@phuetz/code-buddy 2.1.0 → 2.2.0

package/dist/mcp/client.d.ts

@@ -14,9 +14,20 @@ export declare class MCPManager extends EventEmitter {
     private serverStatuses;
     private retryCounts;
     private healthCheckIntervals;
+    private reconnectTimers;
+    /**
+     * Bumped by removeServer. A still-running addServerInternal must not overwrite
+     * 'disconnected' with 'error' nor schedule autoReconnect (which would reopen
+     * the OAuth browser ~1s after an explicit cancel).
+     */
+    private connectEpochs;
     private serverAddPromises;
     private initializationPromise;
     addServer(config: MCPServerConfig): Promise<void>;
+    private currentEpoch;
+    private bumpConnectEpoch;
+    private assertConnectCurrent;
+    private clearReconnectTimer;
     private addServerInternal;
     private startHealthCheck;
     private stopHealthCheck;

package/dist/mcp/client.js

@@ -2,6 +2,7 @@ import { mcpToolAllowed, validateMCPToolFilter } from './import-normalize.js';
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { EventEmitter } from "events";
 import { createTransport } from "./transports.js";
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { logger } from "../utils/logger.js";
 export const DEFAULT_MCP_INIT_TIMEOUT_MS = 15_000;
 const MAX_MCP_INIT_TIMEOUT_MS = 10 * 60_000;
@@ -26,6 +27,13 @@ export class MCPManager extends EventEmitter {
     serverStatuses = new Map();
     retryCounts = new Map();
     healthCheckIntervals = new Map();
+    reconnectTimers = new Map();
+    /**
+     * Bumped by removeServer. A still-running addServerInternal must not overwrite
+     * 'disconnected' with 'error' nor schedule autoReconnect (which would reopen
+     * the OAuth browser ~1s after an explicit cancel).
+     */
+    connectEpochs = new Map();
     serverAddPromises = new Map();
     initializationPromise = null;
     async addServer(config) {
@@ -51,9 +59,30 @@ export class MCPManager extends EventEmitter {
             }
         }
     }
+    currentEpoch(serverName) {
+        return this.connectEpochs.get(serverName) ?? 0;
+    }
+    bumpConnectEpoch(serverName) {
+        const next = this.currentEpoch(serverName) + 1;
+        this.connectEpochs.set(serverName, next);
+        return next;
+    }
+    assertConnectCurrent(serverName, epoch) {
+        if (this.currentEpoch(serverName) !== epoch) {
+            throw new Error(`MCP server "${serverName}" connection cancelled`);
+        }
+    }
+    clearReconnectTimer(serverName) {
+        const timer = this.reconnectTimers.get(serverName);
+        if (timer) {
+            clearTimeout(timer);
+            this.reconnectTimers.delete(serverName);
+        }
+    }
     async addServerInternal(config) {
         this.serverConfigs.set(config.name, config);
         this.serverStatuses.set(config.name, 'connecting');
+        const epoch = this.currentEpoch(config.name);
         try {
             // Handle legacy stdio-only configuration
             let transportConfig = config.transport;
@@ -80,8 +109,24 @@ export class MCPManager extends EventEmitter {
             });
             this.clients.set(config.name, client);
             // Connect
-            const sdkTransport = await transport.connect();
-            await client.connect(sdkTransport);
+            let sdkTransport = await transport.connect();
+            this.assertConnectCurrent(config.name, epoch);
+            try {
+                await client.connect(sdkTransport);
+                this.assertConnectCurrent(config.name, epoch);
+            }
