@pentoshi/clai 4.13.1 → 4.14.1

package/dist/mcp/auth/device.js

@@ -1,9 +1,11 @@
 import { McpTransportError } from "../transport.js";
+import { fetchOAuthJson } from "./http.js";
 import { assertSafeDiscoveryUrl } from "./security.js";
+import { applyClientAuthentication } from "./token-exchange.js";
+import { setTimeout as delay } from "node:timers/promises";
 const DEFAULT_INTERVAL_SECONDS = 5;
 const DEFAULT_EXPIRES_SECONDS = 900;
 const SLOW_DOWN_EXTRA_SECONDS = 5;
-const MAX_POLL_INTERVAL_SECONDS = 60;
 function defaultSleep(ms) {
     return new Promise((resolve) => {
         const timer = setTimeout(resolve, ms);
@@ -11,38 +13,28 @@ function defaultSleep(ms) {
             timer.unref();
     });
 }
-async function postForm(url, form, deps) {
-    const validate = deps.validateUrl ?? assertSafeDiscoveryUrl;
-    const target = validate(url);
-    const impl = deps.fetchImpl ?? fetch;
-    const response = await impl(target.toString(), {
+async function postForm(url, form, deps, headers = {}) {
+    const response = await fetchOAuthJson(url, {
         method: "POST",
         headers: {
             "content-type": "application/x-www-form-urlencoded",
             accept: "application/json",
+            ...headers,
         },
         body: form.toString(),
-        redirect: "manual",
-    });
-    const text = await response.text().catch(() => "");
-    let record;
-    try {
-        const parsed = JSON.parse(text);
-        if (typeof parsed === "object" && parsed !== null) {
-            record = parsed;
-        }
-    }
-    catch {
-        record = undefined;
-    }
-    return { status: response.status, record };
+    }, deps);
+    return { status: response.status, record: response.record };
 }
 export async function requestDeviceAuthorization(params, deps = {}) {
     const form = new URLSearchParams();
     form.set("client_id", params.clientId);
     if (params.scope)
         form.set("scope", params.scope);
-    const { status, record } = await postForm(params.deviceAuthorizationEndpoint, form, deps);
+    if (params.resource)
+        form.set("resource", params.resource);
+    const headers = {};
+    applyClientAuthentication(form, headers, params.clientId, params.clientSecret, params.authMethod);
+    const { status, record } = await postForm(params.deviceAuthorizationEndpoint, form, deps, headers);
     const deviceCode = record?.device_code;
     const userCode = record?.user_code;
     const verificationUri = record?.verification_uri ?? record?.verification_url;
@@ -61,15 +53,18 @@ export async function requestDeviceAuthorization(params, deps = {}) {
     const complete = record?.verification_uri_complete;
     const interval = record?.interval;
     const expiresIn = record?.expires_in;
+    const validateUrl = deps.validateUrl ?? assertSafeDiscoveryUrl;
+    const verifiedUri = validateUrl(verificationUri).toString();
+    const verifiedComplete = typeof complete === "string" ? validateUrl(complete).toString() : undefined;
     return {
         deviceCode,
         userCode,
-        verificationUri,
-        ...(typeof complete === "string" ? { verificationUriComplete: complete } : {}),
-        intervalSeconds: typeof interval === "number" && interval > 0
-            ? Math.min(interval, MAX_POLL_INTERVAL_SECONDS)
+        verificationUri: verifiedUri,
+        ...(verifiedComplete ? { verificationUriComplete: verifiedComplete } : {}),
+        intervalSeconds: typeof interval === "number" && Number.isFinite(interval) && interval > 0
+            ? interval
             : DEFAULT_INTERVAL_SECONDS,
-        expiresInSeconds: typeof expiresIn === "number" && expiresIn > 0
+        expiresInSeconds: typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0
             ? expiresIn
             : DEFAULT_EXPIRES_SECONDS,
     };
@@ -79,20 +74,48 @@ export async function pollDeviceTokens(params, deps = {}) {
     const deadline = Date.now() + params.expiresInSeconds * 1000;
     let intervalMs = Math.max(1, params.intervalSeconds) * 1000;
     for (;;) {
+        if (deps.signal?.aborted)
+            throw new McpTransportError("cancelled", "MCP OAuth device sign-in cancelled.");
         if (Date.now() >= deadline) {
             throw new McpTransportError("timeout", "MCP OAuth device authorization expired before sign-in completed.");
         }
-        await sleep(Math.min(intervalMs, Math.max(0, deadline - Date.now())));
+        const waitMs = Math.min(intervalMs, Math.max(0, deadline - Date.now()));
+        if (deps.signal && !deps.sleep)
+            await delay(waitMs, undefined, { signal: deps.signal, ref: false });
+        else
+            await sleep(waitMs);
+        if (deps.signal?.aborted)
+            throw new McpTransportError("cancelled", "MCP OAuth device sign-in cancelled.");
+        if (Date.now() >= deadline)
+            throw new McpTransportError("timeout", "MCP OAuth device authorization expired before sign-in completed.");
         const form = new URLSearchParams();
         form.set("grant_type", "urn:ietf:params:oauth:grant-type:device_code");
         form.set("device_code", params.deviceCode);
         form.set("client_id", params.clientId);
-        if (params.clientSecret !== undefined) {
-            form.set("client_secret", params.clientSecret);
+        if (params.resource)
+            form.set("resource", params.resource);
+        const headers = {};
+        applyClientAuthentication(form, headers, params.clientId, params.clientSecret, params.authMethod);
+        let response;
+        try {
+            response = await postForm(params.tokenEndpoint, form, deps, headers);
+        }
+        catch (error) {
+            if (deps.signal?.aborted)
+                throw error;
+            if (error instanceof TypeError ||
+                (error instanceof McpTransportError && ["timeout", "network"].includes(error.kind))) {
+                intervalMs *= 2;
+                continue;
+            }
+            throw error;
         }
-        const { status, record } = await postForm(params.tokenEndpoint, form, deps);
+        const { status, record } = response;
         const accessToken = record?.access_token;
-        if (status >= 200 && status < 300 && typeof accessToken === "string" && accessToken.length > 0) {
+        if (status >= 200 &&
+            status < 300 &&
+            typeof accessToken === "string" &&
+            accessToken.length > 0) {
             return {
                 accessToken,
                 tokenType: typeof record?.token_type === "string" ? record.token_type : "Bearer",
@@ -107,7 +130,7 @@ export async function pollDeviceTokens(params, deps = {}) {
         if (error === "authorization_pending")
             continue;
         if (error === "slow_down") {
-            intervalMs = Math.min((intervalMs + SLOW_DOWN_EXTRA_SECONDS * 1000), MAX_POLL_INTERVAL_SECONDS * 1000);
+            intervalMs += SLOW_DOWN_EXTRA_SECONDS * 1000;
             continue;
         }
         if (error === "access_denied") {

