@poe-platform/safe-bash 0.1.799 → 0.1.801

package/dist/safe-bash-mcp/index.browser.js

@@ -63,7 +63,131 @@ var OAuthAuthorizationError = class extends Error {
   }
 };
 
+// ../mcp-oauth/dist/client/token-auth-method.js
+function normalizeOAuthTokenEndpointAuthMethod(value) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+    throw new Error("Unsupported OAuth token endpoint authentication method");
+  return value;
+}
+
+// ../mcp-oauth/dist/resource-indicator.js
+function canonicalizeResourceIndicator(value) {
+  let url;
+  try {
+    url = value instanceof URL ? new URL(value.toString()) : new URL(value);
+  } catch {
+    throw new Error("Resource indicator must be an absolute URL");
+  }
+  url.hash = "";
+  return url.toString();
+}
+
+// ../mcp-oauth/dist/http-response.js
+async function readBoundedResponseText(response, maxBytes, readers, signal) {
+  if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 1))
+    throw new Error("HTTP response byte limit must be a positive safe integer");
+  if (signal?.aborted) {
+    void response.body?.cancel().catch(() => void 0);
+    throw signal.reason;
+  }
+  const length = response.headers.get("Content-Length");
+  if (length !== null && length.length > 0 && [...length].every((character) => character >= "0" && character <= "9") && Number(length) > maxBytes) {
+    void response.body?.cancel().catch(() => void 0);
+    throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
+  }
+  if (response.body === null)
+    return "";
+  const reader = response.body.getReader();
+  readers?.add(reader);
+  const abort = () => {
+    void reader.cancel().catch(() => void 0);
+  };
+  signal?.addEventListener("abort", abort, { once: true });
+  if (signal?.aborted)
+    abort();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let bytes = 0;
+  let text = "";
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      signal?.throwIfAborted();
+      if (chunk.done)
+        return text + decoder.decode();
+      bytes += chunk.value.byteLength;
+      if (bytes > maxBytes)
+        throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+  } catch (error) {
+    void reader.cancel().catch(() => void 0);
+    throw error;
+  } finally {
+    signal?.removeEventListener("abort", abort);
+    readers?.delete(reader);
+    reader.releaseLock();
+  }
+}
+
+// ../mcp-oauth/dist/http-fetch.js
+async function fetchMcpResponse(fetchImplementation, input, init = {}) {
+  const signal = init.signal;
+  signal?.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (error, response) => {
+      if (settled)
+        return;
+      settled = true;
+      signal?.removeEventListener("abort", abort);
+      if (response === void 0)
+        reject(error);
+      else
+        resolve(response);
+    };
+    const abort = () => finish(signal?.reason);
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) {
+      abort();
+      return;
+    }
+    let pending;
+    try {
+      pending = fetchImplementation(input, { ...init, redirect: "error" });
+    } catch (error) {
+      finish(error);
+      return;
+    }
+    void pending.then((response) => {
+      if (settled || signal?.aborted) {
+        void response.body?.cancel().catch(() => void 0);
+        if (!settled)
+          abort();
+        return;
+      }
+      if (response.redirected || response.type === "opaqueredirect") {
+        void response.body?.cancel().catch(() => void 0);
+        finish(new Error("MCP HTTP redirects are not allowed"));
+      } else
+        finish(void 0, response);
+    }, (error) => finish(error));
+  });
+}
+
+// ../mcp-oauth/dist/client/scope.js
+function normalizeOAuthScope(scope) {
+  if (scope === void 0)
+    return void 0;
+  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+    throw new Error("Invalid OAuth scope syntax");
+  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+  return normalized || void 0;
+}
+
 // ../mcp-oauth/dist/client/token-endpoint.js
+var MAX_JS_DATE_MS = 864e13;
 var oauthErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthError");
 var OAuthError = class extends Error {
   /** Recognize errors from separately bundled copies of this package. */
