@pentoshi/clai 4.10.2 → 4.11.0

package/dist/mcp/auth/provider.js

@@ -0,0 +1,372 @@
+import { McpTransportError } from "../transport.js";
+import { buildProtectedResourceMetadataUrl, discoverAuthorizationServerMetadata, discoverProtectedResourceMetadata, } from "./metadata.js";
+import { createPkcePair } from "./pkce.js";
+import { registerOAuthClient } from "./registration.js";
+import { runLoopbackAuthorization, } from "./loopback.js";
+import { canonicalResourceUri } from "./security.js";
+import { findGithubCredential, githubCredentialHint, isGithubHost, } from "./host-credentials.js";
+import { exchangeAuthorizationCode, refreshAccessToken, } from "./token-exchange.js";
+import { defaultOAuthTokenStore, oauthTokenKey } from "./token-store.js";
+const REFRESH_SKEW_MS = 60_000;
+const DEFAULT_CLIENT_NAME = "clai";
+function bearerHeader(tokenType, accessToken) {
+    const raw = tokenType.trim();
+    const scheme = raw.length === 0 || raw.toLowerCase() === "bearer" ? "Bearer" : raw;
+    return { authorization: `${scheme} ${accessToken}` };
+}
+class NoAuthProvider {
+    kind = "none";
+    async headers() {
+        return {};
+    }
+    async onUnauthorized() {
+        return false;
+    }
+    liveSecrets() {
+        return [];
+    }
+}
+class BearerAuthProvider {
+    token;
+    kind = "bearer";
+    constructor(token) {
+        this.token = token;
+    }
+    async headers() {
+        return bearerHeader("Bearer", this.token);
+    }
+    async onUnauthorized() {
+        return false;
+    }
+    liveSecrets() {
+        return this.token.length > 0 ? [this.token] : [];
+    }
+}
+class HeaderAuthProvider {
+    staticHeaders;
+    kind = "header";
+    constructor(staticHeaders) {
+        this.staticHeaders = staticHeaders;
+    }
+    async headers() {
+        return { ...this.staticHeaders };
+    }
+    async onUnauthorized() {
+        return false;
+    }
+    liveSecrets() {
+        return Object.values(this.staticHeaders).filter((value) => value.length > 0);
+    }
+}
+class OAuthProvider {
+    config;
+    deps;
+    kind = "oauth";
+    cached;
+    metadata;
+    issuer;
+    clientId;
+    clientSecret;
+    scope;
+    resource;
+    warmed = false;
+    inFlight;
+    store;
+    constructor(config, deps) {
+        this.config = config;
+        this.deps = deps;
+        this.resource = canonicalResourceUri(config.resource ?? deps.serverUrl);
+        this.store = deps.tokenStore ?? defaultOAuthTokenStore;
+        this.clientId = config.clientId;
+        this.clientSecret = config.clientSecret;
+    }
+    now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    metadataDeps() {
+        return {
+            ...(this.deps.fetchImpl ? { fetchImpl: this.deps.fetchImpl } : {}),
+            ...(this.deps.validateUrl ? { validateUrl: this.deps.validateUrl } : {}),
+        };
+    }
+    tokenDeps() {
+        return this.metadataDeps();
+    }
+    isValid(tokens) {
+        if (tokens.expiresAt === undefined)
+            return true;
+        return tokens.expiresAt - this.now() > REFRESH_SKEW_MS;
+    }
+    async headers() {
+        const tokens = (await this.warmCached()) ?? this.cached;
+        if (!tokens)
+            return {};
+        if (this.isValid(tokens))
+            return bearerHeader(tokens.tokenType, tokens.accessToken);
+        if (tokens.refreshToken && this.metadata) {
+            const refreshed = await this.tryRefresh(tokens).catch(() => undefined);
+            if (refreshed)
+                return bearerHeader(refreshed.tokenType, refreshed.accessToken);
+        }
+        return {};
+    }
+    async warmCached() {
+        if (this.cached)
+            return this.cached;