+            catch (error) {
+                // First connection may end in UnauthorizedError once the OAuth code has been
+                // exchanged (SDK contract): reconnect once with the stored token.
+                if (!(error instanceof UnauthorizedError) || transportConfig.auth?.type !== 'oauth')
+                    throw error;
+                await transport.disconnect().catch(() => undefined);
+                this.assertConnectCurrent(config.name, epoch);
+                sdkTransport = await transport.connect();
+                this.assertConnectCurrent(config.name, epoch);
+                await client.connect(sdkTransport);
+                this.assertConnectCurrent(config.name, epoch);
+            }
             // Drain the captured MCP stderr to the logger. The stream only exists
             // for stdio transports created with stderr:'pipe' (see StdioTransport);
             // without a consumer the PassThrough back-pressures the child once its
@@ -96,6 +141,7 @@ export class MCPManager extends EventEmitter {
             }
             // List available tools
             const toolsResult = await client.listTools();
+            this.assertConnectCurrent(config.name, epoch);
             // Register tools
             for (const tool of toolsResult.tools) {
                 if (!mcpToolAllowed(tool.name, config.toolFilter))
@@ -114,6 +160,10 @@ export class MCPManager extends EventEmitter {
             this.emit('serverAdded', config.name, toolsResult.tools.length);
         }
         catch (error) {
+            if (this.currentEpoch(config.name) !== epoch) {
+                // Explicit removeServer raced this connect; keep disconnected.
+                throw error;
+            }
             this.serverStatuses.set(config.name, 'error');
             this.handleServerError(config.name, error);
             throw error;
@@ -159,8 +209,13 @@ export class MCPManager extends EventEmitter {
         if (retryCount < maxRetries) {
             this.retryCounts.set(serverName, retryCount + 1);
             const delay = Math.min(1000 * Math.pow(2, retryCount), 30000);
+            const epochAtError = this.currentEpoch(serverName);
             logger.info(`Attempting to reconnect to ${serverName} in ${delay}ms (attempt ${retryCount + 1}/${maxRetries})`);
-            setTimeout(async () => {
+            this.clearReconnectTimer(serverName);
+            const timer = setTimeout(async () => {
+                this.reconnectTimers.delete(serverName);
+                if (this.currentEpoch(serverName) !== epochAtError)
+                    return;
                 try {
                     await this.removeServer(serverName);
                     await this.addServer(config);
@@ -169,6 +224,7 @@ export class MCPManager extends EventEmitter {
                     logger.debug(`Reconnection attempt failed for ${serverName}`, { reconnectError });
                 }
             }, delay);
+            this.reconnectTimers.set(serverName, timer);
         }
         else {
             logger.error(`Max reconnection attempts reached for ${serverName}`);
@@ -179,6 +235,9 @@ export class MCPManager extends EventEmitter {
         return this.serverStatuses.get(serverName);
     }
     async removeServer(serverName) {
+        this.bumpConnectEpoch(serverName);
+        this.clearReconnectTimer(serverName);
+        this.serverAddPromises.delete(serverName);
         this.stopHealthCheck(serverName);
         this.serverStatuses.set(serverName, 'disconnected');
         // Remove tools