package/dist/mcp/auth/device.js.map

@@ -1 +1 @@
-{"version":3,"file":"device.js","sourceRoot":"","sources":["../../../src/mcp/auth/device.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAiCvD,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,IAAqB,EACrB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,sBAAsB,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,GAAG,MAAiC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAkC,EAClC,OAAuB,EAAE;IAEzB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CACvC,MAAM,CAAC,2BAA2B,EAClC,IAAI,EACJ,IAAI,CACL,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,EAAE,WAAW,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,CAAC;IACnC,MAAM,eAAe,GACnB,MAAM,EAAE,gBAAgB,IAAI,MAAM,EAAE,gBAAgB,CAAC;IACvD,IACE,MAAM,GAAG,GAAG;QACZ,MAAM,IAAI,GAAG;QACb,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ,EACnC,CAAC;QACD,MAAM,MAAM,GACV,OAAO,MAAM,EAAE,iBAAiB,KAAK,QAAQ;YAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ;gBACjC,CAAC,CAAC,MAAM,CAAC,KAAK;gBACd,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,kDAAkD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,yBAAyB,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,EAAE,UAAU,CAAC;IACrC,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,eAAe,EACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,GAAG,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAC;YAC/C,CAAC,CAAC,wBAAwB;QAC9B,gBAAgB,EACd,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,CAAC;YAC5C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,uBAAuB;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA8B,EAC9B,OAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAC7D,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAC5D,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CACzB,SAAS,EACT,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,8CAA8C,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,CAAC;QACzC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/F,OAAO;gBACL,WAAW;gBACX,SAAS,EAAE,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;gBAChF,GAAG,CAAC,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,MAAM,EAAE,aAAa,KAAK,QAAQ;oBAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;oBACxC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAChD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,UAAU,GAAG,IAAI,CAAC,GAAG,CACnB,CAAC,UAAU,GAAG,uBAAuB,GAAG,IAAI,CAAC,EAC7C,yBAAyB,GAAG,IAAI,CACjC,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,SAAS,EACT,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GACV,OAAO,MAAM,EAAE,iBAAiB,KAAK,QAAQ;YAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,KAAK,IAAI,QAAQ,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,0CAA0C,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAClE,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../../src/mcp/auth/device.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAsB,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAoC3D,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,IAAqB,EACrB,IAAoB,EACpB,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,GAAG,OAAO;SACX;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,EACD,IAAI,CACL,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAkC,EAClC,OAAuB,EAAE;IAEzB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CACvC,MAAM,CAAC,2BAA2B,EAClC,IAAI,EACJ,IAAI,EACJ,OAAO,CACR,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,EAAE,WAAW,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,CAAC;IACnC,MAAM,eAAe,GAAG,MAAM,EAAE,gBAAgB,IAAI,MAAM,EAAE,gBAAgB,CAAC;IAC7E,IACE,MAAM,GAAG,GAAG;QACZ,MAAM,IAAI,GAAG;QACb,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ,EACnC,CAAC;QACD,MAAM,MAAM,GACV,OAAO,MAAM,EAAE,iBAAiB,KAAK,QAAQ;YAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ;gBACjC,CAAC,CAAC,MAAM,CAAC,KAAK;gBACd,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,kDAAkD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,yBAAyB,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,EAAE,UAAU,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,sBAAsB,CAAC;IAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,MAAM,gBAAgB,GACpB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe,EAAE,WAAW;QAC5B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,eAAe,EACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YACvE,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,wBAAwB;QAC9B,gBAAgB,EACd,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC1E,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,uBAAuB;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA8B,EAC9B,OAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAC7D,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAC5D,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YACtB,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CACzB,SAAS,EACT,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5B,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;;YACjE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YACtB,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YACxB,MAAM,IAAI,iBAAiB,CACzB,SAAS,EACT,kEAAkE,CACnE,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,8CAA8C,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,yBAAyB,CACvB,IAAI,EACJ,OAAO,EACP,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,UAAU,CAClB,CAAC;QACF,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YACtC,IACE,KAAK,YAAY,SAAS;gBAC1B,CAAC,KAAK,YAAY,iBAAiB,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EACnF,CAAC;gBACD,UAAU,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QACpC,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,CAAC;QACzC,IACE,MAAM,IAAI,GAAG;YACb,MAAM,GAAG,GAAG;YACZ,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;YACD,OAAO;gBACL,WAAW;gBACX,SAAS,EAAE,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;gBAChF,GAAG,CAAC,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,MAAM,EAAE,aAAa,KAAK,QAAQ;oBAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;oBACxC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAChD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,UAAU,IAAI,uBAAuB,GAAG,IAAI,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,8CAA8C,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,SAAS,EACT,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GACV,OAAO,MAAM,EAAE,iBAAiB,KAAK,QAAQ;YAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,KAAK,IAAI,QAAQ,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,0CAA0C,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAClE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/mcp/auth/http.d.ts

@@ -0,0 +1,12 @@
+export interface OAuthHttpDeps {
+    readonly fetchImpl?: typeof fetch | undefined;
+    readonly validateUrl?: ((url: string) => URL) | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly timeoutMs?: number | undefined;
+}
+export declare function fetchOAuthJson(url: string, init: RequestInit, deps: OAuthHttpDeps): Promise<{
+    status: number;
+    ok: boolean;
+    record: Record<string, unknown> | undefined;
+}>;
+export declare function oauthErrorDetail(record: Record<string, unknown> | undefined): string;

package/dist/mcp/auth/http.js

@@ -0,0 +1,62 @@
+import { McpTransportError, withTimeout } from "../transport.js";
+import { assertSafeDiscoveryUrl } from "./security.js";
+export async function fetchOAuthJson(url, init, deps) {
+    const target = (deps.validateUrl ?? assertSafeDiscoveryUrl)(url);
+    const { signal, dispose } = withTimeout(deps.signal, deps.timeoutMs ?? 15_000);
+    let reader;
+    try {
+        const response = await (deps.fetchImpl ?? fetch)(target.toString(), {
+            ...init,
+            redirect: "manual",
+            signal,
+        });
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new McpTransportError("protocol", "MCP OAuth endpoint attempted a redirect; use its final URL.");
+        }
+        const decoder = new TextDecoder();
+        let text = "";
+        let bytes = 0;
+        if (response.body) {
+            reader = response.body.getReader();
+            for (;;) {
+                const { value, done } = await reader.read();
+                if (done)
+                    break;
+                if (!value)
+                    continue;
+                bytes += value.byteLength;
+                if (bytes > 256 * 1024)
+                    throw new McpTransportError("too-large", "MCP OAuth document exceeded the size limit.");
+                text += decoder.decode(value, { stream: true });
+            }
+            text += decoder.decode();
+        }
+        let record;
+        try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+                record = parsed;
+        }
+        catch {
+            record = undefined;
+        }
+        return { status: response.status, ok: response.ok, record };
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw signal.reason instanceof McpTransportError
+                ? signal.reason
+                : new McpTransportError("cancelled", "MCP OAuth request cancelled.");
+        throw error;
+    }
+    finally {
+        await reader?.cancel().catch(() => undefined);
+        dispose();
+    }
+}
+export function oauthErrorDetail(record) {
+    const detail = record?.error_description ?? record?.error;
+    return typeof detail === "string" ? `: ${detail.slice(0, 200)}` : "";
+}
+//# sourceMappingURL=http.js.map

