@polpo-ai/connect-server 0.15.144 → 0.16.0

package/dist/mcp-capability-resolver.d.ts

@@ -0,0 +1,22 @@
+import { type ConnectionSlotSpec, type McpCapabilityResolver, type McpCapabilityResolveInput } from "@polpo-ai/core";
+import { type ConnectionAccessResolverOptions, type ConnectionRecord } from "@polpo-ai/connect";
+export interface McpConnectionEndpoint {
+    url: string;
+    transport?: "http" | "sse";
+}
+export interface ConnectionMcpCapabilityResolverOptions extends ConnectionAccessResolverOptions {
+    resolveSpec(input: McpCapabilityResolveInput): ConnectionSlotSpec | Promise<ConnectionSlotSpec>;
+    /** Resolve from the installed Connector/Connection, never the authored agent URL. */
+    resolveEndpoint(connection: ConnectionRecord): McpConnectionEndpoint | Promise<McpConnectionEndpoint>;
+    /** Credential materialization/refresh remains owned by the Connect service. */
+    resolveHeaders(connection: ConnectionRecord, input: McpCapabilityResolveInput): Promise<HeadersInit | undefined>;
+    /** Host-only dispatch quota; receives the persisted selected account/context. */
+    beforeDispatch?(connection: ConnectionRecord, input: McpCapabilityResolveInput): Promise<void>;
+    timeoutMs?: number;
+    /** Host transport seam; default transport validates and pins public DNS. */
+    fetch?: typeof globalThis.fetch;
+}
+/** Share account and grant authorization with API capabilities while keeping
+ * MCP lifecycle and tool calls native. One resolve owns one tool operation. */
+export declare function createConnectionMcpCapabilityResolver(options: ConnectionMcpCapabilityResolverOptions): McpCapabilityResolver;
+//# sourceMappingURL=mcp-capability-resolver.d.ts.map

package/dist/mcp-capability-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-capability-resolver.d.ts","sourceRoot":"","sources":["../src/mcp-capability-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyD,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,EACjH,KAAK,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAkC,KAAK,+BAA+B,EAC3E,KAAK,gBAAgB,EAAiC,MAAM,mBAAmB,CAAC;AAGlF,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC5B;AAED,MAAM,WAAW,sCAAuC,SAAQ,+BAA+B;IAC7F,WAAW,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChG,qFAAqF;IACrF,eAAe,CAAC,UAAU,EAAE,gBAAgB,GAAG,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtG,+EAA+E;IAC/E,cAAc,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACjH,iFAAiF;IACjF,cAAc,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAMD;+EAC+E;AAC/E,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,sCAAsC,GAAG,qBAAqB,CAyF5H"}