@@ -100,6 +224,296 @@ var OAuthError = class extends Error {
 function isRetryableOAuthError(error) {
   return error instanceof OAuthError && (error.status >= 500 || error.error === "server_error" || error.error === "temporarily_unavailable");
 }
+async function exchangeAuthorizationCode(input) {
+  const resource = canonicalizeResourceIndicator(input.resource);
+  return requestTokens({
+    tokenEndpoint: input.tokenEndpoint,
+    clientId: input.clientId,
+    clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
+    params: {
+      grant_type: "authorization_code",
+      code: input.code,
+      code_verifier: input.codeVerifier,
+      redirect_uri: input.redirectUri,
+      resource
+    },
+    fetch: input.fetch,
+    signal: input.signal,
+    now: input.now
+  });
+}
+async function requestTokens(input) {
+  const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? (input.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && (input.clientSecret === void 0 || input.clientSecret.trim() === ""))
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const body = new URLSearchParams(input.params);
+  const headers = new Headers({ Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" });
+  if (method === "client_secret_basic") {
+    const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+    const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+    headers.set("Authorization", `Basic ${btoa(`${encoded}:${encodedSecret}`)}`);
+  } else {
+    body.set("client_id", input.clientId);
+    if (method === "client_secret_post")
+      body.set("client_secret", input.clientSecret);
+  }
+  input.signal?.throwIfAborted();
+  const deadline = AbortSignal.timeout(3e4);
+  const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
+  const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal
+  });
+  const payload = await readOAuthJsonObjectResponse(response, signal);
+  const accessToken = getOwnEntry(payload, "access_token");
+  if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
+    throw new Error("OAuth token response missing access_token");
+  }
+  const normalizedAccessToken = accessToken.trim();
+  try {
+    new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
+  } catch {
+    throw new Error("OAuth token response access_token is not a valid HTTP header value");
+  }
+  const tokenType = normalizeBearerTokenType(getOwnEntry(payload, "token_type"));
+  if (tokenType === null) {
+    throw new Error("OAuth token response missing token_type=Bearer");
+  }
+  const expiresIn = getOwnEntry(payload, "expires_in");
+  let expiresAt = null;
+  if (expiresIn !== void 0) {
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || !Number.isInteger(expiresIn) || expiresIn < 0) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
+    const issuedAt = input.now();
+    if (!Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS)
+      throw new Error("OAuth token response has invalid expires_in");
+    expiresAt = issuedAt + expiresIn * 1e3;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS || !Number.isFinite(new Date(expiresAt).getTime())) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
+  }
+  const refreshToken = getOwnEntry(payload, "refresh_token");
+  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0))
+    throw new Error("OAuth token response has invalid refresh_token");
+  const scope = getOwnEntry(payload, "scope");
+  const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
+  const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
+  if (scope !== void 0 && normalizedScope === void 0)
+    throw new Error("Invalid OAuth scope syntax in token response");
+  return {
+    accessToken: normalizedAccessToken,
+    refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
+    tokenType,
+    expiresAt,
+    scope: normalizedScope === void 0 ? void 0 : normalizedScope
+  };
+}
+async function readOAuthJsonObjectResponse(response, signal) {
+  const fallbackError = createFallbackOAuthError(response.status);
+  let payload;
+  try {
+    payload = JSON.parse(await readBoundedResponseText(response, 1024 * 1024, void 0, signal));
+  } catch (error) {
+    if (signal?.aborted)
+      throw signal.reason;
