@olaservo/mcp-sdk 1.25.2-sep834

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Anthropic, PBC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,169 @@
+# MCP TypeScript SDK [![NPM Version](https://img.shields.io/npm/v/%40modelcontextprotocol%2Fsdk)](https://www.npmjs.com/package/@modelcontextprotocol/sdk) [![MIT licensed](https://img.shields.io/npm/l/%40modelcontextprotocol%2Fsdk)](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/LICENSE)
+
+<details>
+<summary>Table of Contents</summary>
+
+- [Overview](#overview)
+- [Installation](#installation)
+- [Quick Start](#quick-start)
+- [Core Concepts](#core-concepts)
+- [Examples](#examples)
+- [Documentation](#documentation)
+- [Contributing](#contributing)
+- [License](#license)
+
+</details>
+
+## Overview
+
+The Model Context Protocol allows applications to provide context for LLMs in a standardized way, separating the concerns of providing context from the actual LLM interaction. This TypeScript SDK implements
+[the full MCP specification](https://modelcontextprotocol.io/specification/draft), making it easy to:
+
+- Create MCP servers that expose resources, prompts and tools
+- Build MCP clients that can connect to any MCP server
+- Use standard transports like stdio and Streamable HTTP
+
+## Installation
+
+```bash
+npm install @modelcontextprotocol/sdk zod
+```
+
+This SDK has a **required peer dependency** on `zod` for schema validation. The SDK internally imports from `zod/v4`, but maintains backwards compatibility with projects using Zod v3.25 or later. You can use either API in your code by importing from `zod/v3` or `zod/v4`:
+
+## Quick Start
+
+To see the SDK in action end-to-end, start from the runnable examples in `src/examples`:
+
+1. **Install dependencies** (from the SDK repo root):
+
+    ```bash
+    npm install
+    ```
+
+2. **Run the example Streamable HTTP server**:
+
+    ```bash
+    npx tsx src/examples/server/simpleStreamableHttp.ts
+    ```
+
+3. **Run the interactive client in another terminal**:
+
+    ```bash
+    npx tsx src/examples/client/simpleStreamableHttp.ts
+    ```
+
+This pair of examples demonstrates tools, resources, prompts, sampling, elicitation, tasks and logging. For a guided walkthrough and variations (stateless servers, JSON-only responses, SSE compatibility, OAuth, etc.), see [docs/server.md](docs/server.md) and
+[docs/client.md](docs/client.md).
+
+## Core Concepts
+
+### Servers and transports
+
+An MCP server is typically created with `McpServer` and connected to a transport such as Streamable HTTP or stdio. The SDK supports:
+
+- **Streamable HTTP** for remote servers (recommended).
+- **HTTP + SSE** for backwards compatibility only.
+- **stdio** for local, process-spawned integrations.
+
+Runnable server examples live under `src/examples/server` and are documented in [docs/server.md](docs/server.md).
+
+### Tools, resources, prompts
+
+- **Tools** let LLMs ask your server to take actions (computation, side effects, network calls).
+- **Resources** expose read-only data that clients can surface to users or models.
+- **Prompts** are reusable templates that help users talk to models in a consistent way.
+
+The detailed APIs, including `ResourceTemplate`, completions, and display-name metadata, are covered in [docs/server.md](docs/server.md#tools-resources-and-prompts), with runnable implementations in [`simpleStreamableHttp.ts`](src/examples/server/simpleStreamableHttp.ts).
+
+### Capabilities: sampling, elicitation, and tasks
+
+The SDK includes higher-level capabilities for richer workflows:
+
+- **Sampling**: server-side tools can ask connected clients to run LLM completions.
+- **Form elicitation**: tools can request non-sensitive input via structured forms.
+- **URL elicitation**: servers can ask users to complete secure flows in a browser (e.g., API key entry, payments, OAuth).
+- **Tasks (experimental)**: long-running tool calls can be turned into tasks that you poll or resume later.