+        if (this.warmed)
+            return undefined;
+        this.warmed = true;
+        const stored = await this.store
+            .loadForResource?.(this.resource)
+            .catch(() => undefined);
+        if (stored) {
+            this.applyStoredClient(stored);
+            this.cached = stored;
+            return stored;
+        }
+        return this.adoptHostCredential();
+    }
+    async adoptHostCredential() {
+        const credential = await findGithubCredential(this.deps.serverUrl, this.hostCredentialDeps()).catch(() => undefined);
+        if (!credential)
+            return undefined;
+        this.cached = { accessToken: credential.token, tokenType: "Bearer" };
+        return this.cached;
+    }
+    hostCredentialDeps() {
+        return {
+            ...(this.deps.env ? { env: this.deps.env } : {}),
+            ...(this.deps.readHostToken ? { readCliToken: this.deps.readHostToken } : {}),
+        };
+    }
+    canInteract() {
+        return this.deps.interactive !== false && typeof this.deps.openBrowser === "function";
+    }
+    reauthMessage() {
+        return (`MCP server ${this.deps.serverUrl} requires OAuth sign-in and no browser is available here. ` +
+            "Re-authenticate in an interactive session with /mcp login or the mcp.login tool.");
+    }
+    missingClientMessage() {
+        const issuer = this.issuer ?? "its authorization server";
+        const remedy = isGithubHost(this.deps.serverUrl)
+            ? `${githubCredentialHint()}, or add a token explicitly — `
+            : "Add a token instead — ";
+        return (`MCP server ${this.deps.serverUrl} cannot complete OAuth: ${issuer} does not support ` +
+            `dynamic client registration, so clai has no client to sign in with. ${remedy}` +
+            '"auth": {"kind": "bearer", "token": "${env:YOUR_TOKEN}"} — ' +
+            'or register an OAuth app and set "auth": {"kind": "oauth", "clientId": "…"} ' +
+            "in the server entry of .clai/mcp.json.");
+    }
+    async discoverEndpoints(challenge) {
+        const metadataUrl = challenge?.resourceMetadataUrl ?? buildProtectedResourceMetadataUrl(this.resource);
+        const prm = await discoverProtectedResourceMetadata(metadataUrl, this.metadataDeps());
+        if (prm.resource)
+            this.resource = canonicalResourceUri(prm.resource);
+        const issuer = this.config.authorizationServer ?? prm.authorizationServers[0];
+        const metadata = await discoverAuthorizationServerMetadata(issuer, this.metadataDeps());
+        return { issuer, metadata, scopes: prm.scopesSupported };
+    }
+    cacheMetadata(issuer, metadata) {
+        this.issuer = issuer;
+        this.metadata = metadata;
+    }
+    resolveScope(prmScopes, metadata, challenge) {
+        if (this.config.scopes && this.config.scopes.length > 0)
+            return this.config.scopes.join(" ");
+        if (challenge?.scope)
+            return challenge.scope;
+        if (prmScopes.length > 0)
+            return prmScopes.join(" ");
+        if (metadata.scopesSupported.length > 0)
+            return metadata.scopesSupported.join(" ");
+        return undefined;
+    }
+    async reuseStored(issuer) {
+        const stored = await this.store.load(oauthTokenKey(this.resource, issuer));
+        if (!stored)
+            return false;
+        this.applyStoredClient(stored);
+        if (this.isValid(stored)) {
+            this.cached = stored;
+            return true;
+        }
+        this.cached = stored;
+        return false;
+    }
+    applyStoredClient(stored) {
+        if (!this.clientId && stored.clientId)
+            this.clientId = stored.clientId;