+    if (error instanceof Error && error.message.startsWith("HTTP response exceeds "))
+      throw error;
+    if (!response.ok) {
+      throw fallbackError;
+    }
+    throw new Error("OAuth response must be a JSON object");
+  }
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+    if (!response.ok) {
+      throw fallbackError;
+    }
+    throw new Error("OAuth response must be a JSON object");
+  }
+  const record2 = payload;
+  if (!response.ok) {
+    const error = getOwnEntry(record2, "error");
+    if (typeof error !== "string" || error.trim() === "")
+      throw fallbackError;
+    throw new OAuthError(readOAuthError(record2), response.status);
+  }
+  return record2;
+}
+function readOAuthError(payload, fallbackError = "server_error") {
+  const error = getOwnEntry(payload, "error");
+  const errorDescription = getOwnEntry(payload, "error_description");
+  const errorUri = getOwnEntry(payload, "error_uri");
+  return {
+    error: typeof error === "string" ? error : fallbackError,
+    error_description: typeof errorDescription === "string" ? errorDescription : void 0,
+    error_uri: typeof errorUri === "string" ? errorUri : void 0
+  };
+}
+function getOwnEntry(record2, key) {
+  return Object.prototype.hasOwnProperty.call(record2, key) ? record2[key] : void 0;
+}
+function createFallbackOAuthError(status) {
+  const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
+  return new OAuthError({ error }, status, false);
+}
+function normalizeBearerTokenType(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  return value.toLowerCase() === "bearer" ? "Bearer" : null;
+}
+
+// ../mcp-oauth/dist/client/resumable.js
+var responseParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
+function httpsUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#"))
+    throw new Error();
+  return url;
+}
+function base64url(bytes) {
+  return btoa(String.fromCharCode(...bytes)).split("+").join("-").split("/").join("_").split("=").join("");
+}
+function timestamp(now) {
+  const value = now();
+  if (!Number.isSafeInteger(value) || value < 0 || value > 864e13 - 6e5)
+    throw new Error();
+  return value;
+}
+async function beginRemoteMcpAuthorization(options) {
+  try {
+    const { store, signal, discover } = options;
+    const now = options.now?.bind(options) ?? Date.now;
+    const resource = httpsUrl(options.resource).href;
+    const redirect = httpsUrl(options.redirectUri);
+    if (responseParameters.some((key) => redirect.searchParams.has(key)))
+      throw new Error();
+    const client = structuredClone(options.client);
+    if (typeof client.clientId !== "string" || !client.clientId.trim())
+      throw new Error();
+    const method = normalizeOAuthTokenEndpointAuthMethod(client.tokenEndpointAuthMethod) ?? (client.clientSecret === void 0 ? "none" : "client_secret_post");
+    if (client.clientSecret !== void 0 && (typeof client.clientSecret !== "string" || !client.clientSecret.trim()))
+      throw new Error();
+    if (method !== "none" && client.clientSecret === void 0)
+      throw new Error();
+    if (client.registration !== void 0 && (client.registration.client_id !== client.clientId || client.registration.client_secret != null && client.registration.client_secret !== client.clientSecret || client.registration.token_endpoint_auth_method != null && client.registration.token_endpoint_auth_method !== method))
+      throw new Error();
+    client.tokenEndpointAuthMethod = method;
+    if (client.requestedRedirectUri !== void 0 && client.requestedRedirectUri !== redirect.href)
+      throw new Error();
+    if (client.registration?.redirect_uris != null && !client.registration.redirect_uris.includes(redirect.href))
+      throw new Error();
+    const scope = normalizeOAuthScope(options.scope);
+    const ttl = options.ttlMs ?? 6e5;
+    if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > 6e5)
+      throw new Error();
+    signal?.throwIfAborted();
+    const metadata = structuredClone(await discover(resource, signal));
+    signal?.throwIfAborted();
+    const server = metadata.authorizationServerMetadata;