+
+Conceptual overviews and links to runnable examples are in:
+
+- [docs/capabilities.md](docs/capabilities.md)
+
+Key example servers include:
+
+- [`toolWithSampleServer.ts`](src/examples/server/toolWithSampleServer.ts)
+- [`elicitationFormExample.ts`](src/examples/server/elicitationFormExample.ts)
+- [`elicitationUrlExample.ts`](src/examples/server/elicitationUrlExample.ts)
+
+### Clients
+
+The high-level `Client` class connects to MCP servers over different transports and exposes helpers like `listTools`, `callTool`, `listResources`, `readResource`, `listPrompts`, and `getPrompt`.
+
+Runnable clients live under `src/examples/client` and are described in [docs/client.md](docs/client.md), including:
+
+- Interactive Streamable HTTP client ([`simpleStreamableHttp.ts`](src/examples/client/simpleStreamableHttp.ts))
+- Streamable HTTP client with SSE fallback ([`streamableHttpWithSseFallbackClient.ts`](src/examples/client/streamableHttpWithSseFallbackClient.ts))
+- OAuth-enabled clients and polling/parallel examples
+
+### Node.js Web Crypto (globalThis.crypto) compatibility
+
+Some parts of the SDK (for example, JWT-based client authentication in `auth-extensions.ts` via `jose`) rely on the Web Crypto API exposed as `globalThis.crypto`.
+
+See [docs/faq.md](docs/faq.md) for details on supported Node.js versions and how to polyfill `globalThis.crypto` when running on older Node.js runtimes.
+
+## Examples
+
+The SDK ships runnable examples under `src/examples`. Use these tables to find the scenario you care about and jump straight to the corresponding code and docs.
+
+### Server examples
+
+| Scenario                                            | Description                                                                                       | Example file(s)                                                                                          | Related docs                                                             |
+| --------------------------------------------------- | ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| Streamable HTTP server (stateful)                   | Feature-rich server with tools, resources, prompts, logging, tasks, sampling, and optional OAuth. | [`simpleStreamableHttp.ts`](src/examples/server/simpleStreamableHttp.ts)                                 | [`server.md`](docs/server.md), [`capabilities.md`](docs/capabilities.md) |
+| Streamable HTTP server (stateless)                  | No session tracking; good for simple API-style servers.                                           | [`simpleStatelessStreamableHttp.ts`](src/examples/server/simpleStatelessStreamableHttp.ts)               | [`server.md`](docs/server.md)                                            |
+| JSON response mode (no SSE)                         | Streamable HTTP with JSON responses only and limited notifications.                               | [`jsonResponseStreamableHttp.ts`](src/examples/server/jsonResponseStreamableHttp.ts)                     | [`server.md`](docs/server.md)                                            |
+| Server notifications over Streamable HTTP           | Demonstrates server-initiated notifications using SSE with Streamable HTTP.                       | [`standaloneSseWithGetStreamableHttp.ts`](src/examples/server/standaloneSseWithGetStreamableHttp.ts)     | [`server.md`](docs/server.md)                                            |
+| Deprecated HTTP+SSE server                          | Legacy HTTP+SSE transport for backwards-compatibility testing.                                    | [`simpleSseServer.ts`](src/examples/server/simpleSseServer.ts)                                           | [`server.md`](docs/server.md)                                            |
+| Backwards-compatible server (Streamable HTTP + SSE) | Single server that supports both Streamable HTTP and legacy SSE clients.                          | [`sseAndStreamableHttpCompatibleServer.ts`](src/examples/server/sseAndStreamableHttpCompatibleServer.ts) | [`server.md`](docs/server.md)                                            |
+| Form elicitation server                             | Uses form elicitation to collect non-sensitive user input.                                        | [`elicitationFormExample.ts`](src/examples/server/elicitationFormExample.ts)                             | [`capabilities.md`](docs/capabilities.md#elicitation)                    |
+| URL elicitation server                              | Demonstrates URL-mode elicitation in an OAuth-protected server.                                   | [`elicitationUrlExample.ts`](src/examples/server/elicitationUrlExample.ts)                               | [`capabilities.md`](docs/capabilities.md#elicitation)                    |
+| Sampling and tasks server                           | Combines tools, logging, sampling, and experimental task-based execution.                         | [`toolWithSampleServer.ts`](src/examples/server/toolWithSampleServer.ts)                                 | [`capabilities.md`](docs/capabilities.md)                                |