+        if (!this.clientSecret && stored.clientSecret)
+            this.clientSecret = stored.clientSecret;
+        if (!this.scope && stored.scope)
+            this.scope = stored.scope;
+    }
+    async refreshStored(issuer, metadata, scope) {
+        const tokens = this.cached;
+        if (!tokens?.refreshToken || !this.clientId)
+            return false;
+        this.scope = scope ?? this.scope;
+        const refreshed = await this.tryRefresh(tokens).catch(() => undefined);
+        return refreshed !== undefined;
+    }
+    async tryRefresh(tokens) {
+        if (!tokens.refreshToken || !this.clientId || !this.metadata || !this.issuer)
+            return undefined;
+        const response = await refreshAccessToken({
+            tokenEndpoint: this.metadata.tokenEndpoint,
+            refreshToken: tokens.refreshToken,
+            clientId: this.clientId,
+            ...(this.clientSecret ? { clientSecret: this.clientSecret } : {}),
+            resource: this.resource,
+            ...(this.scope ? { scope: this.scope } : {}),
+        }, this.tokenDeps());
+        const next = this.toTokenSet(response, tokens.refreshToken);
+        await this.persist(this.issuer, next);
+        return next;
+    }
+    async ensureClient(metadata, scope, redirectUris) {
+        if (this.clientId) {
+            return {
+                clientId: this.clientId,
+                ...(this.clientSecret ? { clientSecret: this.clientSecret } : {}),
+            };
+        }
+        if (!metadata.registrationEndpoint) {
+            throw new McpTransportError("protocol", this.missingClientMessage());
+        }
+        const registration = await registerOAuthClient({
+            registrationEndpoint: metadata.registrationEndpoint,
+            redirectUris,
+            clientName: this.deps.clientName ?? DEFAULT_CLIENT_NAME,
+            ...(scope ? { scope } : {}),
+        }, this.metadataDeps());
+        this.clientId = registration.clientId;
+        this.clientSecret = registration.clientSecret;
+        return registration;
+    }
+    authorizationUrlBuilder(metadata, clientId, scope, pkce) {
+        return (redirectUri, state) => {
+            const url = new URL(metadata.authorizationEndpoint);
+            url.searchParams.set("response_type", "code");
+            url.searchParams.set("client_id", clientId);
+            url.searchParams.set("redirect_uri", redirectUri);
+            url.searchParams.set("state", state);
+            url.searchParams.set("code_challenge", pkce.challenge);
+            url.searchParams.set("code_challenge_method", pkce.method);
+            url.searchParams.set("resource", this.resource);
+            if (scope)
+                url.searchParams.set("scope", scope);
+            return url.toString();
+        };
+    }
+    async requireConsent(metadata, scope) {
+        if (!this.deps.requestConsent)
+            return;
+        const ok = await this.deps.requestConsent({
+            serverUrl: this.deps.serverUrl,
+            issuer: this.issuer,
+            authorizationEndpoint: metadata.authorizationEndpoint,
+            scope,
+        });
+        if (!ok)
+            throw new McpTransportError("network", "MCP OAuth authorization was declined.");
+    }
+    async runFullFlow(metadata, scope) {
+        await this.requireConsent(metadata, scope);
+        const pkce = createPkcePair();
+        const loopback = this.deps.runLoopback ?? runLoopbackAuthorization;
+        const bootstrapClientId = this.clientId ?? this.deps.clientName ?? DEFAULT_CLIENT_NAME;
+        let registration = {
+            clientId: bootstrapClientId,
+            ...(this.clientSecret ? { clientSecret: this.clientSecret } : {}),