package/dist/mcp/mcp-oauth-constants.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Shared MCP OAuth markers.
+ *
+ * Kept in a leaf module so `mcp-oauth.ts` and `mcp-oauth-provider.ts` can share
+ * them without an import cycle.
+ */
+/** Marker stored as tokenUrl: refresh is handled by the SDK, never by MCPOAuthManager.getValidToken(). */
+export declare const SDK_MANAGED_TOKEN_URL = "sdk-managed";

package/dist/mcp/mcp-oauth-constants.js

@@ -0,0 +1,9 @@
+/**
+ * Shared MCP OAuth markers.
+ *
+ * Kept in a leaf module so `mcp-oauth.ts` and `mcp-oauth-provider.ts` can share
+ * them without an import cycle.
+ */
+/** Marker stored as tokenUrl: refresh is handled by the SDK, never by MCPOAuthManager.getValidToken(). */
+export const SDK_MANAGED_TOKEN_URL = 'sdk-managed';
+//# sourceMappingURL=mcp-oauth-constants.js.map

package/dist/mcp/mcp-oauth-provider.d.ts

@@ -0,0 +1,80 @@
+/**
+ * OAuth provider bridge for HTTP MCP transports.
+ *
+ * Adapts the SDK `OAuthClientProvider` contract (RFC 9728 discovery, PKCE,
+ * URL-based client IDs / dynamic registration handled by the SDK itself) onto
+ * the existing encrypted token store of `mcp-oauth.ts`. No parallel OAuth
+ * implementation: PKCE, discovery and token exchange come from the SDK; the
+ * local callback server, browser opening and token persistence come from the
+ * existing manager.
+ */
+import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { SDK_MANAGED_TOKEN_URL } from './mcp-oauth-constants.js';
+import { type CallbackSession } from './mcp-oauth.js';
+export { SDK_MANAGED_TOKEN_URL };
+export interface MCPTransportOAuthConfig {
+    type: 'oauth';
+    /** Key of the stored token; defaults to the server URL host. */
+    serverId?: string;
+    /** SEP-991 URL-based client id (HTTPS document). Used when the server advertises support. */
+    clientMetadataUrl?: string;
+    /** Pre-registered public client id (token_endpoint_auth_method none). */
+    clientId?: string;
+    scopes?: string[];
+    /** Loopback redirect; default http://localhost:19836/callback (same as mcp-oauth.ts). */
+    redirectUri?: string;
+    /** When false, an authorization requirement fails closed instead of opening a browser. */
+    interactive?: boolean;
+}
+export interface OAuthWaitOptions {
+    signal?: AbortSignal;
+}
+export interface OAuthInteraction {
+    openUrl: (url: string) => Promise<void>;
+    waitForCode: (redirectUri: string, state: string, opts?: OAuthWaitOptions) => Promise<string>;
+    /** Production default: bind the callback port before openUrl. Tests may omit this. */
+    beginWaitForCode?: (redirectUri: string, state: string, opts?: OAuthWaitOptions) => CallbackSession;
+}
+/** Tests inject a fake browser; production keeps the default loopback flow. */
+export declare function setMCPOAuthInteraction(next: OAuthInteraction | null): void;
+interface FinishAuthTransport {
+    finishAuth(authorizationCode: string): Promise<void>;
+}
+export declare class MCPStoredOAuthProvider implements OAuthClientProvider {
+    private readonly serverId;
+    private readonly auth;
+    private verifier?;
+    private stateValue?;
+    private client?;
+    private transport?;
+    /** Single in-flight authorization: concurrent SDK auth() calls share it. */
+    private pending?;
+    private flowAbort?;
+    private callbackSession?;
+    /** Set by abortAuthorization so a late successful callback cannot finishAuth. */
+    private authCancelled;
+    constructor(serverId: string, auth: MCPTransportOAuthConfig);
+    attachTransport(transport: FinishAuthTransport): void;
+    get redirectUrl(): string;
+    get clientMetadataUrl(): string | undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    state(): string;
+    clientInformation(): OAuthClientInformationMixed | undefined;
+    saveClientInformation(info: OAuthClientInformationMixed): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    abortAuthorization(reason?: Error): void;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    private throwIfAuthCancelled;
+    /**
+     * Open the system browser. A slow opener is raced against abort so
+     * removeServer does not stay stuck in openUrl; a failed opener still
+     * prints the URL so the user can complete the loopback callback by hand.
+     */
+    private openAuthorizationUrl;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): void;
+}
+export declare function createOAuthProvider(url: string, auth: MCPTransportOAuthConfig): MCPStoredOAuthProvider;