+| OAuth demo authorization server                     | In-memory OAuth provider used with the example servers.                                           | [`demoInMemoryOAuthProvider.ts`](src/examples/server/demoInMemoryOAuthProvider.ts)                       | [`server.md`](docs/server.md)                                            |
+
+### Client examples
+
+| Scenario                                            | Description                                                                        | Example file(s)                                                                                                                                                                                                                        | Related docs                                                 |
+| --------------------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| Interactive Streamable HTTP client                  | CLI client that exercises tools, resources, prompts, elicitation, and tasks.       | [`simpleStreamableHttp.ts`](src/examples/client/simpleStreamableHttp.ts)                                                                                                                                                               | [`client.md`](docs/client.md)                                |
+| Backwards-compatible client (Streamable HTTP → SSE) | Tries Streamable HTTP first, then falls back to SSE on 4xx responses.              | [`streamableHttpWithSseFallbackClient.ts`](src/examples/client/streamableHttpWithSseFallbackClient.ts)                                                                                                                                 | [`client.md`](docs/client.md), [`server.md`](docs/server.md) |
+| SSE polling client                                  | Polls a legacy SSE server and demonstrates notification handling.                  | [`ssePollingClient.ts`](src/examples/client/ssePollingClient.ts)                                                                                                                                                                       | [`client.md`](docs/client.md)                                |
+| Parallel tool calls client                          | Shows how to run multiple tool calls in parallel.                                  | [`parallelToolCallsClient.ts`](src/examples/client/parallelToolCallsClient.ts)                                                                                                                                                         | [`client.md`](docs/client.md)                                |
+| Multiple clients in parallel                        | Demonstrates connecting multiple clients concurrently to the same server.          | [`multipleClientsParallel.ts`](src/examples/client/multipleClientsParallel.ts)                                                                                                                                                         | [`client.md`](docs/client.md)                                |
+| OAuth clients                                       | Examples of client_credentials (basic and private_key_jwt) and reusable providers. | [`simpleOAuthClient.ts`](src/examples/client/simpleOAuthClient.ts), [`simpleOAuthClientProvider.ts`](src/examples/client/simpleOAuthClientProvider.ts), [`simpleClientCredentials.ts`](src/examples/client/simpleClientCredentials.ts) | [`client.md`](docs/client.md)                                |
+| URL elicitation client                              | Works with the URL elicitation server to drive secure browser flows.               | [`elicitationUrlExample.ts`](src/examples/client/elicitationUrlExample.ts)                                                                                                                                                             | [`capabilities.md`](docs/capabilities.md#elicitation)        |
+
+Shared utilities:
+
+- In-memory event store for resumability: [`inMemoryEventStore.ts`](src/examples/shared/inMemoryEventStore.ts) (see [`server.md`](docs/server.md)).
+
+For more details on how to run these examples (including recommended commands and deployment diagrams), see `src/examples/README.md`.
+
+## Documentation
+
+- Local SDK docs:
+    - [docs/server.md](docs/server.md) – building and running MCP servers, transports, tools/resources/prompts, CORS, DNS rebinding, and multi-node deployment.
+    - [docs/client.md](docs/client.md) – using the high-level client, transports, backwards compatibility, and OAuth helpers.
+    - [docs/capabilities.md](docs/capabilities.md) – sampling, elicitation (form and URL), and experimental task-based execution.
+    - [docs/faq.md](docs/faq.md) – environment and troubleshooting FAQs (including Node.js Web Crypto support).
+- External references:
+    - [Model Context Protocol documentation](https://modelcontextprotocol.io)
+    - [MCP Specification](https://spec.modelcontextprotocol.io)
+    - [Example Servers](https://github.com/modelcontextprotocol/servers)
+
+## Contributing
+
+Issues and pull requests are welcome on GitHub at <https://github.com/modelcontextprotocol/typescript-sdk>.