+    if (httpsUrl(metadata.resource).href !== resource || httpsUrl(metadata.resourceMetadata.resource).href !== resource || server.issuer !== metadata.authorizationServer || !metadata.resourceMetadata.authorization_servers.includes(server.issuer) || !server.response_types_supported.includes("code") || !server.code_challenge_methods_supported.includes("S256"))
+      throw new Error();
+    httpsUrl(server.issuer);
+    httpsUrl(server.token_endpoint);
+    const authorization = httpsUrl(server.authorization_endpoint);
+    const state = base64url(crypto.getRandomValues(new Uint8Array(32)));
+    const codeVerifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
+    const challenge = base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier))));
+    const expiresAt = timestamp(now) + ttl;
+    const session = {
+      resource,
+      authorizationServer: server.issuer,
+      client: { ...client, registrationOwnership: "caller", requestedRedirectUri: redirect.href },
+      ...scope === void 0 ? {} : { requestedScope: scope },
+      discovery: { resourceMetadataUrl: metadata.resourceMetadataUrl, resourceMetadata: metadata.resourceMetadata, authorizationServerMetadata: server }
+    };
+    for (const [key, value] of Object.entries({
+      response_type: "code",
+      client_id: client.clientId,
+      redirect_uri: redirect.href,
+      resource,
+      state,
+      code_challenge: challenge,
+      code_challenge_method: "S256"
+    }))
+      authorization.searchParams.set(key, value);
+    authorization.searchParams.delete("scope");
+    if (scope !== void 0)
+      authorization.searchParams.set("scope", scope);
+    signal?.throwIfAborted();
+    await store.create({
+      state,
+      expiresAt,
+      redirectUri: redirect.href,
+      codeVerifier,
+      requireIssuer: server.authorization_response_iss_parameter_supported === true,
+      session
+    });
+    signal?.throwIfAborted();
+    return { authorizationUrl: authorization.href, expiresAt };
+  } catch {
+    throw new Error("Unable to begin MCP authorization");
+  }
+}
+async function completeRemoteMcpAuthorization(options) {
+  try {
+    const { store, fetch: fetch2, signal } = options;
+    const now = options.now?.bind(options) ?? Date.now;
+    const callback = httpsUrl(options.callbackUrl);
+    for (const key of responseParameters)
+      if (callback.searchParams.getAll(key).length > 1)
+        throw new Error();
+    const state = callback.searchParams.get("state");
+    if (!state || state.length > 256)
+      throw new Error();
+    signal?.throwIfAborted();
+    const stored = await store.consume(state);
+    if (stored === null)
+      throw new Error();
+    const transaction = structuredClone(stored);
+    if (transaction.state !== state || !Number.isSafeInteger(transaction.expiresAt) || transaction.expiresAt <= timestamp(now))
+      throw new Error();
+    const expected = httpsUrl(transaction.redirectUri);
+    const issuer = callback.searchParams.get("iss");
+    if (transaction.requireIssuer && issuer === null || issuer !== null && issuer !== transaction.session.authorizationServer)
+      throw new Error();
+    const code = callback.searchParams.get("code");
+    if (!code || callback.searchParams.has("error"))
+      throw new Error();
+    for (const key of responseParameters)
+      callback.searchParams.delete(key);
+    const actualPairs = [...callback.searchParams].sort(), expectedPairs = [...expected.searchParams].sort();
+    if (callback.origin !== expected.origin || callback.pathname !== expected.pathname || JSON.stringify(actualPairs) !== JSON.stringify(expectedPairs))
+      throw new Error();
+    const session = structuredClone(transaction.session);
+    const tokenEndpoint = httpsUrl(String(session.discovery.authorizationServerMetadata.token_endpoint)).href;
+    signal?.throwIfAborted();
+    session.tokens = await exchangeAuthorizationCode({
+      tokenEndpoint,
+      clientId: session.client.clientId,
+      clientSecret: session.client.clientSecret,
+      tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
+      code,
+      codeVerifier: transaction.codeVerifier,
+      redirectUri: transaction.redirectUri,
+      resource: session.resource,
+      fetch: fetch2,
+      signal,
+      now
+    });