+        };
+        const result = await loopback({
+            buildAuthorizationUrl: async (redirectUri, state) => {
+                registration = await this.ensureClient(metadata, scope, [redirectUri]);
+                return this.authorizationUrlBuilder(metadata, registration.clientId, scope, pkce)(redirectUri, state);
+            },
+            openBrowser: this.deps.openBrowser,
+        });
+        const response = await exchangeAuthorizationCode({
+            tokenEndpoint: metadata.tokenEndpoint,
+            code: result.code,
+            redirectUri: result.redirectUri,
+            clientId: registration.clientId,
+            ...(registration.clientSecret ? { clientSecret: registration.clientSecret } : {}),
+            codeVerifier: pkce.verifier,
+            resource: this.resource,
+        }, this.tokenDeps());
+        const next = this.toTokenSet(response, undefined);
+        await this.persist(this.issuer, next);
+    }
+    toTokenSet(response, fallbackRefresh) {
+        const refreshToken = response.refreshToken ?? fallbackRefresh;
+        return {
+            accessToken: response.accessToken,
+            tokenType: response.tokenType,
+            ...(refreshToken ? { refreshToken } : {}),
+            ...(response.expiresIn !== undefined
+                ? { expiresAt: this.now() + response.expiresIn * 1000 }
+                : {}),
+            ...(response.scope ?? this.scope ? { scope: response.scope ?? this.scope } : {}),
+            ...(this.clientId ? { clientId: this.clientId } : {}),
+            ...(this.clientSecret ? { clientSecret: this.clientSecret } : {}),
+        };
+    }
+    async persist(issuer, tokens) {
+        this.cached = tokens;
+        if (!issuer)
+            return;
+        await this.store.save(oauthTokenKey(this.resource, issuer), tokens);
+    }
+    async onUnauthorized(challenge) {
+        if (this.inFlight)
+            return this.inFlight;
+        const attempt = this.authorize(challenge);
+        this.inFlight = attempt;
+        try {
+            return await attempt;
+        }
+        finally {
+            this.inFlight = undefined;
+        }
+    }
+    async authorize(challenge) {
+        const { issuer, metadata, scopes } = await this.discoverEndpoints(challenge);
+        this.cacheMetadata(issuer, metadata);
+        if (await this.reuseStored(issuer))
+            return true;
+        const scope = this.resolveScope(scopes, metadata, challenge);
+        this.scope = scope ?? this.scope;
+        if (await this.refreshStored(issuer, metadata, scope))
+            return true;
+        if (!this.clientId && !metadata.registrationEndpoint) {
+            if (await this.adoptHostCredential())
+                return true;
+        }
+        if (!this.canInteract())
+            throw new McpTransportError("network", this.reauthMessage());
+        await this.runFullFlow(metadata, scope);
+        return true;
+    }
+    liveSecrets() {
+        const secrets = [];
+        if (this.cached?.accessToken)
+            secrets.push(this.cached.accessToken);
+        if (this.cached?.refreshToken)
+            secrets.push(this.cached.refreshToken);
+        if (this.clientSecret)
+            secrets.push(this.clientSecret);
+        return secrets;
+    }
+}
+export function createAuthProvider(config, deps) {
+    if (!config || config.kind === "none")
+        return new NoAuthProvider();
+    if (config.kind === "bearer")
+        return new BearerAuthProvider(config.token);
+    if (config.kind === "header")
+        return new HeaderAuthProvider(config.headers);
+    return new OAuthProvider(config, deps);
+}
+//# sourceMappingURL=provider.js.map