package/dist/mcp-capability-resolver.js

@@ -0,0 +1,110 @@
+import { ConnectionSelectionError, createToolInvocationContext } from "@polpo-ai/core";
+import { createConnectionAccessResolver } from "@polpo-ai/connect";
+import { callRemoteMcpTool } from "./mcp-execution.js";
+function endpointKey(endpoint) {
+    return JSON.stringify([new URL(endpoint.url).href, endpoint.transport ?? "http"]);
+}
+/** Share account and grant authorization with API capabilities while keeping
+ * MCP lifecycle and tool calls native. One resolve owns one tool operation. */
+export function createConnectionMcpCapabilityResolver(options) {
+    const resolver = createConnectionAccessResolver(options);
+    return {
+        async resolve(original) {
+            const controller = new AbortController();
+            const abort = () => controller.abort();
+            const timeoutMs = Number.isFinite(options.timeoutMs) ? Math.min(Math.max(options.timeoutMs, 1), 30_000) : 30_000;
+            // One deadline covers acquisition, host policy, refresh and execution.
+            // Host adapters are not necessarily cancellable, so bound their waits too.
+            const timeout = setTimeout(abort, timeoutMs);
+            const cancelled = () => new ConnectionSelectionError("connection_scope_denied", "MCP invocation was cancelled or timed out");
+            const bounded = (work) => new Promise((resolve, reject) => {
+                if (controller.signal.aborted) {
+                    reject(cancelled());
+                    return;
+                }
+                const onAbort = () => reject(cancelled());
+                controller.signal.addEventListener("abort", onAbort, { once: true });
+                Promise.resolve().then(() => {
+                    if (controller.signal.aborted)
+                        throw cancelled();
+                    return work();
+                }).then(value => {
+                    if (controller.signal.aborted)
+                        reject(cancelled());
+                    else
+                        resolve(value);
+                }, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+            });
+            original.signal?.addEventListener("abort", abort, { once: true });
+            if (original.signal?.aborted)
+                controller.abort();
+            let access;
+            let consumed = false;
+            const dispose = () => {
+                clearTimeout(timeout);
+                controller.abort();
+                access?.dispose();
+                original.signal?.removeEventListener("abort", abort);
+            };
+            try {
+                const input = Object.freeze({ ...original, invocation: createToolInvocationContext(original.invocation), signal: controller.signal });
+                const spec = await bounded(() => options.resolveSpec(input));
+                access = await bounded(async () => {
+                    const selected = await resolver.acquire({ spec, slot: input.serverName,
+                        toolName: `mcp__${input.serverName}__${input.toolName}`, toolCallId: input.toolCallId,
+                        invocation: input.invocation, signal: controller.signal });
+                    if (controller.signal.aborted) {
+                        selected.dispose();
+                        throw cancelled();
+                    }
+                    return selected;
+                });
+                const acquired = access;
+                const boundInput = Object.freeze({ ...input, invocation: acquired.input.invocation });
+                const endpoint = Object.freeze({ ...await bounded(() => options.resolveEndpoint(acquired.connection)) });
+                const identity = endpointKey(endpoint);
+                const current = async () => {
+                    const connection = await bounded(() => acquired.current());
+                    if (endpointKey(await bounded(() => options.resolveEndpoint(connection))) !== identity) {
+                        throw new ConnectionSelectionError("connection_scope_denied", "The acquired MCP endpoint has changed");
+                    }
+                    return connection;
+                };
+                return {
+                    async call(arguments_) {
+                        if (consumed || controller.signal.aborted)
+                            throw new ConnectionSelectionError("connection_scope_denied", "MCP capability is no longer active");
+                        consumed = true;
+                        try {
+                            await current();
+                            return await callRemoteMcpTool({ ...endpoint, name: boundInput.toolName, arguments: arguments_,
+                                signal: controller.signal, timeoutMs: options.timeoutMs, fetch: options.fetch,
+                                beforeDispatch: options.beforeDispatch ? async () => {
+                                    const connection = await current();
+                                    await bounded(() => options.beforeDispatch(connection, boundInput));
+                                    await current();
+                                } : undefined,
+                                authorize: async () => {
+                                    const connection = await current();
+                                    const headers = await bounded(() => options.resolveHeaders(connection, boundInput));
+                                    // A refresh can yield long enough for a grant, binding, endpoint
+                                    // or installation to change. Deny before sending the result.
+                                    await current();
+                                    return headers;
+                                }, });
+                        }
+                        finally {
+                            dispose();
+                        }
+                    },
+                    dispose,
+                };
+            }
+            catch (error) {
+                dispose();
+                throw error;
+            }
+        },
+    };
+}
+//# sourceMappingURL=mcp-capability-resolver.js.map

package/dist/mcp-capability-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-capability-resolver.js","sourceRoot":"","sources":["../src/mcp-capability-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EACiB,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAoBvD,SAAS,WAAW,CAAC,QAA+B;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,qCAAqC,CAAC,OAA+C;IACnG,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,QAAQ;YACpB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAU,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClH,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,wBAAwB,CAAC,yBAAyB,EAAE,2CAA2C,CAAC,CAAC;YAC7H,MAAM,OAAO,GAAG,CAAI,IAA0B,EAAc,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC7F,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC1C,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;oBAC1B,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,SAAS,EAAE,CAAC;oBACjD,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBACd,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;;wBAC9C,OAAO,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACjD,IAAI,MAA4C,CAAC;YACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,EAAE,OAAO,EAAE,CAAC;gBAClB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACvD,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtI,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7D,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;oBAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU;wBACtE,QAAQ,EAAE,QAAQ,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;wBACrF,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3D,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;wBAAC,MAAM,SAAS,EAAE,CAAC;oBAAC,CAAC;oBACzE,OAAO,QAAQ,CAAC;gBAClB,CAAC,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC;gBACxB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBACtF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;gBACzG,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;oBACzB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3D,IAAI,WAAW,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACvF,MAAM,IAAI,wBAAwB,CAAC,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;oBACzG,CAAC;oBACD,OAAO,UAAU,CAAC;gBACpB,CAAC,CAAC;gBACF,OAAO;oBACL,KAAK,CAAC,IAAI,CAAC,UAAU;wBACnB,IAAI,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,IAAI,wBAAwB,CAC3E,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;wBACnE,QAAQ,GAAG,IAAI,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,OAAO,EAAE,CAAC;4BAChB,OAAO,MAAM,iBAAiB,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU;gCAC9F,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;gCAC7E,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE;oCAClD,MAAM,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;oCACnC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;oCACrE,MAAM,OAAO,EAAE,CAAC;gCAClB,CAAC,CAAC,CAAC,CAAC,SAAS;gCACb,SAAS,EAAE,KAAK,IAAI,EAAE;oCACpB,MAAM,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;oCACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;oCACpF,iEAAiE;oCACjE,6DAA6D;oCAC7D,MAAM,OAAO,EAAE,CAAC;oCAChB,OAAO,OAAO,CAAC;gCACjB,CAAC,GACA,CAAC,CAAC;wBACL,CAAC;gCAAS,CAAC;4BACT,OAAO,EAAE,CAAC;wBACZ,CAAC;oBACH,CAAC;oBACD,OAAO;iBACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mcp-discovery.d.ts