+    if (session.tokens.scope === void 0 && session.requestedScope !== void 0)
+      session.tokens.scope = session.requestedScope;
+    signal?.throwIfAborted();
+    if (transaction.expiresAt <= timestamp(now) || !await store.commit(transaction, session))
+      throw new Error();
+    return { resource: session.resource };
+  } catch {
+    throw new Error("Unable to complete MCP authorization");
+  }
+}
 
 // src/oauth-policy.ts
 function snapshotOAuthBrowserOptions(browser) {
@@ -107,6 +521,7 @@ function snapshotOAuthBrowserOptions(browser) {
     ...browser,
     openBrowser: browser.openBrowser?.bind(browser),
     readLine: browser.readLine?.bind(browser),
+    waitForCallback: browser.waitForCallback?.bind(browser),
     createServer: browser.createServer?.bind(browser),
     redirectUri: browser.redirectUri,
     signal: browser.signal,
@@ -8513,7 +8928,9 @@ async function accessRemoteMcpResources(server, request, options = {}) {
 }
 export {
   accessRemoteMcpResources,
+  beginRemoteMcpAuthorization,
   compileToolArguments,
+  completeRemoteMcpAuthorization,
   createRemoteMcpCommands,
   fetchRemoteMcpSchema,
   remoteMcpCommands,

package/dist/safe-bash-mcp/index.d.ts

@@ -416,6 +416,12 @@ interface DefaultOAuthClientProviderOptions$1 {
     };
     browser: {
         openBrowser?(url: string): Promise<void>;
+        /** Return the full hosted HTTPS callback URL; the client validates redirect, state and issuer. */
+        waitForCallback?(request: {
+            authorizationUrl: string;
+            redirectUri: string;
+            signal: AbortSignal;
+        }): Promise<string>;
         /** Exact registered HTTP loopback redirect URI. */
         redirectUri?: string;
         signal?: AbortSignal;
@@ -1110,6 +1116,12 @@ interface DefaultOAuthClientProviderOptions {
     };
     browser: {
         openBrowser?(url: string): Promise<void>;
+        /** Return the full hosted HTTPS callback URL; the client validates redirect, state and issuer. */
+        waitForCallback?(request: {
+            authorizationUrl: string;
+            redirectUri: string;
+            signal: AbortSignal;
+        }): Promise<string>;
         /** Exact registered HTTP loopback redirect URI. */
         redirectUri?: string;
         signal?: AbortSignal;
@@ -1126,6 +1138,58 @@ interface DefaultOAuthClientProviderOptions {
     now?: () => number;
 }
 
+/** Sensitive, JSON-serializable record. Store only in private, authenticated host storage. */
+interface RemoteMcpAuthorizationTransaction {
+    readonly state: string;
+    readonly expiresAt: number;
+    readonly redirectUri: string;
+    readonly codeVerifier: string;
+    readonly requireIssuer: boolean;
+    readonly session: StoredOAuthSession;
+}
+/** Bind each store instance to the authenticated user and logical server. */
+interface RemoteMcpAuthorizationStore {
+    /** Atomically insert a unique state and capture the current credential generation. Never overwrite a state. */
+    create(transaction: RemoteMcpAuthorizationTransaction): Promise<void>;
+    /** Atomically remove/mark consumed, returning at most once across all workers. Preserve the commit fence. */
+    consume(state: string): Promise<RemoteMcpAuthorizationTransaction | null>;
+    /** Atomically persist only if the consumed transaction's generation is still current.
+     * Reset, deletion, reconfiguration and a superseding grant must invalidate the fence.
+     * Return false if stale. Never implement as an unconditional credential save.
+     */
+    commit(transaction: RemoteMcpAuthorizationTransaction, session: StoredOAuthSession): Promise<boolean>;
+}
+interface BeginRemoteMcpAuthorizationOptions {
+    readonly resource: string;
+    readonly redirectUri: string;
+    readonly client: StoredOAuthClient;
+    readonly scope?: string;
+    readonly store: RemoteMcpAuthorizationStore;
+    /** Host-validated discovery, including issuer trust and network policy. No implicit network access. */
+    readonly discover: (resource: string, signal?: AbortSignal) => Promise<OAuthDiscoveryResult>;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+    /** Transaction lifetime, at most ten minutes. */
+    readonly ttlMs?: number;
+}