package/dist/mcp/auth/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/mcp/auth/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AASvD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,IAAiB,EACjB,IAAmB;IAMnB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC/E,IAAI,MAA2D,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;YAClE,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;YAClB,MAAM;SACP,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,SAAS,CAAC;gBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,GAAG,GAAG,IAAI;oBACpB,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;gBAC1F,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,MAA2C,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzE,MAAM,GAAG,MAAiC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO;YAChB,MAAM,MAAM,CAAC,MAAM,YAAY,iBAAiB;gBAC9C,CAAC,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,IAAI,iBAAiB,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA2C;IAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,iBAAiB,IAAI,MAAM,EAAE,KAAK,CAAC;IAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC"}

package/dist/mcp/auth/loopback.d.ts

@@ -4,14 +4,22 @@ export interface OpenBrowserDeps {
     readonly platform?: NodeJS.Platform | undefined;
     readonly spawnImpl?: typeof spawn | undefined;
 }
+export declare function systemBrowserAvailable(env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform): boolean;
 export declare function openSystemBrowser(rawUrl: string, deps?: OpenBrowserDeps): Promise<void>;
 export interface LoopbackAuthorizationParams {
     buildAuthorizationUrl(redirectUri: string, state: string): string | Promise<string>;
-    openBrowser(url: string): Promise<void>;
+    readonly openBrowser?: ((url: string) => Promise<void>) | undefined;
     readonly timeoutMs?: number | undefined;
     readonly host?: string | undefined;
+    readonly port?: number | undefined;
     readonly callbackPath?: string | undefined;
     readonly successHtml?: string | undefined;
     readonly onAuthorizationUrl?: ((url: string) => void) | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly readCallbackUrl?: ((info: {
+        url: string;
+        redirectUri: string;
+        signal: AbortSignal;
+    }) => Promise<string | undefined>) | undefined;
 }
 export declare function runLoopbackAuthorization(params: LoopbackAuthorizationParams): Promise<LoopbackAuthorizationResult>;

