@ -18,6 +18,12 @@ interface RegistryLike {
     servers: Map<string, ServerProcess>;
 }
 import { type Logger } from '../utils/logger.js';
+/** @internal - Bounds work by aborting the actual request signal at the deadline. */
+export declare function withAbortTimeout<T>(operationFn: (signal: AbortSignal) => Promise<T>, ms: number, operation: string, parentSignal?: AbortSignal): Promise<T>;
+/** @internal - Connects a transport with a deadline that aborts and cleans up the actual connection. */
+export declare function connectTransportWithTimeout(client: Client, transport: Transport, ms: number, operation: string, parentSignal?: AbortSignal): Promise<void>;
+/** @internal - Connects one client/transport pair and reports any failed cleanup. */
+export declare function connectTransport(client: Client, transport: Transport, signal?: AbortSignal): Promise<void>;
 /**
  * Connect MCP SDK client to server with full readiness handling.
  * @internal - Use registry.connect() instead
@@ -65,5 +71,7 @@ export declare function connectMcpClient(registryOrConfig: RegistryLike | Server
     dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;
     logger?: Logger;
     versionNegotiation?: VersionNegotiationOptions;
+    /** Cancels readiness, authentication, and transport connection work. */
+    signal?: AbortSignal;
 }): Promise<Client>;
 export {};

package/dist/cjs/connection/connect-client.d.ts

@@ -4,7 +4,7 @@
  * Helper to connect MCP SDK clients to servers with intelligent transport inference.
  * Automatically detects transport type from URL protocol or type field.
  */
-import type { VersionNegotiationOptions } from '@modelcontextprotocol/client';
+import type { Transport, VersionNegotiationOptions } from '@modelcontextprotocol/client';
 import { Client } from '@modelcontextprotocol/client';
 import { type DcrAuthenticatorOptions } from '../dcr/index.js';
 import type { ServerProcess } from '../spawn/spawn-server.js';
@@ -18,6 +18,12 @@ interface RegistryLike {
     servers: Map<string, ServerProcess>;
 }
 import { type Logger } from '../utils/logger.js';
+/** @internal - Bounds work by aborting the actual request signal at the deadline. */
+export declare function withAbortTimeout<T>(operationFn: (signal: AbortSignal) => Promise<T>, ms: number, operation: string, parentSignal?: AbortSignal): Promise<T>;
+/** @internal - Connects a transport with a deadline that aborts and cleans up the actual connection. */
+export declare function connectTransportWithTimeout(client: Client, transport: Transport, ms: number, operation: string, parentSignal?: AbortSignal): Promise<void>;
+/** @internal - Connects one client/transport pair and reports any failed cleanup. */
+export declare function connectTransport(client: Client, transport: Transport, signal?: AbortSignal): Promise<void>;
 /**
  * Connect MCP SDK client to server with full readiness handling.
  * @internal - Use registry.connect() instead
@@ -65,5 +71,7 @@ export declare function connectMcpClient(registryOrConfig: RegistryLike | Server
     dcrAuthenticator?: Partial<DcrAuthenticatorOptions>;
     logger?: Logger;
     versionNegotiation?: VersionNegotiationOptions;
+    /** Cancels readiness, authentication, and transport connection work. */
+    signal?: AbortSignal;
 }): Promise<Client>;
 export {};

package/dist/cjs/connection/connect-client.js

@@ -7,10 +7,24 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-Object.defineProperty(exports, "connectMcpClient", {
-    enumerable: true,
-    get: function() {
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get connectMcpClient () {
         return connectMcpClient;
+    },
+    get connectTransport () {
+        return connectTransport;
+    },
+    get connectTransportWithTimeout () {
+        return connectTransportWithTimeout;
+    },
+    get withAbortTimeout () {
+        return withAbortTimeout;
     }
 });
 var _client = require("@modelcontextprotocol/client");
@@ -23,6 +37,14 @@ var _urlutilsts = require("../lib/url-utils.js");
 var _loggerts = require("../utils/logger.js");
 var _existingprocesstransportts = require("./existing-process-transport.js");
 var _waitforhttpreadyts = require("./wait-for-http-ready.js");
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -71,6 +93,14 @@ function _interop_require_default(obj) {
         default: obj
     };
 }
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
 function _object_spread(target) {
     for(var i = 1; i < arguments.length; i++){
         var source = arguments[i] != null ? arguments[i] : {};
@@ -86,6 +116,9 @@ function _object_spread(target) {
     }
     return target;
 }
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -185,33 +218,232 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
-/**
- * Wrap promise with timeout - throws if promise takes too long
- * Clears timeout when promise completes to prevent hanging event loop
- * @param promise - Promise to wrap
- * @param ms - Timeout in milliseconds
- * @param operation - Description of operation for error message
- * @returns Promise result or timeout error
- */ function withTimeout(promise, ms, operation) {
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+var HTTP_CONNECTION_TIMEOUT_MS = 30000;
+var CLIENT_CLEANUP_TIMEOUT_MS = 5000;
+function withAbortTimeout(operationFn, ms, operation, parentSignal) {
+    return _async_to_generator(function() {
+        var controller, timeoutError, abortFromParent, timeoutId;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    controller = new AbortController();
+                    timeoutError = new Error("Timeout after ".concat(ms, "ms: ").concat(operation));
+                    abortFromParent = function abortFromParent() {
+                        return controller.abort(_instanceof(parentSignal === null || parentSignal === void 0 ? void 0 : parentSignal.reason, Error) ? parentSignal.reason : new Error('Connection was cancelled'));
+                    };
+                    parentSignal === null || parentSignal === void 0 ? void 0 : parentSignal.addEventListener('abort', abortFromParent, {
+                        once: true
+                    });
+                    if (parentSignal === null || parentSignal === void 0 ? void 0 : parentSignal.aborted) abortFromParent();
+                    timeoutId = setTimeout(function() {
+                        return controller.abort(timeoutError);
+                    }, ms);
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        ,
+                        3,
+                        4
+                    ]);
+                    return [
+                        4,