+interface CompleteRemoteMcpAuthorizationOptions {
+    readonly callbackUrl: string;
+    readonly store: RemoteMcpAuthorizationStore;
+    /** Required host network policy. Redirects are rejected, including at the token endpoint. */
+    readonly fetch: OAuthMetadataFetch;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+}
+/** Start consent without a listener or a pending callback promise. Only the URL leaves private storage. */
+declare function beginRemoteMcpAuthorization(options: BeginRemoteMcpAuthorizationOptions): Promise<{
+    authorizationUrl: string;
+    expiresAt: number;
+}>;
+/** Redeem once after any process restart, then conditionally persist. Returns no tokens or callback secrets. */
+declare function completeRemoteMcpAuthorization(options: CompleteRemoteMcpAuthorizationOptions): Promise<{
+    resource: string;
+}>;
+
 interface EnvironmentReference {
     readonly env: string;
 }
@@ -1341,5 +1405,5 @@ interface RemoteMcpManagementOptions extends ConfigurationOptions {
 /** Create configuration and artifact commands for a host-owned static remote registry. */
 declare function createRemoteMcpManagementCommand(servers: readonly InitRemoteMcpServer[], options?: RemoteMcpManagementOptions): CommandDefinition;
 
-export { accessRemoteMcpResources, authenticateRemoteMcpServer, bindRemoteMcpConfiguration, compileToolArguments, createRemoteMcpCommands, createRemoteMcpManagementCommand, fetchRemoteMcpSchema, generateRemoteMcpArtifact, importRemoteMcpAuthentication, initRemoteMcpConfiguration, parseRemoteMcpArtifact, parseRemoteMcpConfiguration, remoteMcpArtifactPlugin, remoteMcpCommands, resetRemoteMcpAuthentication, resolveRemoteMcpSchemas };
-export type { ArtifactGenerationOptions, ArtifactOptions, ArtifactPluginOptions, BoundRemoteMcpServer, ConfigurationBindingOptions, ConfigurationOptions, EnvironmentReference, GeneratedRemoteMcpArtifact, InitRemoteMcpServer, OAuthCredentialReferences, PublicEnvironmentReference, RemoteMcpArtifact, RemoteMcpAuthenticationConfiguration, RemoteMcpAuthenticationOptions, RemoteMcpAuthenticationResult, RemoteMcpAuthorizationRequest, RemoteMcpCommandOptions, RemoteMcpConfiguration, RemoteMcpCredentialImportOptions, RemoteMcpCredentialImportResult, RemoteMcpCredentialResetOptions, RemoteMcpCredentialResetResult, RemoteMcpElicitationContext, RemoteMcpElicitationHandler, RemoteMcpInitialization, RemoteMcpManagementOptions, RemoteMcpResourceOptions, RemoteMcpResourceRequest, RemoteMcpResourceResult, RemoteMcpSchema, RemoteMcpServer, RemoteMcpServerConfiguration, SchemaFetchOptions, ToolArgumentParseOptions, ToolArgumentParser, ToolParameter };
+export { accessRemoteMcpResources, authenticateRemoteMcpServer, beginRemoteMcpAuthorization, bindRemoteMcpConfiguration, compileToolArguments, completeRemoteMcpAuthorization, createRemoteMcpCommands, createRemoteMcpManagementCommand, fetchRemoteMcpSchema, generateRemoteMcpArtifact, importRemoteMcpAuthentication, initRemoteMcpConfiguration, parseRemoteMcpArtifact, parseRemoteMcpConfiguration, remoteMcpArtifactPlugin, remoteMcpCommands, resetRemoteMcpAuthentication, resolveRemoteMcpSchemas };
+export type { ArtifactGenerationOptions, ArtifactOptions, ArtifactPluginOptions, BeginRemoteMcpAuthorizationOptions, BoundRemoteMcpServer, CompleteRemoteMcpAuthorizationOptions, ConfigurationBindingOptions, ConfigurationOptions, EnvironmentReference, GeneratedRemoteMcpArtifact, InitRemoteMcpServer, OAuthCredentialReferences, PublicEnvironmentReference, RemoteMcpArtifact, RemoteMcpAuthenticationConfiguration, RemoteMcpAuthenticationOptions, RemoteMcpAuthenticationResult, RemoteMcpAuthorizationRequest, RemoteMcpAuthorizationStore, RemoteMcpAuthorizationTransaction, RemoteMcpCommandOptions, RemoteMcpConfiguration, RemoteMcpCredentialImportOptions, RemoteMcpCredentialImportResult, RemoteMcpCredentialResetOptions, RemoteMcpCredentialResetResult, RemoteMcpElicitationContext, RemoteMcpElicitationHandler, RemoteMcpInitialization, RemoteMcpManagementOptions, RemoteMcpResourceOptions, RemoteMcpResourceRequest, RemoteMcpResourceResult, RemoteMcpSchema, RemoteMcpServer, RemoteMcpServerConfiguration, SchemaFetchOptions, ToolArgumentParseOptions, ToolArgumentParser, ToolParameter };