package/dist/mcp/auth/loopback.js

@@ -4,7 +4,7 @@ import { classifyHost } from "../../tools/web/ssrf-guard.js";
 import { McpTransportError } from "../transport.js";
 import { randomState } from "./pkce.js";
 const DEFAULT_TIMEOUT_MS = 300_000;
-const DEFAULT_SUCCESS_HTML = "<!doctype html><html><head><meta charset=\"utf-8\"><title>clai</title></head>" +
+const DEFAULT_SUCCESS_HTML = '<!doctype html><html><head><meta charset="utf-8"><title>clai</title></head>' +
     "<body><p>Authorization complete. You can close this tab and return to clai.</p></body></html>";
 function assertBrowserUrl(raw) {
     let url;
@@ -23,6 +23,13 @@ function assertBrowserUrl(raw) {
     }
     throw new McpTransportError("protocol", `Refusing to open a browser for scheme "${url.protocol}"; only https or loopback http are allowed.`);
 }
+export function systemBrowserAvailable(env = process.env, platform = process.platform) {
+    if (env.SSH_CONNECTION || env.SSH_TTY)
+        return false;
+    return (platform === "darwin" ||
+        platform === "win32" ||
+        Boolean(env.DISPLAY || env.WAYLAND_DISPLAY || env.TERMUX_VERSION));
+}
 function browserCommand(platform, url) {
     if (platform === "darwin")
         return { command: "open", args: [url] };
@@ -65,16 +72,25 @@ export async function openSystemBrowser(rawUrl, deps = {}) {
 function readCallback(requestUrl, callbackPath, expectedState) {
     if (requestUrl.pathname !== callbackPath)
         return { kind: "ignore" };
-    const error = requestUrl.searchParams.get("error");
-    if (error)
-        return { kind: "error", reason: `authorization server returned error "${error}"` };
     const returnedState = requestUrl.searchParams.get("state");
     if (!returnedState || returnedState !== expectedState) {
-        return { kind: "error", reason: "authorization state did not match the request (possible CSRF)" };
+        return {
+            kind: "error",
+            reason: "authorization state did not match the request (possible CSRF)",
+        };
     }
+    const error = requestUrl.searchParams.get("error");
+    if (error)
+        return {
+            kind: "error",
+            reason: `authorization server returned error "${error}"`,
+        };
     const code = requestUrl.searchParams.get("code");
     if (!code)
-        return { kind: "error", reason: "authorization response contained no code" };
+        return {
+            kind: "error",
+            reason: "authorization response contained no code",
+        };
     return { kind: "ok", code };
 }
 export function runLoopbackAuthorization(params) {
@@ -86,6 +102,7 @@ export function runLoopbackAuthorization(params) {
         const server = createServer();
         let redirectUri = "";
         let settled = false;
+        const controller = new AbortController();
         const timer = setTimeout(() => {
             finishReject(new McpTransportError("timeout", "MCP OAuth authorization timed out waiting for the browser callback."));
         }, params.timeoutMs ?? DEFAULT_TIMEOUT_MS);
@@ -95,6 +112,8 @@ export function runLoopbackAuthorization(params) {
             clearTimeout(timer);
             server.closeAllConnections?.();
             server.close(() => undefined);
+            params.signal?.removeEventListener("abort", onAbort);
+            controller.abort();
         };
         function finishResolve(result) {
             if (settled)
@@ -110,6 +129,12 @@ export function runLoopbackAuthorization(params) {
             close();
             reject(error);
         }
+        const onAbort = () => finishReject(new McpTransportError("cancelled", "MCP OAuth authorization cancelled."));
+        if (params.signal?.aborted) {
+            onAbort();
+            return;
+        }
+        params.signal?.addEventListener("abort", onAbort, { once: true });
         server.on("request", (req, res) => {
             const requestUrl = new URL(req.url ?? "/", redirectUri || `http://${host}`);
             const reading = readCallback(requestUrl, callbackPath, state);
@@ -130,14 +155,61 @@ export function runLoopbackAuthorization(params) {
             }
         });
         server.on("error", (error) => finishReject(error));
-        server.listen(0, host, () => {
+        server.listen(params.port ?? 0, host, () => {
             const port = server.address().port;
             redirectUri = `http://${host}:${port}${callbackPath}`;
             Promise.resolve()
                 .then(() => params.buildAuthorizationUrl(redirectUri, state))
                 .then((authUrl) => {
+                if (settled)
+                    return;
                 params.onAuthorizationUrl?.(authUrl);
-                return params.openBrowser(authUrl);
+                if (params.readCallbackUrl) {
+                    void params
+                        .readCallbackUrl({
+                        url: authUrl,
+                        redirectUri,
+                        signal: controller.signal,
+                    })
+                        .then((callbackUrl) => {
+                        if (settled)
+                            return;
+                        if (callbackUrl === undefined) {
+                            finishReject(new McpTransportError("cancelled", "MCP OAuth authorization cancelled."));
+                            return;
+                        }
+                        let callback;
+                        try {
+                            callback = new URL(callbackUrl.trim());
+                        }
+                        catch {
+                            throw new McpTransportError("protocol", "Paste the complete OAuth callback URL, including code and state.");
+                        }
+                        const expected = new URL(redirectUri);
+                        if (callback.origin !== expected.origin ||
+                            callback.pathname !== expected.pathname ||
+                            callback.username ||
+                            callback.password) {
+                            throw new McpTransportError("protocol", "OAuth callback URL did not match this sign-in request.");
+                        }
+                        const reading = readCallback(callback, callbackPath, state);
+                        if (reading.kind === "ok")
+                            finishResolve({ code: reading.code, state, redirectUri });
+                        else
+                            finishReject(new McpTransportError("protocol", reading.kind === "error"
+                                ? `MCP OAuth ${reading.reason}.`
+                                : "OAuth callback URL did not match this sign-in request."));
+                    })
+                        .catch((error) => finishReject(error instanceof Error ? error : new Error(String(error))));
+                }
+                if (params.openBrowser) {
+                    return params.openBrowser(authUrl).catch((error) => {
+                        if (!params.readCallbackUrl)
+                            throw error;
+                    });
+                }
+                if (!params.readCallbackUrl)
+                    throw new McpTransportError("browser", "No browser or callback input is available for OAuth sign-in.");
             })
                 .catch((error) => finishReject(error instanceof Error ? error : new Error(String(error))));
         });