+
+## License
+
+This project is licensed under the MIT License—see the [LICENSE](LICENSE) file for details.

package/dist/cjs/client/auth-extensions.d.ts

@@ -0,0 +1,178 @@
+/**
+ * OAuth provider extensions for specialized authentication flows.
+ *
+ * This module provides ready-to-use OAuthClientProvider implementations
+ * for common machine-to-machine authentication scenarios.
+ */
+import { OAuthClientInformation, OAuthClientMetadata, OAuthTokens } from '../shared/auth.js';
+import { AddClientAuthentication, OAuthClientProvider } from './auth.js';
+/**
+ * Helper to produce a private_key_jwt client authentication function.
+ *
+ * Usage:
+ *   const addClientAuth = createPrivateKeyJwtAuth({ issuer, subject, privateKey, alg, audience? });
+ *   // pass addClientAuth as provider.addClientAuthentication implementation
+ */
+export declare function createPrivateKeyJwtAuth(options: {
+    issuer: string;
+    subject: string;
+    privateKey: string | Uint8Array | Record<string, unknown>;
+    alg: string;
+    audience?: string | URL;
+    lifetimeSeconds?: number;
+    claims?: Record<string, unknown>;
+}): AddClientAuthentication;
+/**
+ * Options for creating a ClientCredentialsProvider.
+ */
+export interface ClientCredentialsProviderOptions {
+    /**
+     * The client_id for this OAuth client.
+     */
+    clientId: string;
+    /**
+     * The client_secret for client_secret_basic authentication.
+     */
+    clientSecret: string;
+    /**
+     * Optional client name for metadata.
+     */
+    clientName?: string;
+}
+/**
+ * OAuth provider for client_credentials grant with client_secret_basic authentication.
+ *
+ * This provider is designed for machine-to-machine authentication where
+ * the client authenticates using a client_id and client_secret.
+ *
+ * @example
+ * const provider = new ClientCredentialsProvider({
+ *   clientId: 'my-client',
+ *   clientSecret: 'my-secret'
+ * });
+ *
+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
+ *   authProvider: provider
+ * });
+ */
+export declare class ClientCredentialsProvider implements OAuthClientProvider {
+    private _tokens?;
+    private _clientInfo;
+    private _clientMetadata;
+    constructor(options: ClientCredentialsProviderOptions);
+    get redirectUrl(): undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): OAuthClientInformation;
+    saveClientInformation(info: OAuthClientInformation): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(): void;
+    saveCodeVerifier(): void;
+    codeVerifier(): string;
+    prepareTokenRequest(scope?: string): URLSearchParams;
+}
+/**
+ * Options for creating a PrivateKeyJwtProvider.
+ */
+export interface PrivateKeyJwtProviderOptions {
+    /**
+     * The client_id for this OAuth client.
+     */
+    clientId: string;
+    /**
+     * The private key for signing JWT assertions.
+     * Can be a PEM string, Uint8Array, or JWK object.
+     */
+    privateKey: string | Uint8Array | Record<string, unknown>;
+    /**
+     * The algorithm to use for signing (e.g., 'RS256', 'ES256').
+     */
+    algorithm: string;
+    /**
+     * Optional client name for metadata.
+     */
+    clientName?: string;
+    /**
+     * Optional JWT lifetime in seconds (default: 300).
+     */
+    jwtLifetimeSeconds?: number;
+}
+/**
+ * OAuth provider for client_credentials grant with private_key_jwt authentication.
+ *
+ * This provider is designed for machine-to-machine authentication where
+ * the client authenticates using a signed JWT assertion (RFC 7523 Section 2.2).