package/dist/mcp/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/mcp/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,iCAAiC,EACjC,mCAAmC,EACnC,iCAAiC,GAElC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,wBAAwB,GAEzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAazE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AA0BnC,SAAS,YAAY,CAAC,SAAiB,EAAE,WAAmB;IAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;IACnF,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,WAAW,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,cAAc;IACT,IAAI,GAAG,MAAe,CAAC;IAChC,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,cAAc;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,WAAW;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAED,MAAM,kBAAkB;IAEO;IADpB,IAAI,GAAG,QAAiB,CAAC;IAClC,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAC9C,KAAK,CAAC,OAAO;QACX,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,cAAc;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,WAAW;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;CACF;AAED,MAAM,kBAAkB;IAEO;IADpB,IAAI,GAAG,QAAiB,CAAC;IAClC,YAA6B,aAA+C;QAA/C,kBAAa,GAAb,aAAa,CAAkC;IAAG,CAAC;IAChF,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,cAAc;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,WAAW;QACT,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/E,CAAC;CACF;AAED,MAAM,aAAa;IAcE;IACA;IAdV,IAAI,GAAG,OAAgB,CAAC;IACzB,MAAM,CAA4B;IAClC,QAAQ,CAA0C;IAClD,MAAM,CAAqB;IAC3B,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,KAAK,CAAqB;IAC1B,QAAQ,CAAS;IACjB,MAAM,GAAG,KAAK,CAAC;IACf,QAAQ,CAA+B;IAC9B,KAAK,CAAkB;IAExC,YACmB,MAAiD,EACjD,IAAsB;QADtB,WAAM,GAAN,MAAM,CAA2C;QACjD,SAAI,GAAJ,IAAI,CAAkB;QAEvC,IAAI,CAAC,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,YAAY;QAClB,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAEO,OAAO,CAAC,MAAqB;QACnC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,SAAS;gBAAE,OAAO,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK;aAC5B,eAAe,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;aAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EACnB,IAAI,CAAC,kBAAkB,EAAE,CAC1B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,kBAAkB;QACxB,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC;IACxF,CAAC;IAEO,aAAa;QACnB,OAAO,CACL,cAAc,IAAI,CAAC,IAAI,CAAC,SAAS,4DAA4D;YAC7F,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAEO,oBAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9C,CAAC,CAAC,GAAG,oBAAoB,EAAE,gCAAgC;YAC3D,CAAC,CAAC,wBAAwB,CAAC;QAC7B,OAAO,CACL,cAAc,IAAI,CAAC,IAAI,CAAC,SAAS,2BAA2B,MAAM,oBAAoB;YACtF,uEAAuE,MAAM,EAAE;YAC/E,6DAA6D;YAC7D,8EAA8E;YAC9E,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,SAAuC;QAEvC,MAAM,WAAW,GACf,SAAS,EAAE,mBAAmB,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,iCAAiC,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;IAC3D,CAAC;IAEO,aAAa,CAAC,MAAc,EAAE,QAAqC;QACzE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAEO,YAAY,CAClB,SAA4B,EAC5B,QAAqC,EACrC,SAAuC;QAEvC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7F,IAAI,SAAS,EAAE,KAAK;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC;QAC7C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAc;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,iBAAiB,CAAC,MAAqB;QAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAc,EACd,QAAqC,EACrC,KAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvE,OAAO,SAAS,KAAK,SAAS,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAqB;QAC5C,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC/F,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC;YACE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,EACD,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,QAAqC,EACrC,KAAyB,EACzB,YAA+B;QAE/B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAC5C;YACE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,YAAY;YACZ,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,mBAAmB;YACvD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,EACD,IAAI,CAAC,YAAY,EAAE,CACpB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC9C,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,uBAAuB,CAC7B,QAAqC,EACrC,QAAgB,EAChB,KAAyB,EACzB,IAAc;QAEd,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,QAAqC,EACrC,KAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QACtC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YACxC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAAqC,EACrC,KAAyB;QAEzB,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,wBAAwB,CAAC;QACnE,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QACvF,IAAI,YAAY,GAA4B;YAC1C,QAAQ,EAAE,iBAAiB;YAC3B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;YAC5B,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;gBAClD,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;gBACvE,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAC/E,WAAW,EACX,KAAK,CACN,CAAC;YACJ,CAAC;YACD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY;SACpC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C;YACE,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAEO,UAAU,CAAC,QAAuB,EAAE,eAAmC;QAC7E,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,eAAe,CAAC;QAC9D,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAA0B,EAAE,MAAqB;QACrE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAuC;QAC1D,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,SAAuC;QAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACjC,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YACrD,IAAI,MAAM,IAAI,CAAC,mBAAmB,EAAE;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;QACT,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAiC,EACjC,IAAsB;IAEtB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,cAAc,EAAE,CAAC;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC"}