package/dist/mcp/mcp-oauth-provider.js

@@ -0,0 +1,241 @@
+/**
+ * OAuth provider bridge for HTTP MCP transports.
+ *
+ * Adapts the SDK `OAuthClientProvider` contract (RFC 9728 discovery, PKCE,
+ * URL-based client IDs / dynamic registration handled by the SDK itself) onto
+ * the existing encrypted token store of `mcp-oauth.ts`. No parallel OAuth
+ * implementation: PKCE, discovery and token exchange come from the SDK; the
+ * local callback server, browser opening and token persistence come from the
+ * existing manager.
+ */
+import * as crypto from 'crypto';
+import { logger } from '../utils/logger.js';
+import { SDK_MANAGED_TOKEN_URL } from './mcp-oauth-constants.js';
+import { getMCPOAuthManager, OAuthCallbackCancelledError, openBrowser, startCallbackServer, startCallbackSession, } from './mcp-oauth.js';
+export { SDK_MANAGED_TOKEN_URL };
+const DEFAULT_REDIRECT = 'http://localhost:19836/callback';
+function waitUntilAborted(signal) {
+    if (signal.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        signal.addEventListener('abort', () => resolve(), { once: true });
+    });
+}
+function storedClientFromMixed(info) {
+    const client = { client_id: info.client_id };
+    if (info.client_secret)
+        client.client_secret = info.client_secret;
+    if (info.client_id_issued_at !== undefined)
+        client.client_id_issued_at = info.client_id_issued_at;
+    if (info.client_secret_expires_at !== undefined)
+        client.client_secret_expires_at = info.client_secret_expires_at;
+    if ('redirect_uris' in info && info.redirect_uris)
+        client.redirect_uris = info.redirect_uris.map(String);
+    if ('token_endpoint_auth_method' in info && info.token_endpoint_auth_method) {
+        client.token_endpoint_auth_method = info.token_endpoint_auth_method;
+    }
+    if ('grant_types' in info && info.grant_types)
+        client.grant_types = info.grant_types;
+    if ('response_types' in info && info.response_types)
+        client.response_types = info.response_types;
+    if ('client_name' in info && info.client_name)
+        client.client_name = info.client_name;
+    if ('scope' in info && info.scope)
+        client.scope = info.scope;
+    return client;
+}
+function defaultInteraction() {
+    return {
+        openUrl: (url) => openBrowser(url),
+        waitForCode: async (redirectUri, state, opts) => (await startCallbackServer(redirectUri, state, 120_000, opts?.signal)).code,
+        beginWaitForCode: (redirectUri, state, opts) => startCallbackSession(redirectUri, state, 120_000, opts?.signal),
+    };
+}
+let interaction = defaultInteraction();
+/** Tests inject a fake browser; production keeps the default loopback flow. */
+export function setMCPOAuthInteraction(next) {
+    interaction = next ?? defaultInteraction();
+}
+export class MCPStoredOAuthProvider {
+    serverId;
+    auth;
+    verifier;
+    stateValue;
+    client;
+    transport;
+    /** Single in-flight authorization: concurrent SDK auth() calls share it. */
+    pending;
+    flowAbort;
+    callbackSession;
+    /** Set by abortAuthorization so a late successful callback cannot finishAuth. */
+    authCancelled = false;
+    constructor(serverId, auth) {
+        this.serverId = serverId;
+        this.auth = auth;
+    }
+    attachTransport(transport) {
+        this.transport = transport;
+    }
+    get redirectUrl() {
+        return this.auth.redirectUri ?? DEFAULT_REDIRECT;
+    }
+    get clientMetadataUrl() {
+        return this.auth.clientMetadataUrl;
+    }
+    get clientMetadata() {
+        return {
+            client_name: 'Code Buddy',
+            redirect_uris: [this.redirectUrl],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            ...(this.auth.scopes?.length ? { scope: this.auth.scopes.join(' ') } : {}),
+        };
+    }
+    state() {
+        this.stateValue = crypto.randomBytes(16).toString('hex');
+        return this.stateValue;
+    }
+    clientInformation() {
+        if (this.auth.clientId)
+            return { client_id: this.auth.clientId };
+        if (this.client)
+            return this.client;
+        const stored = getMCPOAuthManager().getStoredClientInformation(this.serverId);
+        return stored ?? undefined;
+    }
+    saveClientInformation(info) {
+        this.client = info;
+        getMCPOAuthManager().storeClientInformation(this.serverId, storedClientFromMixed(info));
+    }
+    tokens() {
+        const stored = getMCPOAuthManager().getStoredToken(this.serverId);
+        if (!stored)
+            return undefined;
+        const { token } = stored;
+        return {
+            access_token: token.accessToken,
+            token_type: 'bearer',
+            ...(token.refreshToken ? { refresh_token: token.refreshToken } : {}),
+            expires_in: Math.max(0, Math.floor((token.expiresAt - Date.now()) / 1000)),
+            ...(token.scopes.length ? { scope: token.scopes.join(' ') } : {}),
+        };
+    }
+    saveTokens(tokens) {
+        const clientId = this.clientInformation()?.client_id ?? '';
+        getMCPOAuthManager().storeToken(this.serverId, {
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token,