+                        operationFn(controller.signal)
+                    ];
+                case 2:
+                    // Preserve the operation's error unchanged: connection cleanup may have
+                    // attached failures to the original cancellation or timeout.
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+                case 3:
+                    clearTimeout(timeoutId);
+                    parentSignal === null || parentSignal === void 0 ? void 0 : parentSignal.removeEventListener('abort', abortFromParent);
+                    return [
+                        7
+                    ];
+                case 4:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+function connectTransportWithTimeout(client, transport, ms, operation, parentSignal) {
     return _async_to_generator(function() {
-        var timeoutId;
         return _ts_generator(this, function(_state) {
             return [
                 2,
-                Promise.race([
-                    promise.finally(function() {
-                        return clearTimeout(timeoutId);
-                    }),
-                    new Promise(function(_, reject) {
-                        timeoutId = setTimeout(function() {
-                            return reject(new Error("Timeout after ".concat(ms, "ms: ").concat(operation)));
-                        }, ms);
-                    })
-                ])
+                withAbortTimeout(function(signal) {
+                    return connectTransport(client, transport, signal);
+                }, ms, operation, parentSignal)
             ];
         });
     })();
 }
+function throwIfAborted(signal) {
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted) throw _instanceof(signal.reason, Error) ? signal.reason : new Error('Connection was cancelled');
+}
+function closeClientWithinTimeout(client) {
+    return _async_to_generator(function() {
+        var timeoutId;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        ,
+                        2,
+                        3
+                    ]);
+                    return [
+                        4,
+                        Promise.race([
+                            client.close(),
+                            new Promise(function(_, reject) {
+                                timeoutId = setTimeout(function() {
+                                    return reject(new Error("Client cleanup did not complete within ".concat(CLIENT_CLEANUP_TIMEOUT_MS, "ms")));
+                                }, CLIENT_CLEANUP_TIMEOUT_MS);
+                            })
+                        ])
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        3,
+                        3
+                    ];
+                case 2:
+                    if (timeoutId) clearTimeout(timeoutId);
+                    return [
+                        7
+                    ];
+                case 3:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+function rethrowAfterClientCleanup(error, clients, message) {
+    return _async_to_generator(function() {
+        var cleanup, cleanupErrors;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        Promise.allSettled(clients.map(function(client) {
+                            return closeClientWithinTimeout(client);
+                        }))
+                    ];
+                case 1:
+                    cleanup = _state.sent();
+                    cleanupErrors = cleanup.flatMap(function(result) {
+                        return result.status === 'rejected' ? [
+                            result.reason
+                        ] : [];
+                    });
+                    if (cleanupErrors.length > 0) throw new AggregateError([
+                        error
+                    ].concat(_to_consumable_array(cleanupErrors)), message, {
+                        cause: error
+                    });
+                    throw error;
+            }
+        });
+    })();
+}
+function connectTransport(client, transport, signal) {
+    return _async_to_generator(function() {
+        var abortHandler, connecting, aborted, error;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        5,
+                        7,
+                        8
+                    ]);
+                    throwIfAborted(signal);
+                    connecting = client.connect(transport);
+                    if (!signal) return [
+                        3,
+                        2
+                    ];
+                    aborted = new Promise(function(_, reject) {
+                        abortHandler = function abortHandler() {
+                            return reject(_instanceof(signal.reason, Error) ? signal.reason : new Error('Connection was cancelled'));
+                        };
+                        signal.addEventListener('abort', abortHandler, {
+                            once: true
+                        });
+                    });
+                    return [
+                        4,
+                        Promise.race([
+                            connecting,
+                            aborted
+                        ])
+                    ];
+                case 1:
+                    _state.sent();
+                    return [
+                        3,
+                        4
+                    ];
+                case 2:
+                    return [
+                        4,
+                        connecting
+                    ];
+                case 3:
+                    _state.sent();
+                    _state.label = 4;
+                case 4:
+                    return [
+                        3,
+                        8
+                    ];
+                case 5:
+                    error = _state.sent();
+                    return [
+                        4,
+                        rethrowAfterClientCleanup(error, [
+                            client
+                        ], 'MCP connection failed and client cleanup also failed')
+                    ];
+                case 6:
+                    _state.sent();
+                    return [
+                        3,
+                        8
+                    ];
+                case 7:
+                    if (signal && abortHandler) signal.removeEventListener('abort', abortHandler);
+                    return [
+                        7
+                    ];
+                case 8:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
 /**
  * Infer transport type from server configuration with validation.