package/dist/mcp/auth/registration.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthClientRegistration } from "./types.js";
+export interface RegistrationParams {
+    readonly registrationEndpoint: string;
+    readonly redirectUris: readonly string[];
+    readonly clientName: string;
+    readonly scope?: string | undefined;
+}
+export interface RegistrationDeps {
+    readonly fetchImpl?: typeof fetch | undefined;
+    readonly validateUrl?: ((url: string) => URL) | undefined;
+}
+export declare function registerOAuthClient(params: RegistrationParams, deps?: RegistrationDeps): Promise<OAuthClientRegistration>;

package/dist/mcp/auth/registration.js

@@ -0,0 +1,38 @@
+import { McpTransportError } from "../transport.js";
+import { assertSafeDiscoveryUrl } from "./security.js";
+export async function registerOAuthClient(params, deps = {}) {
+    const validate = deps.validateUrl ?? assertSafeDiscoveryUrl;
+    const target = validate(params.registrationEndpoint);
+    const impl = deps.fetchImpl ?? fetch;
+    const body = {
+        client_name: params.clientName,
+        redirect_uris: [...params.redirectUris],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none",
+        ...(params.scope ? { scope: params.scope } : {}),
+    };
+    const response = await impl(target.toString(), {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        redirect: "manual",
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => "");
+        throw new McpTransportError("protocol", `MCP OAuth dynamic client registration failed with ${response.status}${detail ? `: ${detail.slice(0, 200)}` : ""}.`);
+    }
+    const record = (await response.json().catch(() => undefined));
+    const clientId = record?.client_id;
+    if (typeof clientId !== "string" || clientId.length === 0) {
+        throw new McpTransportError("protocol", "MCP OAuth dynamic client registration returned no client_id.");
+    }
+    const clientSecret = record?.client_secret;
+    return {
+        clientId,
+        ...(typeof clientSecret === "string" && clientSecret.length > 0
+            ? { clientSecret }
+            : {}),
+    };
+}
+//# sourceMappingURL=registration.js.map

package/dist/mcp/auth/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../../src/mcp/auth/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAevD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA0B,EAC1B,OAAyB,EAAE;IAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,sBAAsB,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG;QACX,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,aAAa,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QACvC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,MAAM;QAClC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,qDAAqD,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE/C,CAAC;IACd,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,EAAE,aAAa,CAAC;IAC3C,OAAO;QACL,QAAQ;QACR,GAAG,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAC7D,CAAC,CAAC,EAAE,YAAY,EAAE;YAClB,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/mcp/auth/security.d.ts

@@ -0,0 +1,2 @@
+export declare function assertSafeDiscoveryUrl(raw: string): URL;
+export declare function canonicalResourceUri(raw: string): string;

package/dist/mcp/auth/security.js

@@ -0,0 +1,29 @@
+import { classifyHost } from "../../tools/web/ssrf-guard.js";
+import { McpTransportError } from "../transport.js";
+export function assertSafeDiscoveryUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new McpTransportError("protocol", `MCP OAuth discovery URL is not parseable: ${raw}`);
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    const classification = classifyHost(hostname);
+    const isLoopback = classification?.class === "loopback";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+        throw new McpTransportError("protocol", `MCP OAuth discovery refuses ${url.protocol} for ${url.host}; https is required except on loopback.`);
+    }
+    if (classification && classification.class !== "loopback") {
+        throw new McpTransportError("protocol", `MCP OAuth discovery refuses ${classification.class} address ${url.host}.`);
+    }
+    return url;
+}
+export function canonicalResourceUri(raw) {
+    const url = new URL(raw);
+    url.hash = "";
+    if (url.pathname === "/" && url.search.length === 0)
+        return url.origin;
+    return url.toString();
+}
+//# sourceMappingURL=security.js.map

package/dist/mcp/auth/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/mcp/auth/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,6CAA6C,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,cAAc,EAAE,KAAK,KAAK,UAAU,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,+BAA+B,GAAG,CAAC,QAAQ,QAAQ,GAAG,CAAC,IAAI,yCAAyC,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,IAAI,cAAc,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC1D,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,+BAA+B,cAAc,CAAC,KAAK,YAAY,GAAG,CAAC,IAAI,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/mcp/auth/token-exchange.d.ts

@@ -0,0 +1,24 @@
+import type { TokenResponse } from "./types.js";
+export interface TokenEndpointDeps {
+    readonly fetchImpl?: typeof fetch | undefined;
+    readonly validateUrl?: ((url: string) => URL) | undefined;
+}
+export interface ExchangeAuthorizationCodeParams {
+    readonly tokenEndpoint: string;
+    readonly code: string;
+    readonly redirectUri: string;
+    readonly clientId: string;
+    readonly clientSecret?: string | undefined;
+    readonly codeVerifier: string;
+    readonly resource?: string | undefined;
+}
+export interface RefreshAccessTokenParams {
+    readonly tokenEndpoint: string;
+    readonly refreshToken: string;
+    readonly clientId: string;
+    readonly clientSecret?: string | undefined;
+    readonly resource?: string | undefined;
+    readonly scope?: string | undefined;
+}
+export declare function exchangeAuthorizationCode(params: ExchangeAuthorizationCodeParams, deps?: TokenEndpointDeps): Promise<TokenResponse>;
+export declare function refreshAccessToken(params: RefreshAccessTokenParams, deps?: TokenEndpointDeps): Promise<TokenResponse>;