+ *
+ * @example
+ * const provider = new PrivateKeyJwtProvider({
+ *   clientId: 'my-client',
+ *   privateKey: pemEncodedPrivateKey,
+ *   algorithm: 'RS256'
+ * });
+ *
+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
+ *   authProvider: provider
+ * });
+ */
+export declare class PrivateKeyJwtProvider implements OAuthClientProvider {
+    private _tokens?;
+    private _clientInfo;
+    private _clientMetadata;
+    addClientAuthentication: AddClientAuthentication;
+    constructor(options: PrivateKeyJwtProviderOptions);
+    get redirectUrl(): undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): OAuthClientInformation;
+    saveClientInformation(info: OAuthClientInformation): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(): void;
+    saveCodeVerifier(): void;
+    codeVerifier(): string;
+    prepareTokenRequest(scope?: string): URLSearchParams;
+}
+/**
+ * Options for creating a StaticPrivateKeyJwtProvider.
+ */
+export interface StaticPrivateKeyJwtProviderOptions {
+    /**
+     * The client_id for this OAuth client.
+     */
+    clientId: string;
+    /**
+     * A pre-built JWT client assertion to use for authentication.
+     *
+     * This token should already contain the appropriate claims
+     * (iss, sub, aud, exp, etc.) and be signed by the client's key.
+     */
+    jwtBearerAssertion: string;
+    /**
+     * Optional client name for metadata.
+     */
+    clientName?: string;
+}
+/**
+ * OAuth provider for client_credentials grant with a static private_key_jwt assertion.
+ *
+ * This provider mirrors {@link PrivateKeyJwtProvider} but instead of constructing and
+ * signing a JWT on each request, it accepts a pre-built JWT assertion string and
+ * uses it directly for authentication.
+ */
+export declare class StaticPrivateKeyJwtProvider implements OAuthClientProvider {
+    private _tokens?;
+    private _clientInfo;
+    private _clientMetadata;
+    addClientAuthentication: AddClientAuthentication;
+    constructor(options: StaticPrivateKeyJwtProviderOptions);
+    get redirectUrl(): undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): OAuthClientInformation;
+    saveClientInformation(info: OAuthClientInformation): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(): void;
+    saveCodeVerifier(): void;
+    codeVerifier(): string;
+    prepareTokenRequest(scope?: string): URLSearchParams;
+}
+//# sourceMappingURL=auth-extensions.d.ts.map

package/dist/cjs/client/auth-extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-extensions.d.ts","sourceRoot":"","sources":["../../../src/client/auth-extensions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GAAG,uBAAuB,CAgE1B;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC7C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;gBAEjC,OAAO,EAAE,gCAAgC;IAarD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IACzC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE1D;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IAC7D,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;IAC7C,uBAAuB,EAAE,uBAAuB,CAAC;gBAErC,OAAO,EAAE,4BAA4B;IAmBjD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD;AAED;;GAEG;AACH,MAAM,WAAW,kCAAkC;IAC/C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;IAC7C,uBAAuB,EAAE,uBAAuB,CAAC;gBAErC,OAAO,EAAE,kCAAkC;IAkBvD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD"}

package/dist/cjs/client/auth-extensions.js

@@ -0,0 +1,296 @@
+"use strict";
+/**
+ * OAuth provider extensions for specialized authentication flows.
+ *
+ * This module provides ready-to-use OAuthClientProvider implementations
+ * for common machine-to-machine authentication scenarios.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaticPrivateKeyJwtProvider = exports.PrivateKeyJwtProvider = exports.ClientCredentialsProvider = void 0;
+exports.createPrivateKeyJwtAuth = createPrivateKeyJwtAuth;
+/**
+ * Helper to produce a private_key_jwt client authentication function.