  *
@@ -253,7 +485,7 @@ function _ts_generator(thisArg, body) {
 }
 function connectMcpClient(registryOrConfig, serverName, options) {
     return _async_to_generator(function() {
-        var _ref, isRegistry, serversConfig, registry, logger, serverConfig, available, transportType, clientOptions, client, serverHandle, transport, transport1, isSpawnedHttp, url, mcpServerUrl, capabilities, authToken, port, redirectUri, authenticator, tokens, staticHeaders, dcrHeaders, mergedHeaders, transportOptions, transport2, error, errorMessage, cause, isConnectionRefused, shouldFallback, sseClient, staticHeaders1, dcrHeaders1, mergedHeaders1, sseTransportOptions, sseTransport, sseError;
+        var _ref, isRegistry, serversConfig, registry, logger, serverConfig, available, transportType, clientOptions, client, serverHandle, transport, transport1, isSpawnedHttp, url, mcpServerUrl, capabilities, authToken, port, redirectUri, authenticator, tokens, staticHeaders, dcrHeaders, mergedHeaders, transportOptions, transport2, error, _options_signal, errorMessage, cause, isConnectionRefused, unavailable, shouldFallback, sseClient, staticHeaders1, dcrHeaders1, mergedHeaders1, sseTransportOptions, sseTransport;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -262,6 +494,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     serversConfig = isRegistry ? registryOrConfig.config : registryOrConfig;
                     registry = isRegistry ? registryOrConfig : undefined;
                     logger = (_ref = options === null || options === void 0 ? void 0 : options.logger) !== null && _ref !== void 0 ? _ref : _loggerts.logger;
+                    throwIfAborted(options === null || options === void 0 ? void 0 : options.signal);
                     serverConfig = serversConfig[serverName];
                     if (!serverConfig) {
                         available = Object.keys(serversConfig).join(', ');
@@ -297,7 +530,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     transport = new _existingprocesstransportts.ExistingProcessTransport(serverHandle.process);
                     return [
                         4,
-                        client.connect(transport)
+                        connectTransport(client, transport, options === null || options === void 0 ? void 0 : options.signal)
                     ];
                 case 1:
                     _state.sent();
@@ -319,7 +552,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     // client.connect() performs initialize handshake - when it resolves, server is ready
                     return [
                         4,
-                        client.connect(transport1)
+                        connectTransport(client, transport1, options === null || options === void 0 ? void 0 : options.signal)
                     ];
                 case 3:
                     _state.sent();
@@ -327,12 +560,12 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                 case 4:
                     return [
                         3,
-                        22
+                        16
                     ];
                 case 5:
                     if (!(transportType === 'http')) return [
                         3,
-                        22
+                        16
                     ];
                     if (!('url' in serverConfig) || !serverConfig.url) {
                         throw new Error("Server '".concat(serverName, "' has http transport but missing 'url' field"));
@@ -347,7 +580,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     logger.debug("[connectMcpClient] waiting for HTTP server '".concat(serverName, "' at ").concat(serverConfig.url));
                     return [
                         4,
-                        (0, _waitforhttpreadyts.waitForHttpReady)(serverConfig.url)
+                        (0, _waitforhttpreadyts.waitForHttpReady)(serverConfig.url, 30000, options === null || options === void 0 ? void 0 : options.signal)
                     ];
                 case 6:
                     _state.sent();
@@ -365,7 +598,11 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     mcpServerUrl = (0, _urlutilsts.normalizeUrl)(serverConfig.url);
                     return [
                         4,
-                        withTimeout((0, _indexts.probeAuthCapabilities)(mcpServerUrl), _constantsts.DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery')
+                        withAbortTimeout(function(signal) {
+                            return (0, _indexts.probeAuthCapabilities)(mcpServerUrl, {
+                                signal: signal
+                            });
+                        }, _constantsts.DCR_CAPABILTY_DISCOVERY_TIMEOUT, 'DCR capability discovery', options === null || options === void 0 ? void 0 : options.signal)
                     ];
                 case 8:
                     capabilities = _state.sent();
@@ -389,7 +626,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     }, options === null || options === void 0 ? void 0 : options.dcrAuthenticator));
                     return [
                         4,
-                        authenticator.ensureAuthenticated(mcpServerUrl, capabilities)
+                        authenticator.ensureAuthenticated(mcpServerUrl, capabilities, options === null || options === void 0 ? void 0 : options.signal)
                     ];