package/dist/mcp/auth/loopback.js.map

@@ -1 +1 @@
-{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../../src/mcp/auth/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,oBAAoB,GACxB,+EAA+E;IAC/E,+FAA+F,CAAC;AAElG,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,oDAAoD,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,cAAc,EAAE,KAAK,KAAK,UAAU;YAAE,OAAO,GAAG,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,0CAA0C,GAAG,CAAC,QAAQ,6CAA6C,CACpG,CAAC;AACJ,CAAC;AAOD,SAAS,cAAc,CACrB,QAAyB,EACzB,GAAW;IAEX,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACnE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACrC,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CACJ,IAAI,iBAAiB,CACnB,SAAS,EACT,+BAA+B,OAAO,MAAM,KAAK,CAAC,OAAO,GAAG,CAC7D,CACF,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AACvD,CAAC;AAiBD,SAAS,YAAY,CACnB,UAAe,EACf,YAAoB,EACpB,aAAqB;IAErB,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,wCAAwC,KAAK,GAAG,EAAE,CAAC;IAC9F,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAmC;IAEnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC;IACxD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC/D,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,OAAO,IAAI,OAAO,CAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,YAAY,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,qEAAqE,CAAC,CAAC,CAAC;QACxH,CAAC,EAAE,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,SAAS,aAAa,CAAC,MAAmC;YACxD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,YAAY,CAAC,KAAY;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;YACjC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uEAAuE,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,iBAAiB,CAAC,UAAU,EAAE,aAAa,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YAC1B,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACpD,WAAW,GAAG,UAAU,IAAI,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;YACtD,OAAO,CAAC,OAAO,EAAE;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;iBAC5D,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,MAAM,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,CAAC;gBACrC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACf,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../../src/mcp/auth/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,oBAAoB,GACxB,6EAA6E;IAC7E,+FAA+F,CAAC;AAElG,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,oDAAoD,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,cAAc,EAAE,KAAK,KAAK,UAAU;YAAE,OAAO,GAAG,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,0CAA0C,GAAG,CAAC,QAAQ,6CAA6C,CACpG,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,sBAAsB,CACpC,MAAoD,OAAO,CAAC,GAAG,EAC/D,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,CACL,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,OAAO;QACpB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,cAAc,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,QAAyB,EACzB,GAAW;IAEX,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACnE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAwB,EAAE;IAChF,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACrC,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CACJ,IAAI,iBAAiB,CACnB,SAAS,EACT,+BAA+B,OAAO,MAAM,KAAK,CAAC,OAAO,GAAG,CAC7D,CACF,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AACvD,CAAC;AA0BD,SAAS,YAAY,CACnB,UAAe,EACf,YAAoB,EACpB,aAAqB;IAErB,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpE,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK;QACP,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,wCAAwC,KAAK,GAAG;SACzD,CAAC;IACJ,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QACP,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAmC;IAEnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC;IACxD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC/D,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,OAAO,IAAI,OAAO,CAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,YAAY,CACV,IAAI,iBAAiB,CACnB,SAAS,EACT,qEAAqE,CACtE,CACF,CAAC;QACJ,CAAC,EAAE,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,CAAC;QACF,SAAS,aAAa,CAAC,MAAmC;YACxD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,YAAY,CAAC,KAAY;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,GAAS,EAAE,CACzB,YAAY,CAAC,IAAI,iBAAiB,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,IAAI,UAAU,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;YACjC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,GAAG,CACL,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uEAAuE,CAC3F,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,iBAAiB,CAAC,UAAU,EAAE,aAAa,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YACzC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACpD,WAAW,GAAG,UAAU,IAAI,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;YACtD,OAAO,CAAC,OAAO,EAAE;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;iBAC5D,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBAC3B,KAAK,MAAM;yBACR,eAAe,CAAC;wBACf,GAAG,EAAE,OAAO;wBACZ,WAAW;wBACX,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC;yBACD,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;wBACpB,IAAI,OAAO;4BAAE,OAAO;wBACpB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;4BAC9B,YAAY,CACV,IAAI,iBAAiB,CAAC,WAAW,EAAE,oCAAoC,CAAC,CACzE,CAAC;4BACF,OAAO;wBACT,CAAC;wBACD,IAAI,QAAa,CAAC;wBAClB,IAAI,CAAC;4BACH,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;wBACzC,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,kEAAkE,CACnE,CAAC;wBACJ,CAAC;wBACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;wBACtC,IACE,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;4BACnC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;4BACvC,QAAQ,CAAC,QAAQ;4BACjB,QAAQ,CAAC,QAAQ,EACjB,CAAC;4BACD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,wDAAwD,CACzD,CAAC;wBACJ,CAAC;wBACD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;wBAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;4BACvB,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;;4BAE1D,YAAY,CACV,IAAI,iBAAiB,CACnB,UAAU,EACV,OAAO,CAAC,IAAI,KAAK,OAAO;gCACtB,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,GAAG;gCAChC,CAAC,CAAC,wDAAwD,CAC7D,CACF,CAAC;oBACN,CAAC,CAAC;yBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAC;gBACN,CAAC;gBACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;wBAC1D,IAAI,CAAC,MAAM,CAAC,eAAe;4BAAE,MAAM,KAAK,CAAC;oBAC3C,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,eAAe;oBACzB,MAAM,IAAI,iBAAiB,CACzB,SAAS,EACT,8DAA8D,CAC/D,CAAC;YACN,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/auth/metadata.d.ts