@@ -0,0 +1,7 @@
+import type { Tool } from "@modelcontextprotocol/sdk/types.js";
+import { type RemoteMcpTransportInput } from "./mcp-transport.js";
+export interface DiscoverRemoteMcpToolsInput extends RemoteMcpTransportInput {
+}
+/** Strict, read-only discovery. Transport failure is never an empty successful inventory. */
+export declare function discoverRemoteMcpTools(input: DiscoverRemoteMcpToolsInput): Promise<Tool[]>;
+//# sourceMappingURL=mcp-discovery.d.ts.map

package/dist/mcp-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-discovery.d.ts","sourceRoot":"","sources":["../src/mcp-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAE/D,OAAO,EAAuB,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;CAAG;AAM/E,6FAA6F;AAC7F,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBhG"}

package/dist/mcp-discovery.js

@@ -0,0 +1,27 @@
+import { ConnectError } from "@polpo-ai/connect";
+import { withRemoteMcpClient } from "./mcp-transport.js";
+const MAX_TOOLS = 1000;
+const MAX_PAGES = 20;
+const failed = (category) => new ConnectError("http_error", "MCP discovery failed", { details: { category } });
+/** Strict, read-only discovery. Transport failure is never an empty successful inventory. */
+export async function discoverRemoteMcpTools(input) {
+    return withRemoteMcpClient(input, async (client, signal) => {
+        const tools = [];
+        const cursors = new Set();
+        let cursor;
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const result = await client.listTools(cursor ? { cursor } : undefined, { signal });
+            tools.push(...result.tools);
+            if (tools.length > MAX_TOOLS)
+                throw failed("inventory_too_large");
+            if (!result.nextCursor)
+                return tools;
+            if (cursors.has(result.nextCursor))
+                throw failed("invalid_pagination");
+            cursor = result.nextCursor;
+            cursors.add(cursor);
+        }
+        throw failed("inventory_too_large");
+    });
+}
+//# sourceMappingURL=mcp-discovery.js.map

package/dist/mcp-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-discovery.js","sourceRoot":"","sources":["../src/mcp-discovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAgC,MAAM,oBAAoB,CAAC;AAIvF,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,YAAY,EAAE,sBAAsB,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEvH,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAkC;IAC7E,OAAO,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,KAAK,GAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,MAA0B,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACrC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;gBAAE,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACvE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp-execution.d.ts

@@ -0,0 +1,13 @@
+import { type CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { type RemoteMcpTransportInput } from "./mcp-transport.js";
+export interface CallRemoteMcpToolInput extends Omit<RemoteMcpTransportInput, "headers" | "authorize"> {
+    /** Name is fixed by the authorized capability, never chosen inside tool arguments. */
+    name: string;
+    arguments?: Record<string, unknown>;
+    /** Must recheck the acquired Connection/grant and resolve current credentials. */
+    authorize: () => Promise<HeadersInit | undefined>;
+}
+/** One bounded MCP call. Auth/refresh belong to Connect; the SDK may not start
+ * OAuth or persist tokens. The host supplies the Connection-owned endpoint. */
+export declare function callRemoteMcpTool(input: CallRemoteMcpToolInput): Promise<CallToolResult>;
+//# sourceMappingURL=mcp-execution.d.ts.map

package/dist/mcp-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-execution.d.ts","sourceRoot":"","sources":["../src/mcp-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAE/F,OAAO,EAAuB,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,WAAW,CAAC;IACpG,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,kFAAkF;IAClF,SAAS,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;CACnD;AAED;+EAC+E;AAC/E,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ9F"}