+            expiresAt: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+            scopes: tokens.scope ? tokens.scope.split(' ') : (this.auth.scopes ?? []),
+        }, { clientId, clientSecret: undefined, authorizationUrl: '', tokenUrl: SDK_MANAGED_TOKEN_URL, scopes: this.auth.scopes ?? [] });
+    }
+    abortAuthorization(reason) {
+        this.authCancelled = true;
+        this.flowAbort?.abort();
+        this.callbackSession?.abort(reason);
+    }
+    redirectToAuthorization(authorizationUrl) {
+        if (this.auth.interactive === false) {
+            return Promise.reject(new Error(`MCP server "${this.serverId}" requires OAuth authorization; run the connection interactively to sign in.`));
+        }
+        if (!this.transport) {
+            return Promise.reject(new Error('OAuth provider is not attached to a transport'));
+        }
+        if (this.pending)
+            return this.pending;
+        this.authCancelled = false;
+        this.flowAbort = new AbortController();
+        const signal = this.flowAbort.signal;
+        const url = authorizationUrl.toString();
+        this.pending = (async () => {
+            const state = this.stateValue ?? this.state();
+            const opts = { signal };
+            let code;
+            if (interaction.beginWaitForCode) {
+                const session = interaction.beginWaitForCode(this.redirectUrl, state, opts);
+                this.callbackSession = session;
+                await session.listening;
+                this.throwIfAuthCancelled(signal);
+                logger.info(`MCP "${this.serverId}": opening browser for OAuth authorization`);
+                await this.openAuthorizationUrl(url, signal);
+                this.throwIfAuthCancelled(signal);
+                code = (await session.result).code;
+            }
+            else {
+                const codePromise = interaction.waitForCode(this.redirectUrl, state, opts);
+                logger.info(`MCP "${this.serverId}": opening browser for OAuth authorization`);
+                await this.openAuthorizationUrl(url, signal);
+                this.throwIfAuthCancelled(signal);
+                code = await codePromise;
+            }
+            this.throwIfAuthCancelled(signal);
+            await this.transport.finishAuth(code);
+        })().finally(() => {
+            this.pending = undefined;
+            this.callbackSession = undefined;
+            this.flowAbort = undefined;
+        });
+        return this.pending;
+    }
+    throwIfAuthCancelled(signal) {
+        if (this.authCancelled || signal.aborted) {
+            throw new OAuthCallbackCancelledError();
+        }
+    }
+    /**
+     * Open the system browser. A slow opener is raced against abort so
+     * removeServer does not stay stuck in openUrl; a failed opener still
+     * prints the URL so the user can complete the loopback callback by hand.
+     */
+    async openAuthorizationUrl(url, signal) {
+        this.throwIfAuthCancelled(signal);
+        const aborted = waitUntilAborted(signal);
+        aborted.catch(() => undefined);
+        const opener = interaction.openUrl(url).then(() => 'opened', () => 'failed');
+        const outcome = await Promise.race([
+            opener.then((kind) => ({ kind })),
+            aborted.then(() => ({ kind: 'aborted' })),
+        ]);
+        if (outcome.kind === 'aborted' || this.authCancelled) {
+            throw new OAuthCallbackCancelledError();
+        }
+        if (outcome.kind === 'failed') {
+            logger.warn(`MCP "${this.serverId}": browser could not be opened; open this URL manually:\n${url}`);
+        }
+    }
+    saveCodeVerifier(codeVerifier) {
+        // A concurrent auth() while the browser flow is pending must not replace the
+        // verifier the pending flow will exchange its code with.
+        if (this.pending)
+            return;
+        this.verifier = codeVerifier;
+    }
+    codeVerifier() {
+        if (!this.verifier)
+            throw new Error('No PKCE code verifier saved');
+        return this.verifier;
+    }
+    invalidateCredentials(scope) {
+        if (scope === 'tokens') {
+            getMCPOAuthManager().clearTokens(this.serverId);
+            return;
+        }
+        if (scope === 'all' || scope === 'client') {
+            getMCPOAuthManager().removeToken(this.serverId);
+            this.client = undefined;
+        }
+        if (scope === 'all' || scope === 'verifier')
+            this.verifier = undefined;
+    }
+}
+export function createOAuthProvider(url, auth) {
+    const serverId = auth.serverId ?? new URL(url).host;
+    // Fail closed before the SDK performs discovery or client registration: without a
+    // stored token, a non-interactive connection can never complete.
+    if (auth.interactive === false && !getMCPOAuthManager().getStoredToken(serverId)) {
+        throw new Error(`MCP server "${serverId}" requires OAuth authorization; run the connection interactively to sign in.`);
+    }
+    return new MCPStoredOAuthProvider(serverId, auth);
+}
+//# sourceMappingURL=mcp-oauth-provider.js.map