                 case 10:
                     tokens = _state.sent();
@@ -407,7 +644,7 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                         12,
                         14,
                         ,
-                        22
+                        16
                     ]);
                     // Try modern Streamable HTTP first (protocol version 2025-03-26)
                     // Merge static headers from config with DCR auth headers (DCR Authorization takes precedence)
@@ -426,16 +663,19 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     // This is safe at runtime - the undefined is valid per MCP spec
                     return [
                         4,
-                        withTimeout(client.connect(transport2), 30000, 'StreamableHTTP connection')
+                        connectTransportWithTimeout(client, transport2, HTTP_CONNECTION_TIMEOUT_MS, 'StreamableHTTP connection', options === null || options === void 0 ? void 0 : options.signal)
                     ];
                 case 13:
                     _state.sent();
                     return [
                         3,
-                        22
+                        16
                     ];
                 case 14:
                     error = _state.sent();
+                    // Cancellation and cleanup failures must reach the caller; neither can
+                    // safely be converted into an SSE fallback attempt.
+                    if ((options === null || options === void 0 ? void 0 : (_options_signal = options.signal) === null || _options_signal === void 0 ? void 0 : _options_signal.aborted) || _instanceof(error, AggregateError)) throw error;
                     // Fall back to SSE transport (MCP protocol version 2024-11-05)
                     // SSE is a standard MCP transport used by many servers (e.g., FastMCP ecosystem)
                     errorMessage = _instanceof(error, Error) ? error.message : String(error);
@@ -443,19 +683,12 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                     // Check error.cause.code for ECONNREFUSED (fetch errors wrap the actual error in cause)
                     cause = _instanceof(error, Error) ? error.cause : undefined;
                     isConnectionRefused = (cause === null || cause === void 0 ? void 0 : cause.code) === 'ECONNREFUSED' || errorMessage.includes('Connection refused');
-                    if (!isConnectionRefused) return [
-                        3,
-                        16
-                    ];
-                    // Clean up client resources before throwing
-                    return [
-                        4,
-                        client.close().catch(function() {})
-                    ];
-                case 15:
-                    _state.sent();
-                    throw new Error("Server not running at ".concat(url));
-                case 16:
+                    if (isConnectionRefused) {
+                        unavailable = new Error("Server not running at ".concat(url), {
+                            cause: error
+                        });
+                        throw unavailable;
+                    }
                     // Check for known errors that indicate SSE fallback is needed
                     shouldFallback = errorMessage.includes('Missing session ID') || // FastMCP specific
                     errorMessage.includes('404') || // Server doesn't have streamable HTTP endpoint
@@ -483,44 +716,18 @@ function connectMcpClient(registryOrConfig, serverName, options) {
                         }
                     } : undefined;
                     sseTransport = new _client.SSEClientTransport(url, sseTransportOptions);
-                    _state.label = 17;
-                case 17:
-                    _state.trys.push([
-                        17,
-                        19,
-                        ,
-                        21
-                    ]);
                     return [
                         4,
-                        withTimeout(sseClient.connect(sseTransport), 30000, 'SSE connection')
+                        connectTransportWithTimeout(sseClient, sseTransport, HTTP_CONNECTION_TIMEOUT_MS, 'SSE connection', options === null || options === void 0 ? void 0 : options.signal)
                     ];
-                case 18:
+                case 15:
                     _state.sent();
                     // Return SSE client instead of original
                     return [
                         2,
                         sseClient
                     ];
-                case 19:
-                    sseError = _state.sent();
-                    // SSE connection failed - clean up both clients before throwing
-                    return [
-                        4,
-                        Promise.all([
-                            client.close().catch(function() {}),
-                            sseClient.close().catch(function() {})
-                        ])
-                    ];
-                case 20:
-                    _state.sent();
-                    throw sseError;
-                case 21:
-                    return [
-                        3,
-                        22
-                    ];
-                case 22:
+                case 16:
                     return [
                         2,
                         client