+ *
+ * Usage:
+ *   const addClientAuth = createPrivateKeyJwtAuth({ issuer, subject, privateKey, alg, audience? });
+ *   // pass addClientAuth as provider.addClientAuthentication implementation
+ */
+function createPrivateKeyJwtAuth(options) {
+    return async (_headers, params, url, metadata) => {
+        // Lazy import to avoid heavy dependency unless used
+        if (typeof globalThis.crypto === 'undefined') {
+            throw new TypeError('crypto is not available, please ensure you add have Web Crypto API support for older Node.js versions (see https://github.com/modelcontextprotocol/typescript-sdk#nodejs-web-crypto-globalthiscrypto-compatibility)');
+        }
+        const jose = await Promise.resolve().then(() => __importStar(require('jose')));
+        const audience = String(options.audience ?? metadata?.issuer ?? url);
+        const lifetimeSeconds = options.lifetimeSeconds ?? 300;
+        const now = Math.floor(Date.now() / 1000);
+        const jti = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+        const baseClaims = {
+            iss: options.issuer,
+            sub: options.subject,
+            aud: audience,
+            exp: now + lifetimeSeconds,
+            iat: now,
+            jti
+        };
+        const claims = options.claims ? { ...baseClaims, ...options.claims } : baseClaims;
+        // Import key for the requested algorithm
+        const alg = options.alg;
+        let key;
+        if (typeof options.privateKey === 'string') {
+            if (alg.startsWith('RS') || alg.startsWith('ES') || alg.startsWith('PS')) {
+                key = await jose.importPKCS8(options.privateKey, alg);
+            }
+            else if (alg.startsWith('HS')) {
+                key = new TextEncoder().encode(options.privateKey);
+            }
+            else {
+                throw new Error(`Unsupported algorithm ${alg}`);
+            }
+        }
+        else if (options.privateKey instanceof Uint8Array) {
+            if (alg.startsWith('HS')) {
+                key = options.privateKey;
+            }
+            else {
+                // Assume PKCS#8 DER in Uint8Array for asymmetric algorithms
+                key = await jose.importPKCS8(new TextDecoder().decode(options.privateKey), alg);
+            }
+        }
+        else {
+            // Treat as JWK
+            key = await jose.importJWK(options.privateKey, alg);
+        }
+        // Sign JWT
+        const assertion = await new jose.SignJWT(claims)
+            .setProtectedHeader({ alg, typ: 'JWT' })
+            .setIssuer(options.issuer)
+            .setSubject(options.subject)
+            .setAudience(audience)
+            .setIssuedAt(now)
+            .setExpirationTime(now + lifetimeSeconds)
+            .setJti(jti)
+            .sign(key);
+        params.set('client_assertion', assertion);
+        params.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+    };
+}
+/**
+ * OAuth provider for client_credentials grant with client_secret_basic authentication.
+ *
+ * This provider is designed for machine-to-machine authentication where
+ * the client authenticates using a client_id and client_secret.
+ *
+ * @example
+ * const provider = new ClientCredentialsProvider({
+ *   clientId: 'my-client',
+ *   clientSecret: 'my-secret'
+ * });
+ *
+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
+ *   authProvider: provider
+ * });
+ */
+class ClientCredentialsProvider {
+    constructor(options) {
+        this._clientInfo = {
+            client_id: options.clientId,
+            client_secret: options.clientSecret
+        };
+        this._clientMetadata = {
+            client_name: options.clientName ?? 'client-credentials-client',
+            redirect_uris: [],
+            grant_types: ['client_credentials'],
+            token_endpoint_auth_method: 'client_secret_basic'
+        };
+    }
+    get redirectUrl() {
+        return undefined;
+    }
+    get clientMetadata() {
+        return this._clientMetadata;
+    }
+    clientInformation() {
+        return this._clientInfo;
+    }
+    saveClientInformation(info) {
+        this._clientInfo = info;
+    }
+    tokens() {
+        return this._tokens;
+    }
+    saveTokens(tokens) {
+        this._tokens = tokens;
+    }
+    redirectToAuthorization() {
+        throw new Error('redirectToAuthorization is not used for client_credentials flow');
+    }
+    saveCodeVerifier() {
+        // Not used for client_credentials
+    }
+    codeVerifier() {
+        throw new Error('codeVerifier is not used for client_credentials flow');
+    }
+    prepareTokenRequest(scope) {
+        const params = new URLSearchParams({ grant_type: 'client_credentials' });
+        if (scope)
+            params.set('scope', scope);
+        return params;
+    }
+}
+exports.ClientCredentialsProvider = ClientCredentialsProvider;
+/**
+ * OAuth provider for client_credentials grant with private_key_jwt authentication.