package/dist/mcp/auth/token-exchange.js

@@ -0,0 +1,66 @@
+import { McpTransportError } from "../transport.js";
+import { assertSafeDiscoveryUrl } from "./security.js";
+function applySecret(form, headers, clientId, clientSecret) {
+    if (clientSecret === undefined)
+        return;
+    const basic = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+    headers.authorization = `Basic ${basic}`;
+}
+async function postToken(tokenEndpoint, form, headers, deps) {
+    const validate = deps.validateUrl ?? assertSafeDiscoveryUrl;
+    const target = validate(tokenEndpoint);
+    const impl = deps.fetchImpl ?? fetch;
+    const response = await impl(target.toString(), {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+            ...headers,
+        },
+        body: form.toString(),
+        redirect: "manual",
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => "");
+        throw new McpTransportError("protocol", `MCP OAuth token request failed with ${response.status}${detail ? `: ${detail.slice(0, 200)}` : ""}.`);
+    }
+    const record = (await response.json().catch(() => undefined));
+    const accessToken = record?.access_token;
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new McpTransportError("protocol", "MCP OAuth token response had no access_token.");
+    }
+    return {
+        accessToken,
+        tokenType: typeof record?.token_type === "string" ? record.token_type : "Bearer",
+        ...(typeof record?.expires_in === "number" ? { expiresIn: record.expires_in } : {}),
+        ...(typeof record?.refresh_token === "string" ? { refreshToken: record.refresh_token } : {}),
+        ...(typeof record?.scope === "string" ? { scope: record.scope } : {}),
+    };
+}
+export async function exchangeAuthorizationCode(params, deps = {}) {
+    const form = new URLSearchParams();
+    form.set("grant_type", "authorization_code");
+    form.set("code", params.code);
+    form.set("redirect_uri", params.redirectUri);
+    form.set("client_id", params.clientId);
+    form.set("code_verifier", params.codeVerifier);
+    if (params.resource)
+        form.set("resource", params.resource);
+    const headers = {};
+    applySecret(form, headers, params.clientId, params.clientSecret);
+    return postToken(params.tokenEndpoint, form, headers, deps);
+}
+export async function refreshAccessToken(params, deps = {}) {
+    const form = new URLSearchParams();
+    form.set("grant_type", "refresh_token");
+    form.set("refresh_token", params.refreshToken);
+    form.set("client_id", params.clientId);
+    if (params.resource)
+        form.set("resource", params.resource);
+    if (params.scope)
+        form.set("scope", params.scope);
+    const headers = {};
+    applySecret(form, headers, params.clientId, params.clientSecret);
+    return postToken(params.tokenEndpoint, form, headers, deps);
+}
+//# sourceMappingURL=token-exchange.js.map

package/dist/mcp/auth/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../../../src/mcp/auth/token-exchange.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AA2BvD,SAAS,WAAW,CAClB,IAAqB,EACrB,OAA+B,EAC/B,QAAgB,EAChB,YAAgC;IAEhC,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5E,OAAO,CAAC,aAAa,GAAG,SAAS,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,aAAqB,EACrB,IAAqB,EACrB,OAA+B,EAC/B,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,sBAAsB,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,GAAG,OAAO;SACX;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,uCAAuC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE/C,CAAC;IACd,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,CAAC;IACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,+CAA+C,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,WAAW;QACX,SAAS,EAAE,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;QAChF,GAAG,CAAC,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,MAAM,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAuC,EACvC,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAgC,EAChC,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC"}

package/dist/mcp/auth/token-store.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthTokenStore } from "./types.js";
+export declare function oauthTokenKey(resource: string, issuer: string): string;
+export declare const defaultOAuthTokenStore: OAuthTokenStore;