package/dist/mcp-execution.js

@@ -0,0 +1,14 @@
+import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
+import { ConnectError } from "@polpo-ai/connect";
+import { withRemoteMcpClient } from "./mcp-transport.js";
+/** One bounded MCP call. Auth/refresh belong to Connect; the SDK may not start
+ * OAuth or persist tokens. The host supplies the Connection-owned endpoint. */
+export async function callRemoteMcpTool(input) {
+    if (typeof input.authorize !== "function" || typeof input.name !== "string" || !input.name.trim()
+        || input.name.length > 256 || (input.arguments !== undefined && (!input.arguments
+        || typeof input.arguments !== "object" || Array.isArray(input.arguments)))) {
+        throw new ConnectError("invalid_request", "MCP execution requires a tool name, object arguments and host authorization");
+    }
+    return withRemoteMcpClient(input, async (client, signal) => CallToolResultSchema.parse(await client.callTool({ name: input.name, arguments: input.arguments }, CallToolResultSchema, { signal })));
+}
+//# sourceMappingURL=mcp-execution.js.map

package/dist/mcp-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-execution.js","sourceRoot":"","sources":["../src/mcp-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAuB,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAgC,MAAM,oBAAoB,CAAC;AAUvF;+EAC+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;WAC5F,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS;WAC5E,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,6EAA6E,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CACzD,oBAAoB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3I,CAAC"}

package/dist/mcp-oauth-redirect.d.ts

@@ -0,0 +1,4 @@
+/** Browser callback only. Resource/metadata/provider endpoints keep their own
+ * HTTPS and network policies. The host still owns and allowlists this URI. */
+export declare function normalizeMcpOAuthRedirect(value: string): string;
+//# sourceMappingURL=mcp-oauth-redirect.d.ts.map

package/dist/mcp-oauth-redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-redirect.d.ts","sourceRoot":"","sources":["../src/mcp-oauth-redirect.ts"],"names":[],"mappings":"AAEA;8EAC8E;AAC9E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/D"}

package/dist/mcp-oauth-redirect.js

@@ -0,0 +1,25 @@
+import { ConnectError, connectorHostnameIsUnsafe } from "@polpo-ai/connect";
+/** Browser callback only. Resource/metadata/provider endpoints keep their own
+ * HTTPS and network policies. The host still owns and allowlists this URI. */
+export function normalizeMcpOAuthRedirect(value) {
+    const invalid = () => new ConnectError("invalid_request", "MCP OAuth callback must use public HTTPS or a loopback address, without credentials or fragments");
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw invalid();
+    }
+    const loopback = url.hostname === "localhost" || url.hostname.endsWith(".localhost")
+        || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if (url.username || url.password || url.hash
+        || (url.protocol !== "https:" && !(loopback && url.protocol === "http:"))
+        || (!loopback && connectorHostnameIsUnsafe(url.hostname)))
+        throw invalid();
+    for (const key of url.searchParams.keys()) {
+        if (/^(access_token|refresh_token|client_secret|api[_-]?key|authorization|password|token|secret|code|state)$/i.test(key))
+            throw invalid();
+    }
+    return url.toString();
+}
+//# sourceMappingURL=mcp-oauth-redirect.js.map

package/dist/mcp-oauth-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-redirect.js","sourceRoot":"","sources":["../src/mcp-oauth-redirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE5E;8EAC8E;AAC9E,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,iBAAiB,EAAE,kGAAkG,CAAC,CAAC;IAC9J,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;WAC/E,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC9D,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;WACvC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;WACtE,CAAC,CAAC,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC7E,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,0GAA0G,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/mcp-oauth.d.ts

@@ -1,14 +1,15 @@
 import { type McpOAuthClientInformation, type McpOAuthClientMode, type McpOAuthInspection, type McpOAuthSecretMaterial, type TokenSet } from "@polpo-ai/connect";
+export interface McpOAuthRegistrationLookup {
+    resource: string;
+    redirectUri: string;
+    mode: McpOAuthClientMode;
+    /** Hosts must key on this identity when present and must not fall back to an
+     * unkeyed registration. Includes configuration, issuer and client metadata. */
+    registrationKey?: string;
+}
 export interface McpOAuthClientRegistrationStore {
-    get(input: {
-        resource: string;
-        redirectUri: string;
-        mode: McpOAuthClientMode;
-    }): Promise<McpOAuthClientInformation | null>;
-    set(input: {
-        resource: string;
-        redirectUri: string;
-        mode: McpOAuthClientMode;
+    get(input: McpOAuthRegistrationLookup): Promise<McpOAuthClientInformation | null>;
+    set(input: McpOAuthRegistrationLookup & {
         client: McpOAuthClientInformation;
     }): Promise<void>;
 }
@@ -25,6 +26,8 @@ export interface StartMcpOAuthProtocolInput extends InspectMcpOAuthInput {
     clientUri?: string;
     clientMetadataUrl?: string;
     preRegisteredClient?: McpOAuthClientInformation;
+    /** Private host configuration fingerprint/namespace, independent of end-user identity. */
+    registrationNamespace?: string;
 }
 export interface StartMcpOAuthProtocolResult {
     authorizationUrl: string;