package/dist/mcp/mcp-oauth.d.ts

@@ -18,6 +18,19 @@ export interface MCPOAuthToken {
     expiresAt: number;
     scopes: string[];
 }
+/** Client id + optional DCR metadata persisted next to the token (encrypted store). */
+export interface StoredClientInformation {
+    client_id: string;
+    client_secret?: string;
+    client_id_issued_at?: number;
+    client_secret_expires_at?: number;
+    redirect_uris?: string[];
+    token_endpoint_auth_method?: string;
+    grant_types?: string[];
+    response_types?: string[];
+    client_name?: string;
+    scope?: string;
+}
 /**
  * Generate a cryptographically random code verifier (43-128 chars, URL-safe)
  */
@@ -26,6 +39,35 @@ export declare function generateCodeVerifier(): string;
  * Generate code challenge from verifier using S256 method
  */
 export declare function generateCodeChallenge(verifier: string): string;
+interface AuthorizationResult {
+    code: string;
+    state: string;
+}
+export declare class OAuthCallbackCancelledError extends Error {
+    constructor(message?: string);
+}
+export interface CallbackSession {
+    /** Resolves only after listen() succeeded. Rejects on bind failure or abort-before-listen. */
+    listening: Promise<void>;
+    /** Resolves with the authorization code after a valid callback. */
+    result: Promise<AuthorizationResult>;
+    abort: (reason?: Error) => void;
+}
+/**
+ * Bind the loopback callback server. Callers must await `listening` before
+ * opening a browser: a bind failure must not leave an unhandled rejection
+ * nor launch a flow that can never complete.
+ */
+export declare function startCallbackSession(redirectUri: string, expectedState: string, timeoutMs?: number, signal?: AbortSignal): CallbackSession;
+/**
+ * Start a temporary local HTTP server to receive the OAuth callback.
+ * Awaits a successful listen before waiting for the code.
+ */
+export declare function startCallbackServer(redirectUri: string, expectedState: string, timeoutMs?: number, signal?: AbortSignal): Promise<AuthorizationResult>;
+/**
+ * Open a URL in the default browser (cross-platform)
+ */
+export declare function openBrowser(url: string): Promise<void>;
 export declare class MCPOAuthManager {
     private tokenCache;
     /**
@@ -48,17 +90,34 @@ export declare class MCPOAuthManager {
      */
     getValidToken(serverId: string): Promise<string | null>;
     /**
-     * Store a token encrypted on disk and in memory cache
+     * Store a token encrypted on disk and in memory cache.
+     * Preserves any previously persisted client metadata for the same server.
      */
     storeToken(serverId: string, token: MCPOAuthToken, config: MCPOAuthConfig): void;
+    /**
+     * Persist client registration (client_id and optional DCR metadata) in the
+     * encrypted store, even before a token exists. Never writes plaintext.
+     */
+    storeClientInformation(serverId: string, info: StoredClientInformation): void;
     /**
      * Remove a stored token
      */
     removeToken(serverId: string): void;
+    /** Drop access/refresh tokens only; keep client_id and DCR metadata. */
+    clearTokens(serverId: string): void;
     /**
      * Check if a token exists for a server (may be expired)
      */
+    /** Stored token and client id for a server, without refresh side effects. */
+    getStoredToken(serverId: string): {
+        token: MCPOAuthToken;
+        clientId: string;
+        client?: StoredClientInformation;
+    } | null;
+    /** Persisted client id / DCR metadata, independent of whether a token exists. */
+    getStoredClientInformation(serverId: string): StoredClientInformation | null;
     hasToken(serverId: string): boolean;
 }
 export declare function getMCPOAuthManager(): MCPOAuthManager;
 export declare function resetMCPOAuthManager(): void;
+export {};