@@ -1,7 +1,6 @@
+import { type OAuthHttpDeps } from "./http.js";
 import type { AuthorizationServerMetadata, ProtectedResourceMetadata } from "./types.js";
-export interface MetadataFetchDeps {
-    readonly fetchImpl?: typeof fetch | undefined;
-    readonly validateUrl?: ((url: string) => URL) | undefined;
+export interface MetadataFetchDeps extends OAuthHttpDeps {
 }
 export declare function buildProtectedResourceMetadataUrl(resource: string): string;
 export declare function discoverProtectedResourceMetadata(metadataUrl: string, deps?: MetadataFetchDeps): Promise<ProtectedResourceMetadata>;

package/dist/mcp/auth/metadata.js

@@ -1,38 +1,19 @@
 import { McpTransportError } from "../transport.js";
 import { assertSafeDiscoveryUrl } from "./security.js";
-const MAX_METADATA_BYTES = 256 * 1024;
+import { fetchOAuthJson } from "./http.js";
 function stringArray(value) {
     if (!Array.isArray(value))
         return [];
     return value.filter((entry) => typeof entry === "string");
 }
 async function fetchJson(url, deps) {
-    const validate = deps.validateUrl ?? assertSafeDiscoveryUrl;
-    const target = validate(url);
-    const impl = deps.fetchImpl ?? fetch;
-    const response = await impl(target.toString(), {
+    const response = await fetchOAuthJson(url, {
         method: "GET",
         headers: { accept: "application/json" },
-        redirect: "manual",
-    });
-    if (response.status >= 300 && response.status < 400) {
-        throw new McpTransportError("protocol", `MCP OAuth discovery refused a redirect from ${url}.`);
-    }
+    }, deps);
     if (!response.ok)
         return undefined;
-    const text = await response.text();
-    if (text.length > MAX_METADATA_BYTES) {
-        throw new McpTransportError("too-large", "MCP OAuth metadata document exceeded the size limit.");
-    }
-    try {
-        const parsed = JSON.parse(text);
-        return typeof parsed === "object" && parsed !== null
-            ? parsed
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
+    return response.record;
 }
 export function buildProtectedResourceMetadataUrl(resource) {
     const url = new URL(resource);
@@ -89,16 +70,35 @@ function parseAuthorizationServerMetadata(record) {
             : {}),
         scopesSupported: stringArray(record.scopes_supported),
         codeChallengeMethodsSupported: stringArray(record.code_challenge_methods_supported),
+        tokenEndpointAuthMethodsSupported: stringArray(record.token_endpoint_auth_methods_supported),
     };
 }
 export async function discoverAuthorizationServerMetadata(issuer, deps = {}) {
     for (const candidate of authorizationServerMetadataCandidates(issuer)) {
-        const record = await fetchJson(candidate, deps).catch(() => undefined);
+        deps.signal?.throwIfAborted();
+        const record = await fetchJson(candidate, deps).catch((error) => {
+            if (deps.signal?.aborted ||
+                (error instanceof McpTransportError &&
+                    ["too-large", "timeout", "cancelled"].includes(error.kind)))
+                throw error;
+            return undefined;
+        });
         if (!record)
             continue;
         const parsed = parseAuthorizationServerMetadata(record);
-        if (parsed)
+        if (parsed) {
+            if (parsed.issuer && parsed.issuer.replace(/\/+$/, "") !== issuer.replace(/\/+$/, "")) {
+                throw new McpTransportError("protocol", "MCP authorization-server metadata issuer did not match the requested issuer.");
+            }
+            const validate = deps.validateUrl ?? assertSafeDiscoveryUrl;
+            validate(parsed.authorizationEndpoint);
+            validate(parsed.tokenEndpoint);
+            if (parsed.registrationEndpoint)
+                validate(parsed.registrationEndpoint);
+            if (parsed.deviceAuthorizationEndpoint)
+                validate(parsed.deviceAuthorizationEndpoint);
             return parsed;
+        }
     }
     throw new McpTransportError("protocol", `MCP authorization-server metadata was unavailable for issuer ${issuer}.`);
 }