package/dist/mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../src/mcp-oauth.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAEvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,+BAA+B;IAC9C,GAAG,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAC3H,GAAG,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,kBAAkB,CAAC;QAAC,MAAM,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnI;AAED,MAAM,WAAW,oBAAoB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE;AAEjF,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;CACjD;AAED,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,aAAa,CAAC,EAAE,+BAA+B,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB;qBAGvC,oBAAoB,KAAG,OAAO,CAAC,kBAAkB,CAAC;mBA6BpD,0BAA0B,KAAG,OAAO,CAAC,2BAA2B,CAAC;sBAsB9D;QAAE,QAAQ,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,EAAE,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;qBAoBlG;QAAE,QAAQ,EAAE,sBAAsB,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EAiEjH"}
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../src/mcp-oauth.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAEvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAI3B,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB;mFAC+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,+BAA+B;IAC9C,GAAG,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAClF,GAAG,CAAC,KAAK,EAAE,0BAA0B,GAAG;QAAE,MAAM,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/F;AAED,MAAM,WAAW,oBAAoB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE;AAEjF,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IAChD,0FAA0F;IAC1F,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,aAAa,CAAC,EAAE,+BAA+B,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB;qBAGvC,oBAAoB,KAAG,OAAO,CAAC,kBAAkB,CAAC;mBAgCpD,0BAA0B,KAAG,OAAO,CAAC,2BAA2B,CAAC;sBAsB9D;QAAE,QAAQ,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,EAAE,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;qBAoBlG;QAAE,QAAQ,EAAE,sBAAsB,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EAuEjH"}

package/dist/mcp-oauth.js

@@ -1,11 +1,17 @@
 import { discoverOAuthServerInfo, exchangeAuthorization, refreshAuthorization, registerClient, startAuthorization, } from "@modelcontextprotocol/sdk/client/auth.js";
 import { ConnectError, } from "@polpo-ai/connect";
+import { createHash } from "node:crypto";
+import { normalizeMcpOAuthRedirect } from "./mcp-oauth-redirect.js";
 export function createMcpOAuthProtocol(options) {
     const now = options.now ?? (() => new Date());
     async function inspect(input) {
         const url = normalizeHttpsUrl(input.url);
         try {
             const discovered = await discoverOAuthServerInfo(url, { fetchFn: options.fetch });
+            // An SDK fallback may return an origin without any OAuth metadata for
+            // public or static-key servers. This does not establish an auth method.
+            if (!discovered.authorizationServerMetadata)
+                throw new Error("OAuth metadata unavailable");
             const discovery = normalizeDiscovery(url, discovered.authorizationServerUrl, discovered.authorizationServerMetadata, discovered.resourceMetadata);
             const methods = discovery.codeChallengeMethodsSupported;
             if (methods && !methods.includes("S256")) {
@@ -33,7 +39,7 @@ export function createMcpOAuthProtocol(options) {
         if (!inspected.discovery) {
             throw new ConnectError("oauth_discovery_failed", "MCP OAuth metadata could not be discovered");
         }
-        const redirectUri = normalizeHttpsUrl(input.redirectUri);
+        const redirectUri = normalizeMcpOAuthRedirect(input.redirectUri);
         const scopes = normalizeScopes(input.scopes ?? inspected.discovery.scopesSupported ?? []);
         const client = await resolveClient(input, inspected.discovery, redirectUri, scopes);
         const started = await startAuthorization(inspected.discovery.authorizationServer, {
@@ -103,9 +109,6 @@ export function createMcpOAuthProtocol(options) {
         if (!discovery.registrationEndpoint) {
             throw new ConnectError("oauth_registration_failed", "MCP authorization server does not support dynamic client registration");
         }
-        const cached = await options.registrations?.get({ resource: discovery.resource, redirectUri, mode: input.mode });
-        if (cached)
-            return cached;
         const metadata = {
             client_name: input.clientName ?? "Polpo",
             redirect_uris: [redirectUri],
@@ -114,6 +117,15 @@ export function createMcpOAuthProtocol(options) {
             token_endpoint_auth_method: "none",
             ...(input.clientUri ? { client_uri: normalizeHttpsUrl(input.clientUri) } : {}),
         };
+        const registrationKey = createHash("sha256").update(JSON.stringify([
+            input.registrationNamespace ?? null, discovery.resource, discovery.authorizationServer,
+            discovery.authorizationEndpoint, discovery.tokenEndpoint, discovery.registrationEndpoint,
+            redirectUri, input.mode, metadata, [...scopes].sort(),
+        ])).digest("hex");
+        const lookup = { resource: discovery.resource, redirectUri, mode: input.mode, registrationKey };
+        const cached = await options.registrations?.get(lookup);
+        if (cached)
+            return cached;
         try {
             const registered = await registerClient(discovery.authorizationServer, {
                 metadata: discovery.rawAuthorizationServerMetadata,
@@ -122,7 +134,7 @@ export function createMcpOAuthProtocol(options) {
                 fetchFn: options.fetch,
             });
             const client = registered;
-            await options.registrations?.set({ resource: discovery.resource, redirectUri, mode: input.mode, client });
+            await options.registrations?.set({ ...lookup, client });
             return client;
         }
         catch (error) {
@@ -164,7 +176,7 @@ function normalizeTokens(tokens, fallbackScopes, now, fallbackRefreshToken) {
         refreshToken: text(tokens.refresh_token) ?? fallbackRefreshToken,
         tokenType: text(tokens.token_type) ?? "Bearer",
         expiresAt: expiresIn === undefined ? undefined : new Date(now.getTime() + expiresIn * 1000).toISOString(),
-        scopes: normalizeScopes(text(tokens.scope)?.split(/[,\s]+/) ?? fallbackScopes),
+        scopes: normalizeScopes(typeof tokens.scope === "string" ? tokens.scope.split(/[,\s]+/) : fallbackScopes),
         raw: tokens,
     };
 }