+ *
+ * This provider is designed for machine-to-machine authentication where
+ * the client authenticates using a signed JWT assertion (RFC 7523 Section 2.2).
+ *
+ * @example
+ * const provider = new PrivateKeyJwtProvider({
+ *   clientId: 'my-client',
+ *   privateKey: pemEncodedPrivateKey,
+ *   algorithm: 'RS256'
+ * });
+ *
+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
+ *   authProvider: provider
+ * });
+ */
+class PrivateKeyJwtProvider {
+    constructor(options) {
+        this._clientInfo = {
+            client_id: options.clientId
+        };
+        this._clientMetadata = {
+            client_name: options.clientName ?? 'private-key-jwt-client',
+            redirect_uris: [],
+            grant_types: ['client_credentials'],
+            token_endpoint_auth_method: 'private_key_jwt'
+        };
+        this.addClientAuthentication = createPrivateKeyJwtAuth({
+            issuer: options.clientId,
+            subject: options.clientId,
+            privateKey: options.privateKey,
+            alg: options.algorithm,
+            lifetimeSeconds: options.jwtLifetimeSeconds
+        });
+    }
+    get redirectUrl() {
+        return undefined;
+    }
+    get clientMetadata() {
+        return this._clientMetadata;
+    }
+    clientInformation() {
+        return this._clientInfo;
+    }
+    saveClientInformation(info) {
+        this._clientInfo = info;
+    }
+    tokens() {
+        return this._tokens;
+    }
+    saveTokens(tokens) {
+        this._tokens = tokens;
+    }
+    redirectToAuthorization() {
+        throw new Error('redirectToAuthorization is not used for client_credentials flow');
+    }
+    saveCodeVerifier() {
+        // Not used for client_credentials
+    }
+    codeVerifier() {
+        throw new Error('codeVerifier is not used for client_credentials flow');
+    }
+    prepareTokenRequest(scope) {
+        const params = new URLSearchParams({ grant_type: 'client_credentials' });
+        if (scope)
+            params.set('scope', scope);
+        return params;
+    }
+}
+exports.PrivateKeyJwtProvider = PrivateKeyJwtProvider;
+/**
+ * OAuth provider for client_credentials grant with a static private_key_jwt assertion.
+ *
+ * This provider mirrors {@link PrivateKeyJwtProvider} but instead of constructing and
+ * signing a JWT on each request, it accepts a pre-built JWT assertion string and
+ * uses it directly for authentication.
+ */
+class StaticPrivateKeyJwtProvider {
+    constructor(options) {
+        this._clientInfo = {
+            client_id: options.clientId
+        };
+        this._clientMetadata = {
+            client_name: options.clientName ?? 'static-private-key-jwt-client',
+            redirect_uris: [],
+            grant_types: ['client_credentials'],
+            token_endpoint_auth_method: 'private_key_jwt'
+        };
+        const assertion = options.jwtBearerAssertion;
+        this.addClientAuthentication = async (_headers, params) => {
+            params.set('client_assertion', assertion);
+            params.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+        };
+    }
+    get redirectUrl() {
+        return undefined;
+    }
+    get clientMetadata() {
+        return this._clientMetadata;
+    }
+    clientInformation() {
+        return this._clientInfo;
+    }
+    saveClientInformation(info) {
+        this._clientInfo = info;
+    }
+    tokens() {
+        return this._tokens;
+    }
+    saveTokens(tokens) {
+        this._tokens = tokens;
+    }
+    redirectToAuthorization() {
+        throw new Error('redirectToAuthorization is not used for client_credentials flow');
+    }
+    saveCodeVerifier() {
+        // Not used for client_credentials
+    }
+    codeVerifier() {
+        throw new Error('codeVerifier is not used for client_credentials flow');
+    }
+    prepareTokenRequest(scope) {
+        const params = new URLSearchParams({ grant_type: 'client_credentials' });
+        if (scope)
+            params.set('scope', scope);
+        return params;
+    }
+}
+exports.StaticPrivateKeyJwtProvider = StaticPrivateKeyJwtProvider;
+//# sourceMappingURL=auth-extensions.js.map