package/dist/mcp/auth/metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/mcp/auth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAWvD,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEtC,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,sBAAsB,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;QAC7C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,+CAA+C,GAAG,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,sDAAsD,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAAgB;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtD,MAAM,SAAS,GAAG,uCAAuC,CAAC;IAC1D,GAAG,CAAC,QAAQ,GAAG,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC;IACrC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,WAAmB,EACnB,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,sDAAsD,WAAW,GAAG,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACvE,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,oBAAoB;QACpB,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,0CAA0C,MAAM,EAAE;QACzD,GAAG,IAAI,oCAAoC,MAAM,EAAE;QACnD,GAAG,IAAI,GAAG,MAAM,mCAAmC;KACpD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA+B;IAE/B,MAAM,qBAAqB,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;IAC5C,IAAI,OAAO,qBAAqB,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,MAAM,CAAC,6BAA6B,KAAK,QAAQ;YAC1D,CAAC,CAAC,EAAE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACrD,6BAA6B,EAAE,WAAW,CAAC,MAAM,CAAC,gCAAgC,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAc,EACd,OAA0B,EAAE;IAE5B,KAAK,MAAM,SAAS,IAAI,qCAAqC,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,MAAM,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,gEAAgE,MAAM,GAAG,CAC1E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/mcp/auth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,cAAc,EAAsB,MAAM,WAAW,CAAC;AAK/D,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,IAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,GAAG,EACH;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,EACD,IAAI,CACL,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAAgB;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtD,MAAM,SAAS,GAAG,uCAAuC,CAAC;IAC1D,GAAG,CAAC,QAAQ,GAAG,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC;IACrC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,WAAmB,EACnB,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,sDAAsD,WAAW,GAAG,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACvE,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,oBAAoB;QACpB,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,0CAA0C,MAAM,EAAE;QACzD,GAAG,IAAI,oCAAoC,MAAM,EAAE;QACnD,GAAG,IAAI,GAAG,MAAM,mCAAmC;KACpD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gCAAgC,CACvC,MAA+B;IAE/B,MAAM,qBAAqB,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;IAC5C,IAAI,OAAO,qBAAqB,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,MAAM,CAAC,6BAA6B,KAAK,QAAQ;YAC1D,CAAC,CAAC,EAAE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACrD,6BAA6B,EAAE,WAAW,CAAC,MAAM,CAAC,gCAAgC,CAAC;QACnF,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,qCAAqC,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAc,EACd,OAA0B,EAAE;IAE5B,KAAK,MAAM,SAAS,IAAI,qCAAqC,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACvE,IACE,IAAI,CAAC,MAAM,EAAE,OAAO;gBACpB,CAAC,KAAK,YAAY,iBAAiB;oBACjC,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAE7D,MAAM,KAAK,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,MAAM,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,8EAA8E,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,sBAAsB,CAAC;YAC5D,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,oBAAoB;gBAAE,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,2BAA2B;gBAAE,QAAQ,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YACrF,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,gEAAgE,MAAM,GAAG,CAC1E,CAAC;AACJ,CAAC"}

package/dist/mcp/auth/provider.d.ts

@@ -24,6 +24,7 @@ export interface AuthProviderDeps {
         serverUrl: string;
         url: string;
     }) => void) | undefined;
+    readonly readCallbackUrl?: LoopbackAuthorizationParams["readCallbackUrl"];
     readonly env?: Record<string, string | undefined> | undefined;
     readonly readHostToken?: (() => Promise<string | undefined>) | undefined;
 }