package/dist/mcp-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.js","sourceRoot":"","sources":["../src/mcp-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,kBAAkB,GACnB,MAAM,0CAA0C,CAAC;AAMlD,OAAO,EACL,YAAY,GAOb,MAAM,mBAAmB,CAAC;AA+B3B,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,KAAK,UAAU,OAAO,CAAC,KAA2B;QAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAY,EAAE,CAAC,CAAC;YACzF,MAAM,SAAS,GAAG,kBAAkB,CAClC,GAAG,EACH,UAAU,CAAC,sBAAsB,EACjC,UAAU,CAAC,2BAAkE,EAC7E,UAAU,CAAC,gBAAuD,CACnE,CAAC;YACF,MAAM,OAAO,GAAG,SAAS,CAAC,6BAA6B,CAAC;YACxD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,qDAAqD,CAAC,CAAC;YAC1G,CAAC;YACD,MAAM,WAAW,GAAyB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;YAClF,IAAI,SAAS,CAAC,oBAAoB;gBAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC7G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY;gBAAE,MAAM,KAAK,CAAC;YAC/C,OAAO;gBACL,GAAG;gBACH,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM;gBACpC,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;gBACpD,QAAQ,EAAE,CAAC,8EAA8E,CAAC;aAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,KAAiC;QACpD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,4CAA4C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,SAAS,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,mBAAmB,EAAE;YAChF,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,8BAA6D;YAC3F,iBAAiB,EAAE,MAAqC;YACxD,WAAW,EAAE,WAAW;YACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACnD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC;SAChD,CAAC,CAAC;QACH,OAAO;YACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE;YACrD,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;SACxH,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,KAAoF;QAC1G,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBACvF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,8BAA6D;gBAChG,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAqC;gBACvE,iBAAiB,EAAE,KAAK,CAAC,IAAI;gBAC7B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;gBACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;gBACvC,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACpD,OAAO,EAAE,OAAO,CAAC,KAAY;aAC9B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAiC,EAAE,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,uBAAuB,EAAE,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,KAAqE;QAC1F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBACtF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,8BAA6D;gBAChG,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAqC;gBACvE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY;gBAChD,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACpD,OAAO,EAAE,OAAO,CAAC,KAAY;aAC9B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAiC,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,qBAAqB,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,KAAiC,EACjC,SAA4B,EAC5B,WAAmB,EACnB,MAAgB;QAEhB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,+CAA+C,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,KAAK,CAAC,mBAAmB,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,6CAA6C,CAAC,CAAC;YACrG,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;YACpC,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,uEAAuE,CAAC,CAAC;QAC/H,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjH,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAwB;YACpC,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,OAAO;YACxC,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;QACF,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBACrE,QAAQ,EAAE,SAAS,CAAC,8BAA6D;gBACjF,cAAc,EAAE,QAAQ;gBACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnD,OAAO,EAAE,OAAO,CAAC,KAAY;aAC9B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,UAAuC,CAAC;YACvD,MAAM,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,2BAA2B,EAAE,8CAA8C,EAAE,KAAK,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAgB,EAChB,mBAA2B,EAC3B,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,+DAA+D,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACnE,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,6BAA6B,GAAG,OAAO,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;IAC1F,OAAO;QACL,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC;QAC1E,mBAAmB,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;QAC3D,qBAAqB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC;QAC/D,aAAa,EAAE,iBAAiB,CAAC,aAAa,CAAC;QAC/C,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,8BAA8B,EAAE,QAAQ;QACxC,4BAA4B,EAAE,iBAAiB;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,cAAwB,EAAE,GAAS,EAAE,oBAA6B;IAC1H,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,4CAA4C,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,OAAO;QACL,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,oBAAoB;QAChE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,QAAQ;QAC9C,SAAS,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACzG,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC;QAC9E,GAAG,EAAE,MAAM;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IAAC,CAAC;IACpH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,6DAA6D,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,IAAwB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAClI,SAAS,OAAO,CAAC,KAAc,IAA0B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9J,SAAS,aAAa,CAAC,IAAmF,EAAE,OAAe,EAAE,KAAc;IACzI,OAAO,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtJ,CAAC"}
+{"version":3,"file":"mcp-oauth.js","sourceRoot":"","sources":["../src/mcp-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,kBAAkB,GACnB,MAAM,0CAA0C,CAAC;AAMlD,OAAO,EACL,YAAY,GAOb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAyCpE,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,KAAK,UAAU,OAAO,CAAC,KAA2B;QAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAY,EAAE,CAAC,CAAC;YACzF,sEAAsE;YACtE,wEAAwE;YACxE,IAAI,CAAC,UAAU,CAAC,2BAA2B;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC3F,MAAM,SAAS,GAAG,kBAAkB,CAClC,GAAG,EACH,UAAU,CAAC,sBAAsB,EACjC,UAAU,CAAC,2BAAkE,EAC7E,UAAU,CAAC,gBAAuD,CACnE,CAAC;YACF,MAAM,OAAO,GAAG,SAAS,CAAC,6BAA6B,CAAC;YACxD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,qDAAqD,CAAC,CAAC;YAC1G,CAAC;YACD,MAAM,WAAW,GAAyB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;YAClF,IAAI,SAAS,CAAC,oBAAoB;gBAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC7G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY;gBAAE,MAAM,KAAK,CAAC;YAC/C,OAAO;gBACL,GAAG;gBACH,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM;gBACpC,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;gBACpD,QAAQ,EAAE,CAAC,8EAA8E,CAAC;aAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,KAAiC;QACpD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,4CAA4C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,SAAS,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,mBAAmB,EAAE;YAChF,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,8BAA6D;YAC3F,iBAAiB,EAAE,MAAqC;YACxD,WAAW,EAAE,WAAW;YACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACnD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC;SAChD,CAAC,CAAC;QACH,OAAO;YACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE;YACrD,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;SACxH,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,KAAoF;QAC1G,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBACvF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,8BAA6D;gBAChG,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAqC;gBACvE,iBAAiB,EAAE,KAAK,CAAC,IAAI;gBAC7B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;gBACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;gBACvC,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACpD,OAAO,EAAE,OAAO,CAAC,KAAY;aAC9B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAiC,EAAE,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,uBAAuB,EAAE,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,KAAqE;QAC1F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBACtF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,8BAA6D;gBAChG,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAqC;gBACvE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY;gBAChD,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACpD,OAAO,EAAE,OAAO,CAAC,KAAY;aAC9B,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,MAAiC,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,qBAAqB,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,KAAiC,EACjC,SAA4B,EAC5B,WAAmB,EACnB,MAAgB;QAEhB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,+CAA+C,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,KAAK,CAAC,mBAAmB,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,6CAA6C,CAAC,CAAC;YACrG,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;YACpC,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,uEAAuE,CAAC,CAAC;QAC/H,CAAC;QACD,MAAM,QAAQ,GAAwB;YACpC,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,OAAO;YACxC,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;QACF,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACjE,KAAK,CAAC,qBAAqB,IAAI,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,mBAAmB;YACtF,SAAS,CAAC,qBAAqB,EAAE,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,oBAAoB;YACxF,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;SACtD,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,MAAM,GAA+B,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;QAC5H,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBACrE,QAAQ,EAAE,SAAS,CAAC,8BAA6D;gBACjF,cAAc,EAAE,QAAQ;gBACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnD,OAAO,EAAE,OAAO,CAAC,KAAY;aAC9B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,UAAuC,CAAC;YACvD,MAAM,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,aAAa,CAAC,2BAA2B,EAAE,8CAA8C,EAAE,KAAK,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAgB,EAChB,mBAA2B,EAC3B,QAA6C,EAC7C,iBAAsD;IAEtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,+DAA+D,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACnE,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,6BAA6B,GAAG,OAAO,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;IAC1F,OAAO;QACL,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC;QAC1E,mBAAmB,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;QAC3D,qBAAqB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC;QAC/D,aAAa,EAAE,iBAAiB,CAAC,aAAa,CAAC;QAC/C,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,8BAA8B,EAAE,QAAQ;QACxC,4BAA4B,EAAE,iBAAiB;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,cAAwB,EAAE,GAAS,EAAE,oBAA6B;IAC1H,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,4CAA4C,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,OAAO;QACL,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,oBAAoB;QAChE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,QAAQ;QAC9C,SAAS,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACzG,MAAM,EAAE,eAAe,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACzG,GAAG,EAAE,MAAM;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IAAC,CAAC;IACpH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,6DAA6D,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,IAAwB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAClI,SAAS,OAAO,CAAC,KAAc,IAA0B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9J,SAAS,aAAa,CAAC,IAAmF,EAAE,OAAe,EAAE,KAAc;IACzI,OAAO,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtJ,CAAC"}

package/dist/mcp-runner-broker.d.ts

@@ -0,0 +1,29 @@
+import { type McpCapabilityTool, type ResolveMcpRuntimeCapabilities, type ToolInvocationContext } from "@polpo-ai/core";
+export declare class McpRunnerBrokerError extends Error {
+    readonly status: 400 | 401 | 403 | 408 | 409 | 413 | 429 | 503;
+    constructor(status: 400 | 401 | 403 | 408 | 409 | 413 | 429 | 503);
+}
+/** Created from trusted lease storage, never reconstructed from runner input. */
+export interface AuthorizedMcpRunnerLease {
+    readonly agentName: string;
+    readonly invocation: ToolInvocationContext;
+    readonly inventory: readonly {
+        readonly serverName: string;
+        readonly tools: readonly McpCapabilityTool[];
+    }[];
+    /** Must retain the minted grant ceiling and check assertActive during native
+     * transport authorization, including refresh. Uses the canonical MCP resolver. */
+    readonly resolveCapabilities: ResolveMcpRuntimeCapabilities;
+    /** Live lease/run-generation, cancellation and host rollout authorization. */
+    assertActive(): Promise<void>;
+    /** Atomic, durable for the lease lifetime. A repeated ID must throw 409 even
+     * after a failed or disconnected call: mutations are never implicitly retried. */
+    claimCall(toolCallId: string): Promise<void>;
+}
+/** HTTP-neutral server entry, reusable by OSS hosts and managed adapters. The
+ * host owns opaque token storage, tenant identity and the run lifecycle. */
+export declare function createMcpRunnerBroker(options: {
+    authorize(token: string, sandboxId: string): Promise<AuthorizedMcpRunnerLease>;
+    onError?: (error: unknown) => void | Promise<void>;
+}): (request: Request) => Promise<Response>;
+//# sourceMappingURL=mcp-runner-broker.d.ts.map

package/dist/mcp-runner-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-runner-broker.d.ts","sourceRoot":"","sources":["../src/mcp-runner-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,iBAAiB,EAAE,KAAK,6BAA6B,EAC9B,KAAK,qBAAqB,EACvD,MAAM,gBAAgB,CAAC;AAIxB,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;gBAArD,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;CAI3E;AAED,iFAAiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;KAAE,EAAE,CAAC;IAC7G;sFACkF;IAClF,QAAQ,CAAC,mBAAmB,EAAE,6BAA6B,CAAC;IAC5D,8EAA8E;IAC9E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;sFACkF;IAClF,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;4EAC4E;AAC5E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAuH1C"}